--------[ EVEREST Ultimate Edition ]------------------------------------------------------------------------------------

                                                EVEREST v5.02.1750/ru
                                        2.4.258.0
                                      http://www.lavalys.com/
                                              
                                             VLADIMIR
                                             sima
                                   Microsoft Windows 7 Ultimate 6.1.7601
                                                  2015-11-26
                                                 07:35


--------[   ]----------------------------------------------------------------------------------------

    :
                                           ACPI    x86
                                     Microsoft Windows 7 Ultimate
                                       Service Pack 1
      Internet Explorer                                 8.0.7601.17514
      DirectX                                           DirectX 11.0
                                           VLADIMIR
                                         sima
                                              vladimir
       /                                       2015-11-26 / 07:35

     :
                                                   DualCore Intel Core 2 Duo E6550, 2333 MHz (7 x 333)
                                          MSI P965 Neo2 (MS-7235 v2)  (2 PCI, 1 PCI-E x1, 1 PCI-E x4, 1 PCI-E x16, 4 DDR2 DIMM, Audio, Gigabit LAN)
                                    Intel Broadwater P965
                                         3328   (DDR2 SDRAM)
      DIMM1: Kingston 2G-UDIMM                          2  DDR2-800 DDR2 SDRAM  (5-5-5-18 @ 400 )  (4-4-4-12 @ 266 )  (3-3-3-9 @ 200 )
      DIMM2: Samsung M3 78T6553EZS-CE6                  512  DDR2-667 DDR2 SDRAM  (5-5-5-15 @ 333 )  (4-4-4-12 @ 266 )  (3-3-3-9 @ 200 )
      DIMM3: Kingston "                                 2  DDR2-800 DDR2 SDRAM  (5-5-5-18 @ 400 )  (4-4-4-12 @ 266 )  (3-3-3-9 @ 200 )
      DIMM4: Hynix HYMP532U64BP6-Y5                     256  DDR2-667 DDR2 SDRAM  (5-5-5-15 @ 333 )  (4-4-4-12 @ 266 )  (3-3-3-9 @ 200 )
       BIOS                                          AMI (08/06/07)
                                      (COM1)
                                      (LPT1)

    :
                                            NVIDIA GeForce 9800 GTX+  (1024 )
                                            NVIDIA GeForce 9800 GTX+  (1024 )
      3D-                                    nVIDIA GeForce 9800 GTX+
                                                 Acer V173  [17" LCD]  (LE10D1208582)

    :
                                         Realtek ALC888/1200 @ Intel 82801HB ICH8 - High Definition Audio Controller [B-0]

     :
       IDE                                     Intel(R) ICH8 Serial ATA Storage (2-) - 2825
       IDE                                     Intel(R) ICH8 Serial ATA Storage (4-) - 2820
       IDE                                       PCI IDE
                                      ST31000528AS ATA Device  (1000 , 7200 RPM, SATA-II)
                                      ST3320418AS ATA Device  (320 , 7200 RPM, SATA-II)
                                    HL-DT-ST DVD-RAM GH82N ATA Device
       SMART                         OK

    :
      C: (NTFS)                                         298.0  (177.7  )
      D: (NTFS)                                         736.2  (129.5  )
      E: (NTFS)                                         195.3  (51.9  )
                                              1229.5  (359.1  )

    :
                                               HID
                                                PS/2
                                                    HID- 
                                                    Microsoft PS/2 

    :
        IP                                192.168.137.234
        MAC                               10-C3-7B-C8-92-60
                                          ASUS USB-N10 150Mbps 11n Wireless USB dongle  (192.168.137.234)
                                            Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC (NDIS 6.20)

     :
                                                 Fax
                                                 Microsoft XPS Document Writer
                                                   OneNote 2010
       FireWire                               VIA VT6306/6307 Fire II IEEE1394 Host Controller (PHY: VIA VT6307)
       USB1                                   Intel 82801HB ICH8 - USB Universal Host Controller [B-0]
       USB1                                   Intel 82801HB ICH8 - USB Universal Host Controller [B-0]
       USB1                                   Intel 82801HB ICH8 - USB Universal Host Controller [B-0]
       USB1                                   Intel 82801HB ICH8 - USB Universal Host Controller [B-0]
       USB1                                   Intel 82801HB ICH8 - USB Universal Host Controller [B-0]
       USB2                                   Intel 82801HB ICH8 - USB2 Enhanced Host Controller [B-0]
       USB2                                   Intel 82801HB ICH8 - USB2 Enhanced Host Controller [B-0]
      USB-                                    ASUS USB-N10 150Mbps 11n Wireless USB dongle
      USB-                                    USB Microphone
      USB-                                    USB2.0 Camera
      USB-                                    USB- 
      USB-                                    USB- 
      USB-                                    USB- 
      USB-                                     USB 
      USB-                                     USB 

    DMI:
      DMI  BIOS                                American Megatrends Inc.
      DMI  BIOS                                   V3.7
      DMI                           MICRO-STAR INTERNATIONAL CO.,LTD
      DMI                                        MS-7235
      DMI                                2.0
      DMI                         To Be Filled By O.E.M.
      DMI                    MICRO-STAR INTERNATIONAL CO.,LTD
      DMI                                 MS-7235
      DMI                           2.0
      DMI                    To be filled by O.E.M.
      DMI                             MICRO-STAR INTERNATIONAL CO.,LTD
      DMI                                    2.0
      DMI                             To Be Filled By O.E.M.
      DMI Asset-                                To Be Filled By O.E.M.
      DMI                                       Desktop Case


--------[   ]----------------------------------------------------------------------------------------------

          
     NetBIOS                 VLADIMIR
      DNS               vladimir
      DNS              
      DNS              vladimir
     NetBIOS                 VLADIMIR
      DNS               vladimir
      DNS              
      DNS              vladimir


--------[ DMI ]---------------------------------------------------------------------------------------------------------

  [ BIOS ]

     BIOS:
                                           American Megatrends Inc.
                                                  V3.7
                                             08/06/2007
                                                  1024 
                                   Floppy Disk, Hard Disk, CD-ROM, ATAPI ZIP, LS-120
                                             Flash BIOS, Shadow BIOS, Selectable Boot, EDD, BBS
                                 DMI, APM, ACPI, ESCD, PnP
                                   ISA, PCI, USB

  [  ]

     :
                                           MICRO-STAR INTERNATIONAL CO.,LTD
                                                 MS-7235
                                                  2.0
                                           To Be Filled By O.E.M.
      SKU#                                              To Be Filled By O.E.M.
                                               To Be Filled By O.E.M.
                                           

  [   ]

      :
                                           MICRO-STAR INTERNATIONAL CO.,LTD
                                                 MS-7235
                                                  2.0
                                           To be filled by O.E.M.

  [  ]

     :
                                           MICRO-STAR INTERNATIONAL CO.,LTD
                                                  2.0
                                           To Be Filled By O.E.M.
                                            To Be Filled By O.E.M.
                                                
                                     
                               
                                  
                                   

  [  / Intel(R) Core(TM)2 Duo CPU E6550 @ 2.33GHz ]

     :
                                           Intel
                                                  Intel(R) Core(TM)2 Duo CPU E6550 @ 2.33GHz
                                           To Be Filled By O.E.M.
                                            To Be Filled By O.E.M.
                                          To Be Filled By O.E.M.
                                          333 
                                     2333 
                                          2333 
                                                     Central Processor
                                       1.3 V
                                                  
                                              CPU 1

  [ - / L1-Cache ]

     :
                                                     
                                                  
                                             Write-Back
                                         8-way Set-Associative
                                       64 
                                      64 
                                         Parity
                                              L1-Cache

  [ - / L2-Cache ]

     :
                                                     
                                                  
                                             Write-Back
                                         8-way Set-Associative
                                       4096 
                                      4096 
                                         Single-bit ECC
                                              L2-Cache

  [ - / L3-Cache ]

     :
                                                     
                                                  
                                             Write-Back
                                         16-way Set-Associative
                                       8192 
                                      8192 
                                         Single-bit ECC
                                              L3-Cache

  [   / DIMM0 ]

      :
      -                                       DIMM
                                                     SDRAM
                                                     Synchronous
                                                  2048 
                                             64 
                                            64 
                                              DIMM0
                                                    BANK0
                                           Manufacturer0
                                           SerNum0
                                            AssetTagNum0
                                          PartNum0

  [   / DIMM1 ]

      :
      -                                       DIMM
                                                     SDRAM
                                                     Synchronous
                                                  512 
                                             64 
                                            64 
                                              DIMM1
                                                    BANK1
                                           Manufacturer1
                                           SerNum1
                                            AssetTagNum1
                                          PartNum1


--------[  ]------------------------------------------------------------------------------------------------------

     :
                                                   DualCore Intel Core 2 Duo E6550
                                             Conroe
                                              G0
      Engineering Sample                                
        CPUID                                      Intel(R) Core(TM)2 Duo CPU E6550 @ 2.33GHz
       CPUID                                      000006FBh
      CPU VID                                           1.3500 V

     :
                                               2327.5 MHz  (: 2333 MHz)
                                             7x
      CPU FSB                                           332.5 MHz  (: 333 MHz)
                                              332.5 MHz
       DRAM:FSB                              1:1

     :
       L1                                        32  per core
       L1                                      32  per core
       L2                                            4   (On-Die, ECC, ASC, Full-Speed)

      :
      ID                                  64-0100-000001-00101111-080607-Broadwater$0AAAA000_A7235IMS V3.7 080607
                                          MSI P965 Neo2 (MS-7235 v2)  (2 PCI, 1 PCI-E x1, 1 PCI-E x4, 1 PCI-E x16, 4 DDR2 DIMM, Audio, Gigabit LAN)

       ():
                                    Intel Broadwater P965
                                          5-4-4-12  (CL-RCD-RP-RAS)
      Command Rate (CR)                                 2T
      DIMM1: Kingston 2G-UDIMM                          2  DDR2-800 DDR2 SDRAM  (5-5-5-18 @ 400 )  (4-4-4-12 @ 266 )  (3-3-3-9 @ 200 )
      DIMM2: Samsung M3 78T6553EZS-CE6                  512  DDR2-667 DDR2 SDRAM  (5-5-5-15 @ 333 )  (4-4-4-12 @ 266 )  (3-3-3-9 @ 200 )
      DIMM3: Kingston "                                 2  DDR2-800 DDR2 SDRAM  (5-5-5-18 @ 400 )  (4-4-4-12 @ 266 )  (3-3-3-9 @ 200 )
      DIMM4: Hynix HYMP532U64BP6-Y5                     256  DDR2-667 DDR2 SDRAM  (5-5-5-15 @ 333 )  (4-4-4-12 @ 266 )  (3-3-3-9 @ 200 )

     BIOS:
        BIOS                               08/06/07
       BIOS                            12/19/08
      DMI  BIOS                                   V3.7

      :
                                            nVIDIA GeForce 9800 GTX+
                                       G92GTX+  (PCI Express 2.0 x16 10DE / 0613, Rev A2)
        (Geometric Domain)                     301   (: 740 MHz)
        (Shader Domain)                        602   (: 1836 MHz)
                                           100   (: 950 MHz)


--------[  ]----------------------------------------------------------------------------------------------

     :
                                  
                                         
                              
                          


--------[   ]----------------------------------------------------------------------------------------------

    Centrino (Carmel)  :
      : Intel Pentium M (Banias/Dothan)                 (DualCore Intel Core 2 Duo E6550)
      : Intel i855GM/PM                             (Intel Broadwater P965)
      WLAN: Intel PRO/Wireless                          
      : Centrino-                     

    Centrino (Sonoma)  :
      : Intel Pentium M (Dothan)                        (DualCore Intel Core 2 Duo E6550)
      : Intel i915GM/PM                             (Intel Broadwater P965)
      WLAN: Intel PRO/Wireless                          
      : Centrino-                     

    Centrino (Napa)  :
      : Intel Core (Yonah) / Core 2 (Merom)             (DualCore Intel Core 2 Duo E6550)
      : Intel i945GM/PM                             (Intel Broadwater P965)
      WLAN: Intel PRO/Wireless 3945                     
      : Centrino-                     

    Centrino (Santa Rosa)  :
      : Intel Core 2 (Merom/Penryn)                     (DualCore Intel Core 2 Duo E6550)
      : Intel GM965/PM965                           (Intel Broadwater P965)
      WLAN: Intel Wireless WiFi Link 4965               
      : Centrino-                     

    Centrino (Montevina)  :
      : Intel Core 2 (Penryn)                           (DualCore Intel Core 2 Duo E6550)
      : Intel GM45/GM47/GS45/PM45                   (Intel Broadwater P965)
      WLAN: Intel WiFi Link 5000 Series                 
      : Centrino-                     


--------[  ]------------------------------------------------------------------------------------------------------

     :
                                              Fintek F71882F  (ISA A10h)
                                            Diode  (NV-Diode)

    :
                                          78 C  (172 F)
                                                      45 C  (113 F)
       1 /  1                                     45 C  (113 F)
       1 /  2                                     42 C  (108 F)
      Aux                                               40 C  (104 F)
                                                  47 C  (117 F)
      Seagate ST31000528AS                              34 C  (93 F)
      Seagate ST3320418AS                               35 C  (95 F)

    :
                                                      1307 RPM

    :
                                                  1.36 V
      +3.3 V                                            3.36 V
      +5 V                                              5.09 V
      +3.3 V                                      3.36 V
       VBAT                                      3.28 V
      Debug Info F                                      047B 0FFF 0FFF 0FFF
      Debug Info T                                      45 40 78
      Debug Info V                                      D2 AA 75 78 79 FF A2 D2 CD
      Debug Info I                                      03 04 10 19 34 (0541)


--------[  ]----------------------------------------------------------------------------------------------------------

     :
                                                   DualCore Intel Core 2 Duo E6550, 2333 MHz (7 x 333)
                                             Conroe
                                              G0
                                        x86, x86-64, MMX, SSE, SSE2, SSE3, SSSE3
                                         2333 
      ./.                             6x / 7x
      Engineering Sample                                
       L1                                        32  per core
       L1                                      32  per core
       L2                                            4   (On-Die, ECC, ASC, Full-Speed)

    Multi CPU:
      ID                                  TEMPLATE ETEMPLATE
      CPU #1                                            Intel(R) Core(TM)2 Duo CPU E6550 @ 2.33GHz, 2327 
      CPU #2                                            Intel(R) Core(TM)2 Duo CPU E6550 @ 2.33GHz, 2327 

       :
                                              775 Contact LGA
                                          3.75 cm x 3.75 cm
                                       291 .
                                  8M, 65 nm, CMOS, Cu, Low-K Inter-Layer, 2nd Gen Strained Si
                                         143 mm2
                                   1.350 V
       I/O                                    1.350 V
                                        65 - 75 W  (   )
                                    99.4 - 119.3 W  (   )

     :
                                                   Intel Corporation
                                     http://www.intel.com/products/processor

     :
       1 /  1                                     0 %
       1 /  2                                     0 %


--------[ CPUID ]-------------------------------------------------------------------------------------------------------

     CPUID:
       CPUID                               GenuineIntel
        CPUID                                      Intel(R) Core(TM)2 Duo CPU E6550 @ 2.33GHz
       CPUID                                      000006FBh
        IA                            00h  ()
                                  2Ah / MC 01h  (LGA775)
                               B6
      HTT / CMP                                         0 / 2
       Tjmax                                 90 C  (194 F)

     :
      64- x86- (AMD64, Intel64)            
      AMD 3DNow!                                         
      AMD 3DNow! Professional                            
      AMD 3DNowPrefetch                                  
      AMD Enhanced 3DNow!                                
      AMD Extended MMX                                   
      AMD MisAligned SSE                                 
      AMD SSE4A                                          
      AMD SSE5                                           
      Cyrix Extended MMX                                 
      IA-64                                              
      IA MMX                                            
      IA SSE                                            
      IA SSE 2                                          
      IA SSE 3                                          
      IA Supplemental SSE 3                             
      IA SSE 4.1                                         
      IA SSE 4.2                                         
      IA AVX                                             
      IA FMA                                             
      IA AES Extensions                                  
      VIA Alternate Instruction Set                      
       CLFLUSH                                
       CMPXCHG8B                              
       CMPXCHG16B                             
       Conditional Move                       
       LZCNT                                   
       MONITOR / MWAIT                        
       MOVBE                                   
       PCLMULQDQ                               
       POPCNT                                  
       RDTSCP                                  
       SYSCALL / SYSRET                        
       SYSENTER / SYSEXIT                     
       VIA FEMMS                               

     :
      Advanced Cryptography Engine (ACE)                 
      Advanced Cryptography Engine 2 (ACE2)              
         (DEP, NX, EDB)            
          (RNG)         
      PadLock Hash Engine (PHE)                          
      PadLock Montgomery Multiplier (PMM)                
         (PSN)                    

     :
      Automatic Clock Control                           
      Digital Thermometer                               
      Dynamic FSB Frequency Switching                    
      Enhanced Halt State (C1E)                         , 
      Enhanced SpeedStep Technology (EIST, ESS)         , 
      Frequency ID Control                               
      Hardware P-State Control                           
      LongRun                                            
      LongRun Table Interface                            
      PowerSaver 1.0                                     
      PowerSaver 2.0                                     
      PowerSaver 3.0                                     
      Processor Duty Cycle Control                      
      Software Thermal Control                           
                                                
      Thermal Monitor 1                                 
      Thermal Monitor 2                                 
      Thermal Monitoring                                 
      Thermal Trip                                       
      Voltage ID Control                                 

     CPUID:
      1 GB Page Size                                     
      36-bit Page Size Extension                        
      Address Region Registers (ARR)                     
      CPL Qualified Debug Store                         
      Debug Trace Store                                 
      Debugging Extension                               
      Direct Cache Access                                
      Dynamic Acceleration Technology (IDA)              
      Fast Save & Restore                               
      Hyper-Threading Technology (HTT)                   
      Invariant Time Stamp Counter                      
      L1 Context ID                                      
      Local APIC On Chip                                
      Machine Check Architecture (MCA)                  
      Machine Check Exception (MCE)                     
      Memory Configuration Registers (MCR)               
      Memory Type Range Registers (MTRR)                
      Model Specific Registers (MSR)                    
      Nested Paging                                      
      Page Attribute Table (PAT)                        
      Page Global Extension                             
      Page Size Extension (PSE)                         
      Pending Break Event                               
      Physical Address Extension (PAE)                  
      Safer Mode Extensions (SMX)                       
      Secure Virtual Machine Extensions (Pacifica)       
      Self-Snoop                                        
      Time Stamp Counter (TSC)                          
      Turbo Boost                                        
      Virtual Machine Extensions (Vanderpool)           
      Virtual Mode Extension                            
      x2APIC                                             
      XSAVE / XRSTOR Extended States                     

    CPUID Registers (CPU #1):
      CPUID 00000000                                    0000000A-756E6547-6C65746E-49656E69
      CPUID 00000001                                    000006FB-00020800-0000E3FD-BFEBFBFF
      CPUID 00000002                                    05B0B101-005657F0-00000000-2CB43049
      CPUID 00000003                                    00000000-00000000-00000000-00000000
      CPUID 00000004                                    04000121-01C0003F-0000003F-00000001
      CPUID 00000004                                    04000122-01C0003F-0000003F-00000001
      CPUID 00000004                                    04004143-03C0003F-00000FFF-00000001
      CPUID 00000005                                    00000040-00000040-00000003-00000220
      CPUID 00000006                                    00000001-00000002-00000001-00000000
      CPUID 00000007                                    00000000-00000000-00000000-00000000
      CPUID 00000008                                    00000400-00000000-00000000-00000000
      CPUID 00000009                                    00000000-00000000-00000000-00000000
      CPUID 0000000A                                    07280202-00000000-00000000-00000503
      CPUID 80000000                                    80000008-00000000-00000000-00000000
      CPUID 80000001                                    00000000-00000000-00000001-20000000
      CPUID 80000002                                    65746E49-2952286C-726F4320-4D542865
      CPUID 80000003                                    44203229-43206F75-20205550-45202020
      CPUID 80000004                                    30353536-20402020-33332E32-007A4847
      CPUID 80000005                                    00000000-00000000-00000000-00000000
      CPUID 80000006                                    00000000-00000000-10008040-00000000
      CPUID 80000007                                    00000000-00000000-00000000-00000000
      CPUID 80000008                                    00003024-00000000-00000000-00000000

    CPUID Registers (CPU #2):
      CPUID 00000000                                    0000000A-756E6547-6C65746E-49656E69
      CPUID 00000001                                    000006FB-01020800-0000E3FD-BFEBFBFF
      CPUID 00000002                                    05B0B101-005657F0-00000000-2CB43049
      CPUID 00000003                                    00000000-00000000-00000000-00000000
      CPUID 00000004                                    04000121-01C0003F-0000003F-00000001
      CPUID 00000004                                    04000122-01C0003F-0000003F-00000001
      CPUID 00000004                                    04004143-03C0003F-00000FFF-00000001
      CPUID 00000005                                    00000040-00000040-00000003-00000220
      CPUID 00000006                                    00000001-00000002-00000001-00000000
      CPUID 00000007                                    00000000-00000000-00000000-00000000
      CPUID 00000008                                    00000400-00000000-00000000-00000000
      CPUID 00000009                                    00000000-00000000-00000000-00000000
      CPUID 0000000A                                    07280202-00000000-00000000-00000503
      CPUID 80000000                                    80000008-00000000-00000000-00000000
      CPUID 80000001                                    00000000-00000000-00000001-20000000
      CPUID 80000002                                    65746E49-2952286C-726F4320-4D542865
      CPUID 80000003                                    44203229-43206F75-20205550-45202020
      CPUID 80000004                                    30353536-20402020-33332E32-007A4847
      CPUID 80000005                                    00000000-00000000-00000000-00000000
      CPUID 80000006                                    00000000-00000000-10008040-00000000
      CPUID 80000007                                    00000000-00000000-00000000-00000000
      CPUID 80000008                                    00003024-00000000-00000000-00000000

    MSR Registers:
      MSR 00000017                                      0000-0000-8800-872A [PlatID = 0]
      MSR 0000001B                                      0000-0000-FEE0-0900
      MSR 0000002A                                      0000-0000-41C8-0000
      MSR 0000008B                                      0000-00B6-0000-0000
      MSR 000000CD                                      0000-0000-0000-0804
      MSR 000000CE                                      001D-072A-7F7F-071A
      MSR 000000E7                                      0000-00EA-36C7-3010
      MSR 000000E8                                      0000-00F0-E745-C2FE
      MSR 000000EE                                      A800-0000-C37D-5300
      MSR 0000011E                                      0000-0000-BE70-2109
      MSR 00000198                                      072A-072A-0600-072A
      MSR 00000199                                      0000-0000-0000-072A
      MSR 0000019A                                      0000-0000-0000-0002
      MSR 0000019B                                      0000-0000-0000-0000
      MSR 0000019C                                      0000-0000-882D-0000
      MSR 0000019D                                      0000-0000-0000-061D
      MSR 000001A0                                      0000-0044-6294-0488


--------[   ]---------------------------------------------------------------------------------------------

      :
      ID                                  64-0100-000001-00101111-080607-Broadwater$0AAAA000_A7235IMS V3.7 080607
                                          MSI P965 Neo2 (MS-7235 v2)

      FSB:
                                                 Intel AGTL+
                                              64 
                                         333  (QDR)
                                      1333 
                                   10665 /

      :
                                                 Dual DDR2 SDRAM
                                              128 
       DRAM:FSB                              1:1
                                         333  (DDR)
                                      667 
                                   10665 /

      :
                                                 Intel Direct Media Interface

        :
                                         1 LGA775
                                       2 PCI, 1 PCI-E x1, 1 PCI-E x4, 1 PCI-E x16
                                              4 DDR2 DIMM
                                    Audio, Gigabit LAN
      -                                       ATX
                                   230 mm x 300 mm
                                    P965
                                   CoreCell, SATA-II

      :
                                                   Micro-Star Int'l Co.,Ltd.
                                     http://www.msi.com/index.php?func=prodpage1&maincat_no=1
        BIOS                          http://www.msi.com/index.php?func=downloadindex
                                     http://driveragent.com?ref=59
       BIOS                                   http://www.esupport.com/biosagent/index.cfm?refererid=40


--------[  ]------------------------------------------------------------------------------------------------------

     :
                                                   3327 
                                                  1320 
                                                2006 
                                                40 %

       :
                                                   6650 
                                                  1572 
                                                5078 
                                                24 %

     :
                                                   9978 
                                                  2893 
                                                7084 
                                                29 %

     :
                                            C:\pagefile.sys
                                           3327 
      /                           104  / 104 
                                                3 %

    Physical Address Extension (PAE):
                                        
                                        
                                                


--------[ SPD ]---------------------------------------------------------------------------------------------------------

  [ DIMM1: Kingston 2G-UDIMM ]

      :
                                               Kingston 2G-UDIMM
                                           6812B4DCh (3702788712)
                                              22 / 2008
                                            2  (2 ranks, 8 banks)
                                               Unbuffered DIMM
                                               DDR2 SDRAM
                                          DDR2-800 (400 )
                                            64 bit
                                           SSTL 1.8
                                  
                                       (7.8 us), Self-Refresh

     :
      @ 400                                          5-5-5-18  (CL-RCD-RP-RAS) / 23-51-3-6-3-3  (RC-RFC-RRD-WR-WTR-RTP)
      @ 266                                          4-4-4-12  (CL-RCD-RP-RAS) / 16-34-2-4-2-2  (RC-RFC-RRD-WR-WTR-RTP)
      @ 200                                          3-3-3-9  (CL-RCD-RP-RAS) / 12-26-2-3-2-2  (RC-RFC-RRD-WR-WTR-RTP)

      :
      Analysis Probe                                    
      FET Switch External                               
      Weak Driver                                       

      :
                                                   Kingston Technology Company, Inc.
                                     http://www.kingston.com/products/default.asp

  [ DIMM2: Samsung M3 78T6553EZS-CE6 ]

      :
                                               Samsung M3 78T6553EZS-CE6
                                           80254DBEh (3192726912)
                                              39 / 2007
                                            512  (1 rank, 4 banks)
                                               Unbuffered DIMM
                                               DDR2 SDRAM
                                          DDR2-667 (333 )
                                            64 bit
                                           SSTL 1.8
                                  
                                       (7.8 us), Self-Refresh

     :
      @ 333                                          5-5-5-15  (CL-RCD-RP-RAS) / 20-35-3-5-3-3  (RC-RFC-RRD-WR-WTR-RTP)
      @ 266                                          4-4-4-12  (CL-RCD-RP-RAS) / 16-28-2-4-2-2  (RC-RFC-RRD-WR-WTR-RTP)
      @ 200                                          3-3-3-9  (CL-RCD-RP-RAS) / 12-21-2-3-2-2  (RC-RFC-RRD-WR-WTR-RTP)

      :
      Analysis Probe                                    
      FET Switch External                               
      Weak Driver                                       

      :
                                                   Samsung
                                     http://www.samsung.com/global/business/semiconductor

  [ DIMM3: Kingston " ]

      :
                                               Kingston "
                                           17CCA810h (279497751)
                                              4 / 2009
                                            2  (2 ranks, 8 banks)
                                               Unbuffered DIMM
                                               DDR2 SDRAM
                                          DDR2-800 (400 )
                                            64 bit
                                           SSTL 1.8
                                  
                                       (7.8 us), Self-Refresh

     :
      @ 400                                          5-5-5-18  (CL-RCD-RP-RAS) / 23-51-3-6-3-3  (RC-RFC-RRD-WR-WTR-RTP)
      @ 266                                          4-4-4-12  (CL-RCD-RP-RAS) / 16-34-2-4-2-2  (RC-RFC-RRD-WR-WTR-RTP)
      @ 200                                          3-3-3-9  (CL-RCD-RP-RAS) / 12-26-2-3-2-2  (RC-RFC-RRD-WR-WTR-RTP)

      :
      Analysis Probe                                    
      FET Switch External                               
      Weak Driver                                       

      :
                                                   Kingston Technology Company, Inc.
                                     http://www.kingston.com/products/default.asp

  [ DIMM4: Hynix HYMP532U64BP6-Y5 ]

      :
                                               Hynix HYMP532U64BP6-Y5
                                           00002139h (958464000)
                                              25 / 2006
                                            256  (1 rank, 4 banks)
                                               Unbuffered DIMM
                                               DDR2 SDRAM
                                          DDR2-667 (333 )
                                            64 bit
                                           SSTL 1.8
                                  
                                       (7.8 us)

     :
      @ 333                                          5-5-5-15  (CL-RCD-RP-RAS) / 20-35-4-5-3-3  (RC-RFC-RRD-WR-WTR-RTP)
      @ 266                                          4-4-4-12  (CL-RCD-RP-RAS) / 16-28-3-4-2-2  (RC-RFC-RRD-WR-WTR-RTP)
      @ 200                                          3-3-3-9  (CL-RCD-RP-RAS) / 12-21-2-3-2-2  (RC-RFC-RRD-WR-WTR-RTP)

      :
      Analysis Probe                                    
      FET Switch External                               
      Weak Driver                                       

      :
                                                   Hynix Semiconductor Inc.
                                     http://www.hynix.com/gl/products


--------[  ]------------------------------------------------------------------------------------------------------

  [  : Intel Broadwater P965 ]

      :
                                            Intel Broadwater P965
       Intel                                   Bridge Creek
        FSB                       FSB533, FSB800, FSB1066
                                DDR2-533 SDRAM, DDR2-667 SDRAM, DDR2-800 SDRAM
                                 8 
       / Stepping                                 02 / C2
                                              1226 Pin NGP
                                          3.4 cm x 3.4 cm
                                   1.25 V
      In-Order Queue Depth                              12

     :
                                                     Dual Channel  (128 )
                                           Dual Channel  (128 )

     :
      CAS Latency (CL)                                  5T
      RAS To CAS Delay (tRCD)                           4T
      RAS Precharge (tRP)                               4T
      RAS Active Time (tRAS)                            12T
      Row Refresh Cycle Time (tRFC)                     34T
      Command Rate (CR)                                 2T
      RAS To RAS Delay (tRRD)                           3T
      Read To Read Delay (tRTR)                         Same Rank: 4T, Different Rank: 6T
      Read To Write Delay (tRTW)                        8T
      Write To Read Delay (tWTR)                        Same Rank: 10T, Different Rank: 5T
      Write To Write Delay (tWTW)                       Same Rank: 4T, Different Rank: 6T
      Read To Precharge Delay (tRTP)                    4T
      Write To Precharge Delay (tWTP)                   12T
      Precharge To Precharge Delay (tPTP)               1T
      Refresh Period (tREF)                             2080T
      MCH ODT Latency                                   3T
      Performance Level                                 13

     :
      ECC                                                
      ChipKill ECC                                       
      RAID                                               
      ECC Scrubbing                                      

     :
       DRAM #1                                    2   (DDR2 SDRAM)
       DRAM #2                                    512   (DDR2 SDRAM)
       DRAM #3                                    2   (DDR2 SDRAM)
       DRAM #4                                    256   (DDR2 SDRAM)

     PCI Express:
      PCI-E 1.0 x16 port #2                              @ x16  (nVIDIA GeForce 9800 GTX+ Video Adapter)

     :
                                                   Intel Corporation
                                     http://www.intel.com/products/chipsets
                                       http://support.intel.com/support/chipsets
       BIOS                                   http://www.esupport.com/biosagent/index.cfm?refererid=40
                                     http://driveragent.com?ref=59

  [  : Intel 82801HB ICH8 ]

      :
                                               Intel 82801HB ICH8
       Intel                                   Bridge Creek
       / Stepping                                 F2 / B0
                                              652 Pin mBGA
                                          3.1 cm x 3.1 cm
                                   1.05 V

    High Definition Audio:
                                               Realtek ALC888/1200
      ID                                          10EC0888h / 14627235h
                                            00100001h
                                               Audio
                           44 kHz, 48 kHz, 96 kHz, 192 kHz, 16 , 20 , 24 

     PCI Express:
      PCI-E 1.0 x4 port #1                              
      PCI-E 1.0 x1 port #6                               @ x1  (Marvell 88SE6121 Serial ATA II Host Controller)

     :
                                                   Intel Corporation
                                     http://www.intel.com/products/chipsets
                                       http://support.intel.com/support/chipsets
       BIOS                                   http://www.esupport.com/biosagent/index.cfm?refererid=40
                                     http://driveragent.com?ref=59


--------[ BIOS ]--------------------------------------------------------------------------------------------------------

     BIOS:
       BIOS                                          AMI
       BIOS                                       V3.7
        BIOS                               08/06/07
       BIOS                            12/19/08

     BIOS:
                                                   American Megatrends Inc.
                                     http://www.ami.com/amibios
       BIOS                                   http://www.esupport.com/biosagent/index.cfm?refererid=40


--------[ ACPI ]--------------------------------------------------------------------------------------------------------

  [ APIC: Multiple APIC Description Table ]

      ACPI:
       ACPI                                      APIC
                                         Multiple APIC Description Table
                                             CFFB0390h
                                           108 
      OEM ID                                            M S I
      OEM Table ID                                      OEMAPIC
      OEM Revision                                      08000706h
      Creator ID                                        MSFT
      Creator Revision                                  00000097h
      Local APIC Address                                FEE00000h

  [ DSDT: Differentiated System Description Table ]

      ACPI:
       ACPI                                      DSDT
                                         Differentiated System Description Table
                                             CFFB0440h
                                           24027 
      OEM ID                                            0AAAA
      OEM Table ID                                      0AAAA000
      OEM Revision                                      00000000h
      Creator ID                                        INTL
      Creator Revision                                  20051117h

  [ FACP: Fixed ACPI Description Table ]

      ACPI:
       ACPI                                      FACP
                                         Fixed ACPI Description Table
                                             CFFB0200h
                                           132 
      OEM ID                                            M S I
      OEM Table ID                                      OEMFACP
      OEM Revision                                      08000706h
      Creator ID                                        MSFT
      Creator Revision                                  00000097h
      SMI Command Port                                  000000B2h
      PM Timer                                          00000808h

  [ FACS: Firmware ACPI Control Structure ]

      ACPI:
       ACPI                                      FACS
                                         Firmware ACPI Control Structure
                                             CFFBE000h
                                           64 

  [ GSCI: Intel GMCH SCI Table ]

      ACPI:
       ACPI                                      GSCI
                                         Intel GMCH SCI Table
                                             CFFBE0B0h
                                           8228 
      OEM ID                                            M S I
      OEM Table ID                                      GMCHSCI
      OEM Revision                                      08000706h
      Creator ID                                        MSFT
      Creator Revision                                  00000097h

  [ MCFG: Memory Mapped Configuration Space Base Address Description Table ]

      ACPI:
       ACPI                                      MCFG
                                         Memory Mapped Configuration Space Base Address Description Table
                                             CFFB0400h
                                           60 
      OEM ID                                            M S I
      OEM Table ID                                      OEMMCFG
      OEM Revision                                      08000706h
      Creator ID                                        MSFT
      Creator Revision                                  00000097h

  [ OEMB: OEM Specific Information Table ]

      ACPI:
       ACPI                                      OEMB
                                         OEM Specific Information Table
                                             CFFBE040h
                                           97 
      OEM ID                                            M S I
      OEM Table ID                                      AMI_OEM
      OEM Revision                                      08000706h
      Creator ID                                        MSFT
      Creator Revision                                  00000097h

  [ RSD PTR: Root System Description Pointer ]

      ACPI:
       ACPI                                      RSD PTR
                                         Root System Description Pointer
                                             000F9190h
                                           36 
      OEM ID                                            ACPIAM

  [ RSDT: Root System Description Table ]

      ACPI:
       ACPI                                      RSDT
                                         Root System Description Table
                                             CFFB0000h
                                           60 
      OEM ID                                            ACRSYS
      OEM Table ID                                      ACRPRDCT
      OEM Revision                                      08000706h
      Creator ID                                        MSFT
      Creator Revision                                  00000097h

  [ SLIC: Software Licensing Description Table ]

      ACPI:
       ACPI                                      SLIC
                                         Software Licensing Description Table
                                             CFFB0050h
                                           374 
      OEM ID                                            ACRSYS
      OEM Table ID                                      ACRPRDCT
      OEM Revision                                      00000001h
      Creator ID                                        ANNI
      Creator Revision                                  00000001h


--------[   ]----------------------------------------------------------------------------------------

      :
                                              Microsoft Windows 7 Ultimate
                                                   ()
                                               Multiprocessor Free (32-bit)
                                                6.1.7601
                                       Service Pack 1
                                       27.09.2015
                                         C:\Windows

     :
                          sima
                           
      ID                                        00426-OEM-8992662-00006
                                            FJGCP-4DFJD-GJY49-VJBQ7-HYRR2
        (WPA)                           

     :
                                           VLADIMIR
                                         sima
                                              vladimir
                                             1185  (0 ., 0 , 19 , 45 )

     :
      Common Controls                                   6.16
      Internet Explorer                                 8.0.7601.17514
      Windows Mail                                      6.1.7600.16385 (win7_rtm.090713-1255)
      Windows Media Player                              12.0.7600.16385 (win7_rtm.090713-1255)
      Windows Messenger                                 -
      MSN Messenger                                     -
      Internet Information Services (IIS)               -
      .NET Framework                                    4.0.30319.1 built by: RTMRel
      Novell Client                                     -
      DirectX                                           DirectX 11.0
      OpenGL                                            6.1.7600.16385 (win7_rtm.090713-1255)
      ASPI                                              -

      :
                                        
       DBCS                                       
                                        
                                     
                                             
                                         
                                         
                                      
                                      


--------[  ]----------------------------------------------------------------------------------------------------

    Dwm.exe                  C:\Windows\system32\Dwm.exe                                                   32         27712          29024 
    everest.exe              C:\my_programs\setup\system ytilit\EVEREST Ultimate Edition\everest.exe       32         32544          25752 
    Explorer.EXE             C:\Windows\Explorer.EXE                                                       32         39496          25356 
    firefox.exe              C:\Program Files\Mozilla Firefox\firefox.exe                                  32           370            321 
    HsMgr.exe                C:\Windows\system\HsMgr.exe                                                   32          5356           1288 
    NvBackend.exe            C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe                 32         11784           7096 
    nvtray.exe               C:\Program Files\NVIDIA Corporation\Display\nvtray.exe                        32          9548           3176 
    OUTLOOK.EXE              C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE                        32           112          76236 
    Speccy.exe               C:\my_programs\setup\system ytilit\speccy\Speccy.exe                          32         31064          14984 
    taskhost.exe             C:\Windows\system32\taskhost.exe                                              32          8156           7424 
    TOTALCMD.EXE             C:\my_programs\TC\TOTALCMD.EXE                                                32         15192           7076 


--------[   ]------------------------------------------------------------------------------------------

    1394ohci         1394 OHCI- -                                   1394ohci.sys          6.1.7601.17514                        
    ACPI              Microsoft ACPI                                                  ACPI.sys              6.1.7601.17514                        
    AcpiPmi          ACPI Power Meter Driver                                                 acpipmi.sys           6.1.7601.17514                        
    adp94xx          adp94xx                                                                 adp94xx.sys           1.6.6.4                               
    adpahci          adpahci                                                                 adpahci.sys           1.6.6.1                               
    adpu320          adpu320                                                                 adpu320.sys           7.2.0.0                               
    AFD              Ancillary Function Driver for Winsock                                   afd.sys               6.1.7601.17514                        
    agp440           Intel AGP Bus Filter                                                    agp440.sys            6.1.7600.16385                        
    aic78xx          aic78xx                                                                 djsvs.sys             6.0.0.0                               
    aliide           aliide                                                                  aliide.sys            1.2.0.0                               
    amdagp           AMD AGP Bus Filter Driver                                               amdagp.sys            6.1.7600.16385                        
    amdide           amdide                                                                  amdide.sys            6.1.7600.16385                        
    AmdK8            AMD K8 Processor Driver                                                 amdk8.sys             6.1.7600.16385                        
    AmdPPM           AMD Processor Driver                                                    amdppm.sys            6.1.7600.16385                        
    amdsata          amdsata                                                                 amdsata.sys           1.1.2.5                               
    amdsbs           amdsbs                                                                  amdsbs.sys            3.6.1540.127                          
    amdxata          amdxata                                                                 amdxata.sys           1.1.2.5                               
    AppID             AppID                                                           appid.sys             6.1.7601.17514                        
    arc              arc                                                                     arc.sys               5.2.0.10384                           
    arcsas           arcsas                                                                  arcsas.sys            5.2.0.16119                           
    AsyncMac            RAS                                       asyncmac.sys          6.1.7600.16385                        
    atapi             IDE                                                               atapi.sys             6.1.7600.16385                        
    b06bdrv          Broadcom NetXtreme II VBD                                               bxvbdx.sys            4.8.2.0                               
    b57nd60x         Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0                          b57nd60x.sys          10.100.4.0                            
    BazisPortableCDBus  Portable WinCDEmu driver                                                BazisPortableCDBus.sys  3.4.0.2                               
    Beep             Beep                                                                                                                                
    blbdrive         blbdrive                                                                blbdrive.sys          6.1.7600.16385                        
    bowser                                                           bowser.sys            6.1.7600.16385             
    BrFiltLo         Brother USB Mass-Storage Lower Filter Driver                            BrFiltLo.sys          1.10.0.2                              
    BrFiltUp         Brother USB Mass-Storage Upper Filter Driver                            BrFiltUp.sys          1.4.0.1                               
    Brserid          Brother MFC Serial Port Interface Driver (WDM)                          Brserid.sys           1.0.1.6                               
    BrSerWdm         Brother WDM Serial driver                                               BrSerWdm.sys          1.0.0.20                              
    BrUsbMdm         Brother MFC USB Fax Only Modem                                          BrUsbMdm.sys          1.0.0.12                              
    BrUsbSer         Brother MFC USB Serial WDM Driver                                       BrUsbSer.sys          1.0.1.3                               
    BTHMODEM         Bluetooth Serial Communications Driver                                  bthmodem.sys          6.1.7600.16385                        
    cdfs             CD/DVD File System Reader                                               cdfs.sys              6.1.7600.16385             
    cdrom             CD-ROM                                                 cdrom.sys             6.1.7601.17514                        
    circlass         Consumer IR Devices                                                     circlass.sys          6.1.7600.16385                        
    CLFS               (CLFS)                                                     CLFS.sys              6.1.7600.16385                        
    CmBatt           Microsoft ACPI Control Method Battery Driver                            CmBatt.sys            6.1.7600.16385                        
    cmdide           cmdide                                                                  cmdide.sys            2.0.7.0                               
    cmudaxp          ASUS Xonar D1 Audio Interface                                           cmudaxp.sys           5.12.1.8                              
    CNG              CNG                                                                     cng.sys               6.1.7600.16385                        
    Compbatt         Compbatt                                                                compbatt.sys          6.1.7600.16385                        
    CompositeBus                                          CompositeBus.sys      6.1.7601.17514                        
    cpuz138          cpuz138                                                                 cpuz138_x32.sys                                             
    crcdisk          Crcdisk Filter Driver                                                   crcdisk.sys           6.1.7600.16385                        
    CSC                                                               csc.sys               6.1.7601.17514                        
    DfsC             DFS Namespace Client Driver                                             dfsc.sys              6.1.7601.17514             
    discache         System Attribute Cache                                                  discache.sys          6.1.7600.16385                        
    Disk                                                                         disk.sys              6.1.7600.16385                        
    dmvsc            dmvsc                                                                   dmvsc.sys             6.1.7601.17514                        
    drmkaud                                                 drmkaud.sys           6.1.7600.16385                        
    DXGKrnl          LDDM Graphics Subsystem                                                 dxgkrnl.sys           6.1.7601.17514                        
    ebdrv            Broadcom NetXtreme II 10 GigE VBD                                       evbdx.sys             4.8.13.0                              
    elxstor          elxstor                                                                 elxstor.sys           5.2.10.211                            
    ErrDev           Microsoft Hardware Error Device Driver                                  errdev.sys            6.1.7600.16385                        
    EverestDriver    Lavalys EVEREST Kernel Driver                                           kerneld.wnt                                                 
    exfat            exFAT File System Driver                                                                                                 
    fastfat          FAT12/16/32 File System Driver                                                                                           
    fdc              Floppy Disk Controller Driver                                           fdc.sys               6.1.7600.16385                        
    FileInfo         File Information FS MiniFilter                                          fileinfo.sys          6.1.7600.16385             
    Filetrace        Filetrace                                                               filetrace.sys         6.1.7600.16385             
    flpydisk         Floppy Disk Driver                                                      flpydisk.sys          6.1.7600.16385                        
    FltMgr                                                                  fltmgr.sys            6.1.7600.16385             
    FsDepends        File System Dependency Minifilter                                       FsDepends.sys         6.1.7600.16385             
    fvevol               Bitlocker                              fvevol.sys            6.1.7601.17514                        
    gagp30kx         Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms             gagp30kx.sys          6.1.7600.16385                        
    hcw85cir         Hauppauge Consumer Infrared Receiver                                    hcw85cir.sys          1.31.27127.0                          
    HdAudAddService    UAA   High Definition Audio (Microsoft),  1.1  HdAudio.sys           6.1.7601.17514                        
    HDAudBus            UAA  High Definition Audio (Microsoft)              HDAudBus.sys          6.1.7601.17514                        
    HidBatt          HID UPS Battery Driver                                                  HidBatt.sys           6.1.7600.16385                        
    HidBth           Microsoft Bluetooth HID Miniport                                        hidbth.sys            6.1.7600.16385                        
    HidIr            Microsoft Infrared HID Driver                                           hidir.sys             6.1.7600.16385                        
    HidUsb             HID Microsoft                                            hidusb.sys            6.1.7601.17514                        
    HpSAMD           HpSAMD                                                                  HpSAMD.sys            6.12.4.32                             
    HTTP             HTTP                                                                    HTTP.sys              6.1.7601.17514                        
    hwpolicy         Hardware Policy Driver                                                  hwpolicy.sys          6.1.7601.17514                        
    i8042prt          i8042-     PS/2                          i8042prt.sys          6.1.7600.16385                        
    iaStorV          iaStorV                                                                 iaStorV.sys           8.6.2.1014                            
    iirsp            iirsp                                                                   iirsp.sys             5.4.22.0                              
    IntcAzAudAddService  Service for Realtek HD Audio (WDM)                                      RTKVHDA.sys                                                 
    intelide         intelide                                                                intelide.sys          6.1.7600.16385                        
    intelppm          Intel                                                 intelppm.sys          6.1.7600.16385                        
    IpFilterDriver     IP-                                              ipfltdrv.sys          6.1.7600.16385                        
    IPMIDRV          IPMIDRV                                                                 IPMIDrv.sys           6.1.7601.17514                        
    IPNAT            IP Network Address Translator                                           ipnat.sys             6.1.7600.16385                        
    IRENUM           IR Bus Enumerator                                                       irenum.sys            6.1.7600.16385                        
    isapnp           isapnp                                                                  isapnp.sys            6.1.7600.16385                        
    iScsiPrt         iScsiPort Driver                                                        msiscsi.sys           6.1.7601.17514                        
    kbdclass                                                          kbdclass.sys          6.1.7600.16385                        
    kbdhid             HID                                                  kbdhid.sys            6.1.7601.17514                        
    KSecDD           KSecDD                                                                  ksecdd.sys            6.1.7601.17514                        
    KSecPkg          KSecPkg                                                                 ksecpkg.sys           6.1.7600.16385                        
    lltdio           Link-Layer Topology Discovery Mapper I/O Driver                         lltdio.sys            6.1.7600.16385                        
    LSI_FC           LSI_FC                                                                  lsi_fc.sys            1.28.3.52                             
    LSI_SAS          LSI_SAS                                                                 lsi_sas.sys           1.28.3.52                             
    LSI_SAS2         LSI_SAS2                                                                lsi_sas2.sys          2.0.2.71                              
    LSI_SCSI         LSI_SCSI                                                                lsi_scsi.sys          1.28.3.67                             
    luafv                                            luafv.sys             6.1.7600.16385             
    megasas          megasas                                                                 megasas.sys           4.5.1.32                              
    MegaSR           MegaSR                                                                  MegaSR.sys            13.5.409.2009                         
    Modem            Modem                                                                   modem.sys             6.1.7600.16385                        
    monitor          Microsoft Monitor Class Function Driver Service                         monitor.sys           6.1.7600.16385                        
    mouclass                                                                mouclass.sys          6.1.7600.16385                        
    mouhid             HID                                                        mouhid.sys            6.1.7600.16385                        
    mountmgr                                                        mountmgr.sys          6.1.7601.17514                        
    mpio             mpio                                                                    mpio.sys              6.1.7601.17514                        
    mpsdrv              Windows                                 mpsdrv.sys            6.1.7600.16385                        
    MRxDAV              WebDav                                 mrxdav.sys            6.1.7601.17514             
    mrxsmb              - SMB                              mrxsmb.sys            6.1.7601.17514             
    mrxsmb10         - SMB 1.x                                            mrxsmb10.sys          6.1.7601.17514             
    mrxsmb20         - SMB 2.0                                            mrxsmb20.sys          6.1.7601.17514             
    msahci           msahci                                                                  msahci.sys            6.1.7601.17514                        
    msdsm            msdsm                                                                   msdsm.sys             6.1.7601.17514                        
    Msfs             Msfs                                                                                                                     
    mshidkmdf        Pass-through HID to KMDF Filter Driver                                  mshidkmdf.sys         6.1.7600.16385                        
    msisadrv         msisadrv                                                                msisadrv.sys          6.1.7600.16385                        
    MSKSSRV             Microsoft                                   MSKSSRV.sys           6.1.7600.16385                        
    MSPCLOCK            Microsoft                               MSPCLOCK.sys          6.1.7600.16385                        
    MSPQM                Microsoft                     MSPQM.sys             6.1.7600.16385                        
    MsRPC            MsRPC                                                                                                                               
    mssmbios         Microsoft System Management BIOS                                 mssmbios.sys          6.1.7600.16385                        
    MSTEE              Tee/Sink-to-Sink Microsoft                      MSTEE.sys             6.1.7600.16385                        
    MTConfig         Microsoft Input Configuration Driver                                    MTConfig.sys          6.1.7600.16385                        
    Mup              Mup                                                                     mup.sys               6.1.7600.16385             
    NativeWifiP      NativeWiFi Filter                                                       nwifi.sys             6.1.7600.16385                        
    NDIS               NDIS                                                  ndis.sys              6.1.7601.17514                        
    NdisCap          NDIS Capture LightWeight Filter                                         ndiscap.sys           6.1.7600.16385                        
    NdisTapi         NDIS- TAPI                                      ndistapi.sys          6.1.7600.16385                        
    Ndisuio          NDIS Usermode I/O Protocol                                              ndisuio.sys           6.1.7601.17514                        
    NdisWan          NDIS- WAN                                       ndiswan.sys           6.1.7601.17514                        
    NDProxy          NDIS Proxy                                                                                                                          
    NetBIOS          NetBIOS Interface                                                       netbios.sys           6.1.7600.16385             
    NetBT            NetBT                                                                   netbt.sys             6.1.7601.17514                        
    nfrd960          nfrd960                                                                 nfrd960.sys           7.10.0.0                              
    Npfs             Npfs                                                                                                                     
    nsiproxy         NSI proxy service driver.                                               nsiproxy.sys          6.1.7600.16385                        
    Ntfs             Ntfs                                                                                                                     
    Null             Null                                                                                                                                
    nv_agp           NVIDIA nForce AGP Bus Filter                                            nv_agp.sys            6.1.7600.16385                        
    nvlddmkm         nvlddmkm                                                                nvlddmkm.sys          9.18.13.4192                          
    nvraid           nvraid                                                                  nvraid.sys            10.6.0.18                             
    nvstor           nvstor                                                                  nvstor.sys            10.6.0.18                             
    NvStreamKms      NvStreamKms                                                             NvStreamKms.sys       1.0.0.0                               
    nvvad_WaveExtensible  NVIDIA Virtual Audio Device (Wave Extensible) (WDM)                     nvvad32v.sys          1.2.27.0                              
    ohci1394         1394 OHCI Compliant Host Controller (Legacy)                            ohci1394.sys          6.1.7600.16385                        
    Parport                                                         parport.sys           6.1.7600.16385                        
    partmgr                                                                 partmgr.sys           6.1.7601.17514                        
    Parvdm           Parvdm                                                                  parvdm.sys            6.1.7600.16385                        
    pci               PCI                                                         pci.sys               6.1.7601.17514                        
    pciide           pciide                                                                  pciide.sys            6.1.7600.16385                        
    pcmcia           pcmcia                                                                  pcmcia.sys            6.1.7600.16385                        
    pcw              Performance Counters for Windows Driver                                 pcw.sys               6.1.7600.16385                        
    PEAUTH           PEAUTH                                                                  peauth.sys            6.1.7600.16385                        
    PptpMiniport     - WAN (PPTP)                                                    raspptp.sys           6.1.7600.16385                        
    Processor        Processor Driver                                                        processr.sys          6.1.7600.16385                        
    Psched             QoS                                                 pacer.sys             6.1.7600.16385                        
    ql2300           ql2300                                                                  ql2300.sys            9.1.8.6                               
    ql40xx           ql40xx                                                                  ql40xx.sys            2.1.3.20                              
    QWAVEdrv          QWAVE                                                           qwavedrv.sys          6.1.7600.16385                        
    RasAcd           Remote Access Auto Connection Driver                                    rasacd.sys            6.1.7600.16385                        
    RasAgileVpn      WAN Miniport (IKEv2)                                                    AgileVpn.sys          6.1.7600.16385                        
    Rasl2tp          - WAN (L2TP)                                                    rasl2tp.sys           6.1.7600.16385                        
    RasPppoe          PPPOE                                          raspppoe.sys          6.1.7600.16385                        
    RasSstp          - WAN (SSTP)                                                    rassstp.sys           6.1.7600.16385                        
    rdbss                                               rdbss.sys             6.1.7601.17514             
    rdpbus           Remote Desktop Device Redirector Bus Driver                             rdpbus.sys            6.1.7600.16385                        
    RDPCDD           RDPCDD                                                                  RDPCDD.sys            6.1.7601.17514                        
    RDPDR            Terminal Server Device Redirector Driver                                rdpdr.sys             6.1.7601.17514                        
    RDPENCDD         RDP Encoder Mirror Driver                                               rdpencdd.sys          6.1.7600.16385                        
    RDPREFMP         Reflector Display Driver used to gain access to graphics data           rdprefmp.sys          6.1.7600.16385                        
    RdpVideoMiniport  Remote Desktop Video Miniport Driver                                    rdpvideominiport.sys  6.1.7601.17514                        
    RDPWD            RDP Winstation Driver                                                                                                               
    rdyboost         ReadyBoost                                                              rdyboost.sys          6.1.7601.17514                        
    rspndr           Link-Layer Topology Discovery Responder                                 rspndr.sys            6.1.7600.16385                        
    RTL8167           Realtek 8167 NT                                                 Rt86win7.sys          7.2.1125.2008                         
    RtlWlanu         Realtek Wireless LAN 802.11n USB 2.0 Network Adapter                    rtwlanu.sys           1021.3.912.2012                       
    s3cap            s3cap                                                                   vms3cap.sys           6.1.7601.17514                        
    sbp2port         sbp2port                                                                sbp2port.sys          6.1.7601.17514                        
    scfilter           -  PnP                                  scfilter.sys          6.1.7601.17514                        
    secdrv           Security Driver                                                                                                                     
    Serenum            Serenum                                                 serenum.sys           6.1.7600.16385                        
    Serial                                                      serial.sys            6.1.7600.16385                        
    sermouse         Serial Mouse Driver                                                     sermouse.sys          6.1.7600.16385                        
    sffdisk          SFF Storage Class Driver                                                sffdisk.sys           6.1.7600.16385                        
    sffp_mmc         SFF Storage Protocol Driver for MMC                                     sffp_mmc.sys          6.1.7600.16385                        
    sffp_sd          SFF Storage Protocol Driver for SDBus                                   sffp_sd.sys           6.1.7601.17514                        
    sfloppy          High-Capacity Floppy Disk Drive                                         sfloppy.sys           6.1.7600.16385                        
    sisagp           SIS AGP Bus Filter                                                      sisagp.sys            6.1.7600.16385                        
    SiSRaid2         SiSRaid2                                                                SiSRaid2.sys          5.1.1039.2600                         
    SiSRaid4         SiSRaid4                                                                sisraid4.sys          5.1.1039.3600                         
    Smb                TCP/IP  TCP/IPv6 ( SMB)                        smb.sys               6.1.7600.16385                        
    spldr            Security Processor Loader Driver                                                                                                    
    srv                Server SMB 1.xxx                                        srv.sys               6.1.7601.17514             
    srv2               Server SMB 2.xxx                                        srv2.sys              6.1.7601.17514             
    srvnet           srvnet                                                                  srvnet.sys            6.1.7601.17514             
    stexstor         stexstor                                                                stexstor.sys          5.0.1.1                               
    storflt                                   vmstorfl.sys          6.1.7601.17514                        
    storvsc          storvsc                                                                 storvsc.sys           6.1.7601.17514                        
    swenum                                                             swenum.sys            6.1.7600.16385                        
    Synth3dVsc       Synth3dVsc                                                              synth3dvsc.sys        6.1.7601.17514                        
    Tcpip              TCP/IP                                                tcpip.sys             6.1.7601.17514                        
    TCPIP6           Microsoft IPv6 Protocol Driver                                          tcpip.sys             6.1.7601.17514                        
    tcpipreg         TCP/IP Registry Compatibility                                           tcpipreg.sys          6.1.7601.17514                        
    TDPIPE           TDPIPE                                                                  tdpipe.sys            6.1.7601.17514                        
    TDTCP            TDTCP                                                                   tdtcp.sys             6.1.7601.17514                        
    tdx                NetIO Legacy TDI                                      tdx.sys               6.1.7601.17514                        
    TermDD                                                         termdd.sys            6.1.7601.17514                        
    terminpt         Microsoft Remote Desktop Input Driver                                   terminpt.sys          6.1.7601.17514                        
    tssecsrv         Remote Desktop Services Security Filter Driver                          tssecsrv.sys          6.1.7601.17514                        
    TsUsbFlt         TsUsbFlt                                                                tsusbflt.sys          6.1.7601.17514                        
    TsUsbGD          Remote Desktop Generic USB Device                                       TsUsbGD.sys           6.1.7601.17514                        
    tsusbhub         tsusbhub                                                                tsusbhub.sys          6.1.7601.17514                        
    tunnel                Microsoft                        tunnel.sys            6.1.7601.17514                        
    uagp35           Microsoft AGPv3.5 Filter                                                uagp35.sys            6.1.7600.16385                        
    udfs             udfs                                                                    udfs.sys              6.1.7601.17514             
    uliagpkx         Uli AGP Bus Filter                                                      uliagpkx.sys          6.1.7600.16385                        
    umbus            UMBus                                               umbus.sys             6.1.7601.17514                        
    UmPass           Microsoft UMPass Driver                                                 umpass.sys            6.1.7600.16385                        
    usbaudio           USB (WDM)                                                 usbaudio.sys          6.1.7601.17514                        
    usbccgp              USB (Microsoft)         usbccgp.sys           6.1.7601.17514                        
    usbcir           eHome Infrared Receiver (USBCIR)                                        usbcir.sys            6.1.7600.16385                        
    usbehci            Microsoft USB 2.0  -       usbehci.sys           6.1.7601.17514                        
    usbhub             USB- ()                      usbhub.sys            6.1.7601.17514                        
    usbohci          Microsoft USB Open Host Controller Miniport Driver                      usbohci.sys           6.1.7600.16385                        
    usbprint         Microsoft USB PRINTER Class                                             usbprint.sys          6.1.7600.16385                        
    USBSTOR              USB                                  USBSTOR.SYS           6.1.7601.17514                        
    usbuhci            Microsoft USB  -         usbuhci.sys           6.1.7600.16385                        
    usbvideo         USB- (WDM)                                               usbvideo.sys          6.1.7601.17514                        
    vdrvroot             ()                   vdrvroot.sys          6.1.7600.16385                        
    vga              vga                                                                     vgapnp.sys            6.1.7600.16385                        
    VgaSave          VgaSave                                                                 vga.sys               6.1.7600.16385                        
    VGPU             VGPU                                                                    rdvgkmd.sys                                                 
    vhdmp            vhdmp                                                                   vhdmp.sys             6.1.7601.17514                        
    viaagp           VIA AGP Bus Filter                                                      viaagp.sys            6.1.7600.16385                        
    ViaC7            VIA C7 Processor Driver                                                 viac7.sys             6.1.7600.16385                        
    viaide           viaide                                                                  viaide.sys            6.0.6000.170                          
    vmbus            vmbus                                                                   vmbus.sys             6.1.7601.17514                        
    VMBusHID         VMBusHID                                                                VMBusHID.sys          6.1.7601.17514                        
    volmgr                                                             volmgr.sys            6.1.7601.17514                        
    volmgrx                                                        volmgrx.sys           6.1.7600.16385                        
    volsnap                                                         volsnap.sys           6.1.7601.17514                        
    vsmraid          vsmraid                                                                 vsmraid.sys           6.0.6000.6210                         
    vwifibus           Virtual WiFi                                               vwifibus.sys          6.1.7600.16385                        
    WacomPen         Wacom Serial Pen HID Driver                                             wacompen.sys          6.1.7600.16385                        
    WANARP              IP ARP                                       wanarp.sys            6.1.7601.17514                        
    Wanarpv6            IPv6 ARP                                     wanarp.sys            6.1.7601.17514                        
    Wd               Wd                                                                      wd.sys                6.1.7600.16385                        
    Wdf01000         Kernel Mode Driver Frameworks service                                   Wdf01000.sys          1.9.7600.16385                        
    WfpLwf           WFP Lightweight Filter                                                  wfplwf.sys            6.1.7600.16385                        
    WIMMount         WIMMount                                                                wimmount.sys          6.1.7600.16385             
    WinUsb           WinUsb                                                                  WinUsb.sys            6.1.7601.17514                        
    WmiAcpi          Microsoft Windows Management Interface for ACPI                         wmiacpi.sys           6.1.7600.16385                        
    ws2ifsl           WinSock IFS                                                     ws2ifsl.sys           6.1.7600.16385                        
    WudfPf           User Mode Driver Frameworks Platform Driver                             WudfPf.sys            6.1.7601.17514                        
    WUDFRd           WUDFRd                                                                  WUDFRd.sys            6.1.7601.17514                        


--------[  ]------------------------------------------------------------------------------------------------------

    AeLookupSvc                                                              svchost.exe           6.1.7600.16385                       localSystem
    ALG                                                                             alg.exe               6.1.7600.16385                 NT AUTHORITY\LocalService
    AppIDSvc                                                                            svchost.exe           6.1.7600.16385                       NT Authority\LocalService
    Appinfo                                                                                 svchost.exe           6.1.7600.16385                       LocalSystem
    AppMgmt                                                                              svchost.exe           6.1.7600.16385                       LocalSystem
    aspnet_state                         ASP.NET                                                aspnet_state.exe      4.0.30319.1                    NT AUTHORITY\NetworkService
    AudioEndpointBuilder                   Windows Audio                        svchost.exe           6.1.7600.16385                       LocalSystem
    Audiosrv                           Windows Audio                                                           svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    AxInstSV                            ActiveX (AxInstSV)                                           svchost.exe           6.1.7600.16385                       LocalSystem
    BDESVC                                BitLocker                                      svchost.exe           6.1.7600.16385                       localSystem
    BFE                                                                                 svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    BITS                                   (BITS)                         svchost.exe           6.1.7600.16385                       LocalSystem
    Browser                                                                                  svchost.exe           6.1.7600.16385                       LocalSystem
    bthserv                              Bluetooth                                              svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    CertPropSvc                                                                      svchost.exe           6.1.7600.16385                       LocalSystem
    clr_optimization_v2.0.50727_32     Microsoft .NET Framework NGEN v2.0.50727_X86                            mscorsvw.exe          2.0.50727.4927                 LocalSystem
    clr_optimization_v4.0.30319_32     Microsoft .NET Framework NGEN v4.0.30319_X86                            mscorsvw.exe          4.0.30319.1                    LocalSystem
    COMSysApp                            COM+                                               dllhost.exe           6.1.7600.16385                 LocalSystem
    CryptSvc                                                                                 svchost.exe           6.1.7600.16385                       NT Authority\NetworkService
    CscService                                                                                  svchost.exe           6.1.7600.16385                       LocalSystem
    DcomLaunch                            DCOM-                                   svchost.exe           6.1.7600.16385                       LocalSystem
    defragsvc                                                                               svchost.exe           6.1.7600.16385                 localSystem
    Dhcp                               DHCP-                                                             svchost.exe           6.1.7600.16385                       NT Authority\LocalService
    Dnscache                           DNS-                                                              svchost.exe           6.1.7600.16385                       NT AUTHORITY\NetworkService
    dot3svc                                                                              svchost.exe           6.1.7600.16385                       localSystem
    DPS                                                                               svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    EapHost                                (EAP)                         svchost.exe           6.1.7600.16385                       localSystem
    EFS                                   (EFS)                                      lsass.exe             6.1.7600.16385                       LocalSystem
    ehRecvr                              Windows Media Center                                    ehRecvr.exe           6.1.7601.17514                 NT AUTHORITY\networkService
    ehSched                              Windows Media Center                                ehsched.exe           6.1.7600.16385                 NT AUTHORITY\networkService
    eventlog                             Windows                                                  svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    EventSystem                          COM+                                                    svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    Fax                                                                                                    fxssvc.exe            6.1.7601.17514                 NT AUTHORITY\NetworkService
    fdPHost                                                                    svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    FDResPub                                                               svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    FontCache                             Windows                                             svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    FontCache3.0.0.0                     Windows Presentation Foundation 3.0.0.0                     PresentationFontCache.exe  3.0.6920.4902                  NT Authority\LocalService
    GfExperienceService                NVIDIA GeForce Experience Service                                       GfExperienceService.exe  1.0.0.1                        LocalSystem
    gpsvc                                                                               svchost.exe           6.1.7600.16385                       LocalSystem
    hidserv                              HID-                                                svchost.exe           6.1.7600.16385                       LocalSystem
    hkmsvc                                                      svchost.exe           6.1.7600.16385                       localSystem
    HomeGroupListener                                                              svchost.exe           6.1.7600.16385                       LocalSystem
    HomeGroupProvider                                                                   svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    idsvc                              Windows CardSpace                                                       infocard.exe          3.0.4506.5420                        LocalSystem
    IKEEXT                               IPsec        IP     svchost.exe           6.1.7600.16385                       LocalSystem
    IPBusEnum                           IP- PnP-X                                              svchost.exe           6.1.7600.16385                       LocalSystem
    iphlpsvc                             IP                                               svchost.exe           6.1.7600.16385                       LocalSystem
    KeyIso                               CNG                                                     lsass.exe             6.1.7600.16385                       LocalSystem
    KtmRm                              KtmRm                            svchost.exe           6.1.7600.16385                       NT AUTHORITY\NetworkService
    LanmanServer                                                                                         svchost.exe           6.1.7600.16385                       LocalSystem
    LanmanWorkstation                                                                            svchost.exe           6.1.7600.16385                       NT AUTHORITY\NetworkService
    lltdsvc                                                                             svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    lmhosts                              NetBIOS  TCP/IP                                   svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    Mcx2Svc                              Media Center                                      svchost.exe           6.1.7600.16385                       NT Authority\LocalService
    Microsoft SharePoint Workspace Audit Service  Microsoft SharePoint Workspace Audit Service                            GROOVE.EXE            14.0.4761.1000                 NT AUTHORITY\LocalService
    MMCSS                                                                         svchost.exe           6.1.7600.16385                       LocalSystem
    MozillaMaintenance                 Mozilla Maintenance Service                                             maintenanceservice.exe  42.0.0.5780                    LocalSystem
    MpsSvc                              Windows                                                      svchost.exe           6.1.7600.16385                       NT Authority\LocalService
    MSDTC                                                                   msdtc.exe             2001.12.8530.16385                NT AUTHORITY\NetworkService
    MSiSCSI                               iSCSI                                      svchost.exe           6.1.7600.16385                       LocalSystem
    msiserver                           Windows                                                      msiexec.exe           5.0.7601.17514                 LocalSystem
    napagent                                                                         svchost.exe           6.1.7600.16385                       NT AUTHORITY\NetworkService
    Netlogon                                                                                lsass.exe             6.1.7600.16385                       LocalSystem
    Netman                                                                                   svchost.exe           6.1.7600.16385                       LocalSystem
    NetMsmqActivator                     Net.Msmq                                         SMSvcHost.exe         4.0.30319.1                          NT AUTHORITY\NetworkService
    NetPipeActivator                     Net.Pipe                                         SMSvcHost.exe         4.0.30319.1                          NT AUTHORITY\LocalService
    netprofm                                                                                  svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    NetTcpActivator                      Net.Tcp                                          SMSvcHost.exe         4.0.30319.1                          NT AUTHORITY\LocalService
    NetTcpPortSharing                       Net.Tcp                                  SMSvcHost.exe         4.0.30319.1                          NT AUTHORITY\LocalService
    NlaSvc                                                                     svchost.exe           6.1.7600.16385                       NT AUTHORITY\NetworkService
    nsi                                                                          svchost.exe           6.1.7600.16385                       NT Authority\LocalService
    NvNetworkService                   NVIDIA Network Service                                                  NvNetworkService.exe  2.2.0.50                       LocalSystem
    NvStreamSvc                        NVIDIA Streamer Service                                                 nvstreamsvc.exe       4.0.1000.0                     LocalSystem
    nvsvc                              NVIDIA Display Driver Service                                           nvvsvc.exe            8.17.13.4192                   LocalSystem
    ose                                Office  Source Engine                                                   OSE.EXE               14.0.4730.1010                 LocalSystem
    osppsvc                            Office Software Protection Platform                                     OSPPSVC.EXE           14.0.370.400                   NT AUTHORITY\NetworkService
    p2pimsvc                                                            svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    p2psvc                                                                         svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    PcaSvc                                                               svchost.exe           6.1.7600.16385                       LocalSystem
    PeerDistSvc                        BranchCache                                                             svchost.exe           6.1.7600.16385                       NT AUTHORITY\NetworkService
    pla                                                                    svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    PlugPlay                           Plug-and-Play                                                           svchost.exe           6.1.7600.16385                       LocalSystem
    PNRPAutoReg                            PNRP                                 svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    PNRPsvc                             PNRP                                                           svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    PolicyAgent                          IPsec                                                    svchost.exe           6.1.7600.16385                       NT Authority\NetworkService
    Power                                                                                               svchost.exe           6.1.7600.16385                       LocalSystem
    ProfSvc                                                                         svchost.exe           6.1.7600.16385                       LocalSystem
    ProtectedStorage                                                                        lsass.exe             6.1.7600.16385                       LocalSystem
    QWAVE                              Quality Windows Audio Video Experience                                  svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    RasAuto                                                 svchost.exe           6.1.7600.16385                       localSystem
    RasMan                                                                svchost.exe           6.1.7600.16385                       localSystem
    RemoteAccess                                                                  svchost.exe           6.1.7600.16385                       localSystem
    RemoteRegistry                                                                              svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    RpcEptMapper                          RPC                                        svchost.exe           6.1.7600.16385                       NT AUTHORITY\NetworkService
    RpcLocator                             (RPC)                                locator.exe           6.1.7600.16385                 NT AUTHORITY\NetworkService
    RpcSs                                 (RPC)                                          svchost.exe           6.1.7600.16385                       NT AUTHORITY\NetworkService
    SamSs                                                                   lsass.exe             6.1.7600.16385                       LocalSystem
    SCardSvr                           -                                                             svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    Schedule                                                                                 svchost.exe           6.1.7600.16385                       LocalSystem
    SCPolicySvc                          -                                            svchost.exe           6.1.7600.16385                       LocalSystem
    SDRSVC                              Windows                                                       svchost.exe           6.1.7600.16385                 localSystem
    seclogon                                                                              svchost.exe           6.1.7600.16385                       LocalSystem
    SENS                                                                    svchost.exe           6.1.7600.16385                       LocalSystem
    SensrSvc                                                                       svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    SessionEnv                                                           svchost.exe           6.1.7600.16385                       localSystem
    SharedAccess                             (ICS)                            svchost.exe           6.1.7600.16385                       LocalSystem
    ShellHWDetection                                                            svchost.exe           6.1.7600.16385                       LocalSystem
    SNMPTRAP                            SNMP                                                            snmptrap.exe          6.1.7600.16385                 NT AUTHORITY\LocalService
    Spooler                                                                                     spoolsv.exe           6.1.7601.17514                 LocalSystem
    sppsvc                                                                        sppsvc.exe            6.1.7601.17514                 NT AUTHORITY\NetworkService
    sppuinotify                          SPP                                                  svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    SSDPSRV                             SSDP                                                        svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    SstpSvc                             SSTP                                                             svchost.exe           6.1.7600.16385                       NT Authority\LocalService
    Stereo Service                     NVIDIA Stereoscopic 3D Driver Service                                   nvSCPAPISvr.exe       7.17.13.4192                   LocalSystem
    StiSvc                                Windows (WIA)                               svchost.exe           6.1.7600.16385                 NT Authority\LocalService
    swprv                                  (Microsoft)                  svchost.exe           6.1.7600.16385                 LocalSystem
    SysMain                            Superfetch                                                              svchost.exe           6.1.7600.16385                       LocalSystem
    TabletInputService                                                                 svchost.exe           6.1.7600.16385                       LocalSystem
    TapiSrv                                                                                           svchost.exe           6.1.7600.16385                       NT AUTHORITY\NetworkService
    TBS                                                           svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    TermService                                                                    svchost.exe           6.1.7600.16385                       NT Authority\NetworkService
    Themes                                                                                                 svchost.exe           6.1.7600.16385                       LocalSystem
    THREADORDER                                                                       svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    TrkWks                                                                 svchost.exe           6.1.7600.16385                       LocalSystem
    TrustedInstaller                     Windows                                              TrustedInstaller.exe  6.1.7601.17514                 localSystem
    UI0Detect                                                                     UI0Detect.exe         6.1.7600.16385                 LocalSystem
    UmRdpService                                svchost.exe           6.1.7600.16385                       localSystem
    upnphost                             PNP-                                        svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    UxSms                                                           svchost.exe           6.1.7600.16385                       localSystem
    VaultSvc                                                                             lsass.exe             6.1.7600.16385                       LocalSystem
    vds                                                                                         vds.exe               6.1.7601.17514                 LocalSystem
    VSS                                                                                  vssvc.exe             6.1.7601.17514                 LocalSystem
    W32Time                              Windows                                                  svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    wbengine                                                                wbengine.exe          6.1.7601.17514                 localSystem
    WbioSrvc                             Windows                                           svchost.exe           6.1.7600.16385                       LocalSystem
    wcncsvc                              Windows -                   svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    WcsPlugInService                     Windows (WCS)                                          svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    WdiServiceHost                                                                        svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    WdiSystemHost                                                                        svchost.exe           6.1.7600.16385                       LocalSystem
    WebClient                          -                                                              svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    Wecsvc                               Windows                                                 svchost.exe           6.1.7600.16385                       NT AUTHORITY\NetworkService
    wercplsupport                          "     "  svchost.exe           6.1.7600.16385                       localSystem
    WerSvc                                Windows                                       svchost.exe           6.1.7600.16385                       localSystem
    WinDefend                           Windows                                                        svchost.exe           6.1.7600.16385                       LocalSystem
    WinHttpAutoProxySvc                   - WinHTTP                   svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    Winmgmt                              Windows                                       svchost.exe           6.1.7600.16385                       localSystem
    WinRM                                 Windows (WS-Management)                    svchost.exe           6.1.7600.16385                       NT AUTHORITY\NetworkService
    Wlansvc                              WLAN                                               svchost.exe           6.1.7600.16385                       LocalSystem
    wmiApSrv                           WMI Performance Adapter                                                 WmiApSrv.exe          6.1.7600.16385                 localSystem
    WMPNetworkSvc                           Windows Media               wmpnetwk.exe          12.0.7601.17514                NT AUTHORITY\NetworkService
    WPCSvc                             Parental Controls                                                       svchost.exe           6.1.7600.16385                       NT Authority\LocalService
    WPDBusEnum                                                           svchost.exe           6.1.7600.16385                       LocalSystem
    wscsvc                                                                         svchost.exe           6.1.7600.16385                       NT AUTHORITY\LocalService
    WSearch                            Windows Search                                                          SearchIndexer.exe     7.0.7600.16385                 LocalSystem
    wuauserv                             Windows                                                svchost.exe           6.1.7600.16385                       LocalSystem
    wudfsvc                            Windows Driver Foundation - User-mode Driver Framework                  svchost.exe           6.1.7600.16385                       LocalSystem
    WwanSvc                             WWAN                                                      svchost.exe           6.1.7600.16385                       NT Authority\LocalService


--------[  AX ]----------------------------------------------------------------------------------------------------

    bdaplgin.ax                6.1.7600.16385              Microsoft BDA Device Control Plug-in for MPEG2 based networks.
    g711codc.ax                6.1.7601.17514              Intel G711 CODEC
    iac25_32.ax                2.0.5.53                      Indeo audio
    ir41_32.ax                 4.51.16.3                   Intel Indeo Video 4.5
    ivfsrc.ax                  5.10.2.51                    Intel Indeo video IVF  5.10
    ksproxy.ax                 6.1.7601.17514              WDM Streaming ActiveMovie Proxy
    kstvtune.ax                6.1.7601.17514               - WDM
    kswdmcap.ax                6.1.7601.17514                WDM
    ksxbar.ax                  6.1.7601.17514              WDM Streaming Crossbar
    mpeg2data.ax               6.6.7601.17514              Microsoft MPEG-2 Section and Table Acquisition Module
    mpg2splt.ax                6.6.7601.17514              DirectShow MPEG-2 Splitter.
    msdvbnp.ax                 6.6.7601.17514              Microsoft Network Provider for MPEG2 based networks.
    msnp.ax                    6.6.7601.17514              Microsoft Network Provider for MPEG2 based networks.
    psisrndr.ax                6.6.7601.17514              Microsoft Transport Information Filter for MPEG2 based networks.
    vbicodec.ax                6.6.7601.17514              Microsoft VBI Codec
    vbisurf.ax                 6.1.7601.17514              VBI Surface Allocator Filter
    vidcap.ax                  6.1.7600.16385              Video Capture Interface Server
    wstpager.ax                6.6.7601.17514              Microsoft Teletext Server
    xvid.ax                                                


--------[  DLL ]---------------------------------------------------------------------------------------------------

    aaclient.dll               6.1.7601.17514                  
    accessibilitycpl.dll       6.1.7601.17514                 
    acctres.dll                6.1.7600.16385                     (Microsoft)
    acledit.dll                6.1.7600.16385                 ACL
    aclui.dll                  6.1.7600.16385                
    acppage.dll                6.1.7601.17514                  ""
    acproxy.dll                6.1.7600.16385               DLL  AUTOCHK
    actioncenter.dll           6.1.7601.17514               
    actioncentercpl.dll        6.1.7601.17514                 
    actionqueue.dll            6.1.7601.17514              Unattend Action Queue Generator / Executor
    activeds.dll               6.1.7601.17514               DLL   AD
    actxprxy.dll               6.1.7601.17514              ActiveX Interface Marshaling Library
    admparse.dll               8.0.7600.16385              IEAK Global Policy Template Parser
    admtmpl.dll                6.1.7601.17514               " "
    adprovider.dll             6.1.7600.16385               DLL adprovider
    adsldp.dll                 6.1.7601.17514              ADs LDAP Provider DLL
    adsldpc.dll                6.1.7600.16385               DLL  LDAP AD
    adsmsext.dll               6.1.7600.16385              ADs LDAP Provider DLL
    adsnt.dll                  6.1.7600.16385               DLL    Windows NT
    adtschema.dll              6.1.7600.16385                 
    advapi32.dll               6.1.7601.17514                API Windows 32
    advpack.dll                8.0.7600.16385              ADVPACK
    aecache.dll                6.1.7600.16385              AECache Sysprep Plugin
    aeevts.dll                 6.1.7600.16385                  
    aeinv.dll                  6.1.7601.17514              Application Experience Program Inventory Component
    aelupsvc.dll               6.1.7600.16385                 
    aepdu.dll                  6.1.7601.17514                   
    aepic.dll                  6.1.7600.16385              Application Experience Program Cache
    alttab.dll                 6.1.7600.16385              Windows Shell Alt Tab
    amstream.dll               6.6.7601.17514              DirectShow Runtime.
    amxread.dll                6.1.7600.16385              API Tracing Manifest Read Library
    apds.dll                   6.1.7600.16385                  Microsoft
    apilogen.dll               6.1.7600.16385                 API
    api-ms-win-core-console-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-datetime-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-debug-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-delayload-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-errorhandling-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-fibers-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-file-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-handle-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-heap-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-interlocked-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-io-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-libraryloader-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-localization-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-localregistry-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-memory-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-misc-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-namedpipe-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-processenvironment-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-processthreads-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-profile-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-rtlsupport-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-string-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-synch-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-sysinfo-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-threadpool-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-util-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-core-xstate-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-security-base-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-security-lsalookup-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-security-sddl-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-service-core-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-service-management-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-service-management-l2-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    api-ms-win-service-winsvc-l1-1-0.dll  6.1.7600.16385              ApiSet Stub DLL
    apircl.dll                 6.1.7600.16385              Microsoft InfoTech IR Local DLL
    apisetschema.dll           6.1.7600.16385              ApiSet Schema DLL
    apphelp.dll                6.1.7601.17514                 
    apphlpdm.dll               6.1.7600.16385                 
    appidapi.dll               6.1.7600.16385               API-  
    appidpolicyengineapi.dll   6.1.7600.16385              AppId Policy Engine API Module
    appidsvc.dll               6.1.7600.16385                
    appinfo.dll                6.1.7601.17514                 
    appmgmts.dll               6.1.7600.16385                
    appmgr.dll                 6.1.7601.17514                 
    apss.dll                   6.1.7600.16385              Microsoft InfoTech Storage System Library
    asferror.dll               12.0.7600.16385               ASF
    aspnet_counters.dll        4.0.30319.1                 Microsoft ASP.NET Performance Counter Shim DLL
    asycfilt.dll               6.1.7601.17514              
    atl.dll                    3.5.2284.0                  ATL Module for Windows XP (Unicode)
    atl100.dll                 10.0.40219.325              ATL Module for Windows
    atl110.dll                 11.0.51106.1                ATL Module for Windows
    atmfd.dll                  5.1.2.230                   Windows NT OpenType/Type 1 Font Driver
    atmlib.dll                 5.1.2.230                   Windows NT OpenType/Type 1 API Library.
    audiodev.dll               6.1.7601.17514                   
    audioeng.dll               6.1.7600.16385              Audio Engine
    audiokse.dll               6.1.7600.16385              Audio Ks Endpoint
    audioses.dll               6.1.7601.17514                
    audiosrv.dll               6.1.7601.17514               Windows Audio
    auditcse.dll               6.1.7600.16385              CSE   Windows
    auditnativesnapin.dll      6.1.7600.16385                    
    auditpolicygpinterop.dll   6.1.7600.16385                 
    auditpolmsg.dll            6.1.7600.16385                MMC  
    authfwcfg.dll              6.1.7600.16385               Windows      
    authfwgp.dll               6.1.7600.16385               Windows c      
    authfwsnapin.dll           6.1.7601.17514              Microsoft.WindowsFirewall.SnapIn
    authfwwizfwk.dll           6.1.7600.16385              Wizard Framework
    authui.dll                 6.1.7601.17514                
    authz.dll                  6.1.7600.16385              Authorization Framework
    autoplay.dll               6.1.7601.17514               ( )
    auxiliarydisplayapi.dll    6.1.7600.16385              Microsoft Windows SideShow API
    auxiliarydisplayclassinstaller.dll  6.1.7600.16385                 Microsoft Windows SideShow -  
    auxiliarydisplaycpl.dll    6.1.7601.17514                Microsoft Windows SideShow
    auxiliarydisplaydriverlib.dll  6.1.7600.16385              Microsoft Windows SideShow class extension component
    auxiliarydisplayservices.dll  6.1.7601.17514               Microsoft Windows SideShow
    avicap.dll                 1.15.0.1                    AVI Capture DLL
    avicap32.dll               6.1.7600.16385                 AVI
    avifil32.dll               6.1.7601.17514                 AVI
    avifile.dll                4.90.0.3000                 Microsoft AVI File support library
    avrt.dll                   6.1.7600.16385              Multimedia Realtime Runtime
    axinstsv.dll               6.1.7601.17514                ActiveX
    azroles.dll                6.1.7601.17514              azroles Module
    azroleui.dll               6.1.7601.17514               
    azsqlext.dll               6.1.7601.17514              AzMan Sql Audit Extended Stored Procedures Dll
    basecsp.dll                6.1.7601.17514                 - (Microsoft)
    basesrv.dll                6.1.7601.17514              Windows NT BASE API Server DLL
    batmeter.dll               6.1.7601.17514              Battery Meter Helper DLL
    batt.dll                   6.1.7600.16385                
    bcdprov.dll                6.1.7600.16385              Boot Configuration Data WMI Provider
    bcdsrv.dll                 6.1.7601.17514              Boot Configuration Data COM Server
    bcrypt.dll                 6.1.7600.16385              Windows Cryptographic Primitives Library
    bcryptprimitives.dll       6.1.7600.16385              Windows Cryptographic Primitives Library
    bdehdcfglib.dll            6.1.7600.16385                  Windows BitLocker
    bderepair.dll              6.1.7600.16385              BitLocker Drive Encryption: Drive Repair Tool
    bdesvc.dll                 6.1.7600.16385               BDE
    bdeui.dll                  6.1.7600.16385              Windows BitLocker Drive Encryption User Interface
    bfe.dll                    6.1.7601.17514                
    bidispl.dll                6.1.7600.16385              Bidispl DLL
    biocpl.dll                 6.1.7601.17514                - 
    biocredprov.dll            6.1.7600.16385                 WinBio
    bitsigd.dll                7.5.7600.16385              Background Intelligent Transfer Service IGD Support
    bitsperf.dll               7.5.7601.17514              Perfmon Counter Access
    bitsprx2.dll               7.5.7600.16385              Background Intelligent Transfer Service Proxy
    bitsprx3.dll               7.5.7600.16385              Background Intelligent Transfer Service 2.0 Proxy
    bitsprx4.dll               7.5.7600.16385              Background Intelligent Transfer Service 2.5 Proxy
    bitsprx5.dll               7.5.7600.16385              Background Intelligent Transfer Service 3.0 Proxy
    bitsprx6.dll               7.5.7600.16385              Background Intelligent Transfer Service 4.0 Proxy
    blackbox.dll               11.0.7601.17514             BlackBox DLL
    blb_ps.dll                 6.1.7600.16385              Microsoft Block Level Backup proxy/stub
    blbevents.dll              6.1.7601.17514               Blb
    blbres.dll                 6.1.7600.16385                     
    bootres.dll                6.1.7601.17514                
    bootstr.dll                6.1.7600.16385              Boot String Resource Library
    bootvid.dll                6.1.7600.16385              VGA Boot Driver
    brcoinst.dll               1.0.0.20                    Brother Multi Function CoInstaller
    brdgcfg.dll                6.1.7600.16385              NWLink IPX Notify Object
    bridgeres.dll              6.1.7600.16385               
    browcli.dll                6.1.7601.17514              Browser Service Client DLL
    browser.dll                6.1.7601.17514               DLL   
    browseui.dll               6.1.7601.17514              Shell Browser UI Library
    bthci.dll                  6.1.7600.16385                Bluetooth
    bthmtpcontexthandler.dll   6.1.7600.16385                 Bluetooth MTP
    bthpanapi.dll              6.1.7600.16385              bthpanapi
    bthpancontexthandler.dll   1.0.0.1                       Bthpan
    bthserv.dll                6.1.7600.16385                Bluetooth
    btpanui.dll                6.1.7600.16385                Bluetooth   
    bwcontexthandler.dll       1.0.0.1                      ContextH
    bwunpairelevated.dll       6.1.7600.16385              BWUnpairElevated Proxy Dll
    c_g18030.dll               6.1.7600.16385              GB18030 DBCS-Unicode Conversion DLL
    c_is2022.dll               6.1.7600.16385              ISO-2022 Code Page Translation DLL
    c_iscii.dll                6.1.7601.17514              ISCII Code Page Translation DLL
    cabinet.dll                6.1.7601.17514              Microsoft Cabinet File API
    cabview.dll                6.1.7601.17514                 CAB-
    capiprovider.dll           6.1.7600.16385               DLL capiprovider
    capisp.dll                 6.1.7600.16385              Sysprep cleanup dll for CAPI
    cardgames.dll              1.0.0.1                     CardGames Resources
    catsrv.dll                 2001.12.8530.16385          COM+ Configuration Catalog Server
    catsrvps.dll               2001.12.8530.16385          COM+ Configuration Catalog Server Proxy/Stub
    catsrvut.dll               2001.12.8530.16385          COM+ Configuration Catalog Server Utilities
    cca.dll                    6.6.7601.17514              CCA DirectShow Filter.
    cdd.dll                    6.1.7601.17514              Canonical Display Driver
    cdosys.dll                 6.6.7601.17514              Microsoft CDO for Windows Library
    certcli.dll                6.1.7601.17514                 Microsoft Active Directory
    certcredprovider.dll       6.1.7600.16385                 
    certenc.dll                6.1.7600.16385              Active Directory Certificate Services Encoding
    certenroll.dll             6.1.7601.17514                  Active Directory Microsoft
    certenrollui.dll           6.1.7600.16385                  X509
    certmgr.dll                6.1.7601.17514                
    certpoleng.dll             6.1.7601.17514                
    certprop.dll               6.1.7601.17514                 -
    cewmdm.dll                 12.0.7600.16385               Windows CE WMDM
    cfgbkend.dll               6.1.7600.16385              Configuration Backend Interface
    cfgmgr32.dll               6.1.7601.17514              Configuration Manager DLL
    chkwudrv.dll               6.1.7600.16385                    Windows
    chsbrkr.dll                6.1.7600.16385              Simplified Chinese Word Breaker
    chtbrkr.dll                6.1.7600.16385              Chinese Traditional Word Breaker
    chxreadingstringime.dll    6.1.7600.16385              CHxReadingStringIME
    ci.dll                     6.1.7601.17514              Code Integrity Module
    cic.dll                    6.1.7600.16385                CIC - MMC   
    circoinst.dll              6.1.7600.16385              USB Consumer IR Driver coinstaller for eHome
    clb.dll                    6.1.7600.16385                
    clbcatq.dll                2001.12.8530.16385          COM+ Configuration Catalog
    clfsw32.dll                6.1.7600.16385              Common Log Marshalling Win32 DLL
    cliconfg.dll               6.1.7600.16385              SQL Client Configuration Utility DLL
    clusapi.dll                6.1.7601.17514               API 
    cm_oal.dll                 1.0.0.1                     CMedia OpenAL(TM) Implementation
    cmasiop.dll                1.0.8.815                   C-Media Universal ASIO Driver
    cmcfg32.dll                7.2.7600.16385                  Microsoft
    cmdial32.dll               7.2.7600.16385               
    cmicryptinstall.dll        6.1.7600.16385              Installers for cryptographic elements of CMI objects
    cmifw.dll                  6.1.7600.16385              Windows Firewall rule configuration plug-in
    cmiinstallresall.dll       1.0.1.0                     Vista Driver Installer
    cmipnpinstall.dll          6.1.7600.16385              PNP plugin installer for CMI
    cmlua.dll                  7.2.7600.16385                API   
    cmnclim.dll                6.1.7600.16385                
    cmpbk32.dll                7.2.7600.16385              Microsoft Connection Manager Phonebook
    cmstplua.dll               7.2.7600.16385                API      
    cmudaxp.dll                5.12.1.9                    cmudaxp.dll
    cmutil.dll                 7.2.7600.16385                  (Microsoft)
    cngaudit.dll               6.1.7600.16385              Windows Cryptographic Next Generation audit library
    cngprovider.dll            6.1.7600.16385               DLL cngprovider
    cnvfat.dll                 6.1.7600.16385              FAT File System Conversion Utility DLL
    cofiredm.dll               6.1.7600.16385                  
    colbact.dll                2001.12.8530.16385          COM+
    colorcnv.dll               6.1.7600.16385              Windows Media Color Conversion
    colorui.dll                6.1.7600.16385                 
    comcat.dll                 6.1.7600.16385              Microsoft Component Category Manager Library
    comctl32.dll               5.82.7601.17514                  
    comdlg32.dll               6.1.7601.17514                 
    commdlg.dll                3.10.0.103                  Common Dialogs libraries
    compobj.dll                2.10.35.35                  OLE 2.1 16/32 Interoperability Library
    compstui.dll               6.1.7600.16385                   
    comrepl.dll                2001.12.8530.16385          COM+
    comres.dll                 2001.12.8530.16385           COM+
    comsnap.dll                2001.12.8530.16385          COM+ Explorer MMC Snapin
    comsvcs.dll                2001.12.8530.16385          COM+ Services
    comuid.dll                 2001.12.8530.16385          COM+ Explorer UI
    connect.dll                6.1.7600.16385               
    console.dll                6.1.7600.16385                 
    corpol.dll                 8.0.7600.16385              Microsoft COM Runtime Execution Engine
    correngine.dll             6.1.7600.16385              Correlation Engine
    cpfilters.dll              6.6.7601.17514               PTFilter & Encypter/Decrypter Tagger Filters.
    credssp.dll                6.1.7601.17514              Credential Delegation Security Package
    credui.dll                 6.1.7601.17514                 
    crppresentation.dll        6.1.7600.16385              Conference Room Projector : Presentation
    crtdll.dll                 4.0.1183.1                  Microsoft C Runtime Library
    crypt32.dll                6.1.7601.17514              API32 
    cryptbase.dll              6.1.7600.16385              Base cryptographic API DLL
    cryptdlg.dll               6.1.7600.16385                
    cryptdll.dll               6.1.7600.16385              Cryptography Manager
    cryptext.dll               6.1.7600.16385                
    cryptnet.dll               6.1.7600.16385              Crypto Network Related API
    cryptsp.dll                6.1.7600.16385              Cryptographic Service Provider API
    cryptsvc.dll               6.1.7601.17514               
    cryptui.dll                6.1.7601.17514                
    cryptxml.dll               6.1.7600.16385              API- XML DigSig
    cscapi.dll                 6.1.7601.17514              Offline Files Win32 API
    cscdll.dll                 6.1.7601.17514              Offline Files Temporary Shim
    cscmig.dll                 6.1.7601.17514                   (Microsoft)
    cscobj.dll                 6.1.7601.17514               COM-   CSC API
    cscsvc.dll                 6.1.7601.17514              DLL  CSC
    cscui.dll                  6.1.7601.17514                  
    csrsrv.dll                 6.1.7600.16385                -
    ctl3d32.dll                2.31.0.0                    Ctl3D 3D Windows Controls
    ctl3dv2.dll                2.99.0.0                    Ctl3D 3D Windows NT(WOW) Controls
    d2d1.dll                   6.1.7601.17514              Microsoft D2D Library
    d3d10.dll                  6.1.7600.16385              Direct3D 10 Runtime
    d3d10_1.dll                6.1.7600.16385              Direct3D 10.1 Runtime
    d3d10_1core.dll            6.1.7601.17514              Direct3D 10.1 Runtime
    d3d10core.dll              6.1.7600.16385              Direct3D 10 Runtime
    d3d10level9.dll            6.1.7601.17514              Direct3D 10 to Direct3D9 Translation Runtime
    d3d10warp.dll              6.1.7601.17514              Direct3D 10 Rasterizer
    d3d11.dll                  6.1.7601.17514              Direct3D 11 Runtime
    d3d8.dll                   6.1.7600.16385              Microsoft Direct3D
    d3d8thk.dll                6.1.7600.16385              Microsoft Direct3D OS Thunk Layer
    d3d9.dll                   6.1.7601.17514              Direct3D 9 Runtime
    d3dcompiler_33.dll         9.18.904.15                 Microsoft Direct3D
    d3dcompiler_34.dll         9.19.949.46                 Microsoft Direct3D
    d3dcompiler_35.dll         9.19.949.1104               Microsoft Direct3D
    d3dcompiler_36.dll         9.19.949.2111               Microsoft Direct3D
    d3dcompiler_37.dll         9.22.949.2248               Microsoft Direct3D
    d3dcompiler_38.dll         9.23.949.2378               Microsoft Direct3D
    d3dcompiler_39.dll         9.24.949.2307               Microsoft Direct3D
    d3dcompiler_40.dll         9.24.950.2656               Direct3D HLSL Compiler
    d3dcompiler_41.dll         9.26.952.2844               Direct3D HLSL Compiler
    d3dcompiler_42.dll         9.27.952.3022               Direct3D HLSL Compiler
    d3dcompiler_43.dll         9.29.952.3111               Direct3D HLSL Compiler
    d3dcsx_42.dll              9.27.952.3022               Direct3D 10.1 Extensions
    d3dcsx_43.dll              9.29.952.3111               Direct3D 10.1 Extensions
    d3dim.dll                  6.1.7600.16385              Microsoft Direct3D
    d3dim700.dll               6.1.7600.16385              Microsoft Direct3D
    d3dramp.dll                6.1.7600.16385              Microsoft Direct3D
    d3dx10.dll                 9.16.843.0                  Microsoft Direct3D
    d3dx10_33.dll              9.18.904.21                 Microsoft Direct3D
    d3dx10_34.dll              9.19.949.46                 Microsoft Direct3D
    d3dx10_35.dll              9.19.949.1104               Microsoft Direct3D
    d3dx10_36.dll              9.19.949.2009               Microsoft Direct3D
    d3dx10_37.dll              9.19.949.2187               Microsoft Direct3D
    d3dx10_38.dll              9.23.949.2378               Microsoft Direct3D
    d3dx10_39.dll              9.24.949.2307               Microsoft Direct3D
    d3dx10_40.dll              9.24.950.2656               Direct3D 10.1 Extensions
    d3dx10_41.dll              9.26.952.2844               Direct3D 10.1 Extensions
    d3dx10_42.dll              9.27.952.3001               Direct3D 10.1 Extensions
    d3dx10_43.dll              9.29.952.3111               Direct3D 10.1 Extensions
    d3dx11_42.dll              9.27.952.3022               Direct3D 10.1 Extensions
    d3dx11_43.dll              9.29.952.3111               Direct3D 10.1 Extensions
    d3dx9_24.dll               9.5.132.0                   Microsoft DirectX for Windows
    d3dx9_25.dll               9.6.168.0                   Microsoft DirectX for Windows
    d3dx9_26.dll               9.7.239.0                   Microsoft DirectX for Windows
    d3dx9_27.dll               9.8.299.0                   Microsoft DirectX for Windows
    d3dx9_28.dll               9.10.455.0                  Microsoft DirectX for Windows
    d3dx9_29.dll               9.11.519.0                  Microsoft DirectX for Windows
    d3dx9_30.dll               9.12.589.0                  Microsoft DirectX for Windows
    d3dx9_31.dll               9.15.779.0                  Microsoft DirectX for Windows
    d3dx9_32.dll               9.16.843.0                  Microsoft DirectX for Windows
    d3dx9_33.dll               9.18.904.15                 Microsoft DirectX for Windows
    d3dx9_34.dll               9.19.949.46                 Microsoft DirectX for Windows
    d3dx9_35.dll               9.19.949.1104               Microsoft DirectX for Windows
    d3dx9_36.dll               9.19.949.2111               Microsoft DirectX for Windows
    d3dx9_37.dll               9.22.949.2248               Microsoft DirectX for Windows
    d3dx9_38.dll               9.23.949.2378               Microsoft DirectX for Windows
    d3dx9_39.dll               9.24.949.2307               Microsoft DirectX for Windows
    d3dx9_40.dll               9.24.950.2656               Direct3D 9 Extensions
    d3dx9_41.dll               9.26.952.2844               Direct3D 9 Extensions
    d3dx9_42.dll               9.27.952.3001               Direct3D 9 Extensions
    d3dx9_43.dll               9.29.952.3111               Direct3D 9 Extensions
    d3dxof.dll                 6.1.7600.16385              DirectX Files DLL
    dataclen.dll               6.1.7600.16385                 Windows
    davclnt.dll                6.1.7601.17514              Web DAV Client DLL
    davhlpr.dll                6.1.7600.16385              DAV Helper DLL
    dbgeng.dll                 6.1.7601.17514              Windows Symbolic Debugger Engine
    dbghelp.dll                6.1.7601.17514              Windows Image Helper
    dbnetlib.dll               6.1.7600.16385              Winsock Oriented Net DLL for SQL Clients
    dbnmpntw.dll               6.1.7600.16385              Named Pipes Net DLL for SQL Clients
    dciman32.dll               6.1.7600.16385              DCI Manager
    ddaclsys.dll               6.1.7600.16385              SysPrep module for Reseting Data Drive ACL 
    ddeml.dll                  3.50.0.103                  DDE Management library
    ddoiproxy.dll              6.1.7600.16385              DDOI Interface Proxy
    ddores.dll                 6.1.7600.16385                  
    ddraw.dll                  6.1.7600.16385              Microsoft DirectDraw
    ddrawex.dll                6.1.7600.16385              Direct Draw Ex
    defaultlocationcpl.dll     6.1.7601.17514               :   
    defragproxy.dll            6.1.7600.16385              Microsoft Disk Defragmenter Proxy Library
    defragsvc.dll              6.1.7600.16385              \ 
    deskadp.dll                6.1.7600.16385                 
    deskmon.dll                6.1.7600.16385                
    deskperf.dll               6.1.7600.16385                
    devenum.dll                6.6.7600.16385               .
    devicecenter.dll           6.1.7601.17514                
    devicedisplaystatusmanager.dll  6.1.7600.16385              Device Display Status Manager
    devicemetadataparsers.dll  6.1.7600.16385              Common Device Metadata parsers
    devicepairing.dll          6.1.7600.16385               ,   
    devicepairingfolder.dll    6.1.7601.17514                 
    devicepairinghandler.dll   6.1.7600.16385              Device Pairing Handler Dll
    devicepairingproxy.dll     6.1.7600.16385              Device Pairing Proxy Dll
    deviceuxres.dll            6.1.7600.16385              Windows Device User Experience Resource File
    devmgr.dll                 6.1.7600.16385                 
    devobj.dll                 6.1.7600.16385              Device Information Set DLL
    devrtl.dll                 6.1.7600.16385              Device Management Run Time Library
    dfdts.dll                  6.1.7600.16385                  (Windows)
    dfscli.dll                 6.1.7600.16385              Windows NT Distributed File System Client DLL
    dfshim.dll                 4.0.40305.0                     ClickOnce
    dfsshlex.dll               6.1.7600.16385                   DFS
    dhcpcmonitor.dll           6.1.7600.16385               (DLL)   DHCP
    dhcpcore.dll               6.1.7601.17514               DHCP-
    dhcpcore6.dll              6.1.7600.16385               DHCPv6
    dhcpcsvc.dll               6.1.7600.16385               DHCP-
    dhcpcsvc6.dll              6.1.7600.16385               DHCPv6
    dhcpqec.dll                6.1.7600.16385                   Microsoft DHCP
    dhcpsapi.dll               6.1.7600.16385               API  DHCP-c
    diagcpl.dll                6.1.7601.17514                -  
    diagperf.dll               6.1.7601.17514                 (Microsoft)
    difxapi.dll                2.1.0.0                     Driver Install Frameworks for API library module
    dimsjob.dll                6.1.7600.16385               DLL  DIMS
    dimsroam.dll               6.1.7600.16385               DLL  DIMS  
    dinput.dll                 6.1.7600.16385              Microsoft DirectInput
    dinput8.dll                6.1.7600.16385              Microsoft DirectInput
    directdb.dll               6.1.7600.16385              Microsoft Direct Database API
    diskcopy.dll               6.1.7600.16385              Windows DiskCopy
    dispci.dll                 6.1.7600.16385                 (Microsoft)
    dispex.dll                 5.8.7600.16385              Microsoft  DispEx
    display.dll                6.1.7601.17514                
    dmband.dll                 6.1.7600.16385              Microsoft DirectMusic Band
    dmcompos.dll               6.1.7600.16385              Microsoft DirectMusic Composer
    dmdlgs.dll                 6.1.7600.16385              Disk Management Snap-in Dialogs
    dmdskmgr.dll               6.1.7600.16385              Disk Management Snap-in Support Library
    dmdskres.dll               6.1.7600.16385                 
    dmdskres2.dll              6.1.7600.16385                 
    dmime.dll                  6.1.7600.16385              Microsoft DirectMusic Interactive Engine
    dmintf.dll                 6.1.7600.16385              Disk Management DCOM Interface Stub
    dmloader.dll               6.1.7600.16385              Microsoft DirectMusic Loader
    dmocx.dll                  6.1.7600.16385              TreeView OCX
    dmrc.dll                   6.1.7600.16385              Windows MRC
    dmscript.dll               6.1.7600.16385              Microsoft DirectMusic Scripting
    dmstyle.dll                6.1.7600.16385              Microsoft DirectMusic Style Engline
    dmsynth.dll                6.1.7600.16385              Microsoft DirectMusic Software Synthesizer
    dmusic.dll                 6.1.7600.16385                Microsoft DirectMusic
    dmutil.dll                 6.1.7600.16385                 
    dmvdsitf.dll               6.1.7600.16385              Disk Management Snap-in Support Library
    dmvscres.dll               6.1.7601.17514               DLL     
    dnsapi.dll                 6.1.7601.17514                API DNS-
    dnscmmc.dll                6.1.7601.17514               DLL  DNS  MMC
    dnsext.dll                 6.1.7600.16385              DNS extension DLL
    dnshc.dll                  6.1.7600.16385                DNS
    dnsrslvr.dll               6.1.7601.17514                 DNS
    docprop.dll                6.1.7600.16385                OLE
    documentperformanceevents.dll  6.1.7600.16385                   
    dot3api.dll                6.1.7601.17514              802.3 Autoconfiguration API
    dot3cfg.dll                6.1.7601.17514               Netsh  802.3
    dot3dlg.dll                6.1.7600.16385                UI  802.3
    dot3gpclnt.dll             6.1.7600.16385                   802.3
    dot3gpui.dll               6.1.7600.16385               "   802.3"
    dot3hc.dll                 6.1.7600.16385                 Dot3
    dot3msm.dll                6.1.7601.17514                   802.3
    dot3svc.dll                6.1.7601.17514               
    dot3ui.dll                 6.1.7601.17514                802.3
    dpapiprovider.dll          6.1.7600.16385               DLL dpapiprovider
    dplayx.dll                 6.1.7600.16385              Microsoft DirectPlay
    dpmodemx.dll               6.1.7600.16385                      DirectPlay
    dpnaddr.dll                6.1.7601.17514              Microsoft DirectPlay8 Address
    dpnathlp.dll               6.1.7600.16385              Microsoft DirectPlay NAT Helper UPnP
    dpnet.dll                  6.1.7600.16385              Microsoft DirectPlay
    dpnhpast.dll               6.1.7600.16385              Microsoft DirectPlay NAT Helper PAST
    dpnhupnp.dll               6.1.7600.16385              Microsoft DirectPlay NAT Helper UPNP
    dpnlobby.dll               6.1.7600.16385              Microsoft DirectPlay8 Lobby
    dps.dll                    6.1.7601.17514                 WDI
    dpwsockx.dll               6.1.7600.16385                  TCP/IP  IPX  DirectPlay
    dpx.dll                    6.1.7601.17514              Microsoft(R) Delta Package Expander
    drmmgrtn.dll               11.0.7601.17514             DRM Migration DLL
    drmv2clt.dll               11.0.7600.16385             DRMv2 Client DLL
    drprov.dll                 6.1.7600.16385                   ,        ()
    drt.dll                    6.1.7600.16385                
    drtprov.dll                6.1.7600.16385              Distributed Routing Table Providers
    drttransport.dll           6.1.7600.16385              Distributed Routing Table Transport Provider
    drvstore.dll               6.1.7601.17514              Driver Store API
    ds16gt.dll                 3.510.3711.0                Microsoft ODBC Driver Setup Generic Thunk
    ds32gt.dll                 6.1.7600.16385              ODBC Driver Setup Generic Thunk
    dsauth.dll                 6.1.7601.17514              DS Authorization for Services
    dsdmo.dll                  6.1.7600.16385              DirectSound Effects
    dshowrdpfilter.dll         1.0.0.0                           ()
    dskquota.dll               6.1.7600.16385               DLL    Windows
    dskquoui.dll               6.1.7601.17514               DLL   
    dsound.dll                 6.1.7600.16385              DirectSound
    dsprop.dll                 6.1.7600.16385                Active Directory
    dsquery.dll                6.1.7600.16385                 
    dsrole.dll                 6.1.7600.16385              DS Role Client DLL
    dssec.dll                  6.1.7600.16385                 
    dssenh.dll                 6.1.7600.16385              Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider
    dsuiext.dll                6.1.7601.17514                 
    dswave.dll                 6.1.7600.16385              Microsoft DirectMusic Wave
    dtsh.dll                   6.1.7600.16385               API     
    dui70.dll                  6.1.7600.16385               DirectUI Windows
    duser.dll                  6.1.7600.16385              Windows DirectUser Engine
    dwmapi.dll                 6.1.7600.16385               API     ()
    dwmcore.dll                6.1.7601.17514                Microsoft DWM
    dwmredir.dll               6.1.7601.17514                    Microsoft
    dwrite.dll                 6.1.7601.17514               Microsoft DirectX Typography
    dxdiagn.dll                6.1.7601.17514                Microsoft DirectX
    dxgi.dll                   6.1.7601.17514              DirectX Graphics Infrastructure
    dxmasf.dll                 12.0.7601.17514             Microsoft Windows Media Component Removal File.
    dxp.dll                    6.1.7601.17514                 Device Stage
    dxpps.dll                  6.1.7600.16385              Device Experience Platform Proxy\Stub DLL
    dxptaskringtone.dll        6.1.7601.17514                 Microsoft
    dxptasksync.dll            6.1.7601.17514               Microsoft Windows DXP
    dxtmsft.dll                8.0.7600.16385              DirectX Media -- Image DirectX Transforms
    dxtrans.dll                8.0.7600.16385              DirectX Media -- DirectX Transform Core
    dxva2.dll                  6.1.7600.16385              DirectX Video Acceleration 2.0 DLL
    eapp3hst.dll               6.1.7601.17514              Microsoft ThirdPartyEapDispatcher
    eappcfg.dll                6.1.7600.16385                EAP
    eappgnui.dll               6.1.7601.17514                 EAP
    eapphost.dll               6.1.7601.17514                 EAPHost 
    eappprxy.dll               6.1.7600.16385              Microsoft EAPHost Peer Client DLL
    eapqec.dll                 6.1.7600.16385                   Microsoft EAP
    eapsvc.dll                 6.1.7600.16385               Microsoft EAPHost
    efsadu.dll                 6.1.7600.16385                
    efscore.dll                6.1.7601.17514              EFS Core Library
    efslsaext.dll              6.1.7600.16385              LSA extension for EFS
    efssvc.dll                 6.1.7600.16385               EFS
    efsutil.dll                6.1.7600.16385              EFS Utility Library
    ehstorapi.dll              6.1.7601.17514              Windows Enhanced Storage API
    ehstorpwdmgr.dll           6.1.7600.16385                Windows Enhanced Storage
    ehstorshell.dll            6.1.7600.16385               DLL   Windows Enhanced Storage
    els.dll                    6.1.7600.16385                
    elscore.dll                6.1.7600.16385               DLL   Els
    elslad.dll                 6.1.7600.16385              ELS Language Detection
    elstrans.dll               6.1.7601.17514              ELS Transliteration Service
    encapi.dll                 6.1.7600.16385              Encoder API
    encdec.dll                 6.6.7601.17514                XDS     .
    encdump.dll                5.0.1.1                     Media Foundation Crash Dump Encryption DLL 
    energy.dll                 6.1.7600.16385                
    eqossnap.dll               6.1.7600.16385                EQoS
    es.dll                     2001.12.8530.16385          COM+
    esent.dll                  6.1.7601.17514                  ESE  Microsoft(R) Windows(R)
    esentprf.dll               6.1.7600.16385              Extensible Storage Engine Performance Monitoring Library for Microsoft(R) Windows(R)
    eventcls.dll               6.1.7600.16385              Microsoft Volume Shadow Copy Service event class
    evr.dll                    6.1.7601.17514                DLL   
    explorerframe.dll          6.1.7601.17514              ExplorerFrame
    expsrv.dll                 6.0.72.9589                 Visual Basic for Applications Runtime - Expression Service
    f3ahvoas.dll               6.1.7600.16385              JP Japanese Keyboard Layout for Fujitsu FMV oyayubi-shift keyboard
    faultrep.dll               6.1.7601.17514                     Windows
    fdbth.dll                  6.1.7600.16385              Function Discovery Bluetooth Provider Dll
    fdbthproxy.dll             6.1.7600.16385              Bluetooth Provider Proxy Dll
    fde.dll                    6.1.7601.17514                 
    fdeploy.dll                6.1.7601.17514                  
    fdphost.dll                6.1.7600.16385                  
    fdpnp.dll                  6.1.7600.16385              Pnp Provider Dll
    fdprint.dll                6.1.7600.16385               DLL    
    fdproxy.dll                6.1.7600.16385              Function Discovery Proxy Dll
    fdrespub.dll               6.1.7600.16385                  
    fdssdp.dll                 6.1.7600.16385              Function Discovery SSDP Provider Dll
    fdwcn.dll                  6.1.7600.16385              Windows Connect Now - Config Function Discovery Provider DLL
    fdwnet.dll                 6.1.7600.16385              Function Discovery WNet Provider Dll
    fdwsd.dll                  6.1.7600.16385              Function Discovery WS Discovery Provider Dll
    feclient.dll               6.1.7600.16385              Windows NT File Encryption Client Interfaces
    ff_vfw.dll                                             
    filemgmt.dll               6.1.7600.16385                 
    findnetprinters.dll        6.1.7600.16385              Find Network Printers COM Component
    firewallapi.dll            6.1.7600.16385              API  Windows
    firewallcontrolpanel.dll   6.1.7601.17514                -  Windows
    fltlib.dll                 6.1.7600.16385               
    fm20.dll                   14.0.4747.1000              Microsoft Forms DLL
    fm20enu.dll                14.0.4747.1000              Microsoft Forms International DLL
    fmifs.dll                  6.1.7600.16385              FM IFS Utility DLL
    fms.dll                    1.1.6000.16384                
    fntcache.dll               6.1.7601.17514                 Windows
    fontext.dll                6.1.7601.17514                Windows
    fontsub.dll                6.1.7601.17514              Font Subsetting DLL
    fphc.dll                   6.1.7601.17514               Filtering Platform Helper
    framebuf.dll               6.1.7600.16385              Framebuffer Display Driver
    framedyn.dll               6.1.7601.17514              WMI SDK Provider Framework
    framedynos.dll             6.1.7601.17514              WMI SDK Provider Framework
    fthsvc.dll                 6.1.7600.16385                  Microsoft Windows
    fundisc.dll                6.1.7600.16385              DLL  
    fveapi.dll                 6.1.7601.17514              Windows BitLocker Drive Encryption API
    fveapibase.dll             6.1.7600.16385              Windows BitLocker Drive Encryption Base API
    fvecerts.dll               6.1.7600.16385              BitLocker Certificates Library
    fvecpl.dll                 6.1.7601.17514                  BitLocker
    fverecover.dll             6.1.7600.16385                   Windows BitLocker
    fveui.dll                  6.1.7600.16385                 BitLocker
    fvewiz.dll                 6.1.7600.16385                 BitLocker
    fwcfg.dll                  6.1.7600.16385                  Windows
    fwpuclnt.dll               6.1.7601.17514              API   FWP/IPsec
    fwremotesvr.dll            6.1.7600.16385              Windows Firewall Remote APIs Server
    fxsapi.dll                 6.1.7600.16385              Microsoft  Fax API Support DLL
    fxscom.dll                 6.1.7600.16385              Microsoft Fax Server COM Client Interface
    fxscomex.dll               6.1.7600.16385              Microsoft Fax Server Extended COM Client Interface
    fxscompose.dll             6.1.7600.16385              Compose Form
    fxscomposeres.dll          6.1.7600.16385               
    fxsevent.dll               6.1.7600.16385               DLL    Microsoft Fax
    fxsext32.dll               6.1.7600.16385              Microsoft  Fax Exchange Command Extension
    fxsmon.dll                 6.1.7601.17514              Microsoft  Fax Print Monitor
    fxsresm.dll                6.1.7600.16385               DLL   (Microsoft)
    fxsroute.dll               6.1.7600.16385              Microsoft  Fax Routing DLL
    fxsst.dll                  6.1.7600.16385              Fax Service
    fxst30.dll                 6.1.7600.16385              Microsoft  Fax T30 Protocol Service Provider
    fxstiff.dll                6.1.7601.17514              Microsoft  Fax TIFF library
    fxsutility.dll             6.1.7600.16385               (DLL)  
    fxsxp32.dll                6.1.7600.16385              Microsoft  Fax Transport Provider
    gacinstall.dll             6.1.7600.16385              Installers for CLR and other managed code
    gameux.dll                 6.1.7601.17514               
    gameuxlegacygdfs.dll       1.0.0.1                     Legacy GDF resource DLL
    gcdef.dll                  6.1.7600.16385                   
    gdi32.dll                  6.1.7601.17514              GDI Client DLL
    getuname.dll               6.1.7600.16385                   UCE
    glmf32.dll                 6.1.7600.16385              OpenGL Metafiling DLL
    glu32.dll                  6.1.7600.16385                OpenGL
    gpapi.dll                  6.1.7600.16385                API  
    gpedit.dll                 6.1.7600.16385              GPEdit
    gpprefcl.dll               6.1.7601.17514                 
    gpprnext.dll               6.1.7600.16385                 
    gpscript.dll               6.1.7600.16385                
    gpsvc.dll                  6.1.7601.17514                
    gptext.dll                 6.1.7600.16385              GPTExt
    groupinghc.dll             6.1.7600.16385                
    hal.dll                    6.1.7601.17514              Hardware Abstraction Layer DLL
    halacpi.dll                6.1.7601.17514              Hardware Abstraction Layer DLL
    halmacpi.dll               6.1.7601.17514              Hardware Abstraction Layer DLL
    hbaapi.dll                 6.1.7601.17514              HBA API data interface dll for HBA_API_Rev_2-18_2002MAR1.doc
    hcproviders.dll            6.1.7600.16385                
    helppaneproxy.dll          6.1.7600.16385              Microsoft Help Proxy
    hgcpl.dll                  6.1.7601.17514                 
    hgprint.dll                6.1.7601.17514              HomeGroup Printing Support
    hhsetup.dll                6.1.7600.16385              Microsoft HTML Help
    hid.dll                    6.1.7600.16385                HID
    hidserv.dll                6.1.7600.16385               HID
    hlink.dll                  6.1.7600.16385               Microsoft Office 2000
    hnetcfg.dll                6.1.7600.16385                 
    hnetmon.dll                6.1.7600.16385              DLL   
    hotplug.dll                6.1.7600.16385                 
    hotstartuseragent.dll      6.1.7601.17514                Windows HotStart (Microsoft)
    httpapi.dll                6.1.7601.17514              HTTP Protocol Stack API
    htui.dll                   6.1.7600.16385                  
    ias.dll                    6.1.7600.16385                 (NPS)
    iasacct.dll                6.1.7601.17514                NPS
    iasads.dll                 6.1.7600.16385                Active Directory NPS
    iasdatastore.dll           6.1.7600.16385              NPS Datastore server
    iashlpr.dll                6.1.7600.16385                NPS
    iasmigplugin.dll           6.1.7600.16385              NPS Migration DLL
    iasnap.dll                 6.1.7600.16385              NPS NAP Provider
    iaspolcy.dll               6.1.7600.16385              NPS Pipeline
    iasrad.dll                 6.1.7601.17514                RADIUS NPS
    iasrecst.dll               6.1.7601.17514              NPS XML Datastore Access
    iassam.dll                 6.1.7600.16385              NPS NT SAM Provider
    iassdo.dll                 6.1.7600.16385               SDO NPS
    iassvcs.dll                6.1.7600.16385                NPS
    icaapi.dll                 6.1.7601.17514              DLL Interface to TermDD Device Driver
    icardie.dll                8.0.7600.16385              Microsoft Information Card IE Helper
    icardres.dll               3.0.4506.4926               Windows CardSpace
    iccoinstall.dll            6.1.7601.17514              Hyper-V Integration Components Coinstaller
    iccvid.dll                 1.10.0.13                    Cinepak
    icfupgd.dll                6.1.7600.16385              Windows Firewal ICF Settings Upgrade
    icm32.dll                  6.1.7600.16385              Microsoft Color Management Module (CMM)
    icmp.dll                   6.1.7600.16385              ICMP DLL
    icmui.dll                  6.1.7600.16385                  
    iconcodecservice.dll       6.1.7600.16385              Converts a PNG part of the icon to a legacy bmp icon
    icsigd.dll                 6.1.7600.16385                 
    idlisten.dll               6.1.7600.16385               
    idndl.dll                  6.1.7600.16385              Downlevel DLL
    idstore.dll                6.1.7600.16385              Identity Store
    ieakeng.dll                8.0.7600.16385                  Internet Explorer
    ieaksie.dll                8.0.7600.16385                 Internet Explorer   
    ieakui.dll                 8.0.7600.16385                UI DLL Microsoft IEAK
    ieapfltr.dll               8.0.6001.18669              Microsoft SmartScreen Filter
    iedkcs32.dll               18.0.7601.17514               IEAK
    ieframe.dll                8.0.7601.17514              -
    iepeers.dll                8.0.7601.17514              Peer- Internet Explorer
    iernonce.dll               8.0.7600.16385                RunOnce   
    iertutil.dll               8.0.7601.17514              Run time utility for Internet Explorer
    iesetup.dll                8.0.7600.16385                IOD
    iesysprep.dll              8.0.7601.17514              IE Sysprep Provider
    ieui.dll                   8.0.7600.16385                 Internet Explorer
    ifmon.dll                  6.1.7600.16385                IF
    ifsutil.dll                6.1.7601.17514              IFS Utility DLL
    ifsutilx.dll               6.1.7600.16385              IFS Utility Extension DLL
    igddiag.dll                6.1.7600.16385                IGD
    ikeext.dll                 6.1.7601.17514                IKE
    imagehlp.dll               6.1.7601.17514              Windows NT Image Helper
    imageres.dll               6.1.7600.16385              Windows Image Resource
    imagesp1.dll               6.1.7600.16385              Windows SP1 Image Resource
    imapi.dll                  6.1.7600.16385               Image Mastering API
    imapi2.dll                 6.1.7601.17514              IMAPI  2
    imapi2fs.dll               6.1.7601.17514              Image Mastering File System Imaging API v2
    imgutil.dll                8.0.7601.17514              IE plugin image decoder support DLL
    imjp10k.dll                10.1.7600.16385             Microsoft IME
    imm32.dll                  6.1.7601.17514              Multi-User Windows IMM32 API Client DLL
    inetcomm.dll               6.1.7601.17514              Microsoft Internet Messaging API Resources
    inetmib1.dll               6.1.7601.17514              Microsoft MIB-II subagent
    inetpp.dll                 6.1.7601.17514               DLL Internet Print Provider
    inetppui.dll               6.1.7600.16385               DLL    
    inetres.dll                6.1.7600.16385               API  
    infocardapi.dll            3.0.4506.4926               Microsoft InfoCards
    inked.dll                  6.1.7600.16385              Microsoft Tablet PC InkEdit Control
    input.dll                  6.1.7601.17514               DLL  
    inseng.dll                 8.0.7601.17514               
    iologmsg.dll               6.1.7600.16385                /
    ipbusenum.dll              6.1.7600.16385              PnP-X IP Bus Enumerator DLL
    ipbusenumproxy.dll         6.1.7600.16385              Associated Device Presence Proxy Dll
    iphlpapi.dll               6.1.7601.17514              IP Helper API
    iphlpsvc.dll               6.1.7601.17514                   IPv6   IPv4.
    ipnathlp.dll               6.1.7600.16385                 Microsoft NAT
    iprop.dll                  6.1.7600.16385              OLE PropertySet Implementation
    iprtprio.dll               6.1.7600.16385              IP Routing Protocol Priority DLL
    iprtrmgr.dll               6.1.7601.17514               IP-
    ipsecsnp.dll               6.1.7600.16385                 IP-
    ipsecsvc.dll               6.1.7601.17514              Windows IPsec SPD Server DLL
    ipsmsnap.dll               6.1.7601.17514                IP-
    ir32_32.dll                3.24.15.3                   32-  Intel Indeo(R) Video R3.2
    ir41_qc.dll                4.30.62.2                   Intel Indeo Video Interactive Quick Compressor
    ir41_qcx.dll               4.30.62.2                   Intel Indeo Video Interactive Quick Compressor
    ir50_32.dll                5.2562.15.55                Intel Indeo video 5.10
    ir50_qc.dll                5.0.63.48                   Intel Indeo video 5.10 Quick Compressor
    ir50_qcx.dll               5.0.63.48                   Intel Indeo video 5.10 Quick Compressor
    irclass.dll                6.1.7600.16385                 
    irmon.dll                  6.1.7600.16385                
    iscsicpl.dll               5.2.3790.1830                   iSCSI
    iscsidsc.dll               6.1.7600.16385              API-  iSCSI
    iscsied.dll                6.1.7600.16385              iSCSI Extension DLL
    iscsiexe.dll               6.1.7600.16385                iSCSI
    iscsilog.dll               6.1.7600.16385               DLL   iSCSI
    iscsium.dll                6.1.7601.17514              iSCSI Discovery api
    iscsiwmi.dll               6.1.7600.16385              MS iSCSI Initiator WMI Provider
    itircl.dll                 6.1.7601.17514              Microsoft InfoTech IR Local DLL
    itss.dll                   6.1.7600.16385              Microsoft InfoTech Storage System Library
    itvdata.dll                6.6.7601.17514              iTV Data Filters.
    iyuv_32.dll                6.1.7601.17514              Intel Indeo(R) Video YUV 
    jnwmon.dll                 0.3.7600.16385                  Windows
    jscript.dll                5.8.7601.17514              Microsoft (R) JScript
    jsproxy.dll                8.0.7600.16385              JScript Proxy Auto-Configuration
    kbd101.dll                 6.1.7600.16385              JP Japanese Keyboard Layout for 101
    kbd101a.dll                6.1.7600.16385              KO Hangeul Keyboard Layout for 101 (Type A)
    kbd101b.dll                6.1.7600.16385              KO Hangeul Keyboard Layout for 101(Type B)
    kbd101c.dll                6.1.7600.16385              KO Hangeul Keyboard Layout for 101(Type C)
    kbd103.dll                 6.1.7600.16385              KO Hangeul Keyboard Layout for 103
    kbd106.dll                 6.1.7600.16385              JP Japanese Keyboard Layout for 106
    kbd106n.dll                6.1.7600.16385              JP Japanese Keyboard Layout for 106
    kbda1.dll                  6.1.7600.16385              Arabic_English_101 Keyboard Layout
    kbda2.dll                  6.1.7600.16385              Arabic_2 Keyboard Layout
    kbda3.dll                  6.1.7600.16385              Arabic_French_102 Keyboard Layout
    kbdal.dll                  6.1.7600.16385              Albania Keyboard Layout
    kbdarme.dll                6.1.7600.16385              Eastern Armenian Keyboard Layout
    kbdarmw.dll                6.1.7600.16385              Western Armenian Keyboard Layout
    kbdax2.dll                 6.1.7600.16385              JP Japanese Keyboard Layout for AX2
    kbdaze.dll                 6.1.7600.16385              Azerbaijan_Cyrillic Keyboard Layout
    kbdazel.dll                6.1.7600.16385              Azeri-Latin Keyboard Layout
    kbdbash.dll                6.1.7601.17514              Bashkir Keyboard Layout
    kbdbe.dll                  6.1.7600.16385              Belgian Keyboard Layout
    kbdbene.dll                6.1.7600.16385              Belgian Dutch Keyboard Layout
    kbdbgph.dll                6.1.7600.16385              Bulgarian Phonetic Keyboard Layout
    kbdbgph1.dll               6.1.7600.16385              Bulgarian (Phonetic Traditional) Keyboard Layout
    kbdbhc.dll                 6.1.7600.16385              Bosnian (Cyrillic) Keyboard Layout
    kbdblr.dll                 6.1.7601.17514              Belarusian Keyboard Layout
    kbdbr.dll                  6.1.7600.16385              Brazilian Keyboard Layout
    kbdbu.dll                  6.1.7600.16385              Bulgarian (Typewriter) Keyboard Layout
    kbdbulg.dll                6.1.7601.17514              Bulgarian Keyboard Layout
    kbdca.dll                  6.1.7600.16385              Canadian Multilingual Keyboard Layout
    kbdcan.dll                 6.1.7600.16385              Canadian Multilingual Standard Keyboard Layout
    kbdcr.dll                  6.1.7600.16385              Croatian/Slovenian Keyboard Layout
    kbdcz.dll                  6.1.7600.16385              Czech Keyboard Layout
    kbdcz1.dll                 6.1.7601.17514              Czech_101 Keyboard Layout
    kbdcz2.dll                 6.1.7600.16385              Czech_Programmer's Keyboard Layout
    kbdda.dll                  6.1.7600.16385              Danish Keyboard Layout
    kbddiv1.dll                6.1.7600.16385              Divehi Phonetic Keyboard Layout
    kbddiv2.dll                6.1.7600.16385              Divehi Typewriter Keyboard Layout
    kbddv.dll                  6.1.7600.16385              Dvorak US English Keyboard Layout
    kbdes.dll                  6.1.7600.16385              Spanish Alernate Keyboard Layout
    kbdest.dll                 6.1.7600.16385              Estonia Keyboard Layout
    kbdfa.dll                  6.1.7600.16385              Persian Keyboard Layout
    kbdfc.dll                  6.1.7600.16385              Canadian French Keyboard Layout
    kbdfi.dll                  6.1.7600.16385              Finnish Keyboard Layout
    kbdfi1.dll                 6.1.7600.16385              Finnish-Swedish with Sami Keyboard Layout
    kbdfo.dll                  6.1.7600.16385              F?roese Keyboard Layout
    kbdfr.dll                  6.1.7600.16385              French Keyboard Layout
    kbdgae.dll                 6.1.7600.16385              Gaelic Keyboard Layout
    kbdgeo.dll                 6.1.7601.17514              Georgian Keyboard Layout
    kbdgeoer.dll               6.1.7600.16385              Georgian (Ergonomic) Keyboard Layout
    kbdgeoqw.dll               6.1.7600.16385              Georgian (QWERTY) Keyboard Layout
    kbdgkl.dll                 6.1.7601.17514              Greek_Latin Keyboard Layout
    kbdgr.dll                  6.1.7600.16385              German Keyboard Layout
    kbdgr1.dll                 6.1.7601.17514              German_IBM Keyboard Layout
    kbdgrlnd.dll               6.1.7600.16385              Greenlandic Keyboard Layout
    kbdhau.dll                 6.1.7600.16385              Hausa Keyboard Layout
    kbdhe.dll                  6.1.7600.16385              Greek Keyboard Layout
    kbdhe220.dll               6.1.7600.16385              Greek IBM 220 Keyboard Layout
    kbdhe319.dll               6.1.7600.16385              Greek IBM 319 Keyboard Layout
    kbdheb.dll                 6.1.7600.16385              KBDHEB Keyboard Layout
    kbdhela2.dll               6.1.7600.16385              Greek IBM 220 Latin Keyboard Layout
    kbdhela3.dll               6.1.7600.16385              Greek IBM 319 Latin Keyboard Layout
    kbdhept.dll                6.1.7600.16385              Greek_Polytonic Keyboard Layout
    kbdhu.dll                  6.1.7600.16385              Hungarian Keyboard Layout
    kbdhu1.dll                 6.1.7600.16385              Hungarian 101-key Keyboard Layout
    kbdibm02.dll               6.1.7600.16385              JP Japanese Keyboard Layout for IBM 5576-002/003
    kbdibo.dll                 6.1.7600.16385              Igbo Keyboard Layout
    kbdic.dll                  6.1.7600.16385              Icelandic Keyboard Layout
    kbdinasa.dll               6.1.7600.16385              Assamese (Inscript) Keyboard Layout
    kbdinbe1.dll               6.1.7600.16385              Bengali - Inscript (Legacy) Keyboard Layout
    kbdinbe2.dll               6.1.7600.16385              Bengali (Inscript) Keyboard Layout
    kbdinben.dll               6.1.7601.17514              Bengali Keyboard Layout
    kbdindev.dll               6.1.7600.16385              Devanagari Keyboard Layout
    kbdinguj.dll               6.1.7600.16385              Gujarati Keyboard Layout
    kbdinhin.dll               6.1.7601.17514              Hindi Keyboard Layout
    kbdinkan.dll               6.1.7601.17514              Kannada Keyboard Layout
    kbdinmal.dll               6.1.7600.16385              Malayalam Keyboard Layout Keyboard Layout
    kbdinmar.dll               6.1.7601.17514              Marathi Keyboard Layout
    kbdinori.dll               6.1.7601.17514              Oriya Keyboard Layout
    kbdinpun.dll               6.1.7600.16385              Punjabi/Gurmukhi Keyboard Layout
    kbdintam.dll               6.1.7601.17514              Tamil Keyboard Layout
    kbdintel.dll               6.1.7601.17514              Telugu Keyboard Layout
    kbdinuk2.dll               6.1.7600.16385              Inuktitut Naqittaut Keyboard Layout
    kbdir.dll                  6.1.7600.16385              Irish Keyboard Layout
    kbdit.dll                  6.1.7600.16385              Italian Keyboard Layout
    kbdit142.dll               6.1.7600.16385              Italian 142 Keyboard Layout
    kbdiulat.dll               6.1.7600.16385              Inuktitut Latin Keyboard Layout
    kbdjpn.dll                 6.1.7600.16385              JP Japanese Keyboard Layout Stub driver
    kbdkaz.dll                 6.1.7600.16385              Kazak_Cyrillic Keyboard Layout
    kbdkhmr.dll                6.1.7600.16385              Cambodian Standard Keyboard Layout
    kbdkor.dll                 6.1.7600.16385              KO Hangeul Keyboard Layout Stub driver
    kbdkyr.dll                 6.1.7600.16385              Kyrgyz Keyboard Layout
    kbdla.dll                  6.1.7600.16385              Latin-American Spanish Keyboard Layout
    kbdlao.dll                 6.1.7600.16385              Lao Standard Keyboard Layout
    kbdlk41a.dll               6.1.7601.17514              DEC LK411-AJ Keyboard Layout
    kbdlt.dll                  6.1.7600.16385              Lithuania Keyboard Layout
    kbdlt1.dll                 6.1.7601.17514              Lithuanian Keyboard Layout
    kbdlt2.dll                 6.1.7600.16385              Lithuanian Standard Keyboard Layout
    kbdlv.dll                  6.1.7600.16385              Latvia Keyboard Layout
    kbdlv1.dll                 6.1.7600.16385              Latvia-QWERTY Keyboard Layout
    kbdmac.dll                 6.1.7600.16385              Macedonian (FYROM) Keyboard Layout
    kbdmacst.dll               6.1.7600.16385              Macedonian (FYROM) - Standard Keyboard Layout
    kbdmaori.dll               6.1.7601.17514              Maori Keyboard Layout
    kbdmlt47.dll               6.1.7600.16385              Maltese 47-key Keyboard Layout
    kbdmlt48.dll               6.1.7600.16385              Maltese 48-key Keyboard Layout
    kbdmon.dll                 6.1.7601.17514              Mongolian Keyboard Layout
    kbdmonmo.dll               6.1.7600.16385              Mongolian (Mongolian Script) Keyboard Layout
    kbdne.dll                  6.1.7600.16385              Dutch Keyboard Layout
    kbdnec.dll                 6.1.7600.16385              JP Japanese Keyboard Layout for (NEC PC-9800)
    kbdnec95.dll               6.1.7600.16385              JP Japanese Keyboard Layout for (NEC PC-9800 Windows 95)
    kbdnecat.dll               6.1.7600.16385              JP Japanese Keyboard Layout for (NEC PC-9800 on PC98-NX)
    kbdnecnt.dll               6.1.7600.16385              JP Japanese NEC PC-9800 Keyboard Layout
    kbdnepr.dll                6.1.7601.17514              Nepali Keyboard Layout
    kbdno.dll                  6.1.7600.16385              Norwegian Keyboard Layout
    kbdno1.dll                 6.1.7600.16385              Norwegian with Sami Keyboard Layout
    kbdnso.dll                 6.1.7600.16385              Sesotho sa Leboa Keyboard Layout
    kbdpash.dll                6.1.7600.16385              Pashto (Afghanistan) Keyboard Layout
    kbdpl.dll                  6.1.7600.16385              Polish Keyboard Layout
    kbdpl1.dll                 6.1.7600.16385              Polish Programmer's Keyboard Layout
    kbdpo.dll                  6.1.7601.17514              Portuguese Keyboard Layout
    kbdro.dll                  6.1.7600.16385              Romanian (Legacy) Keyboard Layout
    kbdropr.dll                6.1.7600.16385              Romanian (Programmers) Keyboard Layout
    kbdrost.dll                6.1.7600.16385              Romanian (Standard) Keyboard Layout
    kbdru.dll                  6.1.7600.16385              Russian Keyboard Layout
    kbdru1.dll                 6.1.7600.16385              Russia(Typewriter) Keyboard Layout
    kbdsf.dll                  6.1.7601.17514              Swiss French Keyboard Layout
    kbdsg.dll                  6.1.7601.17514              Swiss German Keyboard Layout
    kbdsl.dll                  6.1.7600.16385              Slovak Keyboard Layout
    kbdsl1.dll                 6.1.7600.16385              Slovak(QWERTY) Keyboard Layout
    kbdsmsfi.dll               6.1.7600.16385              Sami Extended Finland-Sweden Keyboard Layout
    kbdsmsno.dll               6.1.7600.16385              Sami Extended Norway Keyboard Layout
    kbdsn1.dll                 6.1.7600.16385              Sinhala Keyboard Layout
    kbdsorex.dll               6.1.7600.16385              Sorbian Extended Keyboard Layout
    kbdsors1.dll               6.1.7600.16385              Sorbian Standard Keyboard Layout
    kbdsorst.dll               6.1.7600.16385              Sorbian Standard (Legacy) Keyboard Layout
    kbdsp.dll                  6.1.7600.16385              Spanish Keyboard Layout
    kbdsw.dll                  6.1.7600.16385              Swedish Keyboard Layout
    kbdsw09.dll                6.1.7600.16385              Sinhala - Wij 9 Keyboard Layout
    kbdsyr1.dll                6.1.7600.16385              Syriac Standard Keyboard Layout
    kbdsyr2.dll                6.1.7600.16385              Syriac Phoenetic Keyboard Layout
    kbdtajik.dll               6.1.7601.17514              Tajik Keyboard Layout
    kbdtat.dll                 6.1.7600.16385              Tatar_Cyrillic Keyboard Layout
    kbdth0.dll                 6.1.7600.16385              Thai Kedmanee Keyboard Layout
    kbdth1.dll                 6.1.7600.16385              Thai Pattachote Keyboard Layout
    kbdth2.dll                 6.1.7600.16385              Thai Kedmanee (non-ShiftLock) Keyboard Layout
    kbdth3.dll                 6.1.7600.16385              Thai Pattachote (non-ShiftLock) Keyboard Layout
    kbdtiprc.dll               6.1.7600.16385              Tibetan (PRC) Keyboard Layout
    kbdtuf.dll                 6.1.7601.17514              Turkish F Keyboard Layout
    kbdtuq.dll                 6.1.7601.17514              Turkish Q Keyboard Layout
    kbdturme.dll               6.1.7601.17514              Turkmen Keyboard Layout
    kbdughr.dll                6.1.7600.16385              Uyghur (Legacy) Keyboard Layout
    kbdughr1.dll               6.1.7601.17514              Uyghur Keyboard Layout
    kbduk.dll                  6.1.7600.16385              United Kingdom Keyboard Layout
    kbdukx.dll                 6.1.7600.16385              United Kingdom Extended Keyboard Layout
    kbdur.dll                  6.1.7600.16385              Ukrainian Keyboard Layout
    kbdur1.dll                 6.1.7600.16385              Ukrainian (Enhanced) Keyboard Layout
    kbdurdu.dll                6.1.7600.16385              Urdu Keyboard Layout
    kbdus.dll                  6.1.7601.17514              United States Keyboard Layout
    kbdusa.dll                 6.1.7600.16385              US IBM Arabic 238_L Keyboard Layout
    kbdusl.dll                 6.1.7600.16385              Dvorak Left-Hand US English Keyboard Layout
    kbdusr.dll                 6.1.7600.16385              Dvorak Right-Hand US English Keyboard Layout
    kbdusx.dll                 6.1.7600.16385              US Multinational Keyboard Layout
    kbduzb.dll                 6.1.7600.16385              Uzbek_Cyrillic Keyboard Layout
    kbdvntc.dll                6.1.7600.16385              Vietnamese Keyboard Layout
    kbdwol.dll                 6.1.7600.16385              Wolof Keyboard Layout
    kbdyak.dll                 6.1.7600.16385              Yakut - Russia Keyboard Layout
    kbdyba.dll                 6.1.7600.16385              Yoruba Keyboard Layout
    kbdycc.dll                 6.1.7600.16385              Serbian (Cyrillic) Keyboard Layout
    kbdycl.dll                 6.1.7600.16385              Serbian (Latin) Keyboard Layout
    kd1394.dll                 6.1.7600.16385              1394 Kernel Debugger
    kdcom.dll                  6.1.7600.16385              Serial Kernel Debugger
    kdusb.dll                  6.1.7600.16385              USB 2.0 Kernel Debugger
    kerberos.dll               6.1.7601.17514                Kerberos
    kernel32.dll               6.1.7601.17514                Windows NT BASE API
    kernelbase.dll             6.1.7601.17514                Windows NT BASE API
    kernelceip.dll             6.1.7600.16385                CEIP 
    keyiso.dll                 6.1.7600.16385                 CNG
    keymgr.dll                 6.1.7600.16385                  
    kmsvc.dll                  6.1.7601.17514                
    korwbrkr.dll               6.1.7600.16385              korwbrkr
    ksuser.dll                 6.1.7600.16385              User CSA Library
    ktmw32.dll                 6.1.7600.16385              Windows KTM Win32 Client DLL
    l2gpstore.dll              6.1.7600.16385              Policy Storage dll
    l2nacp.dll                 6.1.7600.16385                 Onex Windows
    l2sechc.dll                6.1.7600.16385                    2
    langcleanupsysprepaction.dll  6.1.7600.16385              Language cleanup Sysprep action
    laprxy.dll                 12.0.7600.16385             Windows Media Logagent Proxy
    licmgr10.dll               8.0.7601.17514               (DLL)    Microsoft
    linkinfo.dll               6.1.7600.16385              Windows Volume Tracking
    listsvc.dll                6.1.7601.17514                Windows
    lltdapi.dll                6.1.7600.16385              Link-Layer Topology Mapper API
    lltdres.dll                6.1.7600.16385                 
    lltdsvc.dll                6.1.7600.16385              Link-Layer Topology Mapper Service
    lmhsvc.dll                 6.1.7600.16385               DLL   TCPIP NetBios
    loadperf.dll               6.1.7600.16385                  
    localsec.dll               6.1.7601.17514               MMC "   "
    localspl.dll               6.1.7601.17514                 
    localui.dll                6.1.7600.16385                
    locationapi.dll            6.1.7600.16385              Microsoft Windows Location API
    loghours.dll               6.1.7600.16385               
    logoncli.dll               6.1.7601.17514              Net Logon Client DLL
    lpk.dll                    6.1.7600.16385              Language Pack
    lpksetupproxyserv.dll      6.1.7600.16385              COM proxy server for lpksetup.exe
    lsasrv.dll                 6.1.7601.17514               DLL  LSA
    lscshostpolicy.dll         6.1.7601.17514              Microsoft Remote Desktop Virtual Graphics Session Licensing Host Policy
    lsmproxy.dll               6.1.7601.17514              LSM interfaces proxy Dll
    luainstall.dll             6.1.7601.17514              Lua manifest install
    lz32.dll                   6.1.7600.16385              LZ Expand/Compress API DLL
    lzexpand.dll               3.10.0.103                  Windows file expansion library
    magnification.dll          6.1.7600.16385               API  ()
    mapi32.dll                 1.0.2536.0                   MAPI 1.0  Windows NT
    mapistub.dll               1.0.2536.0                   MAPI 1.0  Windows NT
    mcewmdrmndbootstrap.dll    1.3.2302.0                  Windows Media Center WMDRM-ND Receiver Bridge Bootstrap DLL
    mciavi32.dll               6.1.7601.17514               MCI Video  Windows
    mcicda.dll                 6.1.7600.16385               MCI   cdaudio
    mciqtz32.dll               6.6.7601.17514               MCI DirectShow
    mciseq.dll                 6.1.7600.16385               MCI   MIDI
    mciwave.dll                6.1.7600.16385               MCI   
    mcmde.dll                  12.0.7601.17514             MCMDE DLL
    mcsrchph.dll               1.0.0.1                     Windows Media Center Search Protocol Handler
    mctres.dll                 6.1.7600.16385                MCT
    mcupdate_authenticamd.dll  6.1.7600.16385              AMD Microcode Update Library
    mcupdate_genuineintel.dll  6.1.7601.17514              Intel Microcode Update Library
    mcx2svc.dll                6.1.7601.17514              Media Center Extender Service
    mcxdriv.dll                6.1.7600.16385                Media Center
    mdminst.dll                6.1.7600.16385               
    mediametadatahandler.dll   6.1.7601.17514              Media Metadata Handler
    memdiag.dll                6.1.7600.16385                 
    mf.dll                     12.0.7601.17514               
    mf3216.dll                 6.1.7600.16385              32-bit to 16-bit Metafile Conversion DLL
    mfaacenc.dll               6.1.7600.16385              Media Foundation AAC Encoder
    mfc100.dll                 10.0.40219.325              MFCDLL Shared Library - Retail Version
    mfc100chs.dll              10.0.40219.325              MFC Language Specific Resources
    mfc100cht.dll              10.0.40219.325              MFC Language Specific Resources
    mfc100deu.dll              10.0.40219.325              MFC Language Specific Resources
    mfc100enu.dll              10.0.40219.325              MFC Language Specific Resources
    mfc100esn.dll              10.0.40219.325              MFC Language Specific Resources
    mfc100fra.dll              10.0.40219.325              MFC Language Specific Resources
    mfc100ita.dll              10.0.40219.325              MFC Language Specific Resources
    mfc100jpn.dll              10.0.40219.325              MFC Language Specific Resources
    mfc100kor.dll              10.0.40219.325              MFC Language Specific Resources
    mfc100rus.dll              10.0.40219.325              MFC Language Specific Resources
    mfc100u.dll                10.0.40219.325              MFCDLL Shared Library - Retail Version
    mfc110.dll                 11.0.51106.1                MFCDLL Shared Library - Retail Version
    mfc110chs.dll              11.0.51106.1                MFC Language Specific Resources
    mfc110cht.dll              11.0.51106.1                MFC Language Specific Resources
    mfc110deu.dll              11.0.51106.1                MFC Language Specific Resources
    mfc110enu.dll              11.0.51106.1                MFC Language Specific Resources
    mfc110esn.dll              11.0.51106.1                MFC Language Specific Resources
    mfc110fra.dll              11.0.51106.1                MFC Language Specific Resources
    mfc110ita.dll              11.0.51106.1                MFC Language Specific Resources
    mfc110jpn.dll              11.0.51106.1                MFC Language Specific Resources
    mfc110kor.dll              11.0.51106.1                MFC Language Specific Resources
    mfc110rus.dll              11.0.51106.1                MFC Language Specific Resources
    mfc110u.dll                11.0.51106.1                MFCDLL Shared Library - Retail Version
    mfc40.dll                  4.1.0.6151                    MFCDLL -  
    mfc40u.dll                 4.1.0.6151                    MFCDLL -  
    mfc42.dll                  6.6.8063.0                    MFCDLL -  
    mfc42u.dll                 6.6.8063.0                    MFCDLL -  
    mfcm100.dll                10.0.40219.325              MFC Managed Library - Retail Version
    mfcm100u.dll               10.0.40219.325              MFC Managed Library - Retail Version
    mfcm110.dll                11.0.51106.1                MFC Managed Library - Retail Version
    mfcm110u.dll               11.0.51106.1                MFC Managed Library - Retail Version
    mfcsubs.dll                2001.12.8530.16385          COM+
    mfds.dll                   12.0.7601.17514             Media Foundation Direct Show wrapper DLL
    mfdvdec.dll                6.1.7600.16385              Media Foundation DV Decoder
    mferror.dll                12.0.7600.16385                
    mfh264enc.dll              6.1.7600.16385              Media Foundation H264 Encoder
    mfmjpegdec.dll             6.1.7600.16385              Media Foundation MJPEG Decoder
    mfplat.dll                 12.0.7600.16385             Media Foundation Platform DLL
    mfplay.dll                 12.0.7601.17514             Media Foundation Playback API DLL
    mfps.dll                   12.0.7600.16385             Media Foundation Proxy DLL
    mfreadwrite.dll            12.0.7601.17514             Media Foundation ReadWrite DLL
    mfvdsp.dll                 6.1.7600.16385              Windows Media Foundation Video DSP Components
    mfwmaaec.dll               6.1.7600.16385              Windows Media Audio AEC for Media Foundation
    mgmtapi.dll                6.1.7600.16385              Microsoft SNMP Manager API (uses WinSNMP)
    microsoft-windows-hal-events.dll  6.1.7600.16385              Microsoft-Windows-HAL-Events Resources
    microsoft-windows-kernel-power-events.dll  6.1.7600.16385              Microsoft-Windows-Kernel-Power-Events Resources
    microsoft-windows-kernel-processor-power-events.dll  6.1.7600.16385              Microsoft-Windows-Kernel-Processor-Power-Events Resources
    midimap.dll                6.1.7600.16385              Microsoft MIDI Mapper
    migisol.dll                6.1.7601.17514              Migration System Isolation Layer
    miguiresource.dll          6.1.7600.16385               MIG wini32
    mimefilt.dll               2008.0.7601.17514            MIME
    mlang.dll                  6.1.7600.16385               DLL  
    mmcbase.dll                6.1.7600.16385                DLL MMC
    mmci.dll                   6.1.7600.16385                
    mmcico.dll                 6.1.7600.16385              Media class co-installer
    mmcndmgr.dll               6.1.7601.17514                 MMC
    mmcshext.dll               6.1.7600.16385              MMC Shell Extension DLL
    mmcss.dll                  6.1.7600.16385                 
    mmdevapi.dll               6.1.7601.17514              MMDevice API
    mmres.dll                  6.1.7600.16385               
    mmsystem.dll               3.10.0.103                  System APIs for Multimedia
    modemui.dll                6.1.7600.16385                Windows
    montr_ci.dll               6.1.7600.16385                 (Microsoft)
    moricons.dll               6.1.7600.16385              Windows NT Setup Icon Resources Library
    mp3dmod.dll                6.1.7600.16385              Microsoft MP3 Decoder DMO
    mp43decd.dll               6.1.7600.16385              Windows Media MPEG-4 Video Decoder
    mp4sdecd.dll               6.1.7600.16385              Windows Media MPEG-4 S Video Decoder
    mpg4decd.dll               6.1.7600.16385              Windows Media MPEG-4 Video Decoder
    mpr.dll                    6.1.7600.16385                   
    mprapi.dll                 6.1.7601.17514              Windows NT MP Router Administration DLL
    mprddm.dll                 6.1.7601.17514                  
    mprdim.dll                 6.1.7600.16385                
    mprmsg.dll                 6.1.7600.16385               (DLL)    
    mpssvc.dll                 6.1.7601.17514                (Microsoft)
    msaatext.dll               2.0.10413.0                 Active Accessibility text support
    msac3enc.dll               6.1.7601.17514              Microsoft AC-3 Encoder
    msacm.dll                  3.50.0.9                    Microsoft Audio Compression Manager
    msacm32.dll                6.1.7600.16385                 Microsoft
    msadce.dll                 6.1.7601.17514              OLE DB Cursor Engine
    msadcer.dll                6.1.7600.16385              OLE DB Cursor Engine Resources
    msadcf.dll                 6.1.7601.17514              Remote Data Services Data Factory
    msadcfr.dll                6.1.7600.16385              Remote Data Services Data Factory Resources
    msadco.dll                 6.1.7601.17514              Remote Data Services Data Control
    msadcor.dll                6.1.7600.16385              Remote Data Services Data Control Resources
    msadcs.dll                 6.1.7601.17514              Remote Data Services ISAPI Library
    msadds.dll                 6.1.7600.16385              OLE DB Data Shape Provider
    msaddsr.dll                6.1.7600.16385               OLE DB Data Shape Provider Resources
    msader15.dll               6.1.7600.16385              ActiveX Data Objects Resources
    msado15.dll                6.1.7601.17514              ActiveX Data Objects
    msadomd.dll                6.1.7601.17514              ActiveX Data Objects (Multi-Dimensional)
    msador15.dll               6.1.7601.17514              Microsoft ActiveX Data Objects Recordset
    msadox.dll                 6.1.7601.17514              ActiveX Data Objects Extensions
    msadrh15.dll               6.1.7600.16385              ActiveX Data Objects Rowset Helper
    msafd.dll                  6.1.7600.16385              Microsoft Windows Sockets 2.0 Service Provider
    msasn1.dll                 6.1.7601.17514              ASN.1 Runtime APIs
    msaudite.dll               6.1.7600.16385                 
    mscandui.dll               6.1.7600.16385                MSCANDUI
    mscat32.dll                6.1.7600.16385              MSCAT32 Forwarder DLL
    msclmd.dll                 6.1.7601.17514              Microsoft Class Mini-driver
    mscms.dll                  6.1.7601.17514              DLL-    
    mscoree.dll                4.0.40305.0                 Microsoft .NET Runtime Execution Engine
    mscorier.dll               2.0.50727.5420               IE    Microsoft .NET
    mscories.dll               2.0.50727.5420              Microsoft .NET IE SECURITY REGISTRATION
    mscpx32r.dll               6.1.7600.16385              ODBC Code Page Translator Resources
    mscpxl32.dll               6.1.7600.16385                 ODBC
    msctf.dll                  6.1.7600.16385                MSCTF
    msctfmonitor.dll           6.1.7600.16385              MsCtfMonitor DLL
    msctfp.dll                 6.1.7600.16385              MSCTFP Server DLL
    msctfui.dll                6.1.7600.16385                MSCTFUI
    msdadc.dll                 6.1.7600.16385              OLE DB Data Conversion Stub
    msdadiag.dll               6.1.7600.16385              Built-In Diagnostics
    msdaenum.dll               6.1.7600.16385              OLE DB Root Enumerator Stub
    msdaer.dll                 6.1.7600.16385              OLE DB Error Collection Stub
    msdaora.dll                6.1.7600.16385              OLE DB Provider for Oracle
    msdaorar.dll               6.1.7600.16385              OLE DB Provider for Oracle Resources
    msdaosp.dll                6.1.7601.17514              OLE DB Simple Provider
    msdaprsr.dll               6.1.7600.16385                OLE DB Persistence Services
    msdaprst.dll               6.1.7600.16385              OLE DB Persistence Services
    msdaps.dll                 6.1.7600.16385              OLE DB Interface Proxies/Stubs
    msdarem.dll                6.1.7601.17514              OLE DB Remote Provider
    msdaremr.dll               6.1.7600.16385              OLE DB Remote Provider Resources
    msdart.dll                 6.1.7600.16385              OLE DB Runtime Routines
    msdasc.dll                 6.1.7600.16385              OLE DB Service Components Stub
    msdasql.dll                6.1.7601.17514              OLE DB Provider for ODBC Drivers
    msdasqlr.dll               6.1.7600.16385              OLE DB Provider for ODBC Drivers Resources
    msdatl3.dll                6.1.7600.16385              OLE DB Implementation Support Routines
    msdatt.dll                 6.1.7600.16385              OLE DB Temporary Table Services
    msdaurl.dll                6.1.7600.16385              OLE DB RootBinder Stub
    msdelta.dll                6.1.7600.16385              Microsoft Patch Engine
    msdfmap.dll                6.1.7601.17514              Data Factory Handler
    msdmo.dll                  6.6.7601.17514              DMO Runtime
    msdri.dll                  6.1.7601.17514              Microsoft Digital Receiver Interface Class Driver
    msdrm.dll                  6.1.7601.17514                 Windows
    msdtckrm.dll               2001.12.8530.16385          Microsoft Distributed Transaction Coordinator OLE Transactions KTM Resource Manager DLL
    msdtclog.dll               2001.12.8530.16385          Microsoft Distributed Transaction Coordinator Log Manager DLL
    msdtcprx.dll               2001.12.8530.16385          Microsoft Distributed Transaction Coordinator OLE Transactions Interface Proxy DLL
    msdtctm.dll                2001.12.8531.17514          Microsoft Distributed Transaction Coordinator Transaction Manager DLL
    msdtcuiu.dll               2001.12.8530.16385          Microsoft Distributed Transaction Coordinator Administrative DLL
    msdtcvsp1res.dll           2001.12.8530.16385               Vista SP1
    msexch40.dll               4.0.9756.0                  Microsoft Jet Exchange Isam
    msexcl40.dll               4.0.9756.0                  Microsoft Jet Excel Isam
    msfeeds.dll                8.0.7601.17514              Microsoft Feeds Manager
    msfeedsbs.dll              8.0.7601.17514                 ()
    msftedit.dll               5.41.21.2510                Rich Text Edit Control, v4.1
    mshtml.dll                 8.0.7601.17514                HTML Microsoft
    mshtmled.dll               8.0.7601.17514              Microsoft HTML Editing Component
    mshtmler.dll               8.0.7600.16385                  HTML (Microsoft)
    msi.dll                    5.0.7601.17514              Windows Installer
    msicofire.dll              6.1.7600.16385                  MSI-
    msidcrl30.dll              6.1.7600.16385              IDCRL Dynamic Link Library
    msidcrl40.dll              5.0.819.1                   IDCRL Dynamic Link Library
    msident.dll                6.1.7600.16385                (Microsoft)
    msidle.dll                 6.1.7600.16385              User Idle Monitor
    msidntld.dll               6.1.7600.16385                (Microsoft)
    msieftp.dll                6.1.7601.17514                Microsoft Internet Explorer  FTP
    msihnd.dll                 5.0.7601.17514              Windows installer
    msiltcfg.dll               5.0.7600.16385              Windows Installer Configuration API Stub
    msimg32.dll                6.1.7600.16385              GDIEXT Client DLL
    msimsg.dll                 5.0.7600.16385                 Windows
    msimtf.dll                 6.1.7600.16385              Active IMM Server DLL
    msisip.dll                 5.0.7600.16385              MSI Signature SIP Provider
    msjet40.dll                4.0.9756.0                  Microsoft Jet Engine Library
    msjetoledb40.dll           4.0.9756.0                  
    msjint40.dll               4.0.9756.0                       Microsoft Jet
    msjro.dll                  6.1.7601.17514              Jet and Replication Objects
    msjter40.dll               4.0.9756.0                  Microsoft Jet Database Engine Error DLL
    msjtes40.dll               4.0.9756.0                  Microsoft Jet Expression Service
    msls31.dll                 3.10.349.0                  Microsoft Line Services library file
    msltus40.dll               4.0.9756.0                  Microsoft Jet Lotus 1-2-3 Isam
    msmapi32.dll               14.0.4760.1000              Extended MAPI 1.0 for Windows NT
    msmmsp.dll                 6.1.7600.16385              Mount Point Manger Sysprep Utility Library
    msmpeg2adec.dll            6.1.7140.0                  Microsoft DTV-DVD Audio Decoder
    msmpeg2enc.dll             6.1.7601.17514               Microsoft MPEG-2
    msmpeg2vdec.dll            6.1.7140.0                  Microsoft DTV-DVD Video Decoder
    msncon32.dll               14.0.4760.1000              Microsoft Outlook Hotmail Connector
    msncon32.dll               14.0.6123.5001              Microsoft Outlook Hotmail Connector
    msnconr.dll                14.0.4763.1004              OLC Intl Pluggable UI
    msnetobj.dll               11.0.7601.17514             DRM ActiveX Network Object
    msobjs.dll                 6.1.7600.16385                 
    msoeacct.dll               6.1.7600.16385              Microsoft Internet Account Manager
    msoert2.dll                6.1.7600.16385              Microsoft Windows Mail RT Lib
    msorc32r.dll               6.1.7600.16385                ODBC  Oracle
    msorcl32.dll               6.1.7601.17514              ODBC Driver for Oracle
    mspatcha.dll               6.1.7600.16385              Microsoft File Patch Application API
    mspbda.dll                 6.1.7601.17514              Microsoft Protected Broadcast Digital Architecture Class Driver
    mspbdacoinst.dll           6.1.7600.16385              Microsoft Protected Broadcast Digital Architecture Class Driver CoInstaller
    mspbde40.dll               4.0.9756.0                  Microsoft Jet Paradox Isam
    msports.dll                6.1.7600.16385                 
    msprivs.dll                6.1.7600.16385                
    msrahc.dll                 6.1.7600.16385                 
    msrating.dll               8.0.7601.17514                   
    msrd2x40.dll               4.0.9756.0                  Microsoft (R) Red ISAM
    msrd3x40.dll               4.0.9756.0                  Microsoft (R) Red ISAM
    msrdc.dll                  6.1.7600.16385              Remote Differential Compression COM server
    msrdpwebaccess.dll         6.1.7600.16385              Microsoft Remote Desktop Services Web Access Control
    msrepl40.dll               4.0.9756.0                  Microsoft Replication Library
    msrle32.dll                6.1.7601.17514              Microsoft RLE Compressor
    msscntrs.dll               7.0.7600.16385              msscntrs.dll
    msscp.dll                  11.0.7601.17514             Windows Media Secure Content Provider
    mssha.dll                  6.1.7600.16385                  Windows
    msshavmsg.dll              6.1.7600.16385                     Windows
    msshooks.dll               7.0.7600.16385              MSSHooks.dll
    mssign32.dll               6.1.7600.16385               API  
    mssip32.dll                6.1.7600.16385              MSSIP32 Forwarder DLL
    mssitlb.dll                7.0.7600.16385              mssitlb
    mssph.dll                  7.0.7600.16385                 Microsoft
    mssphtb.dll                7.0.7601.17514              Outlook MSSearch Connector
    mssprxy.dll                7.0.7600.16385              Microsoft Search Proxy
    mssrch.dll                 7.0.7601.17514              mssrch.dll
    mssvp.dll                  7.0.7601.17514               Vista MSSearch
    msswch.dll                 6.1.7600.16385              msswch
    mstask.dll                 6.1.7601.17514                 
    mstext40.dll               4.0.9756.0                  Microsoft Jet Text Isam
    mstime.dll                 8.0.7601.17514              Microsoft (R) Timed Interactive Multimedia Extensions to HTML
    mstscax.dll                6.1.7601.17514              ActiveX-    
    msutb.dll                  6.1.7601.17514               (DLL)  MSUTB
    msv1_0.dll                 6.1.7601.17514              Microsoft Authentication Package v1.0
    msvbvm60.dll               6.0.98.15                   Visual Basic Virtual Machine
    msvcirt.dll                7.0.7600.16385              Windows NT IOStreams DLL
    msvcp100.dll               10.0.40219.325              Microsoft C Runtime Library
    msvcp110.dll               11.0.51106.1                Microsoft C Runtime Library
    msvcp60.dll                7.0.7600.16385              Windows NT C++ Runtime Library DLL
    msvcp71.dll                7.10.3077.0                 Microsoft C++ Runtime Library
    msvcr100.dll               10.0.40219.325              Microsoft C Runtime Library
    msvcr100_clr0400.dll       10.0.30319.1                Microsoft C Runtime Library
    msvcr110.dll               11.0.51106.1                Microsoft C Runtime Library
    msvcr71.dll                7.10.3052.4                 Microsoft C Runtime Library
    msvcrt.dll                 7.0.7600.16385              Windows NT CRT DLL
    msvcrt20.dll               2.12.0.0                    Microsoft C Runtime Library
    msvcrt40.dll               6.1.7600.16385              VC 4.x CRT DLL (Forwarded to msvcrt.dll)
    msvfw32.dll                6.1.7601.17514               Microsoft Video  Windows
    msvidc32.dll               6.1.7601.17514                Microsoft Video 1
    msvidctl.dll               6.5.7601.17514               ActiveX  
    msvideo.dll                1.15.0.1                    Microsoft Video for Windows DLL
    mswdat10.dll               4.0.9756.0                  Microsoft Jet Sort Tables
    mswmdm.dll                 12.0.7600.16385               Windows Media Device Manager
    mswsock.dll                6.1.7601.17514                 API Microsoft Windows Sockets 2.0
    mswstr10.dll               4.0.9756.0                    Microsoft Jet
    msxactps.dll               6.1.7600.16385              OLE DB Transaction Proxies/Stubs
    msxbde40.dll               4.0.9756.0                  Microsoft Jet xBASE Isam
    msxml3.dll                 8.110.7601.17514            MSXML 3.0 SP11
    msxml3r.dll                8.110.7600.16385            XML Resources
    msxml6.dll                 6.30.7601.17514             MSXML 6.0 SP3
    msxml6r.dll                6.30.7600.16385             XML Resources
    msyuv.dll                  6.1.7601.17514              Microsoft UYVY Video Decompressor
    mtxclu.dll                 2001.12.8531.17514          Microsoft Distributed Transaction Coordinator Failover Clustering Support DLL
    mtxdm.dll                  2001.12.8530.16385          COM+
    mtxex.dll                  2001.12.8530.16385          COM+
    mtxlegih.dll               2001.12.8530.16385          COM+
    mtxoci.dll                 2001.12.8530.16385          Microsoft Distributed Transaction Coordinator Database Support DLL for Oracle
    muifontsetup.dll           6.1.7601.17514              MUI Callback for font registry settings
    muilanguagecleanup.dll     6.1.7600.16385              MUI Callback for Language pack cleanup
    mycomput.dll               6.1.7600.16385               
    mydocs.dll                 6.1.7601.17514                 " "
    napcrypt.dll               6.1.7601.17514              NAP Cryptographic API helper
    napdsnap.dll               6.1.7601.17514               GPEdit    
    naphlpr.dll                6.1.7601.17514              NAP client config API helper
    napinsp.dll                6.1.7600.16385                    
    napipsec.dll               6.1.7600.16385                      IPSec
    napmontr.dll               6.1.7600.16385                NAP  Netsh
    nativehooks.dll            6.1.7600.16385              Microsoft Narrator Native hook handler
    naturallanguage6.dll       6.1.7601.17514              Natural Language Development Platform 6
    ncdprop.dll                6.1.7600.16385                 
    nci.dll                    6.1.7601.17514              CoInstaller: NET
    ncobjapi.dll               6.1.7600.16385              Microsoft Windows Operating System
    ncrypt.dll                 6.1.7600.16385                (Windows)
    ncryptui.dll               6.1.7601.17514               UI     Windows
    ncsi.dll                   6.1.7601.17514                 
    nddeapi.dll                6.1.7600.16385              Network DDE Share Management APIs
    ndfapi.dll                 6.1.7600.16385              API    
    ndfetw.dll                 6.1.7600.16385              Network Diagnostic Engine Event Interface
    ndfhcdiscovery.dll         6.1.7600.16385              Network Diagnostic Framework HC Discovery API
    ndiscapcfg.dll             6.1.7600.16385              NdisCap Notify Object
    ndishc.dll                 6.1.7600.16385                NDIS
    ndproxystub.dll            6.1.7600.16385              Network Diagnostic Engine Proxy/Stub
    negoexts.dll               6.1.7600.16385              NegoExtender Security Package
    netapi.dll                 3.11.0.300                  Microsoft Network Dynamic Link Library for Microsoft Windows
    netapi32.dll               6.1.7601.17514              Net Win32 API DLL
    netbios.dll                6.1.7600.16385              NetBIOS Interface Library
    netcenter.dll              6.1.7601.17514                 -  
    netcfgx.dll                6.1.7601.17514                
    netcorehc.dll              6.1.7600.16385                   
    netdiagfx.dll              6.1.7601.17514                
    netevent.dll               6.1.7600.16385                
    netfxperf.dll              4.0.40305.0                 Extensible Performance Counter Shim
    neth.dll                   6.1.7600.16385                 
    netid.dll                  6.1.7601.17514                  
    netiohlp.dll               6.1.7601.17514               DLL   Netio
    netjoin.dll                6.1.7601.17514              Domain Join DLL
    netlogon.dll               6.1.7601.17514                 Net Logon
    netman.dll                 6.1.7600.16385                
    netmsg.dll                 6.1.7600.16385                
    netplwiz.dll               6.1.7601.17514                   
    netprof.dll                6.1.7600.16385                 
    netprofm.dll               6.1.7600.16385                
    netprojw.dll               6.1.7600.16385                 
    netshell.dll               6.1.7601.17514                
    nettrace.dll               6.1.7600.16385                 
    netutils.dll               6.1.7601.17514              Net Win32 API Helpers DLL
    networkexplorer.dll        6.1.7601.17514               
    networkitemfactory.dll     6.1.7600.16385                
    networkmap.dll             6.1.7601.17514               
    newdev.dll                 6.0.5054.0                    
    nlaapi.dll                 6.1.7601.17514              Network Location Awareness 2
    nlahc.dll                  6.1.7600.16385                NLA
    nlasvc.dll                 6.1.7601.17514                   2
    nlhtml.dll                 2008.0.7600.16385            HTML
    nlmgp.dll                  6.1.7600.16385                 
    nlmsprep.dll               6.1.7600.16385              Network List Manager Sysprep Module
    nlsbres.dll                6.1.7601.17514              NLSBuild resource DLL
    nlsdata0000.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0001.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0002.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0003.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0007.dll            6.1.7600.16385              Microsoft German Natural Language Server Data and Code
    nlsdata0009.dll            6.1.7600.16385              Microsoft English Natural Language Server Data and Code
    nlsdata000a.dll            6.1.7600.16385              Microsoft Spanish Natural Language Server Data and Code
    nlsdata000c.dll            6.1.7600.16385              Microsoft French Natural Language Server Data and Code
    nlsdata000d.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata000f.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0010.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0011.dll            6.1.7600.16385              Microsoft Japanese Natural Language Server Data and Code
    nlsdata0013.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0018.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0019.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata001a.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata001b.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata001d.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0020.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0021.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0022.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0024.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0026.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0027.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata002a.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0039.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata003e.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0045.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0046.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0047.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0049.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata004a.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata004b.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata004c.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata004e.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0414.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0416.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0816.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata081a.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdata0c1a.dll            6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsdl.dll                  6.1.7600.16385              Nls Downlevel DLL
    nlslexicons0001.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0002.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0003.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0007.dll        6.1.7600.16385              Microsoft German Natural Language Server Data and Code
    nlslexicons0009.dll        6.1.7600.16385              Microsoft English Natural Language Server Data and Code
    nlslexicons000a.dll        6.1.7600.16385              Microsoft Spanish Natural Language Server Data and Code
    nlslexicons000c.dll        6.1.7600.16385              Microsoft French Natural Language Server Data and Code
    nlslexicons000d.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons000f.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0010.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0011.dll        6.1.7600.16385              Microsoft Japanese Natural Language Server Data and Code
    nlslexicons0013.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0018.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0019.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons001a.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons001b.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons001d.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0020.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0021.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0022.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0024.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0026.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0027.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons002a.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0039.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons003e.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0045.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0046.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0047.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0049.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons004a.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons004b.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons004c.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons004e.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0414.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0416.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0816.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons081a.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlslexicons0c1a.dll        6.1.7600.16385              Microsoft Neutral Natural Language Server Data and Code
    nlsmodels0011.dll          6.1.7600.16385              Microsoft Japanese Natural Language Server Data and Code
    normaliz.dll               6.1.7600.16385              Unicode Normalization DLL
    npmproxy.dll               6.1.7600.16385              Network List Manager Proxy
    nrpsrv.dll                 6.1.7601.17514              Name Resolution Proxy (NRP) RPC interface
    nshhttp.dll                6.1.7600.16385               DLL netsh  HTTP
    nshipsec.dll               6.1.7601.17514               DLL  IPSec  Net
    nshwfp.dll                 6.1.7601.17514                  Windows  Netsh
    nsi.dll                    6.1.7600.16385              NSI User-mode interface DLL
    nsisvc.dll                 6.1.7600.16385              RPC-   
    ntdll.dll                  6.1.7601.17514                NT
    ntdsapi.dll                6.1.7600.16385              Active Directory Domain Services API
    ntlanman.dll               6.1.7601.17514              Microsoft LAN Manager
    ntlanui2.dll               6.1.7600.16385                  
    ntmarta.dll                6.1.7600.16385               Windows NT MARTA
    ntprint.dll                6.1.7601.17514                  
    ntshrui.dll                6.1.7601.17514               ,    
    ntvdmd.dll                 6.1.7600.16385              NTVDMD.DLL
    nvapi.dll                  9.18.13.4192                NVIDIA NVAPI Library, Version 341.92 
    nvaudcap32v.dll            1.2.27.0                    NVIDIA Virtual Audio Driver
    nvcompiler.dll             8.17.13.4192                NVIDIA Compiler, Version 341.92 
    nvcpl.dll                  8.17.13.4192                NVIDIA Display Properties Extension
    nvcuda.dll                 8.17.13.4192                NVIDIA CUDA Driver, Version 341.92 
    nvcuvid.dll                7.17.13.4192                NVIDIA CUDA Video Decode API, Version 341.92 
    nvd3dum.dll                9.18.13.4192                NVIDIA WDDM D3D Driver, Version 341.92 
    nvdispco3234192.dll        2.0.41.4                    Display Driver Coinstaller
    nvdispgenco3234192.dll     2.0.20.2                    Generic Coinstaller
    nvfbc.dll                  6.14.13.4192                NVIDIA Front Buffer Capture Library, Version 
    nvifr.dll                  6.14.13.4192                NVIDIA In-band Frame Rendering Library, Version 
    nvmctray.dll               8.17.13.4192                NVIDIA Media Center Library
    nvoglv32.dll               9.18.13.4192                NVIDIA Compatible OpenGL ICD
    nvopencl.dll               8.17.13.4192                NVIDIA CUDA 6.5.51 OpenCL 1.1 Driver, Version 341.92 
    nvshext.dll                1.2.0.1                     NVIDIA Display Shell Extension
    nvspbridge.dll             17.12.8.0                   NVIDIA GFE - Notification Bridge
    nvspcap.dll                17.12.8.0                   NVIDIA Capture Server Proxy
    nvsvc.dll                  8.17.13.4192                NVIDIA Driver Helper Service, Version 341.92
    nvsvcr.dll                 8.17.13.4192                NVIDIA Driver Helper Service, Version 341.92
    nvwgf2um.dll               9.18.13.4192                NVIDIA D3D10 Driver, Version 341.92 
    objsel.dll                 6.1.7600.16385                
    occache.dll                8.0.7601.17514                  
    ocsetapi.dll               6.1.7601.17514              Windows Optional Component Setup API
    odbc16gt.dll               3.510.3711.0                Microsoft ODBC Driver Generic Thunk
    odbc32.dll                 6.1.7601.17514              ODBC Driver Manager
    odbc32gt.dll               6.1.7600.16385              ODBC Driver Generic Thunk
    odbcbcp.dll                6.1.7600.16385              BCP for ODBC
    odbcconf.dll               6.1.7601.17514              ODBC Driver Configuration Program
    odbccp32.dll               6.1.7601.17514              ODBC Installer
    odbccr32.dll               6.1.7600.16385              ODBC Cursor Library
    odbccu32.dll               6.1.7600.16385              ODBC Cursor Library
    odbcint.dll                6.1.7600.16385              ODBC Resources
    odbcji32.dll               6.1.7600.16385              Microsoft ODBC Desktop Driver Pack 3.5
    odbcjt32.dll               6.1.7601.17514              Microsoft ODBC Desktop Driver Pack 3.5
    odbctrac.dll               6.1.7601.17514              ODBC Driver Manager Trace
    oddbse32.dll               6.1.7600.16385              ODBC (3.0) driver for DBase
    odexl32.dll                6.1.7600.16385              ODBC (3.0) driver for Excel
    odfox32.dll                6.1.7600.16385              ODBC (3.0) driver for FoxPro
    odpdx32.dll                6.1.7600.16385              ODBC (3.0) driver for Paradox
    odtext32.dll               6.1.7600.16385              ODBC (3.0) driver for text files
    offfilt.dll                2008.0.7600.16385            OFFICE
    ogldrv.dll                 6.1.7600.16385              MSOGL
    ole2.dll                   2.10.35.35                  OLE 2.1 16/32 Interoperability Library
    ole2disp.dll               2.10.3050.1                 OLE 2.1 16/32 Interoperability Library
    ole2nls.dll                2.10.3050.1                 OLE 2.1 16/32 Interoperability Library
    ole32.dll                  6.1.7601.17514              Microsoft OLE   Windows
    oleacc.dll                 7.0.0.0                     Active Accessibility Core Component
    oleacchooks.dll            7.0.0.0                     Active Accessibility Event Hooks Library
    oleaccrc.dll               7.0.0.0                     Active Accessibility Resource DLL
    oleaut32.dll               6.1.7601.17514              
    olecli.dll                 1.32.0.0                    Object Linking and Embedding Client Library
    olecli32.dll               6.1.7600.16385                OLE
    oledb32.dll                6.1.7601.17514              OLE DB Core Services
    oledb32r.dll               6.1.7600.16385                 OLE DB
    oledlg.dll                 6.1.7600.16385                 OLE
    oleprn.dll                 6.1.7600.16385              Oleprn DLL
    olepro32.dll               6.1.7601.17514              
    oleres.dll                 6.1.7600.16385                OLE
    olesvr.dll                 1.11.0.0                    Object Linking and Embedding Server Library
    olesvr32.dll               6.1.7600.16385              Object Linking and Embedding Server Library
    olethk32.dll               6.1.7601.17514              Microsoft OLE for Windows
    onex.dll                   6.1.7601.17514                IEEE 802.1X
    onexui.dll                 6.1.7601.17514                 IEEE 802.1X
    onlineidcpl.dll            6.1.7601.17514                -  
    oobefldr.dll               6.1.7601.17514                
    opcservices.dll            6.1.7601.17514              Native Code OPC Services Library
    openal32.dll               6.14.357.23                 Standard OpenAL(TM) Implementation
    opencl.dll                 1.0.0.0                     OpenCL Client DLL
    opengl32.dll               6.1.7600.16385              OpenGL Client DLL
    osbaseln.dll               6.1.7600.16385              Service Reporting API
    osuninst.dll               6.1.7600.16385              Uninstall Interface
    p2p.dll                    6.1.7600.16385                
    p2pcollab.dll              6.1.7600.16385                  
    p2pgraph.dll               6.1.7600.16385              Peer-to-Peer Graphing
    p2pnetsh.dll               6.1.7600.16385                 NetSh
    p2psvc.dll                 6.1.7600.16385               
    packager.dll               6.1.7600.16385               2
    panmap.dll                 6.1.7600.16385              PANOSE(tm) Font Mapper
    pautoenr.dll               6.1.7600.16385                
    pcadm.dll                  6.1.7600.16385              Program Compatibility Assistant Diagnostic Module
    pcaevts.dll                6.1.7600.16385                   
    pcasvc.dll                 6.1.7600.16385                  
    pcaui.dll                  6.1.7600.16385                  
    pcwum.dll                  6.1.7600.16385              Performance Counters for Windows Native DLL
    pcwutl.dll                 6.1.7600.16385                     
    pdh.dll                    6.1.7601.17514                  Windows
    pdhui.dll                  6.1.7601.17514                
    peerdist.dll               6.1.7600.16385                BranchCache
    peerdisthttptrans.dll      6.1.7600.16385              BranchCache HTTP Tansport
    peerdistsh.dll             6.1.7600.16385                BranchCache Netshell
    peerdistsvc.dll            6.1.7600.16385               BranchCache
    peerdistwsddiscoprov.dll   6.1.7600.16385              BranchCache WSD Discovery Provider
    perfcentercpl.dll          6.1.7601.17514               
    perfctrs.dll               6.1.7600.16385               
    perfdisk.dll               6.1.7600.16385                  Windows
    perfnet.dll                6.1.7600.16385                   Windows
    perfos.dll                 6.1.7600.16385                  Windows
    perfproc.dll               6.1.7600.16385                   Windows
    perftrack.dll              6.1.7600.16385              Microsoft Performance PerfTrack
    perfts.dll                 6.1.7601.17514              Windows Remote Desktop Services Performance Objects
    photometadatahandler.dll   6.1.7600.16385              Photo Metadata Handler
    photowiz.dll               6.1.7601.17514                
    pid.dll                    6.1.7600.16385              Microsoft PID
    pidgenx.dll                6.1.7600.16385              Pid Generation
    pifmgr.dll                 6.1.7601.17514              Windows NT PIF Manager Icon Resources Library
    pku2u.dll                  6.1.7600.16385              Pku2u Security Package
    pla.dll                    6.1.7601.17514                 
    playsndsrv.dll             6.1.7600.16385               PlaySound
    pmcsnap.dll                6.1.7600.16385              pmcsnap dll
    pmspl.dll                  2.10.0.1                    Microsoft LAN Manager 2.1 Network Dynamic Link Library for Microsoft Windows
    pncrt.dll                  6.0.0.0                     Real Networks C/C++ Runtime Library
    pndx5016.dll               5.0.0.0                     16 bit DirectX helper DLL
    pndx5032.dll               5.0.0.0                     32 bit DirectX helper DLL
    pngfilt.dll                8.0.7600.16385              IE PNG plugin image decoder
    pnidui.dll                 6.1.7601.17514                
    pnpsetup.dll               6.1.7600.16385              Pnp installer for CMI
    pnpts.dll                  6.1.7600.16385              PlugPlay Troubleshooter
    pnpui.dll                  5.2.3668.0                  DLL    
    pnpxassoc.dll              6.1.7600.16385              PNPX Association Dll
    pnpxassocprx.dll           6.1.7600.16385                PNPX
    pnrpauto.dll               6.1.7600.16385               DLL   PNRP
    pnrphc.dll                 6.1.7600.16385                 PNRP
    pnrpnsp.dll                6.1.7600.16385                 PNRP
    pnrpsvc.dll                6.1.7600.16385                PNRP
    polstore.dll               6.1.7600.16385              Policy Storage dll
    portabledeviceapi.dll      6.1.7601.17514               API    Windows
    portabledeviceclassextension.dll  6.1.7600.16385              Windows Portable Device Class Extension Component
    portabledeviceconnectapi.dll  6.1.7600.16385              Portable Device Connection API Components
    portabledevicestatus.dll   6.1.7601.17514                  Microsoft Windows
    portabledevicesyncprovider.dll  6.1.7601.17514                 Microsoft Windows
    portabledevicetypes.dll    6.1.7600.16385              Windows Portable Device (Parameter) Types Component
    portabledevicewiacompat.dll  6.1.7600.16385              PortableDevice WIA Compatibility Driver
    portabledevicewmdrm.dll    6.1.7600.16385              Windows Portable Device WMDRM Component
    pots.dll                   6.1.7600.16385               
    powercpl.dll               6.1.7601.17514                
    powrprof.dll               6.1.7600.16385              DLL     
    ppcsnap.dll                6.1.7600.16385              ppcsnap DLL
    presentationcffrasterizernative_v0300.dll  3.0.6920.4902               WinFX OpenType/CFF Rasterizer
    presentationhostproxy.dll  4.0.40305.0                 Windows Presentation Foundation Host Proxy
    presentationnative_v0300.dll  3.0.6920.4902               PresentationNative_v0300.dll
    prflbmsg.dll               6.1.7600.16385                  
    printfilterpipelineprxy.dll  6.1.7600.16385              Print Filter Pipeline Proxy
    printisolationproxy.dll    6.1.7601.17514              Print Sandbox COM Proxy Stub
    printui.dll                6.1.7601.17514                 
    prncache.dll               6.1.7601.17514              Print UI Cache
    prnfldr.dll                6.1.7601.17514              prnfldr dll
    prnntfy.dll                6.1.7600.16385              prnntfy DLL
    prntvpt.dll                6.1.7601.17514              Print Ticket Services Module
    procinst.dll               6.1.7600.16385                
    profapi.dll                6.1.7600.16385              User Profile Basic API
    profprov.dll               6.1.7601.17514              User Profile WMI Provider
    profsvc.dll                6.1.7601.17514              ProfSvc
    propsys.dll                7.0.7601.17514                 (Microsoft)
    provsvc.dll                6.1.7601.17514                Windows
    provthrd.dll               6.1.7600.16385              WMI Provider Thread & Log Library
    psapi.dll                  6.1.7600.16385              Process Status Helper
    psbase.dll                 6.1.7600.16385                
    pshed.dll                  6.1.7600.16385                ,   
    psisdecd.dll               6.6.7600.16385              Microsoft SI/PSI parser for MPEG2 based networks.
    pstorec.dll                6.1.7600.16385              Protected Storage COM interfaces
    pstorsvc.dll               6.1.7600.16385              Protected storage server
    pthreadgc2.dll             2.9.0.0                     POSIX Threads for Windows32 Library
    puiapi.dll                 6.1.7600.16385               DLL puiapi
    puiobj.dll                 6.1.7601.17514               DLL  PrintUI
    pwrshplugin.dll            6.1.7600.16385              pwrshplugin.dll
    qagent.dll                 6.1.7601.17514                
    qagentrt.dll               6.1.7601.17514                  
    qasf.dll                   12.0.7601.17514             DirectShow ASF Support
    qcap.dll                   6.6.7601.17514                DirecxX DirectShow.
    qcliprov.dll               6.1.7601.17514               WMI   
    qdv.dll                    6.6.7601.17514                DirecxX DirectShow.
    qdvd.dll                   6.6.7601.17514              DirectShow DVD PlayBack Runtime.
    qedit.dll                  6.6.7601.17514               DirectShow
    qedwipes.dll               6.6.7600.16385              DirectShow Editing SMPTE Wipes
    qmgr.dll                   7.5.7601.17514                 
    qmgrprxy.dll               7.5.7600.16385              Background Intelligent Transfer Service Proxy
    qshvhost.dll               6.1.7601.17514                SHV
    qsvrmgmt.dll               6.1.7601.17514                
    quartz.dll                 6.6.7601.17514                DirecxX DirectShow.
    query.dll                  6.1.7601.17514                  
    qutil.dll                  6.1.7601.17514                
    qwave.dll                  6.1.7600.16385              Windows NT
    racengn.dll                6.1.7601.17514                  
    racpldlg.dll               6.1.7600.16385                 
    radardt.dll                6.1.7600.16385                   Windows
    radarrs.dll                6.1.7600.16385                   Microsoft Windows
    rasadhlp.dll               6.1.7600.16385              Remote Access AutoDial Helper
    rasapi32.dll               6.1.7600.16385              Remote Access API
    rasauto.dll                6.1.7600.16385                   
    rascfg.dll                 6.1.7600.16385                RAS
    raschap.dll                6.1.7601.17514                 PPP CHAP
    rasctrs.dll                6.1.7600.16385                     Windows NT
    rasdiag.dll                6.1.7600.16385                  RAS
    rasdlg.dll                 6.1.7600.16385              API     
    rasgcw.dll                 6.1.7600.16385                RAS
    rasman.dll                 6.1.7600.16385              Remote Access Connection Manager
    rasmans.dll                6.1.7601.17514                 
    rasmbmgr.dll               6.1.7600.16385                 VPN -         .
    rasmm.dll                  6.1.7600.16385                RAS
    rasmontr.dll               6.1.7600.16385                RAS
    rasmxs.dll                 6.1.7600.16385              Remote Access Device DLL for modems, PADs and switches
    rasplap.dll                6.1.7600.16385                 RAS PLAP
    rasppp.dll                 6.1.7601.17514              Remote Access PPP
    rasser.dll                 6.1.7600.16385              Remote Access Media DLL for COM ports
    rastapi.dll                6.1.7601.17514              Remote Access TAPI Compliance Layer
    rastls.dll                 6.1.7601.17514                 PPP EAP-TLS
    rdpcfgex.dll               6.1.7601.17514                  ,       ,   RDP
    rdpcore.dll                6.1.7601.17514              RDP Core DLL
    rdpcorekmts.dll            6.1.7601.17514               DLL RDPCore TS (KM)
    rdpcorets.dll              6.1.7601.17514               DLL RDPCore  
    rdpd3d.dll                 6.1.7601.17514              RDP Direct3D Remoting DLL
    rdpdd.dll                  6.1.7601.17514              RDP Display Driver
    rdpencdd.dll               6.1.7601.17514              RDP Encoder Mirror Driver
    rdpencom.dll               6.1.7601.17514              RDPSRAPI COM Objects
    rdpendp.dll                6.1.7601.17514                 RDP
    rdprefdd.dll               6.1.7601.17514              Microsoft RDP Reflector Display Driver
    rdprefdrvapi.dll           6.1.7601.17514              Reflector Driver API
    rdpudd.dll                 6.1.7601.17514              UMRDP Display Driver
    rdpwsx.dll                 6.1.7601.17514              RDP Extension DLL
    reagent.dll                6.1.7601.17514               DLL   Microsoft Windows
    recovery.dll               6.1.7601.17514                
    regapi.dll                 6.1.7601.17514              Registry Configuration APIs
    regctrl.dll                6.1.7600.16385              RegCtrl
    regidle.dll                6.1.7600.16385                 RegIdle
    regsvc.dll                 6.1.7600.16385                 
    remotepg.dll               6.1.7601.17514              CPL-  
    resampledmo.dll            6.1.7600.16385              Windows Media Resampler
    resutils.dll               6.1.7601.17514              Microsoft Cluster Resource Utility DLL
    rgb9rast.dll               6.1.7600.16385              Microsoft Windows Operating System
    riched20.dll               5.31.23.1230                Rich Text Edit Control, v3.1
    riched32.dll               6.1.7601.17514              Wrapper Dll for Richedit 1.0
    rmoc3260.dll               6.0.10.72                   Real Player(tm) ActiveX Control
    rnr20.dll                  6.1.7600.16385              Windows Socket2 NameSpace DLL
    rpcdiag.dll                6.1.7600.16385              RPC Diagnostics
    rpcepmap.dll               6.1.7600.16385                 RPC

    rpchttp.dll                6.1.7601.17514              RPC HTTP DLL
    rpcndfp.dll                1.0.0.1                        RPC NDF
    rpcns4.dll                 6.1.7600.16385                    (RPC)
    rpcnsh.dll                 6.1.7600.16385                RPC Netshell
    rpcrt4.dll                 6.1.7601.17514                 
    rpcrtremote.dll            6.1.7601.17514              Remote RPC Extension
    rpcss.dll                  6.1.7601.17514              Distributed COM Services
    rsaenh.dll                 6.1.7600.16385              Microsoft Enhanced Cryptographic Provider
    rshx32.dll                 6.1.7600.16385                
    rstrtmgr.dll               6.1.7600.16385               
    rtffilt.dll                2008.0.7600.16385            RTF
    rtkapo.dll                 11.0.6000.125               Realtek(r) LFX/GFX DSP component
    rtm.dll                    6.1.7600.16385                
    rtutils.dll                6.1.7601.17514              Routing Utilities
    samcli.dll                 6.1.7601.17514              Security Accounts Manager Client DLL
    samlib.dll                 6.1.7600.16385              SAM Library DLL
    sampleres.dll              6.1.7600.16385               (Microsoft)
    samsrv.dll                 6.1.7601.17514                  
    sas.dll                    6.1.7600.16385              WinLogon Software SAS Library
    sbe.dll                    6.6.7601.17514              DirectShow Stream Buffer Filter.
    sbeio.dll                  12.0.7600.16385             Stream Buffer IO DLL
    sberes.dll                 6.6.7600.16385                  DirectShow.
    scansetting.dll            6.1.7601.17514                    Microsoft Windows(TM)
    scarddlg.dll               6.1.7600.16385              SCardDlg -   -
    scardsvr.dll               6.1.7600.16385                 -
    scavengeui.dll             6.1.7601.17514                
    sccls.dll                  6.1.7600.16385               DLL    -
    scecli.dll                 6.1.7601.17514                 
    scesrv.dll                 6.1.7601.17514                
    scext.dll                  6.1.7600.16385                DLL      minwin-
    schannel.dll               6.1.7601.17514              TLS / SSL Security Provider
    schedcli.dll               6.1.7601.17514              Scheduler Service Client DLL
    schedsvc.dll               6.1.7601.17514                
    scksp.dll                  6.1.7600.16385              Microsoft Smart Card Key Storage Provider
    scripto.dll                6.6.7600.16385              Microsoft ScriptO
    scrobj.dll                 5.8.7600.16385              Windows  Script Component Runtime
    scrptadm.dll               6.1.7601.17514                
    scrrun.dll                 5.8.7600.16385              Microsoft  Script Runtime
    sdautoplay.dll             6.1.7600.16385                  Microsoft Windows
    sdcpl.dll                  6.1.7601.17514                  
    sdengin2.dll               6.1.7601.17514                Microsoft Windows
    sdhcinst.dll               6.1.7600.16385              Secure Digital Host Controller Class Installer
    sdiageng.dll               6.1.7600.16385                 
    sdiagprv.dll               6.1.7600.16385              API    Windows
    sdiagschd.dll              6.1.7600.16385                 
    sdohlp.dll                 6.1.7600.16385                 SDO NPS
    sdrsvc.dll                 6.1.7601.17514                Microsoft Windows
    sdshext.dll                6.1.7600.16385                 Microsoft Windows
    searchfolder.dll           6.1.7601.17514              SearchFolder
    sechost.dll                6.1.7600.16385              Host for SCM/SDDL/LSA Lookup APIs
    seclogon.dll               6.1.7600.16385              DLL   
    secproc.dll                6.1.7601.17514              Windows Rights Management Desktop Security Processor
    secproc_isv.dll            6.1.7601.17514              Windows Rights Management Desktop Security Processor
    secproc_ssp.dll            6.1.7601.17514              Windows Rights Management Services Server Security Processor
    secproc_ssp_isv.dll        6.1.7601.17514              Windows Rights Management Services Server Security Processor (Pre-production)
    secur32.dll                6.1.7601.17514              Security Support Provider Interface
    security.dll               6.1.7600.16385              Security Support Provider Interface
    sendmail.dll               6.1.7600.16385               
    sens.dll                   6.1.7600.16385                   (SENS)
    sensapi.dll                6.1.7600.16385              SENS Connectivity API DLL
    sensorsapi.dll             6.1.7600.16385              Sensor API
    sensorsclassextension.dll  6.1.7600.16385              Sensor Driver Class Extension component
    sensorscpl.dll             6.1.7601.17514                "    "
    sensrsvc.dll               6.1.7600.16385                  Microsoft Windows
    serialui.dll               6.1.7600.16385                
    serwvdrv.dll               6.1.7600.16385                Unimodem
    sessenv.dll                6.1.7601.17514                   
    setbcdlocale.dll           6.1.7601.17514              MUI Callback for Bcd
    setupapi.dll               6.1.7601.17514              Windows Setup API
    setupcln.dll               6.1.7601.17514                
    setupetw.dll               6.1.7600.16385                  Windows  
    sfc.dll                    6.1.7600.16385              Windows File Protection
    sfc_os.dll                 6.1.7600.16385              Windows File Protection
    shacct.dll                 6.1.7601.17514              Shell Accounts Classes
    sharemediacpl.dll          6.1.7601.17514                    
    shdocvw.dll                6.1.7601.17514                    
    shell.dll                  3.10.0.103                  Windows Shell library
    shell32.dll                6.1.7601.17514                 Windows
    shellstyle.dll             6.1.7600.16385              Windows Shell Style Resource Dll
    shfolder.dll               6.1.7600.16385              Shell Folder Service
    shgina.dll                 6.1.7601.17514              Windows Shell User Logon
    shimeng.dll                6.1.7600.16385              Shim Engine DLL
    shimgvw.dll                6.1.7601.17514               
    shlwapi.dll                6.1.7601.17514                 
    shpafact.dll               6.1.7600.16385              Windows Shell LUA/PA Elevation Factory Dll
    shsetup.dll                6.1.7601.17514              Shell setup helper
    shsvcs.dll                 6.1.7601.17514               DLL   Windows
    shunimpl.dll               6.1.7601.17514              Windows Shell Obsolete APIs
    shwebsvc.dll               6.1.7601.17514              -  Windows
    signdrv.dll                6.1.7600.16385              WMI provider for Signed Drivers
    sisbkup.dll                6.1.7601.17514              Single-Instance Store Backup Support Functions
    slc.dll                    6.1.7600.16385              Software Licensing Client DLL
    slcext.dll                 6.1.7600.16385              Software Licensing Client Extension Dll
    slwga.dll                  6.1.7601.17514              Software Licensing WGA API
    smartcardcredentialprovider.dll  6.1.7601.17514                 - Windows
    smbhelperclass.dll         1.0.0.1                        SMB (   )    
    smiengine.dll              6.1.7601.17514              WMI Configuration Core
    sndvolsso.dll              6.1.7601.17514               SCA 
    snmpapi.dll                6.1.7600.16385              SNMP Utility Library
    sntsearch.dll              6.1.7600.16385               DLL  
    softkbd.dll                6.1.7600.16385                  
    softpub.dll                6.1.7600.16385              Softpub Forwarder DLL
    sortserver2003compat.dll   6.1.7600.16385              Sort Version Server 2003
    sortwindows6compat.dll     6.1.7600.16385              Sort Version Windows 6.0
    spbcd.dll                  6.1.7601.17514              BCD Sysprep Plugin
    spcmsg.dll                 6.1.7600.16385               Dll    
    sperror.dll                6.1.7600.16385                
    spfileq.dll                6.1.7600.16385              Windows SPFILEQ
    spinf.dll                  6.1.7600.16385              Windows SPINF
    spnet.dll                  6.1.7600.16385              Net Sysprep Plugin
    spoolss.dll                6.1.7600.16385              Spooler SubSystem DLL
    spopk.dll                  6.1.7601.17514              OPK Sysprep Plugin
    spp.dll                    6.1.7601.17514                  Microsoft Windows
    sppc.dll                   6.1.7601.17514              Software Licensing Client DLL
    sppcc.dll                  6.1.7600.16385                  
    sppcext.dll                6.1.7600.16385              Software Protection Platform Client Extension Dll
    sppcomapi.dll              6.1.7601.17514                 
    sppcommdlg.dll             6.1.7600.16385              API     
    sppinst.dll                6.1.7601.17514              SPP CMI Installer Plug-in DLL
    sppnp.dll                  6.1.7601.17514              PnP- SysPrep
    sppobjs.dll                6.1.7601.17514              Software Protection Platform Plugins
    sppuinotify.dll            6.1.7601.17514                SPP
    sppwinob.dll               6.1.7601.17514              Software Protection Platform Windows Plugin
    sppwmi.dll                 6.1.7600.16385              Software Protection Platform WMI provider
    spwinsat.dll               6.1.7600.16385              WinSAT Sysprep Plugin
    spwizeng.dll               6.1.7601.17514              Setup Wizard Framework
    spwizimg.dll               6.1.7600.16385              Setup Wizard Framework Resources
    spwizres.dll               6.1.7601.17514                 
    spwizui.dll                6.1.7601.17514               UI SPC
    spwmp.dll                  6.1.7601.17514              Windows Media Player System Preparation DLL
    sqlceoledb30.dll           3.0.7600.0                  Microsoft SQL Mobile
    sqlceqp30.dll              3.0.7600.0                  Microsoft SQL Mobile
    sqlcese30.dll              3.0.7601.0                  Microsoft SQL Mobile
    sqloledb.dll               6.1.7601.17514              OLE DB Provider for SQL Server
    sqlsrv32.dll               6.1.7601.17514              SQL Server ODBC Driver
    sqlunirl.dll               2000.80.728.0               String Function .DLL for SQL Enterprise Components
    sqlwid.dll                 1999.10.20.0                Unicode Function .DLL for SQL Enterprise Components
    sqlwoa.dll                 1999.10.20.0                Unicode/ANSI Function .DLL for SQL Enterprise Components
    sqlxmlx.dll                6.1.7600.16385              XML extensions for SQL Server
    sqmapi.dll                 6.1.7601.17514              SQM Client
    srchadmin.dll              7.0.7601.17514               
    srclient.dll               6.1.7600.16385              Microsoft Windows System Restore Client Library
    srcore.dll                 6.1.7601.17514                  Microsoft Windows
    srhelper.dll               6.1.7600.16385              Microsoft Windows driver and windows update enumeration library
    srpuxnativesnapin.dll      6.1.7600.16385                     
    srrstr.dll                 6.1.7601.17514                  Microsoft Windows
    srvcli.dll                 6.1.7601.17514              Server Service Client DLL
    srvsvc.dll                 6.1.7601.17514               (DLL)    
    srwmi.dll                  6.1.7600.16385              Microsoft Windows System Restore WMI Provider
    sscore.dll                 6.1.7601.17514               DLL-  
    ssdpapi.dll                6.1.7600.16385              SSDP Client API DLL
    ssdpsrv.dll                6.1.7600.16385               DLL  SSDP
    sspicli.dll                6.1.7601.17514              Security Support Provider Interface
    sspisrv.dll                6.1.7601.17514              LSA SSPI RPC interface DLL
    ssshim.dll                 6.1.7600.16385              Windows Componentization Platform Servicing API
    sstpsvc.dll                6.1.7600.16385                 SSTP        VPN.
    stclient.dll               2001.12.8530.16385          COM+ Configuration Catalog Client
    sti.dll                    6.1.7600.16385                   
    sti_ci.dll                 6.1.7600.16385                 
    stobject.dll               6.1.7601.17514                 Systray
    storage.dll                2.10.35.35                  OLE 2.1 16/32 Interoperability Library
    storagecontexthandler.dll  6.1.7600.16385                   
    storprop.dll               6.1.7600.16385                  
    streamci.dll               6.1.7600.16385              Streaming Device Class Installer
    structuredquery.dll        7.0.7601.17514              Structured Query
    sud.dll                    6.1.7601.17514                SUD
    swprv.dll                  6.1.7600.16385                 Microsoft Volume Shadow Copy Service
    sxproxy.dll                6.1.7600.16385                  Microsoft Windows
    sxs.dll                    6.1.7601.17514              Fusion 2.5
    sxshared.dll               6.1.7600.16385              Microsoft Windows SX Shared Library
    sxssrv.dll                 6.1.7600.16385              Windows SxS Server DLL
    sxsstore.dll               6.1.7600.16385              Sxs Store DLL
    synccenter.dll             6.1.7601.17514                
    synceng.dll                6.1.7600.16385              Windows Briefcase Engine
    synchostps.dll             6.1.7600.16385              Proxystub for sync host
    syncinfrastructure.dll     6.1.7600.16385                Microsoft Windows.
    syncinfrastructureps.dll   6.1.7600.16385              Microsoft Windows sync infrastructure proxy stub.
    syncreg.dll                2007.94.7600.16385          Microsoft Synchronization Framework Registration
    syncui.dll                 6.1.7601.17514               Windows
    sysclass.dll               6.1.7601.17514                 
    sysfxui.dll                6.1.7600.16385                   
    sysmain.dll                6.1.7601.17514                Superfetch
    sysntfy.dll                6.1.7600.16385              Windows Notifications Dynamic Link Library
    sysprepmce.dll             6.1.7600.16385              Windows Media Center SysPrep DLL
    syssetup.dll               6.1.7601.17514              Windows NT System Setup
    systemcpl.dll              6.1.7601.17514              CPL 
    t2embed.dll                6.1.7601.17514              Microsoft T2Embed Font Embedding
    tabbtn.dll                 6.1.7600.16385                  (Microsoft)
    tabbtnex.dll               6.1.7600.16385              Microsoft Tablet PC Extended Buttons Component
    tabsvc.dll                 6.1.7601.17514                  (Microsoft)
    tapi.dll                   3.10.0.103                  Microsoft Windows(TM) Telephony Server16
    tapi3.dll                  6.1.7600.16385              Microsoft TAPI3
    tapi32.dll                 6.1.7600.16385               API  Microsoft Windows
    tapilua.dll                6.1.7600.16385              Microsoft Windows(TM) Phone And Modem Lua Elevation Dll
    tapimigplugin.dll          6.1.7600.16385              Microsoft Windows(TM) TAPI Migration Plugin Dll
    tapiperf.dll               6.1.7600.16385              Microsoft Windows(TM) Telephony Performance Monitor
    tapisrv.dll                6.1.7601.17514                 Microsoft Windows
    tapisysprep.dll            6.1.7600.16385              Microsoft Windows(TM) Telephony Sysprep Work
    tapiui.dll                 6.1.7600.16385               DLL   Microsoft Windows
    taskbarcpl.dll             6.1.7601.17514                -  
    taskcomp.dll               6.1.7601.17514                  
    taskschd.dll               6.1.7601.17514              Task Scheduler COM API
    taskschdps.dll             6.1.7600.16385              Task Scheduler Interfaces Proxy
    tbs.dll                    6.1.7600.16385              TBS
    tbssvc.dll                 6.1.7600.16385               TBS
    tcpipcfg.dll               6.1.7601.17514                
    tcpmib.dll                 6.1.7600.16385              Standard TCP/IP Port Monitor Helper DLL
    tcpmon.dll                 6.1.7600.16385                 TCP/IP
    tcpmonui.dll               6.1.7600.16385                  TCP/IP
    tdh.dll                    6.1.7600.16385                 
    termmgr.dll                6.1.7601.17514              Microsoft TAPI3 Terminal Manager
    termsrv.dll                6.1.7601.17514                  ,       
    thawbrkr.dll               6.1.7600.16385              Thai Word Breaker
    themecpl.dll               6.1.7601.17514              CPL 
    themeservice.dll           6.1.7600.16385               DLL    Windows
    themeui.dll                6.1.7601.17514              API   Windows
    thumbcache.dll             6.1.7601.17514                
    timedatemuicallback.dll    6.1.7600.16385              Time Date Control UI Language Change plugin
    tlscsp.dll                 6.1.7601.17514              Microsoft Remote Desktop Services Cryptographic Utility
    toolhelp.dll               3.10.0.103                  Windows Debug/Tool helper library
    tpmcompc.dll               6.1.7600.16385                
    tquery.dll                 7.0.7601.17514              tquery.dll
    traffic.dll                6.1.7600.16385              Microsoft Traffic Control 1.0 DLL
    trapi.dll                  6.1.7601.17514              Microsoft Narrator Text Renderer
    trkwks.dll                 6.1.7600.16385                 
    tsbyuv.dll                 6.1.7601.17514              Toshiba Video Codec
    tscfgwmi.dll               6.1.7601.17514              Remote Desktop Session Host Server Configuration WMI provider
    tschannel.dll              6.1.7600.16385              Task Scheduler Proxy
    tsddd.dll                  6.1.7600.16385              Framebuffer Display Driver
    tserrredir.dll             6.1.7600.16385              Remote Desktop Services Logon Error Redirector
    tsgqec.dll                 6.1.7601.17514                      
    tsmf.dll                   6.1.7601.17514                MF    
    tspkg.dll                  6.1.7601.17514              Web Service Security Package
    tspnprdrcoinstaller.dll    6.1.7600.16385              Remote Desktop PnP Redirected Device Co-Installer
    tspubwmi.dll               6.1.7601.17514              Remote Desktop Programs WMI provider
    tssrvlic.dll               6.1.7601.17514              RD Server Licensing Policy Module
    tsusbgdcoinstaller.dll     6.1.7601.17514                 USB   
    tsusbredirectiongrouppolicyextension.dll  6.1.7601.17514                GP USB   
    tsworkspace.dll            6.1.7601.17514                      RemoteApp
    tvratings.dll              6.6.7600.16385              Module for managing TV ratings
    twext.dll                  6.1.7601.17514              :  
    txflog.dll                 2001.12.8530.16385          COM+
    txfw32.dll                 6.1.7600.16385              TxF Win32 DLL
    typelib.dll                2.10.3029.1                 OLE 2.1 16/32 Interoperability Library
    tzres.dll                  6.1.7601.17514               DLL   
    ubpm.dll                   6.1.7600.16385               DLL    
    ucmhc.dll                  6.1.7600.16385                 UCM
    udhisapi.dll               6.1.7600.16385              UPnP Device Host ISAPI Extension
    udwm.dll                   6.1.7600.16385                  
    uexfat.dll                 6.1.7600.16385              eXfat Utility DLL
    ufat.dll                   6.1.7600.16385              FAT Utility DLL
    uianimation.dll            6.1.7600.16385              Windows Animation Manager
    uiautomationcore.dll       7.0.0.0                        Microsoft UI
    uicom.dll                  6.1.7600.16385              Add/Remove Modems
    uihub.dll                  6.1.7600.16385                     (Microsoft)
    uiribbon.dll               6.1.7601.17514                Windows
    uiribbonres.dll            6.1.7601.17514              Windows Ribbon Framework Resources
    ulib.dll                   6.1.7600.16385              DLL   
    umb.dll                    6.1.7601.17514              User Mode Bus Driver Interface Dll
    umdmxfrm.dll               6.1.7600.16385              Unimodem Tranform Module
    umpnpmgr.dll               6.1.7601.17514                  (Plug-and-Play)
    umpo.dll                   6.1.7601.17514                 
    umrdp.dll                  6.1.7601.17514                    
    unattend.dll               6.1.7601.17514              Unattend Library
    unimdmat.dll               6.1.7601.17514              - AT   Unimodem
    uniplat.dll                6.1.7600.16385              Unimodem AT Mini Driver Platform Driver for Windows NT
    unrar.dll                  3.71.1.246                  RAR decompression library
    untfs.dll                  6.1.7601.17514              NTFS Utility DLL
    upnp.dll                   6.1.7601.17514              API   UPnP
    upnphost.dll               6.1.7600.16385                PNP-
    ureg.dll                   6.1.7600.16385              Registry Utility DLL
    url.dll                    8.0.7600.16385              Internet Shortcut Shell Extension DLL
    urlmon.dll                 8.0.7601.17514               OLE32  Win32
    usbceip.dll                6.1.7600.16385               USBCEIP
    usbmon.dll                 6.1.7600.16385              Standard Dynamic Printing Port Monitor DLL
    usbperf.dll                6.1.7600.16385               DLL   USB
    usbui.dll                  6.1.7600.16385              USB UI Dll
    user32.dll                 6.1.7601.17514                 USER API Windows
    useraccountcontrolsettings.dll  6.1.7601.17514                  
    usercpl.dll                6.1.7601.17514                
    userenv.dll                6.1.7601.17514              Userenv
    usp10.dll                  1.626.7601.17514            Uniscribe Unicode script processor
    utildll.dll                6.1.7601.17514                WinStation
    uudf.dll                   6.1.7600.16385              UDF Utility DLL
    uxinit.dll                 6.1.7600.16385              Windows User Experience Session Initialization Dll
    uxlib.dll                  6.1.7601.17514              Setup Wizard Framework
    uxlibres.dll               6.1.7600.16385              UXLib Resources
    uxsms.dll                  6.1.7600.16385              Microsoft User Experience Session Management Service
    uxtheme.dll                6.1.7600.16385                UxTheme (Microsoft)
    van.dll                    6.1.7601.17514                
    vault.dll                  6.1.7601.17514                -  Windows
    vaultcli.dll               6.1.7600.16385              Credential Vault Client Library
    vaultcredprovider.dll      6.1.7600.16385                 Vault
    vaultsvc.dll               6.1.7601.17514                 
    vbajet32.dll               6.0.1.9431                  Visual Basic for Applications Development Environment - Expression Service Loader
    vbame.dll                  14.0.4746.1000              Microsoft Visual Basic component
    vbscript.dll               5.8.7601.17514              Microsoft  VBScript
    vcamp110.dll               11.0.51106.1                Microsoft C++ AMP Runtime
    vccorlib110.dll            11.0.51106.1                Microsoft  VC WinRT core library
    vcomp100.dll               10.0.40219.325              Microsoft C/C++ OpenMP Runtime
    vcomp110.dll               11.0.51106.1                Microsoft C/C++ OpenMP Runtime
    vdmdbg.dll                 6.1.7600.16385              VDMDBG.DLL
    vdmredir.dll               6.1.7600.16385              Virtual Dos Machine Network Interface Library
    vds_ps.dll                 6.1.7600.16385              Microsoft Virtual Disk Service proxy/stub
    vdsbas.dll                 6.1.7601.17514                  
    vdsdyn.dll                 6.1.7600.16385                  VDS,  2.1.0.1
    vdsutil.dll                6.1.7601.17514                  
    vdsvd.dll                  6.1.7600.16385              VDS Virtual Disk Provider, Version 1.0
    ver.dll                    3.10.0.103                  Version Checking and File Installation Libraries
    verifier.dll               6.1.7600.16385              Standard application verifier provider dll
    version.dll                6.1.7600.16385              Version Checking and File Installation Libraries
    vfpodbc.dll                1.0.2.0                     vfpodbc
    vfwwdm32.dll               6.1.7601.17514               VfW MM Driver    WDM-
    vga.dll                    6.1.7600.16385              VGA 16 Colour Display Driver
    vga256.dll                 6.1.7600.16385              256 Color VGA\SVGA Display Driver
    vga64k.dll                 6.1.7600.16385              32K/64K color VGA\SVGA Display Driver
    vidreszr.dll               6.1.7600.16385              Windows Media Resizer
    virtdisk.dll               6.1.7600.16385              Virtual Disk API DLL
    vmbuscoinstaller.dll       6.1.7601.17514              Hyper-V VMBUS Coinstaller
    vmbuspipe.dll              6.1.7601.17514              VmBus User Mode Pipe DLL
    vmbusres.dll               6.1.7601.17514                 VMBus
    vmdcoinstall.dll           6.1.7601.17514              Hyper-V Integration Components Coinstaller
    vmicres.dll                6.1.7601.17514                    
    vmictimeprovider.dll       6.1.7601.17514              Virtual Machine Integration Component Time Sync Provider Library
    vmstorfltres.dll           6.1.7601.17514                   
    vpnike.dll                 6.1.7601.17514              VPNIKE Protocol Engine - Test dll
    vpnikeapi.dll              6.1.7601.17514              VPN IKE API's
    vsfilter.dll               2.39.5.2                    VobSub & TextSub filter for DirectShow/VirtualDub/Avisynth
    vss_ps.dll                 6.1.7600.16385              Microsoft Volume Shadow Copy Service proxy/stub
    vssapi.dll                 6.1.7601.17514              Microsoft Volume Shadow Copy Requestor/Writer Services API DLL
    vsstrace.dll               6.1.7600.16385                    Microsoft
    w32time.dll                6.1.7600.16385                Windows
    w32topl.dll                6.1.7600.16385              Windows NT Topology Maintenance Tool
    wab32.dll                  6.1.7600.16385              Microsoft (R) Contacts DLL
    wab32res.dll               6.1.7600.16385               Microsoft (R) DLL
    wabsyncprovider.dll        6.1.7600.16385                 Microsoft Windows
    wavdest.dll                6.1.7601.17514              Windows Sound Recorder
    wavemsp.dll                6.1.7601.17514              Microsoft Wave MSP
    wbemcomn.dll               6.1.7601.17514              WMI
    wbiosrvc.dll               6.1.7600.16385                Windows
    wcnapi.dll                 6.1.7600.16385              Windows Connect Now - API Helper DLL
    wcncsvc.dll                6.1.7601.17514                Windows -   
    wcneapauthproxy.dll        6.1.7600.16385              Windows Connect Now - WCN EAP Authenticator Proxy
    wcneappeerproxy.dll        6.1.7600.16385              Windows Connect Now - WCN EAP PEER Proxy
    wcnnetsh.dll               6.1.7600.16385               DLL    Netsh  WCN
    wcnwiz.dll                 6.1.7600.16385                Windows Connect Now
    wcspluginservice.dll       6.1.7600.16385               DLL WcsPlugInService
    wdc.dll                    6.1.7601.17514               
    wdi.dll                    6.1.7600.16385                Windows
    wdiasqmmodule.dll          6.1.7601.17514              Adaptive SQM WDI Plugin
    wdigest.dll                6.1.7600.16385              Microsoft Digest Access
    wdscore.dll                6.1.7601.17514              Panther Engine Module
    webcheck.dll               8.0.7601.17514               -
    webclnt.dll                6.1.7601.17514               DLL - DAV
    webio.dll                  6.1.7601.17514              API    
    webservices.dll            6.1.7601.17514                - Windows
    wecapi.dll                 6.1.7600.16385              Event Collector Configuration API
    wecsvc.dll                 6.1.7600.16385                
    wer.dll                    6.1.7601.17514                  Windows
    werconcpl.dll              6.1.7601.17514              PRS CPL
    wercplsupport.dll          6.1.7600.16385                   
    werdiagcontroller.dll      6.1.7600.16385              WER Diagnostic Controller
    wersvc.dll                 6.1.7600.16385                 Windows
    werui.dll                  6.1.7600.16385               DLL      Windows
    wevtapi.dll                6.1.7600.16385              API    
    wevtfwd.dll                6.1.7600.16385              WS-Management Event Forwarding Plug-in
    wevtsvc.dll                6.1.7601.17514                
    wfapigp.dll                6.1.7600.16385              Windows Firewall GPO Helper dll
    wfhc.dll                   6.1.7600.16385               Windows.   
    wfsr.dll                   6.1.7600.16385                  Windows
    whealogr.dll               6.1.7600.16385                WHEA
    whhelper.dll               6.1.7600.16385              DLL     winHttp
    wiaaut.dll                 6.1.7600.16385               WIA-
    wiadefui.dll               6.1.7601.17514                  WIA
    wiadss.dll                 6.1.7600.16385               WIA -  TWAIN
    wiarpc.dll                 6.1.7601.17514              Windows Image Acquisition RPC client DLL
    wiascanprofiles.dll        6.1.7600.16385              Microsoft Windows ScanProfiles
    wiaservc.dll               6.1.7601.17514                  
    wiashext.dll               6.1.7600.16385                     
    wiatrace.dll               6.1.7600.16385              WIA Tracing
    wiavideo.dll               6.1.7601.17514              WIA Video
    wifeman.dll                3.10.0.103                  Windows WIFE interface core component
    wimgapi.dll                6.1.7601.17514               Windows Imaging
    win32spl.dll               6.1.7601.17514                    
    win87em.dll                                            
    winbio.dll                 6.1.7600.16385              API   Windows
    winbrand.dll               6.1.7600.16385              Windows Branding Resources
    wincredprovider.dll        6.1.7600.16385               DLL wincredprovider
    windowscodecs.dll          6.1.7601.17514              Microsoft Windows Codecs Library
    windowscodecsext.dll       6.1.7600.16385              Microsoft Windows Codecs Extended Library
    winethc.dll                6.1.7600.16385                 WinInet
    winfax.dll                 6.1.7600.16385              Microsoft  Fax API Support DLL
    winhttp.dll                6.1.7601.17514               HTTP Windows
    wininet.dll                8.0.7601.17514                 Win32
    winipsec.dll               6.1.7600.16385              Windows IPsec SPD Client DLL
    winmm.dll                  6.1.7601.17514              MCI API DLL
    winnls.dll                 3.10.0.103                  Windows IME interface core component
    winnsi.dll                 6.1.7600.16385              Network Store Information RPC interface
    winrnr.dll                 6.1.7600.16385              LDAP RnR Provider DLL
    winrscmd.dll               6.1.7600.16385              remtsvc
    winrsmgr.dll               6.1.7600.16385              WSMan Shell API
    winrssrv.dll               6.1.7600.16385              winrssrv
    winsatapi.dll              6.1.7601.17514              Windows System Assessment Tool API
    winscard.dll               6.1.7601.17514              API - (Microsoft)
    winshfhc.dll               6.1.7600.16385              File Risk Estimation
    winsock.dll                3.10.0.103                  Windows Socket 16-Bit DLL
    winsockhc.dll              6.1.7600.16385                   Winsock
    winsrpc.dll                6.1.7600.16385              WINS RPC LIBRARY
    winsrv.dll                 6.1.7601.17514                 Windows
    winsta.dll                 6.1.7601.17514              Winstation Library
    winsync.dll                2007.94.7600.16385          Synchronization Framework
    winsyncmetastore.dll       2007.94.7600.16385          Windows Synchronization Metadata Store
    winsyncproviders.dll       2007.94.7600.16385          Windows Synchronization Provider Framework
    wintrust.dll               6.1.7601.17514              Microsoft Trust Verification APIs
    winusb.dll                 6.1.7600.16385              Windows USB Driver User Library
    wkscli.dll                 6.1.7601.17514              Workstation Service Client DLL
    wksprtps.dll               6.1.7600.16385              WorkspaceRuntime ProxyStub DLL
    wkssvc.dll                 6.1.7601.17514               DLL   
    wlanapi.dll                6.1.7600.16385              Windows WLAN AutoConfig Client Side API DLL
    wlancfg.dll                6.1.7600.16385               DLL    Netsh  WLAN
    wlanconn.dll               6.1.7600.16385                Dot11
    wlandlg.dll                6.1.7600.16385                   
    wlangpui.dll               6.1.7601.17514               "   "
    wlanhc.dll                 6.1.7600.16385                   
    wlanhlp.dll                6.1.7600.16385              Windows Wireless LAN 802.11 Client Side Helper API
    wlaninst.dll               6.1.7600.16385              Windows NET Device Class Co-Installer for Wireless LAN
    wlanmm.dll                 6.1.7600.16385                Dot11   
    wlanmsm.dll                6.1.7601.17514              Windows Wireless LAN 802.11 MSM DLL
    wlanpref.dll               6.1.7601.17514                
    wlansec.dll                6.1.7600.16385              Windows Wireless LAN 802.11 MSM Security Module DLL
    wlansvc.dll                6.1.7600.16385               DLL       Windows
    wlanui.dll                 6.1.7601.17514                 
    wlanutil.dll               6.1.7600.16385               DLL     Windows   802.11
    wldap32.dll                6.1.7601.17514              Win32 LDAP API DLL
    wlgpclnt.dll               6.1.7600.16385                 802.11
    wls0wndh.dll               6.1.7600.16385              Session0 Viewer Window Hook DLL
    wmadmod.dll                6.1.7601.17514              Windows Media Audio Decoder
    wmadmoe.dll                6.1.7600.16385              Windows Media Audio 10 Encoder/Transcoder
    wmalfxgfxdsp.dll           6.1.7600.16385              SysFx DSP
    wmasf.dll                  12.0.7600.16385             Windows Media ASF DLL
    wmcodecdspps.dll           6.1.7600.16385              Windows Media CodecDSP Proxy Stub Dll
    wmdmlog.dll                12.0.7600.16385             Windows Media Device Manager Logger
    wmdmps.dll                 12.0.7600.16385             Windows Media Device Manager Proxy Stub
    wmdrmdev.dll               12.0.7601.17514             Windows Media DRM for Network Devices Registration DLL
    wmdrmnet.dll               12.0.7601.17514             Windows Media DRM for Network Devices DLL
    wmdrmsdk.dll               11.0.7601.17514             Windows Media DRM SDK DLL
    wmerror.dll                12.0.7600.16385               Windows Media ()
    wmi.dll                    6.1.7600.16385              WMI DC and DP functionality
    wmicmiplugin.dll           6.1.7601.17514              WMI CMI Plugin
    wmidx.dll                  12.0.7600.16385             Windows Media Indexer DLL
    wmiprop.dll                6.1.7600.16385                  WDM
    wmnetmgr.dll               12.0.7601.17514             Windows Media Network Plugin Manager DLL
    wmp.dll                    12.0.7601.17514             Windows Media Player
    wmpcm.dll                  12.0.7600.16385             Windows Media Player Compositing Mixer
    wmpdui.dll                 12.0.7600.16385             Windows Media Player UI Engine
    wmpdxm.dll                 12.0.7601.17514             Windows Media Player Extension
    wmpeffects.dll             12.0.7601.17514             Windows Media Player Effects
    wmpencen.dll               12.0.7601.17514             Windows Media Player Encoding Module
    wmphoto.dll                6.1.7601.17514               Windows Media
    wmploc.dll                 12.0.7601.17514               Windows Media
    wmpmde.dll                 12.0.7601.17514             WMPMDE DLL
    wmpps.dll                  12.0.7601.17514             Windows Media Player Proxy Stub Dll
    wmpshell.dll               12.0.7601.17514                Windows Media
    wmpsrcwp.dll               12.0.7601.17514             WMPSrcWp Module
    wmsgapi.dll                6.1.7600.16385              WinLogon IPC Client
    wmspdmod.dll               6.1.7601.17514              Windows Media Audio Voice Decoder
    wmspdmoe.dll               6.1.7600.16385              Windows Media Audio Voice Encoder
    wmvcore.dll                12.0.7601.17514             Windows Media Playback/Authoring DLL
    wmvdecod.dll               6.1.7601.17514              Windows Media Video Decoder
    wmvdspa.dll                6.1.7600.16385              Windows Media Video DSP Components - Advanced
    wmvencod.dll               6.1.7600.16385              Windows Media Video 9 Encoder
    wmvsdecd.dll               6.1.7601.17514              Windows Media Screen Decoder
    wmvsencd.dll               6.1.7600.16385              Windows Media Screen Encoder
    wmvxencd.dll               6.1.7600.16385              Windows Media Video Encoder
    wow32.dll                  6.1.7600.16385              32-bit WOW Subsystem Library
    wpc.dll                    1.0.0.1                        
    wpcao.dll                  6.1.7600.16385                WPC
    wpccpl.dll                 6.1.7601.17514                 " "
    wpcmig.dll                 1.0.0.1                         Windows
    wpcsvc.dll                 1.0.0.1                         Windows
    wpcumi.dll                 1.0.0.1                        Windows
    wpd_ci.dll                 6.1.7601.17514                     Windows
    wpdbusenum.dll             6.1.7601.17514                
    wpdmtp.dll                 6.1.7600.16385              MTP core protocol component
    wpdmtpus.dll               6.1.7600.16385              Usbscan transport layer for MTP driver
    wpdshext.dll               6.1.7601.17514                  
    wpdshserviceobj.dll        6.1.7601.17514              Windows Portable Device Shell Service Object
    wpdsp.dll                  6.1.7601.17514              WMDM Service Provider for Windows Portable Devices
    wpdwcn.dll                 6.1.7601.17514                    WCN
    wrap_oal.dll               2.2.0.0                     OpenAL32
    ws2_32.dll                 6.1.7601.17514              32-  Windows Socket 2.0
    ws2help.dll                6.1.7600.16385              Windows Socket 2.0 Helper for Windows NT
    wscapi.dll                 6.1.7601.17514              Windows Security Center API
    wscinterop.dll             6.1.7600.16385              Windows Health Center WSC Interop
    wscisvif.dll               6.1.7600.16385              Windows Security Center ISV API
    wscmisetup.dll             6.1.7600.16385              Installers for Winsock Transport and Name Space Providers
    wscproxystub.dll           6.1.7600.16385              Windows Security Center ISV Proxy Stub
    wscsvc.dll                 6.1.7600.16385                  Windows
    wsdapi.dll                 6.1.7601.17514              -   DLL API- 
    wsdchngr.dll               6.1.7601.17514              WSD Challenge Component
    wsdmon.dll                 6.1.7600.16385                 WSD
    wsdprintproxy.dll          6.1.7600.16385              Function Discovery Printer Proxy Dll
    wsdscanproxy.dll           6.1.7600.16385              Function Discovery WSD Scanner Proxy Dll
    wsecedit.dll               6.1.7600.16385                 
    wsepno.dll                 7.0.7600.16385                     Windows Search
    wshbth.dll                 6.1.7601.17514              Windows Sockets Helper DLL
    wshcon.dll                 5.8.7600.16385              Microsoft  Windows Script Controller
    wshelper.dll               6.1.7600.16385               DLL    Winsock Net
    wshext.dll                 5.8.7600.16385              Microsoft  Shell Extension for Windows Script Host
    wship6.dll                 6.1.7600.16385               DLL  Winsock2 (TL/IPv6)
    wshirda.dll                6.1.7601.17514              Windows Sockets Helper DLL
    wshnetbs.dll               6.1.7600.16385              Netbios Windows Sockets Helper DLL
    wshqos.dll                 6.1.7600.16385               DLL   QoS Winsock2
    wshrm.dll                  6.1.7600.16385                DLL   Windows  PGM
    wshtcpip.dll               6.1.7600.16385               DLL   Winsock2 (TL/IPv4)
    wsmanmigrationplugin.dll   6.1.7600.16385              WinRM Migration Plugin
    wsmauto.dll                6.1.7600.16385              WSMAN Automation
    wsmplpxy.dll               6.1.7600.16385              wsmplpxy
    wsmres.dll                 6.1.7600.16385               DLL  WSMan
    wsmsvc.dll                 6.1.7601.17514               WSMan
    wsmwmipl.dll               6.1.7600.16385              WSMAN WMI Provider
    wsnmp32.dll                6.1.7601.17514              Microsoft WinSNMP v2.0 Manager API
    wsock32.dll                6.1.7600.16385              Windows Socket 32-Bit DLL
    wtsapi32.dll               6.1.7601.17514              Windows Remote Desktop Session Host Server SDK APIs
    wuapi.dll                  7.5.7601.17514              API    Windows
    wuaueng.dll                7.5.7601.17514                Windows
    wucltux.dll                7.5.7601.17514                   Windows
    wudfcoinstaller.dll        6.1.7601.17514              Windows Driver Foundation - User-mode Platform Device Co-Installer
    wudfplatform.dll           6.1.7601.17514              Windows Driver Foundation -    
    wudfsvc.dll                6.1.7601.17514              Windows Driver Foundation (WDF) -     
    wudfx.dll                  6.1.7601.17514              WDF:UMDF Framework Library
    wudriver.dll               7.5.7601.17514              Windows Update WUDriver Stub
    wups.dll                   7.5.7601.17514              Windows Update client proxy stub
    wups2.dll                  7.5.7601.17514              Windows Update client proxy stub 2
    wuwebv.dll                 7.5.7601.17514              Windows Update Vista Web Control
    wvc.dll                    6.1.7601.17514              Windows Visual Components
    wwanadvui.dll              8.1.2.0                         
    wwanapi.dll                6.1.7600.16385              Mbnapi
    wwancfg.dll                6.1.7600.16385                DLL  Netsh  MBN
    wwanconn.dll               8.1.7601.17514                  
    wwanhc.dll                 8.1.2.0                         
    wwaninst.dll               8.1.2.0                     Windows NET Device Class Co-Installer for Wireless WAN
    wwanmm.dll                 8.1.2.0                         
    wwanpref.dll               8.1.2.0                          
    wwanprotdim.dll            8.1.7601.17514              WWAN Device Interface Module
    wwansvc.dll                8.1.2.0                       WWAN
    wwapi.dll                  8.1.2.0                     WWAN API
    wzcdlg.dll                 6.1.7600.16385              Windows Connect Now - Flash Config Enrollee
    x3daudio1_0.dll            9.11.519.0                  X3DAudio
    x3daudio1_1.dll            9.15.779.0                  X3DAudio
    x3daudio1_2.dll            9.21.1148.0                 X3DAudio
    x3daudio1_3.dll            9.22.1284.0                 X3DAudio
    x3daudio1_4.dll            9.23.1350.0                 X3DAudio
    x3daudio1_5.dll            9.25.1476.0                 X3DAudio
    x3daudio1_6.dll            9.26.1590.0                 3D Audio Library
    x3daudio1_7.dll            9.28.1886.0                 3D Audio Library
    xactengine2_0.dll          9.11.519.0                  XACT Engine API
    xactengine2_1.dll          9.12.589.0                  XACT Engine API
    xactengine2_10.dll         9.21.1148.0                 XACT Engine API
    xactengine2_2.dll          9.13.644.0                  XACT Engine API
    xactengine2_3.dll          9.14.701.0                  XACT Engine API
    xactengine2_4.dll          9.15.779.0                  XACT Engine API
    xactengine2_5.dll          9.16.857.0                  XACT Engine API
    xactengine2_6.dll          9.17.892.0                  XACT Engine API
    xactengine2_7.dll          9.18.944.0                  XACT Engine API
    xactengine2_8.dll          9.19.1007.0                 XACT Engine API
    xactengine2_9.dll          9.20.1057.0                 XACT Engine API
    xactengine3_0.dll          9.22.1284.0                 XACT Engine API
    xactengine3_1.dll          9.23.1350.0                 XACT Engine API
    xactengine3_2.dll          9.24.1400.0                 XACT Engine API
    xactengine3_3.dll          9.25.1476.0                 XACT Engine API
    xactengine3_4.dll          9.26.1590.0                 XACT Engine API
    xactengine3_5.dll          9.27.1734.0                 XACT Engine API
    xactengine3_6.dll          9.28.1886.0                 XACT Engine API
    xactengine3_7.dll          9.29.1962.0                 XACT Engine API
    xapofx1_0.dll              9.23.1350.0                 XAPOFX
    xapofx1_1.dll              9.24.1400.0                 XAPOFX
    xapofx1_2.dll              9.25.1476.0                 XAPOFX
    xapofx1_3.dll              9.26.1590.0                 Audio Effect Library
    xapofx1_4.dll              9.28.1886.0                 Audio Effect Library
    xapofx1_5.dll              9.29.1962.0                 Audio Effect Library
    xaudio2_0.dll              9.22.1284.0                 XAudio2 Game Audio API
    xaudio2_1.dll              9.23.1350.0                 XAudio2 Game Audio API
    xaudio2_2.dll              9.24.1400.0                 XAudio2 Game Audio API
    xaudio2_3.dll              9.25.1476.0                 XAudio2 Game Audio API
    xaudio2_4.dll              9.26.1590.0                 XAudio2 Game Audio API
    xaudio2_5.dll              9.27.1734.0                 XAudio2 Game Audio API
    xaudio2_6.dll              9.28.1886.0                 XAudio2 Game Audio API
    xaudio2_7.dll              9.29.1962.0                 XAudio2 Game Audio API
    xinput1_1.dll              9.12.589.0                  Microsoft Common Controller API
    xinput1_2.dll              9.14.701.0                  Microsoft Common Controller API
    xinput1_3.dll              9.18.944.0                  Microsoft Common Controller API
    xinput9_1_0.dll            6.1.7600.16385                XNA
    xmlfilter.dll              2008.0.7600.16385            XML
    xmllite.dll                1.3.1000.0                  Microsoft XmlLite Library
    xmlprovi.dll               6.1.7600.16385              Network Provisioning Service Client API
    xmlrw.dll                  2.0.3609.0                  Microsoft XML Slim Library
    xmlrwbin.dll               2.0.3609.0                  Microsoft XML Slim Library
    xolehlp.dll                2001.12.8530.16385          Microsoft Distributed Transaction Coordinator Helper APIs DLL
    xpsfilt.dll                6.1.7600.16385              XML Paper Specification Document IFilter
    xpsgdiconverter.dll        6.1.7601.17514              XPS to GDI Converter
    xpsprint.dll               6.1.7601.17514              XPS Printing DLL
    xpsrasterservice.dll       6.1.7601.17514              XPS Rasterization Service Component
    xpsservices.dll            6.1.7601.17514              Xps Object Model in memory creation and deserialization
    xpsshhdr.dll               6.1.7600.16385              Package Document Shell Extension Handler
    xpssvcs.dll                6.1.7600.16385              Native Code Xps Services Library
    xvidcore.dll                                           
    xvidvfw.dll                                            
    xwizards.dll               6.1.7600.16385                 
    xwreg.dll                  6.1.7600.16385              Extensible Wizard Registration Manager Module
    xwtpdui.dll                6.1.7600.16385                   DUI
    xwtpw32.dll                6.1.7600.16385                   Win32
    zgmprxy.dll                6.1.7600.16385              Internal file used by the Internet Games
    zipfldr.dll                6.1.7601.17514               ZIP-


--------[   ]------------------------------------------------------------------------------------------------

     :
                         25.11.2015 15:03:42
                           26.11.2015 7:15:51
                                            26.11.2015 7:35:25
                                             1188  (0 ., 0 , 19 , 48 )

      :
                                     28.09.2015 1:27:21
                            28.09.2015 1:24:40
                                        848385  (9 ., 19 , 39 , 45 )
                                       4525798  (52 ., 9 , 9 , 58 )
                                  60956  (0 ., 16 , 55 , 56 )
                                 300930  (3 ., 11 , 35 , 30 )
                                       93
                                15.79%

      (" "):
                                              0

    :
                                                    


--------[   ]-----------------------------------------------------------------------------------------------

    ADMIN$                                    Admin                           C:\Windows
    C$                                                           C:\
    D$                                                           D:\
    E$                                                           E:\
    IPC$                            IPC            IPC                             


--------[  ]------------------------------------------------------------------------------------------------

       :
                                          
                                             vladimir
                              
                      
      ./.                      0 / 42 .
                                  0 
                                     
                                       
                                30 
                                30 


--------[    ]----------------------------------------------------------------------------------------------

    sima                                          VLADIMIR                  vladimir


--------[  ]------------------------------------------------------------------------------------------------

  [ sima ]

     :
                                         sima
                                               sima
                                               
                                     116
                                           -

     :
                         
                                     
                             
                                  
                                         
                                      
                            

  [  ]

     :
                                         
                                               
                                                 /
                                               
                                     6
                                           -

     :
                         
                                     
                             
                                  
                                         
                                      
                            

  [  ]

     :
                                         
                                               
                                                      
                                               
                                     0
                                           -

     :
                         
                                     
                             
                                  
                                         
                                      
                            


--------[   ]--------------------------------------------------------------------------------------------

  [ IIS_IUSRS ]

      :
                                              ,    IIS.

     :
      IUSR                                              

  [  ]

      :
                                               ,         

     :
      sima                                              
                                           

  [  ]

      :
                                                   ,   ,     "",     .

     :
                                                   

  [   ]

      :
                                                 .

  [   ]

      :
                                                         .

  [    ]

      :
                                                         

  [   ]

      :
                                                        

  [  DCOM ]

      :
                                                 ,     DCOM   .

  [    ]

      :
                                                     ,         ,        .

  [    ]

      :
                                                  ,       

  [     ]

      :
                                                     

  [  ]

      :
                                                         

     :
                                           
                                       

  [  ]

      :
                                                 

  [    ]

      :
                                                      


--------[   ]-------------------------------------------------------------------------------------------

  [ None ]

      :
                                             Ordinary users

     :
      sima                                              
                                           
                                                   


--------[  Windows ]-----------------------------------------------------------------------------------------------

  [ NVIDIA GeForce 9800 GTX+ ]

     :
                                      NVIDIA GeForce 9800 GTX+
                                          GeForce 9800 GTX+
       BIOS                                       Version 62.92.6d.0.0
                                      GeForce 9800 GTX+
       DAC                                           Integrated RAMDAC
                                            13.10.2015
                                          9.18.13.4192 - nVIDIA Detonator 41.92
                                       NVIDIA
                                           1024 

     :
      nvd3dum                                           9.18.13.4192 - nVIDIA Detonator 41.92
      nvwgf2um                                          9.18.13.4192
      nvwgf2um                                          9.18.13.4192

     :
                                                   NVIDIA Corporation
                                     http://www.nvidia.com/page/products.html
                                       http://www.nvidia.com/content/drivers/drivers.asp
                                     http://driveragent.com?ref=59

  [ NVIDIA GeForce 9800 GTX+ ]

     :
                                      NVIDIA GeForce 9800 GTX+
                                          GeForce 9800 GTX+
       BIOS                                       Version 62.92.6d.0.0
                                      GeForce 9800 GTX+
       DAC                                           Integrated RAMDAC
                                            13.10.2015
                                          9.18.13.4192 - nVIDIA Detonator 41.92
                                       NVIDIA
                                           1024 

     :
      nvd3dum                                           9.18.13.4192 - nVIDIA Detonator 41.92
      nvwgf2um                                          9.18.13.4192
      nvwgf2um                                          9.18.13.4192

     :
                                                   NVIDIA Corporation
                                     http://www.nvidia.com/page/products.html
                                       http://www.nvidia.com/content/drivers/drivers.asp
                                     http://driveragent.com?ref=59


--------[  PCI / AGP ]---------------------------------------------------------------------------------------------

    nVIDIA GeForce 9800 GTX+                                                          
    nVIDIA GeForce 9800 GTX+                                                          3D-


--------[   ]---------------------------------------------------------------------------------------

  [ PCI Express 2.0 x16: nVIDIA GeForce 9800 GTX+ ]

      :
                                            nVIDIA GeForce 9800 GTX+
       BIOS                                       62.92.6D.00
                                       G92GTX+
      PCI-                                    10DE-0613 / 0000-0000  (Rev A2)
                                       754 .
                                  55 nm
                                                 PCI Express 2.0 x16 @ x16
                                           1 
        (Geometric Domain)                     738   (: 740 MHz)
        (Shader Domain)                        1836   (: 1836 MHz)
       RAMDAC                                    400 
                                     16
      TMU                                     1
                                     128  (v4.0)
        DirectX                      DirectX v10
                            11808 /
                            47232 /

      :
                                                 GDDR3
                                              256 
                                         950  (DDR)  (: 950 MHz)
                                      1901 
                                   59.4 /

    :
                                     40%

    nVIDIA ForceWare Clocks:
      Standard 2D                                        : 300 , : 600 , : 100 
      Low-Power 3D                                       : 740 , : 1836 , : 950 

      :
                                                   NVIDIA Corporation
                                     http://www.nvidia.com/page/products.html
                                       http://www.nvidia.com/content/drivers/drivers.asp
                                     http://driveragent.com?ref=59

    nVIDIA GPU Registers:
      nv-000000                                         092980A2
      nv-0010F0                                         00000000
      nv-001218                                         00000000
      nv-001540                                         F30F00FF
      nv-0015F4                                         00000000
      nv-0015F8                                         00000000
      nv-0015FC                                         00000000
      nv-001600                                         00000000
      nv-001850                                         00000000
      nv-004000                                         00000000
      nv-004004                                         00000000
      nv-004008                                         8018E400
      nv-00400C                                         00002C05
      nv-004018                                         00001200
      nv-00401C                                         00001C03
      nv-004020                                         80000000
      nv-004024                                         00002202
      nv-004028                                         A0000000
      nv-00402C                                         00002906
      nv-00C040                                         2E80DBB3
      nv-00E114                                         00001046
      nv-00E118                                         00000682
      nv-00E11C                                         00000001
      nv-00E120                                         00000000
      nv-020008                                         C00836D9
      nv-020014                                         FE6C037A
      nv-020400                                         00000030
      nv-100000                                         0000C042
      nv-100200                                         01001000
      nv-10020C                                         40000000
      nv-100214                                         00002222
      nv-100474                                         00000000
      nv-100714                                         00033122
      nv-100914                                         00000000
      nv-101000                                         9F428C96

  [ nVIDIA SLI ]

    nVIDIA SLI:
       SLI                                        


--------[  ]-----------------------------------------------------------------------------------------------------

  [ Acer V173 ]

     :
                                             Acer V173
      ID                                        ACR0053
                                                  Acer V173
                                             17" LCD (SXGA)
                                              21 / 2010
                                           LE10D1208582
      .                         34 cm x 27 cm (17.1")
                                       5:4
                                            31 - 80 
                                           56 - 76 
      Maximum Pixel Clock                               140 
                                  1280 x 1024
                                                   2.20
        DPMS                        Standby, Suspend

     :
      640 x 480                                         76 
      800 x 480                                         76 
      800 x 600                                         76 
      1024 x 600                                        76 
      1024 x 768                                        76 
      1152 x 864                                        76 
      1280 x 720                                        76 
      1280 x 768                                        76 
      1280 x 800                                        76 
      1280 x 1024                                       70 

     :
                                                   Acer Inc.
                                     http://us.acer.com/acer/product.do
                                       http://global.acer.com/support/index.htm
                                     http://driveragent.com?ref=59


--------[   ]------------------------------------------------------------------------------------------------

      :
                                     
                                              1280 x 1024
                                            32 
                                       1
                                        96 dpi
        /                         36 / 36
                                     51
                                      60 
                                    C:\Users\sima\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg

      :
       -                             
                                              
                                      
                              
      ClearType                                         
             
                                
                                  
                                      
                                  
                                 
                                            
                                   
       /           
                                           
                              
                               
                            
                              
      Windows Aero                                      
       Windows Plus!                               


--------[  ]-----------------------------------------------------------------------------------------------

    \\.\DISPLAY1           (0,0)          (1280,1024)


--------[  ]-------------------------------------------------------------------------------------------------

    640 x 480           8   60 Hz
    640 x 480           8   72 Hz
    640 x 480           8   75 Hz
    640 x 480          16   60 Hz
    640 x 480          16   72 Hz
    640 x 480          16   75 Hz
    640 x 480          32   60 Hz
    640 x 480          32   72 Hz
    640 x 480          32   75 Hz
    720 x 480           8   56 Hz
    720 x 480           8   56 Hz
    720 x 480           8   56 Hz
    720 x 480           8   60 Hz
    720 x 480           8   60 Hz
    720 x 480           8   60 Hz
    720 x 480           8   72 Hz
    720 x 480           8   72 Hz
    720 x 480           8   72 Hz
    720 x 480           8   75 Hz
    720 x 480           8   75 Hz
    720 x 480           8   75 Hz
    720 x 480          16   56 Hz
    720 x 480          16   56 Hz
    720 x 480          16   56 Hz
    720 x 480          16   60 Hz
    720 x 480          16   60 Hz
    720 x 480          16   60 Hz
    720 x 480          16   72 Hz
    720 x 480          16   72 Hz
    720 x 480          16   72 Hz
    720 x 480          16   75 Hz
    720 x 480          16   75 Hz
    720 x 480          16   75 Hz
    720 x 480          32   56 Hz
    720 x 480          32   56 Hz
    720 x 480          32   56 Hz
    720 x 480          32   60 Hz
    720 x 480          32   60 Hz
    720 x 480          32   60 Hz
    720 x 480          32   72 Hz
    720 x 480          32   72 Hz
    720 x 480          32   72 Hz
    720 x 480          32   75 Hz
    720 x 480          32   75 Hz
    720 x 480          32   75 Hz
    720 x 576           8   56 Hz
    720 x 576           8   56 Hz
    720 x 576           8   56 Hz
    720 x 576           8   60 Hz
    720 x 576           8   60 Hz
    720 x 576           8   60 Hz
    720 x 576           8   72 Hz
    720 x 576           8   72 Hz
    720 x 576           8   72 Hz
    720 x 576           8   75 Hz
    720 x 576           8   75 Hz
    720 x 576           8   75 Hz
    720 x 576          16   56 Hz
    720 x 576          16   56 Hz
    720 x 576          16   56 Hz
    720 x 576          16   60 Hz
    720 x 576          16   60 Hz
    720 x 576          16   60 Hz
    720 x 576          16   72 Hz
    720 x 576          16   72 Hz
    720 x 576          16   72 Hz
    720 x 576          16   75 Hz
    720 x 576          16   75 Hz
    720 x 576          16   75 Hz
    720 x 576          32   56 Hz
    720 x 576          32   56 Hz
    720 x 576          32   56 Hz
    720 x 576          32   60 Hz
    720 x 576          32   60 Hz
    720 x 576          32   60 Hz
    720 x 576          32   72 Hz
    720 x 576          32   72 Hz
    720 x 576          32   72 Hz
    720 x 576          32   75 Hz
    720 x 576          32   75 Hz
    720 x 576          32   75 Hz
    800 x 600           8   56 Hz
    800 x 600           8   60 Hz
    800 x 600           8   72 Hz
    800 x 600           8   75 Hz
    800 x 600          16   56 Hz
    800 x 600          16   60 Hz
    800 x 600          16   72 Hz
    800 x 600          16   75 Hz
    800 x 600          32   56 Hz
    800 x 600          32   60 Hz
    800 x 600          32   72 Hz
    800 x 600          32   75 Hz
    1024 x 768          8   60 Hz
    1024 x 768          8   70 Hz
    1024 x 768          8   75 Hz
    1024 x 768         16   60 Hz
    1024 x 768         16   70 Hz
    1024 x 768         16   75 Hz
    1024 x 768         32   60 Hz
    1024 x 768         32   70 Hz
    1024 x 768         32   75 Hz
    1152 x 864          8   75 Hz
    1152 x 864         16   75 Hz
    1152 x 864         32   75 Hz
    1280 x 720          8   60 Hz
    1280 x 720          8   60 Hz
    1280 x 720          8   60 Hz
    1280 x 720         16   60 Hz
    1280 x 720         16   60 Hz
    1280 x 720         16   60 Hz
    1280 x 720         32   60 Hz
    1280 x 720         32   60 Hz
    1280 x 720         32   60 Hz
    1280 x 768          8   60 Hz
    1280 x 768          8   60 Hz
    1280 x 768          8   60 Hz
    1280 x 768         16   60 Hz
    1280 x 768         16   60 Hz
    1280 x 768         16   60 Hz
    1280 x 768         32   60 Hz
    1280 x 768         32   60 Hz
    1280 x 768         32   60 Hz
    1280 x 800          8   60 Hz
    1280 x 800          8   60 Hz
    1280 x 800          8   60 Hz
    1280 x 800         16   60 Hz
    1280 x 800         16   60 Hz
    1280 x 800         16   60 Hz
    1280 x 800         32   60 Hz
    1280 x 800         32   60 Hz
    1280 x 800         32   60 Hz
    1280 x 960          8   60 Hz
    1280 x 960         16   60 Hz
    1280 x 960         32   60 Hz
    1280 x 1024         8   60 Hz
    1280 x 1024         8   75 Hz
    1280 x 1024        16   60 Hz
    1280 x 1024        16   75 Hz
    1280 x 1024        32   60 Hz
    1280 x 1024        32   75 Hz


--------[ OpenGL ]------------------------------------------------------------------------------------------------------

     OpenGL:
                                           NVIDIA Corporation
      Renderer                                          GeForce 9800 GTX+/PCIe/SSE2
                                                  3.3.0
                                    3.30 NVIDIA via Cg compiler
      OpenGL DLL                                        6.1.7600.16385(win7_rtm.090713-1255)
       ICD                                       nvoglv32.dll (9.18.13.4192 - nVIDIA Detonator 41.92)
      Multitexture Texture Units                        4
      Occlusion Query Counter Bits                      32
      Sub-Pixel Precision                               8 
      Max Viewport Size                                 8192 x 8192
      Max Cube Map Texture Size                         8192 x 8192
      Max Rectangle Texture Size                        8192 x 8192
      Max 3D Texture Size                               2048 x 2048 x 2048
      Max Anisotropy                                    16
      Max Clipping Planes                               8
      Max Display-List Nesting Level                    64
      Max Draw Buffers                                  8
      Max Evaluator Order                               8
      Max General Register Combiners                    8
      Max Light Sources                                 8
      Max Pixel Map Table Size                          65536
      Min / Max Program Texel Offset                    -8 / 7
      Max Texture Array Layers                          512
      Max Texture LOD Bias                              15
      Max Vertex Array Range Element Size               1048575

     OpenGL:
      OpenGL 1.1                                          (100%)
      OpenGL 1.2                                          (100%)
      OpenGL 1.3                                          (100%)
      OpenGL 1.4                                          (100%)
      OpenGL 1.5                                          (100%)
      OpenGL 2.0                                          (100%)
      OpenGL 2.1                                          (100%)
      OpenGL 3.0                                          (100%)
      OpenGL 3.1                                          (100%)

    Max Stack Depth:
      Attribute Stack                                   16
      Client Attribute Stack                            16
      Modelview Matrix Stack                            32
      Name Stack                                        128
      Projection Matrix Stack                           4
      Texture Matrix Stack                              10

    Draw Range Elements:
      Max Index Count                                   1048576
      Max Vertex Count                                  1048576

    Extended Lighting Parameters:
      Max Shininess                                     128
      Max Spot Exponent                                 128

    Transform Feedback:
      Max Interleaved Components                        64
      Max Separate Attributes                           4
      Max Separate Components                           4

    Framebuffer Object:
      Max Color Attachments                             8
      Max Render Buffer Size                            8192 x 8192

    Imaging:
      Max Color Matrix Stack Depth                      2
      Max Convolution Width / Height                    11 / 11

    Vertex Shader:
      Max Uniform Vertex Components                     4096
      Max Varying Floats                                60
      Max Vertex Texture Image Units                    32
      Max Combined Texture Image Units                  96

    Geometry Shader:
      Max Geometry Texture Units                        32
      Max Varying Components                            60
      Max Geometry Varying Components                   124
      Max Vertex Varying Components                     60
      Max Geometry Uniform Components                   2048
      Max Geometry Output Vertices                      1024
      Max Geometry Total Output Components              1024

    Fragment Shader:
      Max Uniform Fragment Components                   2048

    Vertex Program:
      Max Local Parameters                              1024
      Max Environment Parameters                        256
      Max Program Matrices                              8
      Max Program Matrix Stack Depth                    1
      Max Tracking Matrices                             8
      Max Tracking Matrix Stack Depth                   1
      Max Vertex Attributes                             16
      Max Instructions                                  16384
      Max Native Instructions                           16384
      Max Temporaries                                   4096
      Max Native Temporaries                            4096
      Max Parameters                                    1024
      Max Native Parameters                             1024
      Max Attributes                                    16
      Max Native Attributes                             16
      Max Address Registers                             2
      Max Native Address Registers                      2

    Fragment Program:
      Max Local Parameters                              512
      Max Environment Parameters                        256
      Max Texture Coordinates                           8
      Max Texture Image Units                           32
      Max Instructions                                  16384
      Max Native Instructions                           16384
      Max Temporaries                                   4096
      Max Native Temporaries                            4096
      Max Parameters                                    1024
      Max Native Parameters                             1024
      Max Attributes                                    16
      Max Native Attributes                             16
      Max Address Registers                             1
      Max Native Address Registers                      1
      Max ALU Instructions                              16384
      Max Native ALU Instructions                       16384
      Max Texture Instructions                          16384
      Max Native Texture Instructions                   16384
      Max Texture Indirections                          16384
      Max Native Texture Indirections                   16384
      Max Execution Instructions                        16777216
      Max Call Stack Depth                              32
      Max If Statement Depth                            64
      Max Loop Depth                                    64
      Max Loop Count                                    16777216

     OpenGL:
      GL_3DFX_multisample                                
      GL_3DFX_tbuffer                                    
      GL_3DFX_texture_compression_FXT1                   
      GL_3DL_direct_texture_access2                      
      GL_3Dlabs_multisample_transparency_id              
      GL_3Dlabs_multisample_transparency_range           
      GL_AMD_performance_monitor                         
      GL_AMD_texture_texture4                            
      GL_AMDX_vertex_shader_tessellator                  
      GL_APPLE_aux_depth_stencil                         
      GL_APPLE_client_storage                            
      GL_APPLE_element_array                             
      GL_APPLE_fence                                     
      GL_APPLE_float_pixels                              
      GL_APPLE_flush_buffer_range                        
      GL_APPLE_flush_render                              
      GL_APPLE_packed_pixel                              
      GL_APPLE_packed_pixels                             
      GL_APPLE_pixel_buffer                              
      GL_APPLE_specular_vector                           
      GL_APPLE_texture_range                             
      GL_APPLE_transform_hint                            
      GL_APPLE_vertex_array_object                       
      GL_APPLE_vertex_array_range                        
      GL_APPLE_vertex_program_evaluators                 
      GL_APPLE_ycbcr_422                                 
      GL_ARB_arrays_of_arrays                           
      GL_ARB_base_instance                              
      GL_ARB_blend_func_extended                        
      GL_ARB_clear_buffer_object                        
      GL_ARB_color_buffer_float                         
      GL_ARB_compatibility                              
      GL_ARB_compressed_texture_pixel_storage           
      GL_ARB_conservative_depth                         
      GL_ARB_copy_buffer                                
      GL_ARB_copy_image                                 
      GL_ARB_debug_output                               
      GL_ARB_depth_buffer_float                         
      GL_ARB_depth_clamp                                
      GL_ARB_depth_texture                              
      GL_ARB_draw_buffers                               
      GL_ARB_draw_elements_base_vertex                  
      GL_ARB_draw_instanced                             
      GL_ARB_enhanced_layouts                           
      GL_ARB_ES2_compatibility                          
      GL_ARB_ES3_compatibility                          
      GL_ARB_explicit_attrib_location                   
      GL_ARB_explicit_uniform_location                  
      GL_ARB_fragment_coord_conventions                 
      GL_ARB_fragment_layer_viewport                    
      GL_ARB_fragment_program                           
      GL_ARB_fragment_program_shadow                    
      GL_ARB_fragment_shader                            
      GL_ARB_framebuffer_no_attachments                 
      GL_ARB_framebuffer_object                         
      GL_ARB_framebuffer_sRGB                           
      GL_ARB_geometry_shader4                           
      GL_ARB_get_program_binary                         
      GL_ARB_half_float_pixel                           
      GL_ARB_half_float_vertex                          
      GL_ARB_imaging                                    
      GL_ARB_instanced_arrays                           
      GL_ARB_internalformat_query                       
      GL_ARB_internalformat_query2                      
      GL_ARB_invalidate_subdata                         
      GL_ARB_map_buffer_alignment                       
      GL_ARB_map_buffer_range                           
      GL_ARB_matrix_palette                              
      GL_ARB_multi_bind                                 
      GL_ARB_multisample                                
      GL_ARB_multitexture                               
      GL_ARB_occlusion_query                            
      GL_ARB_occlusion_query2                           
      GL_ARB_pixel_buffer_object                        
      GL_ARB_point_parameters                           
      GL_ARB_point_sprite                               
      GL_ARB_program_interface_query                    
      GL_ARB_provoking_vertex                           
      GL_ARB_robust_buffer_access_behavior              
      GL_ARB_robustness                                 
      GL_ARB_sampler_objects                            
      GL_ARB_seamless_cube_map                          
      GL_ARB_separate_shader_objects                    
      GL_ARB_shader_bit_encoding                        
      GL_ARB_shader_objects                             
      GL_ARB_shader_texture_lod                         
      GL_ARB_shading_language_100                       
      GL_ARB_shading_language_420pack                   
      GL_ARB_shading_language_include                   
      GL_ARB_shading_language_packing                   
      GL_ARB_shadow                                     
      GL_ARB_shadow_ambient                              
      GL_ARB_stencil_texturing                          
      GL_ARB_sync                                       
      GL_ARB_texture_border_clamp                       
      GL_ARB_texture_buffer_object                      
      GL_ARB_texture_buffer_range                       
      GL_ARB_texture_compression                        
      GL_ARB_texture_compression_rgtc                   
      GL_ARB_texture_cube_map                           
      GL_ARB_texture_env_add                            
      GL_ARB_texture_env_combine                        
      GL_ARB_texture_env_crossbar                       
      GL_ARB_texture_env_dot3                           
      GL_ARB_texture_float                              
      GL_ARB_texture_mirror_clamp_to_edge               
      GL_ARB_texture_mirrored_repeat                    
      GL_ARB_texture_multisample                        
      GL_ARB_texture_non_power_of_two                   
      GL_ARB_texture_query_levels                       
      GL_ARB_texture_rectangle                          
      GL_ARB_texture_rg                                 
      GL_ARB_texture_rgb10_a2ui                         
      GL_ARB_texture_stencil8                           
      GL_ARB_texture_storage                            
      GL_ARB_texture_storage_multisample                
      GL_ARB_texture_swizzle                            
      GL_ARB_texture_view                               
      GL_ARB_timer_query                                
      GL_ARB_transpose_matrix                           
      GL_ARB_uniform_buffer_object                      
      GL_ARB_vertex_array_bgra                          
      GL_ARB_vertex_array_object                        
      GL_ARB_vertex_attrib_binding                      
      GL_ARB_vertex_blend                                
      GL_ARB_vertex_buffer_object                       
      GL_ARB_vertex_program                             
      GL_ARB_vertex_shader                              
      GL_ARB_vertex_type_10f_11f_11f_rev                
      GL_ARB_vertex_type_2_10_10_10_rev                 
      GL_ARB_viewport_array                             
      GL_ARB_window_pos                                 
      GL_ATI_array_rev_comps_in_4_bytes                  
      GL_ATI_blend_equation_separate                     
      GL_ATI_blend_weighted_minmax                       
      GL_ATI_draw_buffers                               
      GL_ATI_element_array                               
      GL_ATI_envmap_bumpmap                              
      GL_ATI_fragment_shader                             
      GL_ATI_lock_texture                                
      GL_ATI_map_object_buffer                           
      GL_ATI_meminfo                                     
      GL_ATI_pixel_format_float                          
      GL_ATI_pn_triangles                                
      GL_ATI_point_cull_mode                             
      GL_ATI_separate_stencil                            
      GL_ATI_shader_texture_lod                          
      GL_ATI_text_fragment_shader                        
      GL_ATI_texture_compression_3dc                     
      GL_ATI_texture_env_combine3                        
      GL_ATI_texture_float                              
      GL_ATI_texture_mirror_once                        
      GL_ATI_vertex_array_object                         
      GL_ATI_vertex_attrib_array_object                  
      GL_ATI_vertex_blend                                
      GL_ATI_vertex_shader                               
      GL_ATI_vertex_streams                              
      GL_ATIX_pn_triangles                               
      GL_ATIX_texture_env_combine3                       
      GL_ATIX_texture_env_route                          
      GL_ATIX_vertex_shader_output_point_size            
      GL_Autodesk_facet_normal                           
      GL_Autodesk_valid_back_buffer_hint                 
      GL_DIMD_YUV                                        
      GL_EXT_422_pixels                                  
      GL_EXT_abgr                                       
      GL_EXT_bgra                                       
      GL_EXT_bindable_uniform                           
      GL_EXT_blend_color                                
      GL_EXT_blend_equation_separate                    
      GL_EXT_blend_func_separate                        
      GL_EXT_blend_logic_op                              
      GL_EXT_blend_minmax                               
      GL_EXT_blend_subtract                             
      GL_EXT_Cg_shader                                  
      GL_EXT_clip_volume_hint                            
      GL_EXT_cmyka                                       
      GL_EXT_color_matrix                                
      GL_EXT_color_subtable                              
      GL_EXT_color_table                                 
      GL_EXT_compiled_vertex_array                      
      GL_EXT_convolution                                 
      GL_EXT_convolution_border_modes                    
      GL_EXT_coordinate_frame                            
      GL_EXT_copy_buffer                                 
      GL_EXT_copy_texture                                
      GL_EXT_cull_vertex                                 
      GL_EXT_depth_bounds_test                          
      GL_EXT_depth_buffer_float                          
      GL_EXT_direct_state_access                        
      GL_EXT_draw_buffers2                              
      GL_EXT_draw_instanced                             
      GL_EXT_draw_range_elements                        
      GL_EXT_fog_coord                                  
      GL_EXT_fog_function                                
      GL_EXT_fog_offset                                  
      GL_EXT_fragment_lighting                           
      GL_EXT_framebuffer_blit                           
      GL_EXT_framebuffer_multisample                    
      GL_EXT_framebuffer_multisample_blit_scaled        
      GL_EXT_framebuffer_object                         
      GL_EXT_framebuffer_sRGB                           
      GL_EXT_generate_mipmap                             
      GL_EXT_geometry_shader4                           
      GL_EXT_gpu_program_parameters                     
      GL_EXT_gpu_shader4                                
      GL_EXT_histogram                                   
      GL_EXT_import_sync_object                         
      GL_EXT_index_array_formats                         
      GL_EXT_index_func                                  
      GL_EXT_index_material                              
      GL_EXT_index_texture                               
      GL_EXT_interlace                                   
      GL_EXT_light_texture                               
      GL_EXT_misc_attribute                              
      GL_EXT_multi_draw_arrays                          
      GL_EXT_multisample                                 
      GL_EXT_packed_depth_stencil                       
      GL_EXT_packed_float                               
      GL_EXT_packed_pixels                              
      GL_EXT_packed_pixels_12                            
      GL_EXT_paletted_texture                            
      GL_EXT_pixel_buffer_object                        
      GL_EXT_pixel_format                                
      GL_EXT_pixel_texture                               
      GL_EXT_pixel_transform                             
      GL_EXT_pixel_transform_color_table                 
      GL_EXT_point_parameters                           
      GL_EXT_polygon_offset                              
      GL_EXT_provoking_vertex                           
      GL_EXT_rescale_normal                             
      GL_EXT_scene_marker                                
      GL_EXT_secondary_color                            
      GL_EXT_separate_shader_objects                    
      GL_EXT_separate_specular_color                    
      GL_EXT_shader_integer_mix                         
      GL_EXT_shadow_funcs                               
      GL_EXT_shared_texture_palette                      
      GL_EXT_stencil_clear_tag                           
      GL_EXT_stencil_two_side                           
      GL_EXT_stencil_wrap                               
      GL_EXT_subtexture                                  
      GL_EXT_swap_control                                
      GL_EXT_texgen_reflection                           
      GL_EXT_texture                                     
      GL_EXT_texture_array                              
      GL_EXT_texture_border_clamp                        
      GL_EXT_texture_buffer_object                      
      GL_EXT_texture_color_table                         
      GL_EXT_texture_compression_dxt1                   
      GL_EXT_texture_compression_latc                   
      GL_EXT_texture_compression_rgtc                   
      GL_EXT_texture_compression_s3tc                   
      GL_EXT_texture_cube_map                           
      GL_EXT_texture_edge_clamp                         
      GL_EXT_texture_env                                 
      GL_EXT_texture_env_add                            
      GL_EXT_texture_env_combine                        
      GL_EXT_texture_env_dot3                           
      GL_EXT_texture_filter_anisotropic                 
      GL_EXT_texture_integer                            
      GL_EXT_texture_lod                                
      GL_EXT_texture_lod_bias                           
      GL_EXT_texture_mirror_clamp                       
      GL_EXT_texture_object                             
      GL_EXT_texture_perturb_normal                      
      GL_EXT_texture_rectangle                           
      GL_EXT_texture_shared_exponent                    
      GL_EXT_texture_sRGB                               
      GL_EXT_texture_sRGB_decode                        
      GL_EXT_texture_storage                            
      GL_EXT_texture_swizzle                            
      GL_EXT_texture3D                                  
      GL_EXT_texture4D                                   
      GL_EXT_timer_query                                
      GL_EXT_transform_feedback                          
      GL_EXT_vertex_array                               
      GL_EXT_vertex_array_bgra                          
      GL_EXT_vertex_shader                               
      GL_EXT_vertex_weighting                            
      GL_EXTX_framebuffer_mixed_formats                 
      GL_EXTX_packed_depth_stencil                       
      GL_FGL_lock_texture                                
      GL_GL2_geometry_shader                             
      GL_GREMEDY_frame_terminator                        
      GL_GREMEDY_string_marker                           
      GL_HP_convolution_border_modes                     
      GL_HP_image_transform                              
      GL_HP_occlusion_test                               
      GL_HP_texture_lighting                             
      GL_I3D_argb                                        
      GL_I3D_color_clamp                                 
      GL_I3D_interlace_read                              
      GL_IBM_clip_check                                  
      GL_IBM_cull_vertex                                 
      GL_IBM_load_named_matrix                           
      GL_IBM_multi_draw_arrays                           
      GL_IBM_multimode_draw_arrays                       
      GL_IBM_occlusion_cull                              
      GL_IBM_pixel_filter_hint                           
      GL_IBM_rasterpos_clip                             
      GL_IBM_rescale_normal                              
      GL_IBM_static_data                                 
      GL_IBM_texture_clamp_nodraw                        
      GL_IBM_texture_mirrored_repeat                    
      GL_IBM_vertex_array_lists                          
      GL_IBM_YCbCr                                       
      GL_INGR_blend_func_separate                        
      GL_INGR_color_clamp                                
      GL_INGR_interlace_read                             
      GL_INGR_multiple_palette                           
      GL_INTEL_parallel_arrays                           
      GL_INTEL_texture_scissor                           
      GL_KHR_debug                                      
      GL_KTX_buffer_region                              
      GL_MESA_pack_invert                                
      GL_MESA_resize_buffers                             
      GL_MESA_window_pos                                 
      GL_MESA_ycbcr_texture                              
      GL_MESAX_texture_stack                             
      GL_MTX_fragment_shader                             
      GL_MTX_precision_dpi                               
      GL_NV_blend_square                                
      GL_NV_centroid_sample                              
      GL_NV_conditional_render                          
      GL_NV_copy_depth_to_color                         
      GL_NV_copy_image                                  
      GL_NV_depth_buffer_float                          
      GL_NV_depth_clamp                                 
      GL_NV_depth_range_unclamped                        
      GL_NV_ES1_1_compatibility                         
      GL_NV_evaluators                                   
      GL_NV_explicit_multisample                        
      GL_NV_fence                                       
      GL_NV_float_buffer                                
      GL_NV_fog_distance                                
      GL_NV_fragment_program                            
      GL_NV_fragment_program_option                     
      GL_NV_fragment_program2                           
      GL_NV_fragment_program4                            
      GL_NV_framebuffer_multisample_coverage            
      GL_NV_framebuffer_multisample_ex                   
      GL_NV_geometry_program4                            
      GL_NV_geometry_shader4                            
      GL_NV_gpu_program4                                
      GL_NV_half_float                                  
      GL_NV_light_max_exponent                          
      GL_NV_multisample_coverage                        
      GL_NV_multisample_filter_hint                     
      GL_NV_occlusion_query                             
      GL_NV_packed_depth_stencil                        
      GL_NV_parameter_buffer_object                     
      GL_NV_parameter_buffer_object2                    
      GL_NV_path_rendering                              
      GL_NV_pixel_buffer_object                          
      GL_NV_pixel_data_range                            
      GL_NV_point_sprite                                
      GL_NV_present_video                                
      GL_NV_primitive_restart                           
      GL_NV_register_combiners                          
      GL_NV_register_combiners2                         
      GL_NV_shader_buffer_load                          
      GL_NV_texgen_emboss                                
      GL_NV_texgen_reflection                           
      GL_NV_texture_barrier                             
      GL_NV_texture_compression_latc                     
      GL_NV_texture_compression_vtc                     
      GL_NV_texture_env_combine4                        
      GL_NV_texture_expand_normal                       
      GL_NV_texture_multisample                         
      GL_NV_texture_rectangle                           
      GL_NV_texture_shader                              
      GL_NV_texture_shader2                             
      GL_NV_texture_shader3                             
      GL_NV_timer_query                                  
      GL_NV_transform_feedback                          
      GL_NV_transform_feedback2                          
      GL_NV_vertex_array_range                          
      GL_NV_vertex_array_range2                         
      GL_NV_vertex_buffer_unified_memory                
      GL_NV_vertex_program                              
      GL_NV_vertex_program1_1                           
      GL_NV_vertex_program2                             
      GL_NV_vertex_program2_option                      
      GL_NV_vertex_program3                             
      GL_NV_vertex_program4                              
      GL_NVX_conditional_render                         
      GL_NVX_flush_hold                                  
      GL_NVX_gpu_memory_info                            
      GL_NVX_ycrcb                                       
      GL_OES_byte_coordinates                            
      GL_OES_compressed_paletted_texture                 
      GL_OES_fixed_point                                 
      GL_OES_query_matrix                                
      GL_OES_read_format                                 
      GL_OES_single_precision                            
      GL_OML_interlace                                   
      GL_OML_resample                                    
      GL_OML_subsample                                   
      GL_PGI_misc_hints                                  
      GL_PGI_vertex_hints                                
      GL_REND_screen_coordinates                         
      GL_S3_performance_analyzer                         
      GL_S3_s3tc                                        
      GL_SGI_color_matrix                                
      GL_SGI_color_table                                 
      GL_SGI_compiled_vertex_array                       
      GL_SGI_cull_vertex                                 
      GL_SGI_index_array_formats                         
      GL_SGI_index_func                                  
      GL_SGI_index_material                              
      GL_SGI_index_texture                               
      GL_SGI_make_current_read                           
      GL_SGI_texture_add_env                             
      GL_SGI_texture_color_table                         
      GL_SGI_texture_edge_clamp                          
      GL_SGI_texture_lod                                 
      GL_SGIS_color_range                                
      GL_SGIS_detail_texture                             
      GL_SGIS_fog_function                               
      GL_SGIS_generate_mipmap                           
      GL_SGIS_multisample                                
      GL_SGIS_multitexture                               
      GL_SGIS_pixel_texture                              
      GL_SGIS_point_line_texgen                          
      GL_SGIS_sharpen_texture                            
      GL_SGIS_texture_border_clamp                       
      GL_SGIS_texture_color_mask                         
      GL_SGIS_texture_edge_clamp                         
      GL_SGIS_texture_filter4                            
      GL_SGIS_texture_lod                               
      GL_SGIS_texture_select                             
      GL_SGIS_texture4D                                  
      GL_SGIX_async                                      
      GL_SGIX_async_histogram                            
      GL_SGIX_async_pixel                                
      GL_SGIX_blend_alpha_minmax                         
      GL_SGIX_clipmap                                    
      GL_SGIX_convolution_accuracy                       
      GL_SGIX_depth_pass_instrument                      
      GL_SGIX_depth_texture                             
      GL_SGIX_flush_raster                               
      GL_SGIX_fog_offset                                 
      GL_SGIX_framezoom                                  
      GL_SGIX_instruments                                
      GL_SGIX_interlace                                  
      GL_SGIX_ir_instrument1                             
      GL_SGIX_list_priority                              
      GL_SGIX_pbuffer                                    
      GL_SGIX_pixel_texture                              
      GL_SGIX_pixel_texture_bits                         
      GL_SGIX_reference_plane                            
      GL_SGIX_resample                                   
      GL_SGIX_shadow                                    
      GL_SGIX_shadow_ambient                             
      GL_SGIX_sprite                                     
      GL_SGIX_subsample                                  
      GL_SGIX_tag_sample_buffer                          
      GL_SGIX_texture_add_env                            
      GL_SGIX_texture_coordinate_clamp                   
      GL_SGIX_texture_lod_bias                           
      GL_SGIX_texture_multi_buffer                       
      GL_SGIX_texture_range                              
      GL_SGIX_texture_scale_bias                         
      GL_SGIX_vertex_preclip                             
      GL_SGIX_vertex_preclip_hint                        
      GL_SGIX_ycrcb                                      
      GL_SGIX_ycrcb_subsample                            
      GL_SUN_convolution_border_modes                    
      GL_SUN_global_alpha                                
      GL_SUN_mesh_array                                  
      GL_SUN_multi_draw_arrays                           
      GL_SUN_slice_accum                                
      GL_SUN_triangle_list                               
      GL_SUN_vertex                                      
      GL_SUNX_constant_data                              
      GL_WGL_ARB_extensions_string                       
      GL_WGL_EXT_extensions_string                       
      GL_WGL_EXT_swap_control                            
      GL_WIN_phong_shading                               
      GL_WIN_specular_fog                                
      GL_WIN_swap_hint                                  
      GLU_EXT_nurbs_tessellator                          
      GLU_EXT_object_space_tess                          
      GLU_SGI_filter4_parameters                         
      GLX_ARB_create_context                             
      GLX_ARB_fbconfig_float                             
      GLX_ARB_framebuffer_sRGB                           
      GLX_ARB_get_proc_address                           
      GLX_ARB_multisample                                
      GLX_EXT_fbconfig_packed_float                      
      GLX_EXT_framebuffer_sRGB                           
      GLX_EXT_import_context                             
      GLX_EXT_scene_marker                               
      GLX_EXT_texture_from_pixmap                        
      GLX_EXT_visual_info                                
      GLX_EXT_visual_rating                              
      GLX_MESA_agp_offset                                
      GLX_MESA_copy_sub_buffer                           
      GLX_MESA_pixmap_colormap                           
      GLX_MESA_release_buffers                           
      GLX_MESA_set_3dfx_mode                             
      GLX_NV_present_video                               
      GLX_NV_swap_group                                  
      GLX_NV_video_output                                
      GLX_OML_swap_method                                
      GLX_OML_sync_control                               
      GLX_SGI_cushion                                    
      GLX_SGI_make_current_read                          
      GLX_SGI_swap_control                               
      GLX_SGI_video_sync                                 
      GLX_SGIS_blended_overlay                           
      GLX_SGIS_color_range                               
      GLX_SGIS_multisample                               
      GLX_SGIX_dm_buffer                                 
      GLX_SGIX_fbconfig                                  
      GLX_SGIX_hyperpipe                                 
      GLX_SGIX_pbuffer                                   
      GLX_SGIX_swap_barrier                              
      GLX_SGIX_swap_group                                
      GLX_SGIX_video_resize                              
      GLX_SGIX_video_source                              
      GLX_SGIX_visual_select_group                       
      GLX_SUN_get_transparent_index                      
      GLX_SUN_video_resize                               
      WGL_3DFX_gamma_control                             
      WGL_3DFX_multisample                               
      WGL_3DL_stereo_control                             
      WGL_ARB_buffer_region                             
      WGL_ARB_create_context                            
      WGL_ARB_create_context_profile                    
      WGL_ARB_create_context_robustness                 
      WGL_ARB_extensions_string                         
      WGL_ARB_framebuffer_sRGB                           
      WGL_ARB_make_current_read                         
      WGL_ARB_multisample                               
      WGL_ARB_pbuffer                                   
      WGL_ARB_pixel_format                              
      WGL_ARB_pixel_format_float                        
      WGL_ARB_render_texture                            
      WGL_ATI_pbuffer_memory_hint                        
      WGL_ATI_pixel_format_float                        
      WGL_ATI_render_texture_rectangle                   
      WGL_EXT_buffer_region                              
      WGL_EXT_create_context_es_profile                 
      WGL_EXT_create_context_es2_profile                
      WGL_EXT_depth_float                                
      WGL_EXT_display_color_table                        
      WGL_EXT_extensions_string                         
      WGL_EXT_framebuffer_sRGB                          
      WGL_EXT_framebuffer_sRGBWGL_ARB_create_context     
      WGL_EXT_gamma_control                              
      WGL_EXT_make_current_read                          
      WGL_EXT_multisample                                
      WGL_EXT_pbuffer                                    
      WGL_EXT_pixel_format                               
      WGL_EXT_pixel_format_packed_float                 
      WGL_EXT_render_texture                             
      WGL_EXT_swap_control                              
      WGL_EXT_swap_control_tear                         
      WGL_EXT_swap_interval                              
      WGL_I3D_digital_video_control                      
      WGL_I3D_gamma                                      
      WGL_I3D_genlock                                    
      WGL_I3D_image_buffer                               
      WGL_I3D_swap_frame_lock                            
      WGL_I3D_swap_frame_usage                           
      WGL_MTX_video_preview                              
      WGL_NV_delay_before_swap                          
      WGL_NV_DX_interop                                 
      WGL_NV_DX_interop2                                
      WGL_NV_float_buffer                               
      WGL_NV_gpu_affinity                                
      WGL_NV_multisample_coverage                       
      WGL_NV_present_video                               
      WGL_NV_render_depth_texture                       
      WGL_NV_render_texture_rectangle                   
      WGL_NV_swap_group                                  
      WGL_NV_video_output                                
      WGL_NVX_DX_interop                                
      WGL_OML_sync_control                               

       :
      RGB DXT1                                          
      RGBA DXT1                                          
      RGBA DXT3                                         
      RGBA DXT5                                         
      RGB FXT1                                           
      RGBA FXT1                                          
      3Dc                                                


--------[ GPGPU ]-------------------------------------------------------------------------------------------------------

  [ CUDA: GeForce 9800 GTX+ ]

     :
                                           GeForce 9800 GTX+
                                                 1836 
      /                             16 / 128
      Max Threads Per Block                             512
      Max Registers Per Block                           8192
      Warp Size                                         32 threads
      Max Block Size                                    512 x 512 x 64
      Max Grid Size                                     65535 x 65535 x 1
      Compute Capability                                1.1
      CUDA DLL                                          nvcuda.dll (8.17.13.4192 - nVIDIA Detonator 41.92)

     :
      Total Memory                                      1024 
      Total Constant Memory                             64 
      Max Shared Memory Per Block                       16 
      Max Memory Pitch                                  2147483647 
      Texture Alignment                                 256 

     :
      32-bit Atomic Operations                          
      64-bit Atomic Operations                           
      Concurrent Memory Copy & Execute                  
      Double-Precision Floating-Point                    
      Warp Vote Functions                                

     :
                                                   NVIDIA Corporation
                                     http://www.nvidia.com/page/products.html
                                       http://www.nvidia.com/content/drivers/drivers.asp
                                     http://driveragent.com?ref=59


--------[  ]------------------------------------------------------------------------------------------------------

    @Arial Unicode MS                         Swiss                               14 x 43   40 %
    @Arial Unicode MS                         Swiss                             14 x 43   40 %
    @Arial Unicode MS                         Swiss                            14 x 43   40 %
    @Arial Unicode MS                         Swiss                              14 x 43   40 %
    @Arial Unicode MS                         Swiss                               14 x 43   40 %
    @Arial Unicode MS                         Swiss                                  14 x 43   40 %
    @Arial Unicode MS                         Swiss                          14 x 43   40 %
    @Arial Unicode MS                         Swiss                (2312)        14 x 43   40 %
    @Arial Unicode MS                         Swiss                (BIG5)        14 x 43   40 %
    @Arial Unicode MS                         Swiss                                14 x 43   40 %
    @Arial Unicode MS                         Swiss                               14 x 43   40 %
    @Arial Unicode MS                         Swiss                (Johab)         14 x 43   40 %
    @Arial Unicode MS                         Swiss                                14 x 43   40 %
    @Arial Unicode MS                         Swiss                  14 x 43   40 %
    @Arial Unicode MS                         Swiss                               14 x 43   40 %
    @Batang                                   Roman       Regular                      16 x 32   40 %
    @Batang                                   Roman       Regular                       16 x 32   40 %
    @Batang                                   Roman       Regular                        16 x 32   40 %
    @Batang                                   Roman       Regular                   16 x 32   40 %
    @Batang                                   Roman       Regular                        16 x 32   40 %
    @Batang                                   Roman       Regular                         16 x 32   40 %
    @Batang                                   Roman       Regular           16 x 32   40 %
    @BatangChe                                Modern      Regular                      16 x 32   40 %
    @BatangChe                                Modern      Regular                       16 x 32   40 %
    @BatangChe                                Modern      Regular                        16 x 32   40 %
    @BatangChe                                Modern      Regular                   16 x 32   40 %
    @BatangChe                                Modern      Regular                        16 x 32   40 %
    @BatangChe                                Modern      Regular                         16 x 32   40 %
    @BatangChe                                Modern      Regular           16 x 32   40 %
    @DFKai-SB                                 Script      Regular                        16 x 32   40 %
    @DFKai-SB                                 Script      Regular         (BIG5)        16 x 32   40 %
    @Dotum                                    Swiss       Regular                      16 x 32   40 %
    @Dotum                                    Swiss       Regular                       16 x 32   40 %
    @Dotum                                    Swiss       Regular                        16 x 32   40 %
    @Dotum                                    Swiss       Regular                   16 x 32   40 %
    @Dotum                                    Swiss       Regular                        16 x 32   40 %
    @Dotum                                    Swiss       Regular                         16 x 32   40 %
    @Dotum                                    Swiss       Regular           16 x 32   40 %
    @DotumChe                                 Modern      Regular                      16 x 32   40 %
    @DotumChe                                 Modern      Regular                       16 x 32   40 %
    @DotumChe                                 Modern      Regular                        16 x 32   40 %
    @DotumChe                                 Modern      Regular                   16 x 32   40 %
    @DotumChe                                 Modern      Regular                        16 x 32   40 %
    @DotumChe                                 Modern      Regular                         16 x 32   40 %
    @DotumChe                                 Modern      Regular           16 x 32   40 %
    @FangSong                                 Modern                              16 x 32   40 %
    @FangSong                                 Modern               (2312)        16 x 32   40 %
    @Gulim                                    Swiss       Regular                      16 x 32   40 %
    @Gulim                                    Swiss       Regular                       16 x 32   40 %
    @Gulim                                    Swiss       Regular                        16 x 32   40 %
    @Gulim                                    Swiss       Regular                   16 x 32   40 %
    @Gulim                                    Swiss       Regular                        16 x 32   40 %
    @Gulim                                    Swiss       Regular                         16 x 32   40 %
    @Gulim                                    Swiss       Regular           16 x 32   40 %
    @GulimChe                                 Modern      Regular                      16 x 32   40 %
    @GulimChe                                 Modern      Regular                       16 x 32   40 %
    @GulimChe                                 Modern      Regular                        16 x 32   40 %
    @GulimChe                                 Modern      Regular                   16 x 32   40 %
    @GulimChe                                 Modern      Regular                        16 x 32   40 %
    @GulimChe                                 Modern      Regular                         16 x 32   40 %
    @GulimChe                                 Modern      Regular           16 x 32   40 %
    @Gungsuh                                  Roman       Regular                      16 x 32   40 %
    @Gungsuh                                  Roman       Regular                       16 x 32   40 %
    @Gungsuh                                  Roman       Regular                        16 x 32   40 %
    @Gungsuh                                  Roman       Regular                   16 x 32   40 %
    @Gungsuh                                  Roman       Regular                        16 x 32   40 %
    @Gungsuh                                  Roman       Regular                         16 x 32   40 %
    @Gungsuh                                  Roman       Regular           16 x 32   40 %
    @GungsuhChe                               Modern      Regular                      16 x 32   40 %
    @GungsuhChe                               Modern      Regular                       16 x 32   40 %
    @GungsuhChe                               Modern      Regular                        16 x 32   40 %
    @GungsuhChe                               Modern      Regular                   16 x 32   40 %
    @GungsuhChe                               Modern      Regular                        16 x 32   40 %
    @GungsuhChe                               Modern      Regular                         16 x 32   40 %
    @GungsuhChe                               Modern      Regular           16 x 32   40 %
    @KaiTi                                    Modern                              16 x 32   40 %
    @KaiTi                                    Modern               (2312)        16 x 32   40 %
    @Malgun Gothic                            Swiss       Regular                        15 x 43   40 %
    @Malgun Gothic                            Swiss       Regular                         15 x 43   40 %
    @Meiryo UI                                Swiss                             17 x 41   40 %
    @Meiryo UI                                Swiss                              17 x 41   40 %
    @Meiryo UI                                Swiss                               17 x 41   40 %
    @Meiryo UI                                Swiss                          17 x 41   40 %
    @Meiryo UI                                Swiss                               17 x 41   40 %
    @Meiryo UI                                Swiss                  17 x 41   40 %
    @Meiryo UI                                Swiss                               17 x 41   40 %
    @Meiryo                                   Swiss                             31 x 48   40 %
    @Meiryo                                   Swiss                              31 x 48   40 %
    @Meiryo                                   Swiss                               31 x 48   40 %
    @Meiryo                                   Swiss                          31 x 48   40 %
    @Meiryo                                   Swiss                               31 x 48   40 %
    @Meiryo                                   Swiss                  31 x 48   40 %
    @Meiryo                                   Swiss                               31 x 48   40 %
    @Microsoft JhengHei                       Swiss                              15 x 43   40 %
    @Microsoft JhengHei                       Swiss                               15 x 43   40 %
    @Microsoft JhengHei                       Swiss                (BIG5)        15 x 43   40 %
    @Microsoft YaHei                          Swiss                              15 x 42   40 %
    @Microsoft YaHei                          Swiss                               15 x 42   40 %
    @Microsoft YaHei                          Swiss                          15 x 42   40 %
    @Microsoft YaHei                          Swiss                (2312)        15 x 42   40 %
    @Microsoft YaHei                          Swiss                               15 x 42   40 %
    @Microsoft YaHei                          Swiss                  15 x 42   40 %
    @MingLiU                                  Modern      Regular                        16 x 32   40 %
    @MingLiU                                  Modern      Regular         (BIG5)        16 x 32   40 %
    @MingLiU_HKSCS                            Roman       Regular                        16 x 32   40 %
    @MingLiU_HKSCS                            Roman       Regular         (BIG5)        16 x 32   40 %
    @MingLiU_HKSCS-ExtB                       Roman       Regular                        16 x 32   40 %
    @MingLiU_HKSCS-ExtB                       Roman       Regular         (BIG5)        16 x 32   40 %
    @MingLiU-ExtB                             Roman       Regular                        16 x 32   40 %
    @MingLiU-ExtB                             Roman       Regular         (BIG5)        16 x 32   40 %
    @MS Gothic                                Modern      Regular                      16 x 32   40 %
    @MS Gothic                                Modern      Regular                       16 x 32   40 %
    @MS Gothic                                Modern      Regular                        16 x 32   40 %
    @MS Gothic                                Modern      Regular                   16 x 32   40 %
    @MS Gothic                                Modern      Regular                        16 x 32   40 %
    @MS Gothic                                Modern      Regular           16 x 32   40 %
    @MS Gothic                                Modern      Regular                        16 x 32   40 %
    @MS Mincho                                Modern      Regular                      16 x 32   40 %
    @MS Mincho                                Modern      Regular                       16 x 32   40 %
    @MS Mincho                                Modern      Regular                        16 x 32   40 %
    @MS Mincho                                Modern      Regular                   16 x 32   40 %
    @MS Mincho                                Modern      Regular                        16 x 32   40 %
    @MS Mincho                                Modern      Regular           16 x 32   40 %
    @MS Mincho                                Modern      Regular                        16 x 32   40 %
    @MS PGothic                               Swiss       Regular                      13 x 32   40 %
    @MS PGothic                               Swiss       Regular                       13 x 32   40 %
    @MS PGothic                               Swiss       Regular                        13 x 32   40 %
    @MS PGothic                               Swiss       Regular                   13 x 32   40 %
    @MS PGothic                               Swiss       Regular                        13 x 32   40 %
    @MS PGothic                               Swiss       Regular           13 x 32   40 %
    @MS PGothic                               Swiss       Regular                        13 x 32   40 %
    @MS PMincho                               Roman       Regular                      13 x 32   40 %
    @MS PMincho                               Roman       Regular                       13 x 32   40 %
    @MS PMincho                               Roman       Regular                        13 x 32   40 %
    @MS PMincho                               Roman       Regular                   13 x 32   40 %
    @MS PMincho                               Roman       Regular                        13 x 32   40 %
    @MS PMincho                               Roman       Regular           13 x 32   40 %
    @MS PMincho                               Roman       Regular                        13 x 32   40 %
    @MS UI Gothic                             Swiss       Regular                      13 x 32   40 %
    @MS UI Gothic                             Swiss       Regular                       13 x 32   40 %
    @MS UI Gothic                             Swiss       Regular                        13 x 32   40 %
    @MS UI Gothic                             Swiss       Regular                   13 x 32   40 %
    @MS UI Gothic                             Swiss       Regular                        13 x 32   40 %
    @MS UI Gothic                             Swiss       Regular           13 x 32   40 %
    @MS UI Gothic                             Swiss       Regular                        13 x 32   40 %
    @NSimSun                                  Modern      Regular                        16 x 32   40 %
    @NSimSun                                  Modern      Regular         (2312)        16 x 32   40 %
    @PMingLiU                                 Roman       Regular                        16 x 32   40 %
    @PMingLiU                                 Roman       Regular         (BIG5)        16 x 32   40 %
    @PMingLiU-ExtB                            Roman       Regular                        16 x 32   40 %
    @PMingLiU-ExtB                            Roman       Regular         (BIG5)        16 x 32   40 %
    @SimHei                                   Modern                              16 x 32   40 %
    @SimHei                                   Modern               (2312)        16 x 32   40 %
    @SimSun                                   Special     Regular                        16 x 32   40 %
    @SimSun                                   Special     Regular         (2312)        16 x 32   40 %
    @SimSun-ExtB                              Modern                              16 x 32   40 %
    @SimSun-ExtB                              Modern               (2312)        16 x 32   40 %
    Agency FB                                 Swiss                            11 x 37   70 %
    Aharoni                                   Special                             15 x 32   70 %
    Algerian                                  Decorative  Regular                        17 x 36   40 %
    Andalus                                   Roman       Regular                        15 x 49   40 %
    Andalus                                   Roman       Regular                        15 x 49   40 %
    Angsana New                               Roman                                8 x 43   40 %
    Angsana New                               Roman                                 8 x 43   40 %
    AngsanaUPC                                Roman                                8 x 43   40 %
    AngsanaUPC                                Roman                                 8 x 43   40 %
    Aparajita                                 Swiss       Regular                        16 x 38   40 %
    Arabic Typesetting                        Script                               9 x 36   40 %
    Arabic Typesetting                        Script                             9 x 36   40 %
    Arabic Typesetting                        Script                               9 x 36   40 %
    Arabic Typesetting                        Script                               9 x 36   40 %
    Arabic Typesetting                        Script                  9 x 36   40 %
    Arial Black                               Swiss                             18 x 45   90 %
    Arial Black                               Swiss                              18 x 45   90 %
    Arial Black                               Swiss                               18 x 45   90 %
    Arial Black                               Swiss                          18 x 45   90 %
    Arial Black                               Swiss                               18 x 45   90 %
    Arial Black                               Swiss                  18 x 45   90 %
    Arial Narrow                              Swiss                             12 x 36   40 %
    Arial Narrow                              Swiss                              12 x 36   40 %
    Arial Narrow                              Swiss                               12 x 36   40 %
    Arial Narrow                              Swiss                          12 x 36   40 %
    Arial Narrow                              Swiss                               12 x 36   40 %
    Arial Narrow                              Swiss                  12 x 36   40 %
    Arial Rounded MT Bold                     Swiss                               15 x 37   40 %
    Arial Unicode MS                          Swiss                               14 x 43   40 %
    Arial Unicode MS                          Swiss                             14 x 43   40 %
    Arial Unicode MS                          Swiss                            14 x 43   40 %
    Arial Unicode MS                          Swiss                              14 x 43   40 %
    Arial Unicode MS                          Swiss                               14 x 43   40 %
    Arial Unicode MS                          Swiss                                  14 x 43   40 %
    Arial Unicode MS                          Swiss                          14 x 43   40 %
    Arial Unicode MS                          Swiss                (2312)        14 x 43   40 %
    Arial Unicode MS                          Swiss                (BIG5)        14 x 43   40 %
    Arial Unicode MS                          Swiss                                14 x 43   40 %
    Arial Unicode MS                          Swiss                               14 x 43   40 %
    Arial Unicode MS                          Swiss                (Johab)         14 x 43   40 %
    Arial Unicode MS                          Swiss                                14 x 43   40 %
    Arial Unicode MS                          Swiss                  14 x 43   40 %
    Arial Unicode MS                          Swiss                               14 x 43   40 %
    Arial                                     Swiss                               14 x 36   40 %
    Arial                                     Swiss                             14 x 36   40 %
    Arial                                     Swiss                            14 x 36   40 %
    Arial                                     Swiss                              14 x 36   40 %
    Arial                                     Swiss                               14 x 36   40 %
    Arial                                     Swiss                                  14 x 36   40 %
    Arial                                     Swiss                          14 x 36   40 %
    Arial                                     Swiss                               14 x 36   40 %
    Arial                                     Swiss                  14 x 36   40 %
    Baskerville Old Face                      Roman                               13 x 37   40 %
    Batang                                    Roman       Regular                      16 x 32   40 %
    Batang                                    Roman       Regular                       16 x 32   40 %
    Batang                                    Roman       Regular                        16 x 32   40 %
    Batang                                    Roman       Regular                   16 x 32   40 %
    Batang                                    Roman       Regular                        16 x 32   40 %
    Batang                                    Roman       Regular                         16 x 32   40 %
    Batang                                    Roman       Regular           16 x 32   40 %
    BatangChe                                 Modern      Regular                      16 x 32   40 %
    BatangChe                                 Modern      Regular                       16 x 32   40 %
    BatangChe                                 Modern      Regular                        16 x 32   40 %
    BatangChe                                 Modern      Regular                   16 x 32   40 %
    BatangChe                                 Modern      Regular                        16 x 32   40 %
    BatangChe                                 Modern      Regular                         16 x 32   40 %
    BatangChe                                 Modern      Regular           16 x 32   40 %
    Bauhaus 93                                Decorative                          14 x 36   40 %
    Bell MT                                   Roman                               13 x 35   40 %
    Berlin Sans FB Demi                       Swiss                            14 x 36   70 %
    Berlin Sans FB                            Swiss                            15 x 36   70 %
    Bernard MT Condensed                      Roman                               12 x 38   40 %
    Blackadder ITC                            Decorative                          10 x 41   40 %
    Bodoni MT Black                           Roman                               16 x 37   90 %
    Bodoni MT Condensed                       Roman                                9 x 38   40 %
    Bodoni MT Poster Compressed               Roman                                8 x 37   30 %
    Bodoni MT Poster Compressed               Roman                                8 x 37   30 %
    Bodoni MT                                 Roman                               13 x 38   40 %
    Book Antiqua                              Roman                             14 x 40   40 %
    Book Antiqua                              Roman                              14 x 40   40 %
    Book Antiqua                              Roman                               14 x 40   40 %
    Book Antiqua                              Roman                          14 x 40   40 %
    Book Antiqua                              Roman                               14 x 40   40 %
    Book Antiqua                              Roman                  14 x 40   40 %
    Bookman Old Style                         Roman                             16 x 36   30 %
    Bookman Old Style                         Roman                              16 x 36   30 %
    Bookman Old Style                         Roman                               16 x 36   30 %
    Bookman Old Style                         Roman                          16 x 36   30 %
    Bookman Old Style                         Roman                               16 x 36   30 %
    Bookman Old Style                         Roman                  16 x 36   30 %
    Bookshelf Symbol 7                        Special     Regular                      21 x 32   40 %
    Bradley Hand ITC                          Script                              13 x 40   40 %
    Britannic Bold                            Swiss                               14 x 35   40 %
    Broadway                                  Decorative                          17 x 36   40 %
    Browallia New                             Swiss       Regular                         9 x 40   40 %
    Browallia New                             Swiss       Regular                          9 x 40   40 %
    BrowalliaUPC                              Swiss       Regular                         9 x 40   40 %
    BrowalliaUPC                              Swiss       Regular                          9 x 40   40 %
    Brush Script MT                           Script                               10 x 39   40 %
    Calibri                                   Swiss       Regular                      17 x 39   40 %
    Calibri                                   Swiss       Regular                     17 x 39   40 %
    Calibri                                   Swiss       Regular                       17 x 39   40 %
    Calibri                                   Swiss       Regular                        17 x 39   40 %
    Calibri                                   Swiss       Regular                   17 x 39   40 %
    Calibri                                   Swiss       Regular                        17 x 39   40 %
    Calibri                                   Swiss       Regular           17 x 39   40 %
    Californian FB                            Roman                               13 x 36   40 %
    Calisto MT                                Roman                               13 x 37   40 %
    Cambria Math                              Roman       Regular                      20 x 179   40 %
    Cambria Math                              Roman       Regular                     20 x 179   40 %
    Cambria Math                              Roman       Regular                       20 x 179   40 %
    Cambria Math                              Roman       Regular                        20 x 179   40 %
    Cambria Math                              Roman       Regular                   20 x 179   40 %
    Cambria Math                              Roman       Regular                        20 x 179   40 %
    Cambria Math                              Roman       Regular           20 x 179   40 %
    Cambria                                   Roman       Regular                      20 x 38   40 %
    Cambria                                   Roman       Regular                     20 x 38   40 %
    Cambria                                   Roman       Regular                       20 x 38   40 %
    Cambria                                   Roman       Regular                        20 x 38   40 %
    Cambria                                   Roman       Regular                   20 x 38   40 %
    Cambria                                   Roman       Regular                        20 x 38   40 %
    Cambria                                   Roman       Regular           20 x 38   40 %
    Candara                                   Swiss       Regular                      17 x 39   40 %
    Candara                                   Swiss       Regular                     17 x 39   40 %
    Candara                                   Swiss       Regular                       17 x 39   40 %
    Candara                                   Swiss       Regular                        17 x 39   40 %
    Candara                                   Swiss       Regular                   17 x 39   40 %
    Candara                                   Swiss       Regular                        17 x 39   40 %
    Candara                                   Swiss       Regular           17 x 39   40 %
    Castellar                                 Roman                               21 x 39   40 %
    Centaur                                   Roman                               12 x 36   40 %
    Century Gothic                            Swiss                             16 x 38   40 %
    Century Gothic                            Swiss                              16 x 38   40 %
    Century Gothic                            Swiss                               16 x 38   40 %
    Century Gothic                            Swiss                          16 x 38   40 %
    Century Gothic                            Swiss                               16 x 38   40 %
    Century Gothic                            Swiss                  16 x 38   40 %
    Century Schoolbook                        Roman                             15 x 38   40 %
    Century Schoolbook                        Roman                              15 x 38   40 %
    Century Schoolbook                        Roman                               15 x 38   40 %
    Century Schoolbook                        Roman                          15 x 38   40 %
    Century Schoolbook                        Roman                               15 x 38   40 %
    Century Schoolbook                        Roman                  15 x 38   40 %
    Century                                   Roman                             15 x 38   40 %
    Century                                   Roman                              15 x 38   40 %
    Century                                   Roman                               15 x 38   40 %
    Century                                   Roman                          15 x 38   40 %
    Century                                   Roman                               15 x 38   40 %
    Century                                   Roman                  15 x 38   40 %
    Chiller                                   Decorative                           9 x 37   40 %
    Colonna MT                                Decorative                          13 x 34   40 %
    Comic Sans MS                             Script                            15 x 45   40 %
    Comic Sans MS                             Script                             15 x 45   40 %
    Comic Sans MS                             Script                              15 x 45   40 %
    Comic Sans MS                             Script                         15 x 45   40 %
    Comic Sans MS                             Script                              15 x 45   40 %
    Comic Sans MS                             Script                 15 x 45   40 %
    Consolas                                  Modern      Regular                      18 x 37   40 %
    Consolas                                  Modern      Regular                     18 x 37   40 %
    Consolas                                  Modern      Regular                       18 x 37   40 %
    Consolas                                  Modern      Regular                        18 x 37   40 %
    Consolas                                  Modern      Regular                   18 x 37   40 %
    Consolas                                  Modern      Regular                        18 x 37   40 %
    Consolas                                  Modern      Regular           18 x 37   40 %
    Constantia                                Roman       Regular                      17 x 39   40 %
    Constantia                                Roman       Regular                     17 x 39   40 %
    Constantia                                Roman       Regular                       17 x 39   40 %
    Constantia                                Roman       Regular                        17 x 39   40 %
    Constantia                                Roman       Regular                   17 x 39   40 %
    Constantia                                Roman       Regular                        17 x 39   40 %
    Constantia                                Roman       Regular           17 x 39   40 %
    Cooper Black                              Roman                               16 x 37   40 %
    Copperplate Gothic Bold                   Swiss                               19 x 36   40 %
    Copperplate Gothic Light                  Swiss                               18 x 35   40 %
    Corbel                                    Swiss       Regular                      17 x 39   40 %
    Corbel                                    Swiss       Regular                     17 x 39   40 %
    Corbel                                    Swiss       Regular                       17 x 39   40 %
    Corbel                                    Swiss       Regular                        17 x 39   40 %
    Corbel                                    Swiss       Regular                   17 x 39   40 %
    Corbel                                    Swiss       Regular                        17 x 39   40 %
    Corbel                                    Swiss       Regular           17 x 39   40 %
    Cordia New                                Swiss       Regular                         9 x 44   40 %
    Cordia New                                Swiss       Regular                          9 x 44   40 %
    CordiaUPC                                 Swiss       Regular                         9 x 44   40 %
    CordiaUPC                                 Swiss       Regular                          9 x 44   40 %
    Courier New                               Modern                              19 x 36   40 %
    Courier New                               Modern                            19 x 36   40 %
    Courier New                               Modern                           19 x 36   40 %
    Courier New                               Modern                             19 x 36   40 %
    Courier New                               Modern                              19 x 36   40 %
    Courier New                               Modern                                 19 x 36   40 %
    Courier New                               Modern                         19 x 36   40 %
    Courier New                               Modern                              19 x 36   40 %
    Courier New                               Modern                 19 x 36   40 %
    Courier                                   Roman                                  8 x 13   40 %
    Curlz MT                                  Decorative                          12 x 42   40 %
    DaunPenh                                  Special                             12 x 43   40 %
    David                                     Swiss       Regular                           13 x 31   40 %
    DFKai-SB                                  Script      Regular                        16 x 32   40 %
    DFKai-SB                                  Script      Regular         (BIG5)        16 x 32   40 %
    DilleniaUPC                               Roman                                9 x 42   40 %
    DilleniaUPC                               Roman                                 9 x 42   40 %
    DokChampa                                 Swiss                               19 x 62   40 %
    DokChampa                                 Swiss                                19 x 62   40 %
    Dotum                                     Swiss       Regular                      16 x 32   40 %
    Dotum                                     Swiss       Regular                       16 x 32   40 %
    Dotum                                     Swiss       Regular                        16 x 32   40 %
    Dotum                                     Swiss       Regular                   16 x 32   40 %
    Dotum                                     Swiss       Regular                        16 x 32   40 %
    Dotum                                     Swiss       Regular                         16 x 32   40 %
    Dotum                                     Swiss       Regular           16 x 32   40 %
    DotumChe                                  Modern      Regular                      16 x 32   40 %
    DotumChe                                  Modern      Regular                       16 x 32   40 %
    DotumChe                                  Modern      Regular                        16 x 32   40 %
    DotumChe                                  Modern      Regular                   16 x 32   40 %
    DotumChe                                  Modern      Regular                        16 x 32   40 %
    DotumChe                                  Modern      Regular                         16 x 32   40 %
    DotumChe                                  Modern      Regular           16 x 32   40 %
    Ebrima                                    Special                           19 x 43   40 %
    Ebrima                                    Special                             19 x 43   40 %
    Ebrima                                    Special                             19 x 43   40 %
    Ebrima                                    Special                19 x 43   40 %
    Edwardian Script ITC                      Script                               8 x 38   40 %
    Elephant                                  Roman                               16 x 41   40 %
    Engravers MT                              Roman                               25 x 37   50 %
    Eras Bold ITC                             Swiss                               16 x 37   40 %
    Eras Demi ITC                             Swiss                               15 x 36   40 %
    Eras Light ITC                            Swiss                               13 x 36   40 %
    Eras Medium ITC                           Swiss                               14 x 36   40 %
    Estrangelo Edessa                         Script                              16 x 36   40 %
    EucrosiaUPC                               Roman                                9 x 39   40 %
    EucrosiaUPC                               Roman                                 9 x 39   40 %
    Euphemia                                  Swiss       Regular                        22 x 42   40 %
    FangSong                                  Modern                              16 x 32   40 %
    FangSong                                  Modern               (2312)        16 x 32   40 %
    Felix Titling                             Decorative                          19 x 37   40 %
    Fixedsys                                  Swiss                                  8 x 16   40 %
    Footlight MT Light                        Roman                               13 x 34   30 %
    Forte                                     Script      Regular                        14 x 35   40 %
    Franklin Gothic Book                      Swiss                             13 x 36   40 %
    Franklin Gothic Book                      Swiss                              13 x 36   40 %
    Franklin Gothic Book                      Swiss                               13 x 36   40 %
    Franklin Gothic Book                      Swiss                          13 x 36   40 %
    Franklin Gothic Book                      Swiss                               13 x 36   40 %
    Franklin Gothic Book                      Swiss                  13 x 36   40 %
    Franklin Gothic Demi Cond                 Swiss                             12 x 36   40 %
    Franklin Gothic Demi Cond                 Swiss                              12 x 36   40 %
    Franklin Gothic Demi Cond                 Swiss                               12 x 36   40 %
    Franklin Gothic Demi Cond                 Swiss                          12 x 36   40 %
    Franklin Gothic Demi Cond                 Swiss                               12 x 36   40 %
    Franklin Gothic Demi Cond                 Swiss                  12 x 36   40 %
    Franklin Gothic Demi                      Swiss                             14 x 36   40 %
    Franklin Gothic Demi                      Swiss                              14 x 36   40 %
    Franklin Gothic Demi                      Swiss                               14 x 36   40 %
    Franklin Gothic Demi                      Swiss                          14 x 36   40 %
    Franklin Gothic Demi                      Swiss                               14 x 36   40 %
    Franklin Gothic Demi                      Swiss                  14 x 36   40 %
    Franklin Gothic Heavy                     Swiss                             15 x 36   40 %
    Franklin Gothic Heavy                     Swiss                              15 x 36   40 %
    Franklin Gothic Heavy                     Swiss                               15 x 36   40 %
    Franklin Gothic Heavy                     Swiss                          15 x 36   40 %
    Franklin Gothic Heavy                     Swiss                               15 x 36   40 %
    Franklin Gothic Heavy                     Swiss                  15 x 36   40 %
    Franklin Gothic Medium Cond               Swiss                             12 x 36   40 %
    Franklin Gothic Medium Cond               Swiss                              12 x 36   40 %
    Franklin Gothic Medium Cond               Swiss                               12 x 36   40 %
    Franklin Gothic Medium Cond               Swiss                          12 x 36   40 %
    Franklin Gothic Medium Cond               Swiss                               12 x 36   40 %
    Franklin Gothic Medium Cond               Swiss                  12 x 36   40 %
    Franklin Gothic Medium                    Swiss                             14 x 36   40 %
    Franklin Gothic Medium                    Swiss                              14 x 36   40 %
    Franklin Gothic Medium                    Swiss                               14 x 36   40 %
    Franklin Gothic Medium                    Swiss                          14 x 36   40 %
    Franklin Gothic Medium                    Swiss                               14 x 36   40 %
    Franklin Gothic Medium                    Swiss                  14 x 36   40 %
    FrankRuehl                                Swiss       Regular                           13 x 30   40 %
    FreesiaUPC                                Swiss       Regular                         9 x 38   40 %
    FreesiaUPC                                Swiss       Regular                          9 x 38   40 %
    Freestyle Script                          Script                               8 x 38   40 %
    French Script MT                          Script                               9 x 36   40 %
    Gabriola                                  Decorative  Regular                      16 x 59   40 %
    Gabriola                                  Decorative  Regular                       16 x 59   40 %
    Gabriola                                  Decorative  Regular                        16 x 59   40 %
    Gabriola                                  Decorative  Regular                   16 x 59   40 %
    Gabriola                                  Decorative  Regular                        16 x 59   40 %
    Gabriola                                  Decorative  Regular           16 x 59   40 %
    Garamond                                  Roman                             12 x 36   40 %
    Garamond                                  Roman                              12 x 36   40 %
    Garamond                                  Roman                               12 x 36   40 %
    Garamond                                  Roman                          12 x 36   40 %
    Garamond                                  Roman                               12 x 36   40 %
    Garamond                                  Roman                  12 x 36   40 %
    Gautami                                   Swiss       Regular                        18 x 56   40 %
    Georgia                                   Roman                             14 x 36   40 %
    Georgia                                   Roman                              14 x 36   40 %
    Georgia                                   Roman                               14 x 36   40 %
    Georgia                                   Roman                          14 x 36   40 %
    Georgia                                   Roman                               14 x 36   40 %
    Georgia                                   Roman                  14 x 36   40 %
    Gigi                                      Decorative                          13 x 44   40 %
    Gill Sans MT Condensed                    Swiss                               10 x 39   40 %
    Gill Sans MT Condensed                    Swiss                  10 x 39   40 %
    Gill Sans MT Ext Condensed Bold           Swiss                                7 x 38   40 %
    Gill Sans MT Ext Condensed Bold           Swiss                   7 x 38   40 %
    Gill Sans MT                              Swiss                               13 x 37   40 %
    Gill Sans MT                              Swiss                  13 x 37   40 %
    Gill Sans Ultra Bold Condensed            Swiss                               14 x 40   40 %
    Gill Sans Ultra Bold Condensed            Swiss                  14 x 40   40 %
    Gill Sans Ultra Bold                      Swiss                               20 x 40   40 %
    Gill Sans Ultra Bold                      Swiss                  20 x 40   40 %
    Gisha                                     Swiss                               16 x 38   40 %
    Gisha                                     Swiss                                  16 x 38   40 %
    Gloucester MT Extra Condensed             Roman       Regular                         9 x 37   40 %
    Goudy Old Style                           Roman                               13 x 36   40 %
    Goudy Stout                               Roman                               36 x 44   40 %
    Gulim                                     Swiss       Regular                      16 x 32   40 %
    Gulim                                     Swiss       Regular                       16 x 32   40 %
    Gulim                                     Swiss       Regular                        16 x 32   40 %
    Gulim                                     Swiss       Regular                   16 x 32   40 %
    Gulim                                     Swiss       Regular                        16 x 32   40 %
    Gulim                                     Swiss       Regular                         16 x 32   40 %
    Gulim                                     Swiss       Regular           16 x 32   40 %
    GulimChe                                  Modern      Regular                      16 x 32   40 %
    GulimChe                                  Modern      Regular                       16 x 32   40 %
    GulimChe                                  Modern      Regular                        16 x 32   40 %
    GulimChe                                  Modern      Regular                   16 x 32   40 %
    GulimChe                                  Modern      Regular                        16 x 32   40 %
    GulimChe                                  Modern      Regular                         16 x 32   40 %
    GulimChe                                  Modern      Regular           16 x 32   40 %
    Gungsuh                                   Roman       Regular                      16 x 32   40 %
    Gungsuh                                   Roman       Regular                       16 x 32   40 %
    Gungsuh                                   Roman       Regular                        16 x 32   40 %
    Gungsuh                                   Roman       Regular                   16 x 32   40 %
    Gungsuh                                   Roman       Regular                        16 x 32   40 %
    Gungsuh                                   Roman       Regular                         16 x 32   40 %
    Gungsuh                                   Roman       Regular           16 x 32   40 %
    GungsuhChe                                Modern      Regular                      16 x 32   40 %
    GungsuhChe                                Modern      Regular                       16 x 32   40 %
    GungsuhChe                                Modern      Regular                        16 x 32   40 %
    GungsuhChe                                Modern      Regular                   16 x 32   40 %
    GungsuhChe                                Modern      Regular                        16 x 32   40 %
    GungsuhChe                                Modern      Regular                         16 x 32   40 %
    GungsuhChe                                Modern      Regular           16 x 32   40 %
    Haettenschweiler                          Swiss                             10 x 33   40 %
    Haettenschweiler                          Swiss                              10 x 33   40 %
    Haettenschweiler                          Swiss                               10 x 33   40 %
    Haettenschweiler                          Swiss                          10 x 33   40 %
    Haettenschweiler                          Swiss                               10 x 33   40 %
    Haettenschweiler                          Swiss                  10 x 33   40 %
    Harlow Solid Italic                       Decorative  Italic                         12 x 40   40 %
    Harrington                                Decorative                          14 x 38   40 %
    High Tower Text                           Roman                               13 x 37   40 %
    Impact                                    Swiss                             13 x 39   40 %
    Impact                                    Swiss                              13 x 39   40 %
    Impact                                    Swiss                               13 x 39   40 %
    Impact                                    Swiss                          13 x 39   40 %
    Impact                                    Swiss                               13 x 39   40 %
    Impact                                    Swiss                  13 x 39   40 %
    Imprint MT Shadow                         Decorative                          13 x 38   40 %
    Informal Roman                            Script                              12 x 32   40 %
    IrisUPC                                   Swiss       Regular                         9 x 40   40 %
    IrisUPC                                   Swiss       Regular                          9 x 40   40 %
    Iskoola Pota                              Swiss                               22 x 36   40 %
    JasmineUPC                                Roman       Regular                         9 x 34   40 %
    JasmineUPC                                Roman       Regular                          9 x 34   40 %
    Jokerman                                  Decorative                          16 x 48   40 %
    Juice ITC                                 Decorative                           9 x 36   40 %
    KaiTi                                     Modern                              16 x 32   40 %
    KaiTi                                     Modern               (2312)        16 x 32   40 %
    Kalinga                                   Swiss       Regular                        19 x 48   40 %
    Kartika                                   Roman       Regular                        27 x 46   40 %
    Khmer UI                                  Swiss                               21 x 36   40 %
    KodchiangUPC                              Roman       Regular                         9 x 31   40 %
    KodchiangUPC                              Roman       Regular                          9 x 31   40 %
    Kokila                                    Swiss       Regular                        13 x 37   40 %
    Kristen ITC                               Script                              16 x 44   40 %
    Kunstler Script                           Script                               8 x 35   40 %
    Lao UI                                    Swiss                               18 x 43   40 %
    Latha                                     Swiss       Regular                        23 x 44   40 %
    Leelawadee                                Swiss                               17 x 38   40 %
    Leelawadee                                Swiss                                17 x 38   40 %
    Levenim MT                                Special     Regular                           16 x 42   40 %
    LilyUPC                                   Swiss                                9 x 30   40 %
    LilyUPC                                   Swiss                                 9 x 30   40 %
    Lucida Bright                             Roman       Regular                        16 x 36   40 %
    Lucida Calligraphy                        Script      Italic                         17 x 40   40 %
    Lucida Console                            Modern                             19 x 32   40 %
    Lucida Console                            Modern                              19 x 32   40 %
    Lucida Console                            Modern                         19 x 32   40 %
    Lucida Console                            Modern                              19 x 32   40 %
    Lucida Console                            Modern                 19 x 32   40 %
    Lucida Fax                                Roman       Regular                        16 x 37   40 %
    Lucida Handwriting                        Script      Italic                         18 x 41   40 %
    Lucida Sans Typewriter                    Modern      Regular                        19 x 36   40 %
    Lucida Sans Unicode                       Swiss                             16 x 49   40 %
    Lucida Sans Unicode                       Swiss                              16 x 49   40 %
    Lucida Sans Unicode                       Swiss                               16 x 49   40 %
    Lucida Sans Unicode                       Swiss                                  16 x 49   40 %
    Lucida Sans Unicode                       Swiss                          16 x 49   40 %
    Lucida Sans Unicode                       Swiss                               16 x 49   40 %
    Lucida Sans Unicode                       Swiss                  16 x 49   40 %
    Lucida Sans                               Swiss       Regular                        16 x 36   40 %
    Magneto                                   Decorative                       18 x 39   70 %
    Maiandra GD                               Swiss                               14 x 38   40 %
    Malgun Gothic                             Swiss       Regular                        15 x 43   40 %
    Malgun Gothic                             Swiss       Regular                         15 x 43   40 %
    Mangal                                    Roman       Regular                        19 x 54   40 %
    Marlett                                   Special     Regular                      31 x 32   50 %
    Matura MT Script Capitals                 Script                              14 x 43   40 %
    Meiryo UI                                 Swiss                             17 x 41   40 %
    Meiryo UI                                 Swiss                              17 x 41   40 %
    Meiryo UI                                 Swiss                               17 x 41   40 %
    Meiryo UI                                 Swiss                          17 x 41   40 %
    Meiryo UI                                 Swiss                               17 x 41   40 %
    Meiryo UI                                 Swiss                  17 x 41   40 %
    Meiryo UI                                 Swiss                               17 x 41   40 %
    Meiryo                                    Swiss                             31 x 48   40 %
    Meiryo                                    Swiss                              31 x 48   40 %
    Meiryo                                    Swiss                               31 x 48   40 %
    Meiryo                                    Swiss                          31 x 48   40 %
    Meiryo                                    Swiss                               31 x 48   40 %
    Meiryo                                    Swiss                  31 x 48   40 %
    Meiryo                                    Swiss                               31 x 48   40 %
    Microsoft Himalaya                        Special                             13 x 32   40 %
    Microsoft JhengHei                        Swiss                              15 x 43   40 %
    Microsoft JhengHei                        Swiss                               15 x 43   40 %
    Microsoft JhengHei                        Swiss                (BIG5)        15 x 43   40 %
    Microsoft New Tai Lue                     Swiss       Regular                        19 x 42   40 %
    Microsoft PhagsPa                         Swiss       Regular                        24 x 41   40 %
    Microsoft Sans Serif                      Swiss                               14 x 36   40 %
    Microsoft Sans Serif                      Swiss                             14 x 36   40 %
    Microsoft Sans Serif                      Swiss                            14 x 36   40 %
    Microsoft Sans Serif                      Swiss                              14 x 36   40 %
    Microsoft Sans Serif                      Swiss                               14 x 36   40 %
    Microsoft Sans Serif                      Swiss                                  14 x 36   40 %
    Microsoft Sans Serif                      Swiss                          14 x 36   40 %
    Microsoft Sans Serif                      Swiss                                14 x 36   40 %
    Microsoft Sans Serif                      Swiss                               14 x 36   40 %
    Microsoft Sans Serif                      Swiss                  14 x 36   40 %
    Microsoft Tai Le                          Swiss       Regular                        19 x 41   40 %
    Microsoft Uighur                          Special                             13 x 32   40 %
    Microsoft Uighur                          Special                             13 x 32   40 %
    Microsoft YaHei                           Swiss                              15 x 42   40 %
    Microsoft YaHei                           Swiss                               15 x 42   40 %
    Microsoft YaHei                           Swiss                          15 x 42   40 %
    Microsoft YaHei                           Swiss                (2312)        15 x 42   40 %
    Microsoft YaHei                           Swiss                               15 x 42   40 %
    Microsoft YaHei                           Swiss                  15 x 42   40 %
    Microsoft Yi Baiti                        Script                              21 x 32   40 %
    MingLiU                                   Modern      Regular                        16 x 32   40 %
    MingLiU                                   Modern      Regular         (BIG5)        16 x 32   40 %
    MingLiU_HKSCS                             Roman       Regular                        16 x 32   40 %
    MingLiU_HKSCS                             Roman       Regular         (BIG5)        16 x 32   40 %
    MingLiU_HKSCS-ExtB                        Roman       Regular                        16 x 32   40 %
    MingLiU_HKSCS-ExtB                        Roman       Regular         (BIG5)        16 x 32   40 %
    MingLiU-ExtB                              Roman       Regular                        16 x 32   40 %
    MingLiU-ExtB                              Roman       Regular         (BIG5)        16 x 32   40 %
    Miriam Fixed                              Modern      Regular                           19 x 32   40 %
    Miriam                                    Swiss       Regular                           13 x 32   40 %
    Mistral                                   Script                            10 x 39   40 %
    Mistral                                   Script                             10 x 39   40 %
    Mistral                                   Script                              10 x 39   40 %
    Mistral                                   Script                         10 x 39   40 %
    Mistral                                   Script                              10 x 39   40 %
    Mistral                                   Script                 10 x 39   40 %
    Modern No. 20                             Roman                               13 x 33   40 %
    Modern                                    Modern                     OEM/DOS                 19 x 37   40 %
    Mongolian Baiti                           Script                              14 x 34   40 %
    Monotype Corsiva                          Script                            11 x 35   40 %
    Monotype Corsiva                          Script                             11 x 35   40 %
    Monotype Corsiva                          Script                              11 x 35   40 %
    Monotype Corsiva                          Script                         11 x 35   40 %
    Monotype Corsiva                          Script                              11 x 35   40 %
    Monotype Corsiva                          Script                 11 x 35   40 %
    MoolBoran                                 Swiss                               13 x 43   40 %
    MS Gothic                                 Modern      Regular                      16 x 32   40 %
    MS Gothic                                 Modern      Regular                       16 x 32   40 %
    MS Gothic                                 Modern      Regular                        16 x 32   40 %
    MS Gothic                                 Modern      Regular                   16 x 32   40 %
    MS Gothic                                 Modern      Regular                        16 x 32   40 %
    MS Gothic                                 Modern      Regular           16 x 32   40 %
    MS Gothic                                 Modern      Regular                        16 x 32   40 %
    MS Mincho                                 Modern      Regular                      16 x 32   40 %
    MS Mincho                                 Modern      Regular                       16 x 32   40 %
    MS Mincho                                 Modern      Regular                        16 x 32   40 %
    MS Mincho                                 Modern      Regular                   16 x 32   40 %
    MS Mincho                                 Modern      Regular                        16 x 32   40 %
    MS Mincho                                 Modern      Regular           16 x 32   40 %
    MS Mincho                                 Modern      Regular                        16 x 32   40 %
    MS Outlook                                Special                           31 x 33   40 %
    MS PGothic                                Swiss       Regular                      13 x 32   40 %
    MS PGothic                                Swiss       Regular                       13 x 32   40 %
    MS PGothic                                Swiss       Regular                        13 x 32   40 %
    MS PGothic                                Swiss       Regular                   13 x 32   40 %
    MS PGothic                                Swiss       Regular                        13 x 32   40 %
    MS PGothic                                Swiss       Regular           13 x 32   40 %
    MS PGothic                                Swiss       Regular                        13 x 32   40 %
    MS PMincho                                Roman       Regular                      13 x 32   40 %
    MS PMincho                                Roman       Regular                       13 x 32   40 %
    MS PMincho                                Roman       Regular                        13 x 32   40 %
    MS PMincho                                Roman       Regular                   13 x 32   40 %
    MS PMincho                                Roman       Regular                        13 x 32   40 %
    MS PMincho                                Roman       Regular           13 x 32   40 %
    MS PMincho                                Roman       Regular                        13 x 32   40 %
    MS Reference Sans Serif                   Swiss                             16 x 39   40 %
    MS Reference Sans Serif                   Swiss                            16 x 39   40 %
    MS Reference Sans Serif                   Swiss                              16 x 39   40 %
    MS Reference Sans Serif                   Swiss                               16 x 39   40 %
    MS Reference Sans Serif                   Swiss                          16 x 39   40 %
    MS Reference Sans Serif                   Swiss                               16 x 39   40 %
    MS Reference Sans Serif                   Swiss                  16 x 39   40 %
    MS Reference Specialty                    Special                           23 x 39   40 %
    MS Sans Serif                             Swiss                                  5 x 13   40 %
    MS Serif                                  Roman                                  5 x 13   40 %
    MS UI Gothic                              Swiss       Regular                      13 x 32   40 %
    MS UI Gothic                              Swiss       Regular                       13 x 32   40 %
    MS UI Gothic                              Swiss       Regular                        13 x 32   40 %
    MS UI Gothic                              Swiss       Regular                   13 x 32   40 %
    MS UI Gothic                              Swiss       Regular                        13 x 32   40 %
    MS UI Gothic                              Swiss       Regular           13 x 32   40 %
    MS UI Gothic                              Swiss       Regular                        13 x 32   40 %
    MT Extra                                  Roman       Regular                      20 x 32   40 %
    MV Boli                                   Special                             18 x 52   40 %
    Narkisim                                  Swiss       Regular                           12 x 32   40 %
    Niagara Engraved                          Decorative                           8 x 34   40 %
    Niagara Solid                             Decorative                           8 x 34   40 %
    NSimSun                                   Modern      Regular                        16 x 32   40 %
    NSimSun                                   Modern      Regular         (2312)        16 x 32   40 %
    Nyala                                     Special                           18 x 33   40 %
    Nyala                                     Special                             18 x 33   40 %
    Nyala                                     Special                             18 x 33   40 %
    Nyala                                     Special                18 x 33   40 %
    OCR A Extended                            Modern                              19 x 33   40 %
    Old English Text MT                       Script                              12 x 39   40 %
    Onyx                                      Decorative                           8 x 37   40 %
    Palace Script MT                          Script      Regular                         7 x 30   40 %
    Palatino Linotype                         Roman                             14 x 43   40 %
    Palatino Linotype                         Roman                            14 x 43   40 %
    Palatino Linotype                         Roman                              14 x 43   40 %
    Palatino Linotype                         Roman                               14 x 43   40 %
    Palatino Linotype                         Roman                          14 x 43   40 %
    Palatino Linotype                         Roman                               14 x 43   40 %
    Palatino Linotype                         Roman                  14 x 43   40 %
    Papyrus                                   Script                              13 x 50   40 %
    Parchment                                 Script                               6 x 34   40 %
    Perpetua Titling MT                       Roman                            21 x 39   70 %
    Perpetua                                  Roman                               12 x 37   40 %
    Plantagenet Cherokee                      Roman                               14 x 41   40 %
    Playbill                                  Decorative                           8 x 32   40 %
    PMingLiU                                  Roman       Regular                        16 x 32   40 %
    PMingLiU                                  Roman       Regular         (BIG5)        16 x 32   40 %
    PMingLiU-ExtB                             Roman       Regular                        16 x 32   40 %
    PMingLiU-ExtB                             Roman       Regular         (BIG5)        16 x 32   40 %
    Poor Richard                              Roman                               12 x 36   40 %
    Pristina                                  Script                              10 x 42   40 %
    Raavi                                     Swiss       Regular                        13 x 53   40 %
    Rage Italic                               Script                              11 x 40   40 %
    Ravie                                     Decorative                          22 x 43   40 %
    Rockwell Condensed                        Roman                               11 x 38   40 %
    Rockwell Extra Bold                       Roman                               19 x 38   80 %
    Rockwell                                  Roman                               15 x 38   40 %
    Rod                                       Modern      Regular                           19 x 31   40 %
    Roman                                     Roman                      OEM/DOS                 22 x 37   40 %
    Sakkal Majalla                            Special                             16 x 45   40 %
    Sakkal Majalla                            Special                           16 x 45   40 %
    Sakkal Majalla                            Special                             16 x 45   40 %
    Sakkal Majalla                            Special                             16 x 45   40 %
    Sakkal Majalla                            Special                16 x 45   40 %
    Script MT Bold                            Script      Regular                        13 x 39   70 %
    Script                                    Script                     OEM/DOS                 16 x 36   40 %
    Segoe Print                               Special     Regular                      21 x 56   40 %
    Segoe Print                               Special     Regular                       21 x 56   40 %
    Segoe Print                               Special     Regular                        21 x 56   40 %
    Segoe Print                               Special     Regular                   21 x 56   40 %
    Segoe Print                               Special     Regular                        21 x 56   40 %
    Segoe Print                               Special     Regular           21 x 56   40 %
    Segoe Script                              Swiss                             22 x 51   40 %
    Segoe Script                              Swiss                              22 x 51   40 %
    Segoe Script                              Swiss                               22 x 51   40 %
    Segoe Script                              Swiss                          22 x 51   40 %
    Segoe Script                              Swiss                               22 x 51   40 %
    Segoe Script                              Swiss                  22 x 51   40 %
    Segoe UI Light                            Swiss       Regular                      17 x 43   30 %
    Segoe UI Light                            Swiss       Regular                     17 x 43   30 %
    Segoe UI Light                            Swiss       Regular                       17 x 43   30 %
    Segoe UI Light                            Swiss       Regular                        17 x 43   30 %
    Segoe UI Light                            Swiss       Regular                   17 x 43   30 %
    Segoe UI Light                            Swiss       Regular                        17 x 43   30 %
    Segoe UI Light                            Swiss       Regular           17 x 43   30 %
    Segoe UI Semibold                         Swiss       Regular                      18 x 43   60 %
    Segoe UI Semibold                         Swiss       Regular                     18 x 43   60 %
    Segoe UI Semibold                         Swiss       Regular                       18 x 43   60 %
    Segoe UI Semibold                         Swiss       Regular                        18 x 43   60 %
    Segoe UI Semibold                         Swiss       Regular                   18 x 43   60 %
    Segoe UI Semibold                         Swiss       Regular                        18 x 43   60 %
    Segoe UI Semibold                         Swiss       Regular           18 x 43   60 %
    Segoe UI Symbol                           Swiss                               23 x 43   40 %
    Segoe UI                                  Swiss                               17 x 43   40 %
    Segoe UI                                  Swiss                             17 x 43   40 %
    Segoe UI                                  Swiss                            17 x 43   40 %
    Segoe UI                                  Swiss                              17 x 43   40 %
    Segoe UI                                  Swiss                               17 x 43   40 %
    Segoe UI                                  Swiss                          17 x 43   40 %
    Segoe UI                                  Swiss                               17 x 43   40 %
    Segoe UI                                  Swiss                  17 x 43   40 %
    Shonar Bangla                             Swiss       Regular                        16 x 41   40 %
    Showcard Gothic                           Decorative                          18 x 40   40 %
    Shruti                                    Swiss       Regular                        14 x 54   40 %
    SimHei                                    Modern                              16 x 32   40 %
    SimHei                                    Modern               (2312)        16 x 32   40 %
    Simplified Arabic Fixed                   Modern      Regular                        19 x 35   40 %
    Simplified Arabic Fixed                   Modern      Regular                        19 x 35   40 %
    Simplified Arabic                         Roman       Regular                        13 x 53   40 %
    Simplified Arabic                         Roman       Regular                        13 x 53   40 %
    SimSun                                    Special     Regular                        16 x 32   40 %
    SimSun                                    Special     Regular         (2312)        16 x 32   40 %
    SimSun-ExtB                               Modern                              16 x 32   40 %
    SimSun-ExtB                               Modern               (2312)        16 x 32   40 %
    Small Fonts                               Swiss                                   1 x 3   40 %
    Snap ITC                                  Decorative                          19 x 41   40 %
    standard 07_57                            Special     Regular                       15 x 48   40 %
    standard 07_57                            Special     Regular                        15 x 48   40 %
    standard 07_57                            Special     Regular                        15 x 48   40 %
    Stencil                                   Decorative                          18 x 38   40 %
    Sylfaen                                   Roman                             13 x 42   40 %
    Sylfaen                                   Roman                              13 x 42   40 %
    Sylfaen                                   Roman                               13 x 42   40 %
    Sylfaen                                   Roman                          13 x 42   40 %
    Sylfaen                                   Roman                               13 x 42   40 %
    Sylfaen                                   Roman                  13 x 42   40 %
    Symbol                                    Roman                             19 x 39   40 %
    System                                    Swiss                                  7 x 16   70 %
    Tahoma                                    Swiss                               14 x 39   40 %
    Tahoma                                    Swiss                             14 x 39   40 %
    Tahoma                                    Swiss                            14 x 39   40 %
    Tahoma                                    Swiss                              14 x 39   40 %
    Tahoma                                    Swiss                               14 x 39   40 %
    Tahoma                                    Swiss                                  14 x 39   40 %
    Tahoma                                    Swiss                          14 x 39   40 %
    Tahoma                                    Swiss                                14 x 39   40 %
    Tahoma                                    Swiss                               14 x 39   40 %
    Tahoma                                    Swiss                  14 x 39   40 %
    Tempus Sans ITC                           Decorative                          13 x 42   40 %
    Terminal                                  Modern                     OEM/DOS                  8 x 12   40 %
    Times New Roman                           Roman                               13 x 35   40 %
    Times New Roman                           Roman                             13 x 35   40 %
    Times New Roman                           Roman                            13 x 35   40 %
    Times New Roman                           Roman                              13 x 35   40 %
    Times New Roman                           Roman                               13 x 35   40 %
    Times New Roman                           Roman                                  13 x 35   40 %
    Times New Roman                           Roman                          13 x 35   40 %
    Times New Roman                           Roman                               13 x 35   40 %
    Times New Roman                           Roman                  13 x 35   40 %
    Traditional Arabic                        Roman       Regular                        15 x 48   40 %
    Traditional Arabic                        Roman       Regular                        15 x 48   40 %
    Trebuchet MS                              Swiss                             15 x 37   40 %
    Trebuchet MS                              Swiss                              15 x 37   40 %
    Trebuchet MS                              Swiss                               15 x 37   40 %
    Trebuchet MS                              Swiss                          15 x 37   40 %
    Trebuchet MS                              Swiss                               15 x 37   40 %
    Trebuchet MS                              Swiss                  15 x 37   40 %
    Tunga                                     Swiss       Regular                        18 x 53   40 %
    Tw Cen MT Condensed Extra Bold            Swiss                               12 x 35   40 %
    Tw Cen MT Condensed Extra Bold            Swiss                  12 x 35   40 %
    Tw Cen MT Condensed                       Swiss                            11 x 34   70 %
    Tw Cen MT Condensed                       Swiss               11 x 34   70 %
    Tw Cen MT                                 Swiss                               13 x 35   40 %
    Tw Cen MT                                 Swiss                  13 x 35   40 %
    Utsaah                                    Swiss       Regular                        13 x 36   40 %
    Vani                                      Swiss       Regular                        23 x 54   40 %
    Verdana                                   Swiss                             16 x 39   40 %
    Verdana                                   Swiss                            16 x 39   40 %
    Verdana                                   Swiss                              16 x 39   40 %
    Verdana                                   Swiss                               16 x 39   40 %
    Verdana                                   Swiss                          16 x 39   40 %
    Verdana                                   Swiss                               16 x 39   40 %
    Verdana                                   Swiss                  16 x 39   40 %
    Vijaya                                    Swiss       Regular                        19 x 32   40 %
    Viner Hand ITC                            Script                              15 x 52   40 %
    Vivaldi                                   Script                                9 x 38   40 %
    Vladimir Script                           Script                              10 x 39   40 %
    Vrinda                                    Swiss       Regular                        20 x 44   40 %
    Webdings                                  Roman                             31 x 32   40 %
    Wide Latin                                Roman                               26 x 39   40 %
    Wingdings 2                               Roman       Regular                      27 x 34   40 %
    Wingdings 3                               Roman       Regular                      25 x 36   40 %
    Wingdings                                 Special     Regular                      28 x 36   40 %


--------[  Windows ]-----------------------------------------------------------------------------------------------

    midi-out.0   0001 001B  Microsoft GS Wavetable Synth
    mixer.0      0001 FFFF    (HDMI) (
    mixer.1      FFFF FFFF   (3- USB Microphone)
    wave-in.0    FFFF FFFF   (3- USB Microphone)
    wave-out.0   0001 FFFF    (HDMI) (


--------[  PCI / PnP ]---------------------------------------------------------------------------------------------

    Realtek ALC888/1200 @ Intel 82801HB ICH8 - High Definition Audio Controller [B-0]  PCI


--------[ HD Audio ]----------------------------------------------------------------------------------------------------

  [ Intel 82801HB ICH8 - High Definition Audio Controller [B-0] ]

     :
                                      Intel 82801HB ICH8 - High Definition Audio Controller [B-0]
        (Windows)                      High Definition Audio (Microsoft)
                                                 PCI
      ID                                      8086-284B
                               1462-7235
                                                  02
       ID                                     PCI\VEN_8086&DEV_284B&SUBSYS_72351462&REV_02

  [ Realtek ALC888/1200 ]

     :
                                      Realtek ALC888/1200
        (Windows)                        High Definition Audio
                                           Audio
                                                 HDAUDIO
      ID                                      10EC-0888
                               1462-7235
                                                  1000
       ID                                     HDAUDIO\FUNC_01&VEN_10EC&DEV_0888&SUBSYS_14627235&REV_1000


--------[ OpenAL ]------------------------------------------------------------------------------------------------------

     OpenAL:
                                           Creative Labs Inc.
      Renderer                                          
                                                  1.1
                                           Generic Software
      OpenAL DLL                                        6.14.0357.23
      Creative OpenAL DLL                               
      Wrapper DLL                                       2.2.0.0
                                0
      X-RAM                                             

     OpenAL:
      AL_EXT_EXPONENT_DISTANCE                          
      AL_EXT_LINEAR_DISTANCE                            
      AL_EXT_OFFSET                                     
      ALC_ENUMERATE_ALL_EXT                             
      ALC_ENUMERATION_EXT                               
      ALC_EXT_CAPTURE                                   
      ALC_EXT_EFX                                       
      EAX                                               
      EAX2.0                                            
      EAX3.0                                             
      EAX3.0EMULATED                                    
      EAX4.0                                             
      EAX4.0EMULATED                                    
      EAX5.0                                             
      EAX-RAM                                            


--------[   ]------------------------------------------------------------------------------------------------

  [ Fraunhofer IIS MPEG Layer-3 Codec (decode only) ]

      ACM:
                                        Fraunhofer IIS MPEG Layer-3 Codec (decode only)
      Copyright-                                  Copyright  1996-1999 Fraunhofer Institut Integrierte Schaltungen IIS
                                         decoder only version
                                          1.09

  [  ADPCM (Microsoft) ]

      ACM:
                                         ADPCM (Microsoft)
      Copyright-                                    , 1992-1996.
                                             Microsoft ADPCM.
                                          4.00

  [  CCITT G.711 A-Law  u-Law (Microsoft) ]

      ACM:
                                         CCITT G.711 A-Law  u-Law (Microsoft)
      Copyright-                                  ()  , 1993-1996.
                                             CCITT G.711 A-Law / u-Law.
                                          4.00

  [  GSM 6.10 (Microsoft) ]

      ACM:
                                         GSM 6.10 (Microsoft)
      Copyright-                                  ()  , 1993-1996.
                                                 ETSI-GSM (European Telecommunications Standards Institute-Groupe Special Mobile)  6.10.
                                          4.00

  [  IMA ADPCM (Microsoft) ]

      ACM:
                                         IMA ADPCM (Microsoft)
      Copyright-                                    , 1992-1996.
                                             IMA ADPCM.
                                          4.00

  [  PCM Microsoft ]

      ACM:
                                         PCM Microsoft
      Copyright-                                    , 1992-1996.
                                                PCM.
                                          5.00


--------[   ]------------------------------------------------------------------------------------------------

    ff_vfw.dll                                                     ffdshow video encoder
    iccvid.dll                 1.10.0.11                            Cinepak
    iyuv_32.dll                6.1.7600.16385 (win7_rtm.090713-1255)  Intel Indeo(R) Video YUV 
    msrle32.dll                6.1.7600.16385 (win7_rtm.090713-1255)  Microsoft RLE Compressor
    msvidc32.dll               6.1.7600.16385 (win7_rtm.090713-1255)    Microsoft Video 1
    msyuv.dll                  6.1.7601.17514 (win7sp1_rtm.101119-1850)  Microsoft UYVY Video Decompressor
    tsbyuv.dll                 6.1.7601.17514 (win7sp1_rtm.101119-1850)  Toshiba Video Codec
    xvidvfw.dll                                                    


--------[ MCI ]---------------------------------------------------------------------------------------------------------

  [ AVIVideo ]

      MCI:
                                              AVIVideo
                                                       Windows
                                                 MCI Video  Windows
                                                     Digital Video Device
                                                 mciavi32.dll
                                                  

      MCI:
                                     
                                  
                                      
                                         
                                 
                                                  
                                        
      ''                             
                                      
                                         
                                         
                                            
                                          
                                          
                                

  [ CDAudio ]

      MCI:
                                              CDAudio
                                                     -
                                                 MCI   cdaudio
                                                     CD Audio Device
                                                 mcicda.dll
                                                  

      MCI:
                                     
                                  
                                      
                                         
                                                  
                                        
                                          
                                          

  [ MPEGVideo ]

      MCI:
                                              MPEGVideo
                                                     DirectShow
                                                 MCI DirectShow
                                                     Digital Video Device
                                                 mciqtz32.dll
                                                  

      MCI:
                                     
                                  
                                      
                                         
                                 
                                                  
                                        
      ''                             
                                      
                                         
                                         
                                            
                                          
                                          
                                

  [ Sequencer ]

      MCI:
                                              Sequencer
                                                      MIDI
                                                 MCI   MIDI
                                                     Sequencer Device
                                                 mciseq.dll
                                                  

      MCI:
                                     
                                  
                                      
                                         
                                                  
                                        
                                          
                                          

  [ WaveAudio ]

      MCI:
                                              WaveAudio
                                                     Sound
                                                 MCI   
                                                     Waveform Audio Device
                                                 mciwave.dll
                                                  

      MCI:
                                     
                                  
                                      
                                         
                                                  
                                        
                                          
                                          


--------[   Windows ]-------------------------------------------------------------------------------------

  [ ST31000528AS ATA Device ]

     :
                                        ST31000528AS ATA Device
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          disk.inf

       :
                                           Seagate
                                   Barracuda 7200.12 1000528
      -                                       3.5"
                                  1000 
                                                   2
                                 4
                                      146.99 x 101.6 x 26.1 mm
                                         622 g
                                4.16 ms
                                        7200 RPM
      .                     1695 /
                                      8.5 ms
                                1 ms
                                               SATA-II
        '-'                300 /
                                             32 
                                          10 

     :
                                                   Seagate Technology LLC
                                     http://www.seagate.com/products

  [ ST3320418AS ATA Device ]

     :
                                        ST3320418AS ATA Device
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          disk.inf

       :
                                           Seagate
                                   Barracuda 7200.12 320418
      -                                       3.5"
                                  320 
                                                   1
                                 2
                                      146.99 x 101.6 x 19.98 mm
                                         415 g
                                4.16 ms
                                        7200 RPM
      .                     1695 /
                                      8.5 ms
                                1 ms
                                               SATA-II
        '-'                300 /
                                             16 
                                          8.5 

     :
                                                   Seagate Technology LLC
                                     http://www.seagate.com/products

  [ HL-DT-ST DVD-RAM GH82N ATA Device ]

     :
                                        HL-DT-ST DVD-RAM GH82N ATA Device
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          cdrom.inf

     :
                                                   LG Electronics
                                     http://www.lge.com/products/category/list/computer%20products_optical%20storage.jhtml
       firmware                                 http://www.lge.com/support/main.jhtml

  [ ATA Channel 0 ]

     :
                                        ATA Channel 0
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          mshdc.inf

  [ ATA Channel 0 ]

     :
                                        ATA Channel 0
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          mshdc.inf

  [ ATA Channel 0 ]

     :
                                        ATA Channel 0
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          mshdc.inf

  [ ATA Channel 1 ]

     :
                                        ATA Channel 1
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          mshdc.inf

  [ ATA Channel 1 ]

     :
                                        ATA Channel 1
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          mshdc.inf

  [ ATA Channel 1 ]

     :
                                        ATA Channel 1
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          mshdc.inf

  [  Intel(R) ICH8 Serial ATA Storage (2-) - 2825 ]

     :
                                         Intel(R) ICH8 Serial ATA Storage (2-) - 2825
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          mshdc.inf

     :
      IRQ                                               19
                                                    9480-948F
                                                    9800-980F
                                                    9880-9883
                                                    9C00-9C07
                                                    A000-A003
                                                    A080-A087

  [  Intel(R) ICH8 Serial ATA Storage (4-) - 2820 ]

     :
                                         Intel(R) ICH8 Serial ATA Storage (4-) - 2820
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          mshdc.inf

     :
      IRQ                                               19
                                                    A480-A48F
                                                    A800-A80F
                                                    A880-A883
                                                    AC00-AC07
                                                    B000-B003
                                                    B080-B087

  [    PCI IDE ]

     :
                                           PCI IDE
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          mshdc.inf

     :
      IRQ                                               17
                                                  FEAFFC00-FEAFFFFF
                                                    D400-D40F
                                                    D480-D483
                                                    D800-D807
                                                    D880-D883
                                                    DC00-DC07


--------[   ]--------------------------------------------------------------------------------------------

    C:                                               NTFS         305142      123159      181983    60 %  50AE-C8F2
    D: (MusicVideo)                                  NTFS         753866      621269      132597    18 %  4386-3D94
    E: (Tatyana)                                     NTFS         199998      146833       53165    27 %  A62C-8644
    F:                                                                                                               


--------[   ]--------------------------------------------------------------------------------------------

  [  #1 - ST3320418AS (298 ) ]

    #1 ()    NTFS                                                             1 MB      100 MB
    #2               NTFS             C:                                            101 MB   305143 MB

  [  #2 - ST31000528AS (931 ) ]

    #1 ()    NTFS             D: (MusicVideo)                                 1 MB   753867 MB
    #2               NTFS             E: (Tatyana)                               753868 MB   199999 MB


--------[   ]---------------------------------------------------------------------------------------

  [ F:\  HL-DT-ST DVD-RAM GH82N ATA Device ]

      :
                                      HL-DT-ST DVD-RAM GH82N ATA Device
                                           K1ED16B3515
       firmware                                   KU02
       firmware                                     13.12.2011
                                             2 
                                              
                               5
                                      4

      :
      BD-ROM                                             
      BD-R                                               
      BD-RE                                              
      HD DVD-ROM                                         
      HD DVD-R                                           
      HD DVD-RW                                          
      DVD-ROM                                           
      DVD+R9 Dual Layer                                  + 
      DVD+R                                              + 
      DVD+RW                                             + 
      DVD-R9 Dual Layer                                  + 
      DVD-R                                              + 
      DVD-RW                                             + 
      DVD-RAM                                            + 
      CD-ROM                                            
      CD-R                                               + 
      CD-RW                                              + 

      :
      Buffer Underrun Protection                        
      C2 Error Pointers                                 
      CD+G                                               
      CD-Text                                           
      Hybrid Disc                                        
      JustLink                                           
      LabelFlash                                         
      Layer-Jump Recording                              
      LightScribe                                        
      Mount Rainier                                      
      SMART                                             
      CSS                                               
      CPRM                                              
      AACS                                               
      VCPS                                               
      BD CPS                                             


--------[ ATA ]---------------------------------------------------------------------------------------------------------

  [ ST31000528AS (9VP5E6LZ) ]

      ATA:
      ID                                          ST31000528AS
                                           9VP5E6LZ
                                                  CC38
      World Wide Name                                   5-000C50-01FF4B48D
                                           SATA-II
                                               : 1938021, : 16,   : 63,   : 512
       LBA                                       1953525168
                                                   
                                           16
       ECC                                         4
                                953870 

      ATA:
      48-bit LBA                                        
       (APM)                             
      Automatic Acoustic Management                     , 
      Device Configuration Overlay                      
      DMA Setup Auto-Activate                            
      General Purpose Logging                           
      Host Protected Area                               , 
      In-Order Data Delivery                             
      Native Command Queuing                            
      Phy Event Counters                                
                                          , 
      Power-Up In Standby                                
      Read Look-Ahead                                   , 
      Release Interrupt                                  
                                       , 
      SMART                                             , 
      SMART Error Logging                               
      SMART Self-Test                                   
      Software Settings Preservation                    , 
      Streaming                                          
      Tagged Command Queuing                             
                                               , 

       ATA:
                                           Seagate
                                   Barracuda 7200.12 1000528
      -                                       3.5"
                                  1000 
                                                   2
                                 4
                                      146.99 x 101.6 x 26.1 mm
                                         622 g
                                4.16 ms
                                        7200 RPM
      .                     1695 /
                                      8.5 ms
                                1 ms
                                               SATA-II
        '-'                300 /
                                             32 
                                          10 

     ATA-:
                                                   Seagate Technology LLC
                                     http://www.seagate.com/products

  [ ST3320418AS (9VMFYAW7) ]

      ATA:
      ID                                          ST3320418AS
                                           9VMFYAW7
                                                  CC38
      World Wide Name                                   5-000C50-026438B4A
                                           SATA-II
                                               : 620181, : 16,   : 63,   : 512
       LBA                                       625142448
                                                   16 
                                           16
       ECC                                         4
                                305245 

      ATA:
      48-bit LBA                                        
       (APM)                             
      Automatic Acoustic Management                     , 
      Device Configuration Overlay                      
      DMA Setup Auto-Activate                            
      General Purpose Logging                           
      Host Protected Area                               , 
      In-Order Data Delivery                             
      Native Command Queuing                            
      Phy Event Counters                                
                                          , 
      Power-Up In Standby                                
      Read Look-Ahead                                   , 
      Release Interrupt                                  
                                       , 
      SMART                                             , 
      SMART Error Logging                               
      SMART Self-Test                                   
      Software Settings Preservation                    , 
      Streaming                                          
      Tagged Command Queuing                             
                                               , 

       ATA:
                                           Seagate
                                   Barracuda 7200.12 320418
      -                                       3.5"
                                  320 
                                                   1
                                 2
                                      146.99 x 101.6 x 19.98 mm
                                         415 g
                                4.16 ms
                                        7200 RPM
      .                     1695 /
                                      8.5 ms
                                1 ms
                                               SATA-II
        '-'                300 /
                                             16 
                                          8.5 

     ATA-:
                                                   Seagate Technology LLC
                                     http://www.seagate.com/products


--------[ SMART ]-------------------------------------------------------------------------------------------------------

  [ ST31000528AS (9VP5E6LZ) ]

    01  Raw Read Error Rate                  6    116  99    115757705  OK:  
    03  Spinup Time                          0    95   94            0  OK:  
    04  Start/Stop Count                     20   92   92         8716  OK:  
    05  Reallocated Sector Count             36   100  100           0  OK:  
    07  Seek Error Rate                      30   74   60     29331221  OK:  
    09  Power-On Time Count                  0    94   94         6008  OK:  
    0A  Spinup Retry Count                   97   100  100           0  OK:  
    0C  Power Cycle Count                    20   97   97         3839  OK:  
    B7  <  >              0    100  100           0  OK:  
    B8  <  >              99   100  100           0  OK:  
    BB  <  >              0    100  100           0  OK:  
    BC  <  >              0    100  99            2  OK:  
    BD  <  >              0    99   99            1  OK:  
    BE  Airflow Temperature                  45   66   49    572129314  OK:  
    C2  Temperature                          0    34   51           34  OK:  
    C3  Hardware ECC Recovered               0    32   23    115757705  OK:  
    C5  Current Pending Sector Count         0    100  100           0  OK:  
    C6  Offline Uncorrectable Sector Count   0    100  100           0  OK:  
    C7  Ultra ATA CRC Error Rate             0    200  200          42  OK:  
    F0  Head Flying Hours                    0    100  253       16395  OK:  
    F1  <  >              0    100  253   890304405  OK:  
    F2  <  >              0    100  253  4053258156  OK:  

  [ ST3320418AS (9VMFYAW7) ]

    01  Raw Read Error Rate                  6    118  99    193607468  OK:  
    03  Spinup Time                          0    97   97            0  OK:  
    04  Start/Stop Count                     20   92   92         8223  OK:  
    05  Reallocated Sector Count             36   100  100           0  OK:  
    07  Seek Error Rate                      30   83   60    217818600  OK:  
    09  Power-On Time Count                  0    92   92         7318  OK:  
    0A  Spinup Retry Count                   97   100  100           0  OK:  
    0C  Power Cycle Count                    20   97   97         4021  OK:  
    B7  <  >              0    100  100           0  OK:  
    B8  <  >              99   100  100           0  OK:  
    BB  <  >              0    100  100           0  OK:  
    BC  <  >              0    100  99           23  OK:  
    BD  <  >              0    100  100           0  OK:  
    BE  Airflow Temperature                  45   65   51    588906531  OK:  
    C2  Temperature                          0    35   49           35  OK:  
    C3  Hardware ECC Recovered               0    52   45    193607468  OK:  
    C5  Current Pending Sector Count         0    100  100           0  OK:  
    C6  Offline Uncorrectable Sector Count   0    100  100           0  OK:  
    C7  Ultra ATA CRC Error Rate             0    200  200           4  OK:  
    F0  Head Flying Hours                    0    100  253       17661  OK:  
    F1  <  >              0    100  253   628192713  OK:  
    F2  <  >              0    100  253  1156720666  OK:  


--------[  Windows ]------------------------------------------------------------------------------------------------

  [ ASUS USB-N10 150Mbps 11n Wireless USB dongle ]

      :
                                          ASUS USB-N10 150Mbps 11n Wireless USB dongle
                                           802.11 Wireless Ethernet
                                         10-C3-7B-C8-92-60
                                                
                                      186 Mbps
      MTU                                               1500 
      DHCP-                               26.11.2015 7:32:58
      DHCP-                               03.12.2015 7:32:58
                                            5693899 (5.4 )
                                          1504451 (1.4 )

      :
       IP /                                 192.168.137.234 / 255.255.255.0
                                                    192.168.137.1
      DHCP                                              192.168.137.1
      DNS                                               192.168.137.1

  [   Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC (NDIS 6.20) ]

      :
                                            Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC (NDIS 6.20)
                                           Gigabit Ethernet
                                         00-00-DB-4D-6D-EE
                                                 
      MTU                                               1500 
                                            0
                                          0

      :
                                                   Realtek Semiconductor Corp.
                                     http://www.realtek.com.tw/products/productsView.aspx?Langid=1&PNid=7&PFid=10&Level=3&Conn=2
                                       http://www.realtek.com.tw/downloads
                                     http://driveragent.com?ref=59


--------[  PCI / PnP ]----------------------------------------------------------------------------------------------

    Realtek RTL8169/8110 Gigabit Ethernet Adapter (PHY: Realtek RTL8211/8212)         PCI


--------[ IAM ]---------------------------------------------------------------------------------------------------------

  [ Microsoft Communities ]

      :
                                        Microsoft Communities
      ID                                   account{AF4BAAF5-7121-4A7D-9C3A-2A7BFEFCB7D8}.oeaccount
                                         ( )
                                                (IE  )
      NNTP-                                       msnews.microsoft.com

      :
        NNTP                                
        NNTP                     
        NNTP                        
         NNTP             
       NNTP                
       NNTP   HTML                         

  [ Active Directory ]

      :
                                        Active Directory
      ID                                   account{2DE0AF63-12C8-4703-BD17-542C7B293D30}.oeaccount
                                        LDAP
                                                (IE  )
      LDAP-                                       NULL:3268
        LDAP                             NULL
        LDAP                               NULL
        LDAP                               1 

      :
        LDAP                      
        LDAP                     
        LDAP                        
         LDAP                     

  [    VeriSign ]

      :
                                           VeriSign
      ID                                   account{113FFB48-78E0-4458-AC25-EE5D18A3E7EF}.oeaccount
                                        LDAP ( )
                                                (IE  )
      LDAP-                                       directory.verisign.com
      LDAP URL                                          http://www.verisign.com
        LDAP                               NULL
        LDAP                               1 

      :
        LDAP                      
        LDAP                     
        LDAP                        
         LDAP                     


--------[  ]----------------------------------------------------------------------------------------------------

     :
                                        about:blank
                                          http://go.microsoft.com/fwlink/?LinkId=54896
                               G:\

     :
                                            

    LAN-:
                                            


--------[  ]----------------------------------------------------------------------------------------------------

                  0.0.0.0          0.0.0.0    192.168.137.1  25   192.168.137.234 (ASUS USB-N10 150Mbps 11n Wireless USB dongle)
                127.0.0.0        255.0.0.0        127.0.0.1  306  127.0.0.1 (Software Loopback Interface 1)
                127.0.0.1  255.255.255.255        127.0.0.1  306  127.0.0.1 (Software Loopback Interface 1)
          127.255.255.255  255.255.255.255        127.0.0.1  306  127.0.0.1 (Software Loopback Interface 1)
            192.168.137.0    255.255.255.0  192.168.137.234  281  192.168.137.234 (ASUS USB-N10 150Mbps 11n Wireless USB dongle)
          192.168.137.234  255.255.255.255  192.168.137.234  281  192.168.137.234 (ASUS USB-N10 150Mbps 11n Wireless USB dongle)
          192.168.137.255  255.255.255.255  192.168.137.234  281  192.168.137.234 (ASUS USB-N10 150Mbps 11n Wireless USB dongle)
                224.0.0.0        240.0.0.0        127.0.0.1  306  127.0.0.1 (Software Loopback Interface 1)
                224.0.0.0        240.0.0.0  192.168.137.234  281  192.168.137.234 (ASUS USB-N10 150Mbps 11n Wireless USB dongle)
          255.255.255.255  255.255.255.255        127.0.0.1  306  127.0.0.1 (Software Loopback Interface 1)
          255.255.255.255  255.255.255.255  192.168.137.234  281  192.168.137.234 (ASUS USB-N10 150Mbps 11n Wireless USB dongle)


--------[ IE Cookie ]---------------------------------------------------------------------------------------------------

    2015-10-25 23:30:53  sima@flashboot.ru/files/file/388/download/sp_ufd_30_recovery_tool_v20820/
    2015-11-01 16:31:31  sima@dl.rutracker.org/forum/
    2015-11-04 21:51:12  sima@yandex.ru/
    2015-11-04 22:11:26  sima@sberbank-school.ru/
    2015-11-04 22:15:02  sima@sberbank.sabanow.net/
    2015-11-05 23:39:00  sima@login.taobao.com/member/
    2015-11-05 23:39:00  sima@ynuf.alipay.com/
    2015-11-05 23:48:25  sima@mmstat.com/
    2015-11-06 04:18:56  sima@taobao.com/item/
    2015-11-06 04:18:56  sima@world.taobao.com/item/
    2015-11-11 03:09:17  sima@taobao.com/
    2015-11-11 03:09:17  sima@taobao.com/auction/
    2015-11-11 03:09:43  sima@detail.tmall.com/
    2015-11-11 03:09:43  sima@tmall.com/
    2015-11-11 03:10:02  sima@world.tmall.com/
    2015-11-11 03:10:02  sima@world.tmall.com/item/
    2015-11-22 13:37:25  sima@www.piriform.com/speccy/download/portable/
    2015-11-26 07:22:14  sima@c.live.com/
    2015-11-26 07:22:14  sima@c.msn.com/


--------[   ]--------------------------------------------------------------------------------------------

    2015-10-14 10:21:18  sima@file:///C:/Users/sima/Desktop/%D0%B2%D0%BE%D0%B2%D0%B8%D0%BD%D1%8B%20%D0%B7%D0%B0%D0%B4%D0%B0%D1%87%D0%B8.xlsx
    2015-10-14 17:18:32  sima@file:///D:/Download/%D1%8D%D0%BA%D1%88%D0%B5%D0%BD%201.jpg
    2015-10-14 17:18:37  sima@file:///D:/Download/%D1%8D%D0%BA%D1%88%D0%B5%D0%BD.jpg
    2015-10-14 17:18:45  sima@file:///D:/Download/%D1%81%D0%B2%D0%B5%D1%80%D0%BA%D0%B0.JPG
    2015-10-20 07:19:04  sima@file:///D:/Download/%D1%84%D0%BE%D1%82%D0%BE/WP_20151019_12_23_40_Pro.jpg
    2015-10-20 07:19:13  sima@file:///D:/Download/%D1%84%D0%BE%D1%82%D0%BE/WP_20151019_12_24_11_Pro.jpg
    2015-10-20 07:19:25  sima@file:///D:/Download/%D1%84%D0%BE%D1%82%D0%BE/WP_20151019_12_24_49_Pro.jpg
    2015-10-20 07:19:41  sima@file:///D:/Download/%D1%84%D0%BE%D1%82%D0%BE/WP_20151019_12_25_09_Pro.jpg
    2015-10-20 07:19:48  sima@file:///D:/Download/%D1%84%D0%BE%D1%82%D0%BE/WP_20151019_12_25_48_Pro.jpg
    2015-10-20 07:19:51  sima@file:///D:/Download/%D1%84%D0%BE%D1%82%D0%BE/WP_20151019_12_25_43_Pro.jpg
    2015-10-21 07:44:22  sima@file:///C:/Users/sima/Desktop/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/WP_20151006_07_09_35_Pro.jpg
    2015-10-21 07:44:27  sima@file:///C:/Users/sima/Desktop/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/WP_20151006_07_09_43_Pro.jpg
    2015-10-21 07:46:14  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%A0%D0%BE%D0%B4%D0%B4%D0%BE%D0%BC/altApojLx60vUWvL4Z_inyYYyrm_w_rx5UFXu6ALXpNsVwJ.jpg
    2015-10-21 07:46:34  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%A0%D0%BE%D0%B4%D0%B4%D0%BE%D0%BC/IMG-20150212-WA0005.jpg
    2015-10-21 07:47:04  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/IMG_7330.JPG
    2015-10-21 08:04:09  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8669.JPG
    2015-10-21 08:07:00  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%92%D1%8B%D0%BF%D0%B8%D1%81%D0%BA%D0%B0/IMG_7277.JPG
    2015-10-21 08:07:04  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%92%D1%8B%D0%BF%D0%B8%D1%81%D0%BA%D0%B0/IMG_7278.JPG
    2015-10-21 08:07:16  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%9A%D0%BE%D0%BF%D1%8B%D1%82%D0%BA%D0%B8/IMG_7346.JPG
    2015-10-21 08:07:44  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%9A%D0%BE%D0%BF%D1%8B%D1%82%D0%BA%D0%B8/IMG_7438.JPG
    2015-10-21 08:07:58  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%9A%D0%BE%D0%BF%D1%8B%D1%82%D0%BA%D0%B8/IMG_7408.JPG
    2015-10-21 08:08:01  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%9A%D0%BE%D0%BF%D1%8B%D1%82%D0%BA%D0%B8/IMG_7409.JPG
    2015-10-21 08:08:04  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%9A%D0%BE%D0%BF%D1%8B%D1%82%D0%BA%D0%B8/IMG_7411.JPG
    2015-10-21 08:09:05  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/01.01.15/IMG_7576.JPG
    2015-10-21 08:09:12  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/01.01.15/IMG_7582.JPG
    2015-10-21 08:09:34  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/WP_20141214_009.jpg
    2015-10-21 08:10:10  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7640.JPG
    2015-10-21 08:10:23  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/03.05.15/WP_20150503_002.jpg
    2015-10-21 08:10:40  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/18.04.15/WP_20150418_004.jpg
    2015-10-21 08:10:50  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/18.04.15/WP_20150418_008.jpg
    2015-10-21 08:12:07  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/14.12.14/WP_20141214_001.jpg
    2015-10-21 08:12:12  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/14.12.14/IMG_7282.JPG
    2015-10-21 08:12:21  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/14.12.14/IMG_7290.JPG
    2015-10-21 08:12:32  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/14.12.14/IMG_7307.JPG
    2015-10-21 08:12:58  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/WP_20141202_003.jpg
    2015-10-22 06:52:59  sima@file:///C:/Users/sima/Downloads/%D0%B4%D0%BE%D1%81%D1%8C%D0%B5.zip
    2015-10-22 07:12:36  sima@file:///D:/Download/work/%D0%BD%D0%B5%D0%BF%D0%B5%D1%80%D0%B5%D0%B4%D0%B0%D0%BD%D0%BD%D1%8B%D0%B5%20%D0%B4%D0%BE%D1%81%D1%8C%D0%B5%20%D0%9A%D0%9A.xlsx
    2015-10-22 07:12:40  sima@file:///D:/Download/work/%D0%BD%D0%B5%D0%BF%D0%B5%D1%80%D0%B5%D0%B4%D0%B0%D0%BD%D0%BD%D1%8B%D0%B5%20%D0%B4%D0%BE%D1%81%D1%8C%D0%B5%20%D0%9A%D0%A4%D0%9B.xlsx
    2015-10-22 20:33:06  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Screenshots/wp_ss_20150609_0007.png
    2015-10-24 00:14:23  sima@file:///D:/Download/%D1%84%D0%BE%D1%82%D0%BE/WP_20151019_12_10_52_Pro.jpg
    2015-10-25 11:08:28  sima@file:///C:/Users/sima/Desktop/%D0%B8%D1%81%D0%BA%D0%BE%D0%B2%D0%BE%D0%B5%20%D0%B7%D0%B0%D1%8F%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5.docx
    2015-10-25 11:08:42  sima@file:///C:/Users/sima/Documents/%D0%98%D1%81%D0%BA%D0%BE%D0%B2%D0%BE%D0%B5%20%D0%B7%D0%B0%D1%8F%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D0%B5%20%D0%9F%D0%BE%D1%82%D0%B0%D0%BF%D0%BE%D0%B2.docx
    2015-10-25 22:53:59  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150915_19_37_31_Pro.jpg
    2015-10-25 22:54:03  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150915_21_59_43_Pro.jpg
    2015-10-25 22:54:21  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150301_013.jpg
    2015-10-25 22:54:40  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150428_026.jpg
    2015-10-25 23:05:51  sima@file:///C:/Users/sima/Desktop/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/WP_20151006_07_10_42_Pro.jpg
    2015-10-25 23:05:57  sima@file:///C:/Users/sima/Desktop/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/WP_20151006_07_10_50_Pro.jpg
    2015-10-25 23:15:18  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150524_002.jpg
    2015-10-25 23:15:29  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150521_002.jpg
    2015-10-25 23:15:34  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150516_023.jpg
    2015-10-25 23:15:38  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150516_013.jpg
    2015-10-25 23:15:46  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150511_053.jpg
    2015-10-25 23:15:52  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150428_019.jpg
    2015-10-25 23:38:04  sima@file:///C:/Users/sima/Desktop/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/WP_20151006_07_11_54_Pro.jpg
    2015-10-25 23:38:27  sima@file:///C:/Users/sima/Desktop/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/WP_20151006_07_12_01_Pro.jpg
    2015-10-26 08:34:20  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150308_025.jpg
    2015-10-26 08:34:23  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150308_024.jpg
    2015-10-26 08:34:25  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150309_001.jpg
    2015-10-26 08:34:39  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150321_001.jpg
    2015-10-26 08:34:51  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150312_012.jpg
    2015-10-26 08:34:57  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150310_003.jpg
    2015-10-26 08:35:01  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150304_023.jpg
    2015-10-26 08:35:09  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150228_006.jpg
    2015-10-26 08:35:14  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150218_046.jpg
    2015-10-26 08:35:20  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150214_013.jpg
    2015-10-26 08:35:27  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150214_001.jpg
    2015-10-26 08:35:37  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150212_009.jpg
    2015-10-29 16:33:08  sima@file:///C:/Users/sima/Desktop/%D0%A8%D0%B0%D0%BF%D0%BA%D0%B8.docx
    2015-11-03 22:30:15  sima@file:///D:/Download/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/IMG-20151008-WA0001.jpg
    2015-11-03 22:36:46  sima@file:///D:/Download/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/adsf/WP_20151010_18_25_54_Pro.jpg
    2015-11-03 22:36:58  sima@file:///D:/Download/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/Camera%20Roll/WP_20150917_10_30_52_Pro.jpg
    2015-11-03 22:37:43  sima@file:///D:/Download/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/Camera%20Roll/WP_20150926_14_53_41_Pro.jpg
    2015-11-03 22:38:28  sima@file:///C:/Users/sima/Desktop/%D0%9A%D0%BE%D0%BC%D0%BC%D1%83%D0%BD%D0%B0%D0%BB%D0%BA%D0%B0.xlsx
    2015-11-03 22:38:42  sima@file:///D:/Download/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/Camera%20Roll/WP_20151018_15_21_20_Pro.jpg
    2015-11-03 22:39:53  sima@file:///D:/Download/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/Camera%20Roll/WP_20151031_13_21_57_Pro.jpg
    2015-11-03 22:41:41  sima@file:///D:/Download/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/WhatsApp/IMG-20150918-WA0015.jpg
    2015-11-03 22:41:51  sima@file:///D:/Download/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/WhatsApp/IMG-20150926-WA0002.jpg
    2015-11-03 22:42:06  sima@file:///D:/Download/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/WhatsApp/IMG-20150929-WA0011.jpg
    2015-11-03 22:45:18  sima@file:///C:/Users/sima/Desktop/GetInline.aspx.jpg
    2015-11-04 00:08:20  sima@file:///C:/Users/sima/Desktop/LAW182825_0_20150822_131438_54066.rtf
    2015-11-04 00:08:27  sima@file:///C:/Users/sima/Desktop/%D0%93%D0%B8%D0%BD%D0%B5%D0%BA%D0%BE%D0%BB%D0%BE%D0%B3%D0%B8.docx
    2015-11-04 00:17:52  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/IMG_7318.JPG
    2015-11-04 00:20:36  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7589.JPG
    2015-11-04 00:21:49  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7599.JPG
    2015-11-04 00:24:22  sima@file:///C:/Users/sima/Desktop/DCIM/100NIKON/47wedding_38photo.jpg
    2015-11-04 00:24:52  sima@file:///C:/Users/sima/Desktop/DCIM/100NIKON/DSC00022.JPG
    2015-11-04 00:29:43  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/01.01.15/IMG_7567.JPG
    2015-11-04 00:32:47  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/14.12.14/IMG_7279.JPG
    2015-11-04 21:35:47  sima@http://pulse-analytics.ru/favicon.ico
    2015-11-04 21:35:47  sima@http://pulse-analytics.ru/landing
    2015-11-04 21:39:48  sima@file:///C:/Users/sima/Pictures/%D0%A1%D0%B8%D0%BC%D0%B0%D0%BD%D0%BE%D0%B2_%D0%B2.jpg
    2015-11-04 21:40:02  sima@https://post.sberbank.ru/owa/attachment.ashx?attach=1&id=RgAAAAAah5IRbZ4dT73kKQ4Jaf4PBwDw84WVrs%2f4Tp43l%2bL2M08JAAAAtpsEAADw84WVrs%2f4Tp43l%2bL2M08JAAAqd2L2AAAJ&attid0=BAAAAAAA&attcnt=1
    2015-11-04 21:52:05  sima@https://sberbank-school.ru/login
    2015-11-04 21:52:30  sima@https://sberbank-school.ru
    2015-11-04 21:53:03  sima@https://sberbank-school.ru/profile/current
    2015-11-04 21:57:54  sima@https://sberbank.sabanow.net/Saba/Web/Main
    2015-11-04 22:11:15  sima@https://sberbank-school.ru/education/catalog/offerings/322
    2015-11-05 23:16:53  sima@file:///F:/VTS_01_1.VOB
    2015-11-05 23:40:45  sima@http://world.taobao.com/item/17064653553.htm?fromSite=main&spm=2013.1.20141002.8.HCUmG8&scm=1007.10009.16127.100200300000001&pvid=6131ef9a-b496-4402-96b3-27c7b6486c89
    2015-11-05 23:41:24  sima@http://world.taobao.com/item/21909708464.htm?fromSite=main&spm=2013.1.20141002.10.HCUmG8&scm=1007.10009.16127.100200300000001&pvid=6131ef9a-b496-4402-96b3-27c7b6486c89
    2015-11-05 23:41:28  sima@http://world.taobao.com/item/16695339847.htm?fromSite=main&spm=2014.12015342.0.0
    2015-11-05 23:43:45  sima@http://world.tmall.com/item/36853298231.htm?id=36853298231&ali_trackid=2:mm_29954000_0_0:1446734580_3k7_1483459547&spm=a231o.7705542.10003.56.XyZzQo&pvid=200_10.98.16.193_515_1446734526447
    2015-11-05 23:47:41  sima@https://login.taobao.com/jump?target=https%3a%2f%2fdetail.tmall.com%2fitem.htm%3fid%3d42510130749%26spm%3da312a.7700718.0.0.rpNE7E%26source%3dsuperboss%26appId%3d113%26tbpm%3d1
    2015-11-05 23:47:48  sima@https://detail.tmall.com/item.htm?id=42510130749&spm=a312a.7700718.0.0.rpNE7E&source=superboss&appId=113&tbpm=1
    2015-11-05 23:48:21  sima@https://detail.tmall.com/item.htm?id=42510130749&spm=a312a.7700718.0.0.rpNE7E&source=superboss&appId=113
    2015-11-05 23:58:59  sima@file:///C:/Users/sima/Desktop/%D0%9F%D0%B0%D0%BB%D0%B0%D1%82%D0%BA%D0%B0.docx
    2015-11-06 03:54:58  sima@file:///C:/Users/sima/Desktop/%D0%98%D0%B3%D1%80%D1%83%D1%88%D0%BA%D0%B8.docx
    2015-11-06 04:32:13  sima@file:///C:/Users/sima/Desktop/%D0%9F%D0%B0%D1%80%D0%BD%D0%B0%D1%8F%20%D0%BE%D0%B4%D0%B5%D0%B6%D0%B4%D0%B0.docx
    2015-11-07 17:06:23  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0239.JPG
    2015-11-09 06:33:26  sima@file:///C:/Users/sima/AppData/Local/Temp/%7B769C1959-EF81-4E13-8E6D-7CDBEF2CB0B8%7D.html
    2015-11-09 06:34:36  sima@file:///C:/Users/sima/AppData/Local/Temp/%7BA88FC34B-880E-4F89-9C84-1857849F8D56%7D.html
    2015-11-09 06:35:20  sima@file:///C:/Users/sima/AppData/Local/Temp/%7B672D013C-6E12-4229-8014-6C5A4BFE222D%7D.html
    2015-11-09 06:39:23  sima@file:///C:/Users/sima/AppData/Local/Temp/%7B1AA6B3B3-9D09-4F63-BAB2-729034A01DEF%7D.html
    2015-11-10 03:20:53  sima@file:///E:/winter20152016mezd.doc
    2015-11-11 04:28:10  sima@file:///C:/Users/sima/Desktop/%D0%9E%D0%B4%D0%B5%D0%B6%D0%B4%D0%B0%20%D0%BF%D0%B0%D1%80%D0%BD%D0%B0%D1%8F.docx
    2015-11-15 20:07:58  sima@file:///G:/%D0%91%D0%B5%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D1%8F%D1%88%D0%BA%D0%B8/IMG_1770.JPG
    2015-11-15 20:10:13  sima@file:///G:/%D0%91%D0%B5%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D1%8F%D1%88%D0%BA%D0%B8/IMG_1773a.jpg
    2015-11-15 20:11:09  sima@file:///G:/%D0%91%D0%B5%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D1%8F%D1%88%D0%BA%D0%B8/IMG_1797.JPG
    2015-11-15 20:11:37  sima@file:///G:/%D0%91%D0%B5%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D1%8F%D1%88%D0%BA%D0%B8/IMG_1807.JPG
    2015-11-15 20:12:03  sima@file:///G:/%D0%91%D0%B5%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D1%8F%D1%88%D0%BA%D0%B8/IMG_1811.JPG
    2015-11-15 20:12:26  sima@file:///C:/Users/sima/Desktop/%D0%94%D0%A0/IMG_1811.JPG
    2015-11-15 20:12:34  sima@file:///G:/%D0%91%D0%B5%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D1%8F%D1%88%D0%BA%D0%B8/IMG_1814.JPG
    2015-11-15 20:13:35  sima@file:///G:/%D0%91%D0%B5%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D1%8F%D1%88%D0%BA%D0%B8/IMG_1826.JPG
    2015-11-15 20:13:53  sima@file:///G:/%D0%91%D0%B5%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D1%8F%D1%88%D0%BA%D0%B8/IMG_1828.JPG
    2015-11-15 20:14:17  sima@file:///G:/%D0%91%D0%B5%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D1%8F%D1%88%D0%BA%D0%B8/IMG_1832.JPG
    2015-11-15 20:15:18  sima@file:///G:/%D0%91%D0%B5%D1%80%D0%B5%D0%BC%D0%B5%D0%BD%D1%8F%D1%88%D0%BA%D0%B8/IMG_1849a.jpg
    2015-11-15 20:17:29  sima@file:///C:/Users/sima/Desktop/%D0%94%D0%A0/IMG_1880.JPG
    2015-11-15 20:30:41  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%92%D1%8B%D0%BF%D0%B8%D1%81%D0%BA%D0%B0/IMG_7270.JPG
    2015-11-15 20:33:13  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/WP_20141211_002.jpg
    2015-11-15 20:33:17  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/WP_20141211_006.jpg
    2015-11-15 20:33:20  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/WP_20141211_007.jpg
    2015-11-15 20:33:22  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/WP_20141211_008.jpg
    2015-11-15 20:39:24  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/WP_20141211_001.jpg
    2015-11-15 21:12:34  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/WP_20141211_009.jpg
    2015-11-15 21:17:32  sima@mshelp://windows/?id=617624ee-08f3-4aff-9713-5e84a9674a26
    2015-11-15 21:18:38  sima@file:///C:/Users/sima/Desktop/%D0%94%D0%A0/IMG_1852.JPG
    2015-11-18 00:21:58  sima@file:///C:/Users/sima/Desktop/%D0%9E%D0%BF%D0%BB%D0%B0%D1%82%D0%B0%20%D0%B4%D0%BE%D0%BC.xlsx
    2015-11-18 18:55:16  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/WP_20141212_001.jpg
    2015-11-18 18:55:33  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/IMG_7279.JPG
    2015-11-18 18:55:57  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/IMG_7287.JPG
    2015-11-18 18:56:01  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/IMG_7288.JPG
    2015-11-18 18:56:04  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/IMG_7290.JPG
    2015-11-18 18:56:17  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/IMG_7326.JPG
    2015-11-18 18:56:24  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/IMG-20150218-WA0002.jpg
    2015-11-18 18:56:27  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/IMG-20150218-WA0001.jpg
    2015-11-18 18:56:42  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/IMG-20150305-WA0001.jpg
    2015-11-18 18:56:55  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/IMG-20150306-WA0002.jpg
    2015-11-18 18:57:00  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/WP_20141128_004.jpg
    2015-11-18 18:57:19  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/WP_20141205_004.jpg
    2015-11-18 18:57:24  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/WP_20141206_006.jpg
    2015-11-18 18:57:27  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/WP_20141207_001.jpg
    2015-11-18 18:57:30  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/WP_20141207_20_07_24_Pro.jpg
    2015-11-18 18:57:38  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/WP_20141211_013.jpg
    2015-11-18 18:57:58  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/WP_20141214_008.jpg
    2015-11-18 18:58:00  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/WP_20141214_007.jpg
    2015-11-18 18:58:09  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/1%20%D0%BC%D0%B5%D1%81/WP_20141215_006.jpg
    2015-11-18 18:58:28  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/01.01.15/IMG_7568.JPG
    2015-11-18 18:58:41  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/01.01.15/IMG_7587.JPG
    2015-11-18 18:58:51  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/17.01.15/WP_20150117_001.jpg
    2015-11-18 18:58:59  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/25.11.14/WP_20141125_004.jpg
    2015-11-18 18:59:03  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/25.11.14/WP_20141125_002.jpg
    2015-11-18 18:59:18  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/26.11.14/WP_20141126_19_15_07_Pro.jpg
    2015-11-18 18:59:20  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/26.11.14/WP_20141126_19_15_04_Pro.jpg
    2015-11-18 18:59:23  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/26.11.14/WP_20141126_19_14_37_Pro.jpg
    2015-11-18 18:59:33  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/28.12.14/IMG_7460.JPG
    2015-11-18 19:00:05  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/WP_20141220_001.jpg
    2015-11-18 19:00:08  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/WP_20141220_002.jpg
    2015-11-18 19:00:10  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/WP_20141220_003.jpg
    2015-11-18 19:00:17  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/%D0%9D%D0%BE%D0%B2%D0%B0%D1%8F%20%D0%BF%D0%B0%D0%BF%D0%BA%D0%B0/WP_20141231_001.jpg
    2015-11-18 19:00:28  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7595.JPG
    2015-11-18 19:00:39  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7617.JPG
    2015-11-18 19:01:01  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7635.JPG
    2015-11-18 19:01:27  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7634.JPG
    2015-11-18 19:01:37  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7645.JPG
    2015-11-18 19:02:13  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7663.JPG
    2015-11-18 19:02:43  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7664.JPG
    2015-11-18 19:02:56  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7671.JPG
    2015-11-18 19:03:20  sima@file:///C:/Users/sima/Desktop/%D0%94%D0%A0/IMG_7667.JPG
    2015-11-18 19:03:30  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7697.JPG
    2015-11-18 19:03:35  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7696.JPG
    2015-11-18 19:03:38  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7694.JPG
    2015-11-18 19:03:41  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7695.JPG
    2015-11-18 19:03:57  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7706.JPG
    2015-11-18 19:04:01  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7707.JPG
    2015-11-18 19:04:04  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7704.JPG
    2015-11-18 19:04:11  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7708.JPG
    2015-11-18 19:04:29  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7712.JPG
    2015-11-18 19:04:42  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7717.JPG
    2015-11-18 19:05:05  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7722.JPG
    2015-11-18 19:05:27  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7804.JPG
    2015-11-18 19:05:33  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7805.JPG
    2015-11-18 19:05:43  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7806.JPG
    2015-11-18 19:05:58  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/IMG_7821.JPG
    2015-11-18 19:06:30  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20141220_001.jpg
    2015-11-18 19:06:59  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20141225_004.jpg
    2015-11-18 19:07:03  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20141225_009.jpg
    2015-11-18 19:07:06  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20141225_008.jpg
    2015-11-18 19:07:19  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20141227_001.jpg
    2015-11-18 19:07:23  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20141227_004.jpg
    2015-11-18 19:07:29  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20141229_002.jpg
    2015-11-18 19:07:35  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20141229_003.jpg
    2015-11-18 19:07:42  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20141229_011.jpg
    2015-11-18 19:07:47  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20141229_016.jpg
    2015-11-18 19:08:01  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20141231_003.jpg
    2015-11-18 19:08:04  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20141231_004.jpg
    2015-11-18 19:08:12  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20141231_005.jpg
    2015-11-18 19:08:21  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20141231_014.jpg
    2015-11-18 19:08:24  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20150101_004.jpg
    2015-11-18 19:08:29  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20150101_008.jpg
    2015-11-18 19:08:33  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20150101_012.jpg
    2015-11-18 19:08:39  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20150101_017.jpg
    2015-11-18 19:08:46  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20150102_001.jpg
    2015-11-18 19:08:59  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20150102_005.jpg
    2015-11-18 19:09:25  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20150102_011.jpg
    2015-11-18 19:09:41  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20150106_003.jpg
    2015-11-18 19:09:43  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20150106_004.jpg
    2015-11-18 19:09:45  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20150106_005.jpg
    2015-11-18 19:09:56  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20150108_001.jpg
    2015-11-18 19:10:00  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20150108_002.jpg
    2015-11-18 19:10:05  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20150108_003.jpg
    2015-11-18 19:10:12  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20150112_001.jpg
    2015-11-18 19:10:17  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20150112_002.jpg
    2015-11-18 19:10:28  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20150112_005.jpg
    2015-11-18 19:10:34  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/2%20%D0%BC%D0%B5%D1%81/WP_20150113_005.jpg
    2015-11-18 19:10:42  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/03.05.15/WP_20150503_001.jpg
    2015-11-18 19:11:27  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/22.01.15/WP_20150122_20_32_09_Pro.jpg
    2015-11-18 19:11:34  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7831.JPG
    2015-11-18 19:11:38  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7830.JPG
    2015-11-18 19:11:47  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7839.JPG
    2015-11-18 19:12:06  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7851.JPG
    2015-11-18 19:12:19  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7861.JPG
    2015-11-18 19:12:23  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7863.JPG
    2015-11-18 19:12:27  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7864.JPG
    2015-11-18 19:12:35  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7867.JPG
    2015-11-18 19:12:44  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7870.JPG
    2015-11-18 19:12:49  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7873.JPG
    2015-11-18 19:12:57  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7875.JPG
    2015-11-18 19:13:19  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7892.JPG
    2015-11-18 19:13:24  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7878.JPG
    2015-11-18 19:13:29  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7888.JPG
    2015-11-18 19:13:36  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7890.JPG
    2015-11-18 19:13:40  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7889.JPG
    2015-11-18 19:13:49  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7893.JPG
    2015-11-18 19:13:57  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7896.JPG
    2015-11-18 19:14:21  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7905.JPG
    2015-11-18 19:14:32  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7910.JPG
    2015-11-18 19:14:36  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7920.JPG
    2015-11-18 19:15:14  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7967.JPG
    2015-11-18 19:15:31  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7952.JPG
    2015-11-18 19:15:45  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7968.JPG
    2015-11-18 19:15:50  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/3%20%D0%BC%D0%B5%D1%81/IMG_7966.JPG
    2015-11-18 19:16:08  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/4%20%D0%BC%D0%B5%D1%81/03.03.15/WP_20150303_001.jpg
    2015-11-18 19:16:16  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/4%20%D0%BC%D0%B5%D1%81/03.03.15/WP_20150303_004.jpg
    2015-11-18 19:16:18  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/4%20%D0%BC%D0%B5%D1%81/03.03.15/WP_20150303_005.jpg
    2015-11-18 19:16:26  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/4%20%D0%BC%D0%B5%D1%81/14.03.15/WP_20150314_001.jpg
    2015-11-18 19:16:40  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/4%20%D0%BC%D0%B5%D1%81/14.03.15/WP_20150314_14_38_41_Pro.jpg
    2015-11-18 19:16:48  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/4%20%D0%BC%D0%B5%D1%81/21.02.15/WP_20150221_001.jpg
    2015-11-18 19:17:06  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/4%20%D0%BC%D0%B5%D1%81/IMG_8005.JPG
    2015-11-18 19:17:19  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/4%20%D0%BC%D0%B5%D1%81/IMG_8054.JPG
    2015-11-18 19:17:26  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/4%20%D0%BC%D0%B5%D1%81/IMG_8048.JPG
    2015-11-18 19:17:34  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/4%20%D0%BC%D0%B5%D1%81/IMG_8050.JPG
    2015-11-18 19:17:50  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/4%20%D0%BC%D0%B5%D1%81/IMG_8061.JPG
    2015-11-18 19:17:55  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/4%20%D0%BC%D0%B5%D1%81/IMG_8062.JPG
    2015-11-18 19:18:09  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/5%20%D0%BC%D0%B5%D1%81/07.04.15/WP_20150407_07_25_51_Pro.jpg
    2015-11-18 19:18:20  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/5%20%D0%BC%D0%B5%D1%81/10.04.15/WP_20150410_001.jpg
    2015-11-18 19:18:27  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/5%20%D0%BC%D0%B5%D1%81/10.04.15/WP_20150410_006.jpg
    2015-11-18 19:19:00  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8670.JPG
    2015-11-18 19:19:04  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8676.JPG
    2015-11-18 19:19:35  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8681.JPG
    2015-11-18 19:19:54  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8682.JPG
    2015-11-18 19:20:09  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8730.JPG
    2015-11-18 19:20:34  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8740.JPG
    2015-11-18 19:20:50  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8743.JPG
    2015-11-18 19:21:08  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8771.JPG
    2015-11-18 19:21:37  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8786.JPG
    2015-11-18 19:21:40  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8785.JPG
    2015-11-18 19:22:07  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8792.JPG
    2015-11-18 19:22:11  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8790.JPG
    2015-11-18 19:22:23  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8806.JPG
    2015-11-18 19:22:33  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8819.JPG
    2015-11-18 19:22:55  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8827.JPG
    2015-11-18 19:23:12  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8828.JPG
    2015-11-18 19:23:24  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8834.JPG
    2015-11-18 19:23:36  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8840.JPG
    2015-11-18 19:23:51  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8846.JPG
    2015-11-18 19:24:02  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8855.JPG
    2015-11-18 19:24:06  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8857.JPG
    2015-11-18 19:24:14  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8863.JPG
    2015-11-18 19:24:29  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8882.JPG
    2015-11-18 19:24:36  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8915.JPG
    2015-11-18 19:24:41  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8917.JPG
    2015-11-18 19:24:51  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8918.JPG
    2015-11-18 19:25:06  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8919.JPG
    2015-11-18 19:25:16  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8920.JPG
    2015-11-18 19:25:19  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8921.JPG
    2015-11-18 19:25:27  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8931.JPG
    2015-11-18 19:25:30  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8930.JPG
    2015-11-18 19:25:33  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8934.JPG
    2015-11-18 19:25:39  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8943.JPG
    2015-11-18 19:25:43  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8944.JPG
    2015-11-18 19:25:51  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8946.JPG
    2015-11-18 19:25:57  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8947.JPG
    2015-11-18 19:26:02  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8948.JPG
    2015-11-18 19:26:16  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8954.JPG
    2015-11-18 19:26:19  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8952.JPG
    2015-11-18 19:26:31  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8955.JPG
    2015-11-18 19:26:43  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8957.JPG
    2015-11-18 19:27:02  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8967.JPG
    2015-11-18 19:27:06  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_8968.JPG
    2015-11-18 19:27:21  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9018.JPG
    2015-11-18 19:27:30  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9053.JPG
    2015-11-18 19:27:40  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9081.JPG
    2015-11-18 19:27:55  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9099.JPG
    2015-11-18 19:56:17  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9122.JPG
    2015-11-18 19:56:39  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9112.JPG
    2015-11-18 19:56:56  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9136.JPG
    2015-11-18 19:57:00  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9137.JPG
    2015-11-18 19:57:03  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9139.JPG
    2015-11-18 19:57:07  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9138.JPG
    2015-11-18 19:57:35  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9145.JPG
    2015-11-18 19:57:39  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9144.JPG
    2015-11-18 19:57:42  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9143.JPG
    2015-11-18 19:57:53  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9154.JPG
    2015-11-18 19:58:03  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9161.JPG
    2015-11-18 19:58:12  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9152.JPG
    2015-11-18 19:58:23  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9199.JPG
    2015-11-18 19:58:29  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9214.JPG
    2015-11-18 19:58:38  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9212.JPG
    2015-11-18 19:58:45  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9210.JPG
    2015-11-18 19:58:57  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9217.JPG
    2015-11-18 20:00:01  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9219.JPG
    2015-11-18 20:00:19  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9274.JPG
    2015-11-18 20:00:22  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9272.JPG
    2015-11-18 20:00:26  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9270.JPG
    2015-11-18 20:00:29  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/10.09.2015/IMG_9268.JPG
    2015-11-18 20:01:01  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/18.04.15/WP_20150418_007.jpg
    2015-11-18 20:01:05  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/18.04.15/WP_20150418_010.jpg
    2015-11-18 20:01:50  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%9A%D0%BE%D0%BF%D1%8B%D1%82%D0%BA%D0%B8/IMG_7345.JPG
    2015-11-18 20:01:58  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%9A%D0%BE%D0%BF%D1%8B%D1%82%D0%BA%D0%B8/IMG_7360.JPG
    2015-11-18 20:02:26  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%9A%D0%BE%D0%BF%D1%8B%D1%82%D0%BA%D0%B8/IMG_7406.JPG
    2015-11-18 20:02:48  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%9A%D0%BE%D0%BF%D1%8B%D1%82%D0%BA%D0%B8/IMG_7418.JPG
    2015-11-18 20:03:25  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%9A%D0%BE%D0%BF%D1%8B%D1%82%D0%BA%D0%B8/IMG_7425.JPG
    2015-11-18 20:03:35  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%9A%D0%BE%D0%BF%D1%8B%D1%82%D0%BA%D0%B8/IMG_7422.JPG
    2015-11-18 20:03:46  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%9A%D0%BE%D0%BF%D1%8B%D1%82%D0%BA%D0%B8/IMG_7434.JPG
    2015-11-18 20:04:06  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%9A%D1%83%D0%BF%D0%B0%D0%BD%D0%B8%D0%B5/IMG_7295.JPG
    2015-11-18 20:04:14  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%9F%D0%B5%D1%80%D0%B2%D0%B0%D1%8F%20%D0%BF%D1%80%D0%BE%D0%B3%D1%83%D0%BB%D0%BA%D0%B0%2027.12.14/IMG_7440.JPG
    2015-11-18 20:04:17  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%9F%D0%B5%D1%80%D0%B2%D0%B0%D1%8F%20%D0%BF%D1%80%D0%BE%D0%B3%D1%83%D0%BB%D0%BA%D0%B0%2027.12.14/IMG_7443.JPG
    2015-11-18 20:04:54  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%A0%D0%BE%D0%B4%D0%B4%D0%BE%D0%BC/altAohj4TD-_SyMuR6scYZ8kZdU1doig1I9iEw0gLvdPuhE.jpg
    2015-11-18 20:04:56  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%A0%D0%BE%D0%B4%D0%B4%D0%BE%D0%BC/altAtO0-27QioKBgGSguQM3XXMdm3xo4R--hdms1zztM00i.jpg
    2015-11-18 20:05:03  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%A0%D0%BE%D0%B4%D0%B4%D0%BE%D0%BC/altAo5URwiu0Z6ZV4BeZb9YpNU_OGBWQTNSyQpvfImj-S0U.jpg
    2015-11-18 20:05:13  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%A0%D0%BE%D0%B4%D0%B4%D0%BE%D0%BC/altApsU6_Jvt2dbirbUayvCTgMClyV6JWXjcgpaMgGDbkT9.jpg
    2015-11-18 20:05:16  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%A0%D0%BE%D0%B4%D0%B4%D0%BE%D0%BC/IMG-20150212-WA0006.jpg
    2015-11-18 20:05:22  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%A0%D0%BE%D0%B4%D0%B4%D0%BE%D0%BC/WP_20141121_001.jpg
    2015-11-18 20:05:28  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/%D0%A0%D0%BE%D0%B4%D0%B4%D0%BE%D0%BC/WP_20141121_002.jpg
    2015-11-18 20:06:00  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/IMG-20150316-WA0001.jpg
    2015-11-18 20:06:08  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/IMG-20150507-WA0001.jpg
    2015-11-18 20:06:27  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/IMG-20150316-WA0002.jpg
    2015-11-18 20:06:30  sima@file:///G:/%D0%A0%D0%B5%D0%B1%D0%B5%D0%BD%D0%BE%D0%BA/IMG-20150327-WA0001.jpg
    2015-11-18 20:06:49  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0001.JPG
    2015-11-18 20:07:11  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0040.JPG
    2015-11-18 20:07:17  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0046.JPG
    2015-11-18 20:07:26  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0063.JPG
    2015-11-18 20:07:31  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0070.JPG
    2015-11-18 20:07:59  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0073.JPG
    2015-11-18 20:08:09  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0099.JPG
    2015-11-18 20:08:38  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0192.JPG
    2015-11-18 20:09:00  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0227.JPG
    2015-11-18 20:09:12  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0244.JPG
    2015-11-18 20:09:20  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0260.JPG
    2015-11-18 20:09:26  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0282.JPG
    2015-11-18 20:09:40  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0301.JPG
    2015-11-18 20:09:52  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0307.JPG
    2015-11-18 20:10:11  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0357.JPG
    2015-11-18 20:10:15  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0369.JPG
    2015-11-18 20:10:19  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0377.JPG
    2015-11-18 20:11:15  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0527.JPG
    2015-11-18 20:11:36  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0569.JPG
    2015-11-18 20:11:42  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0570.JPG
    2015-11-18 20:12:14  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0636.JPG
    2015-11-18 20:12:24  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0663.JPG
    2015-11-18 20:12:46  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0714.JPG
    2015-11-18 20:13:11  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0734.JPG
    2015-11-18 20:13:15  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0725.JPG
    2015-11-18 20:13:18  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0727.JPG
    2015-11-18 20:13:28  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0750.JPG
    2015-11-18 20:13:32  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0755.JPG
    2015-11-18 20:13:44  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0759.JPG
    2015-11-18 20:13:54  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0763.JPG
    2015-11-18 20:14:07  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0761.JPG
    2015-11-18 20:14:15  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0776.JPG
    2015-11-18 20:14:34  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0780.JPG
    2015-11-18 20:14:43  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0793.JPG
    2015-11-18 20:15:01  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_0795.JPG
    2015-11-18 20:15:19  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_1093.JPG
    2015-11-18 20:15:37  sima@file:///C:/Users/sima/Desktop/%D0%94%D0%A0/IMG_1094.JPG
    2015-11-18 20:15:43  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_1097.JPG
    2015-11-18 20:16:29  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_9286.JPG
    2015-11-18 20:17:03  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_9294.JPG
    2015-11-18 20:17:18  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_9317.JPG
    2015-11-18 20:17:32  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_9323.JPG
    2015-11-18 20:17:40  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_9324.JPG
    2015-11-18 20:20:03  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_9363.JPG
    2015-11-18 20:20:12  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_9371.JPG
    2015-11-18 20:20:33  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_9359.JPG
    2015-11-18 20:58:32  sima@file:///E:/FOTO/%D0%9E%D1%82%D0%BF%D1%83%D1%81%D0%BA/%D0%9A%D1%80%D1%8B%D0%BC/IMG_9378.JPG
    2015-11-18 23:02:01  sima@file:///C:/Users/sima/Desktop/Pictures/Camera%20Roll/WP_20150516_13_06_02_Pro.jpg
    2015-11-18 23:02:16  sima@file:///C:/Users/sima/Desktop/Pictures/Camera%20Roll/WP_20150530_11_44_30_Pro.jpg
    2015-11-18 23:02:54  sima@file:///C:/Users/sima/Desktop/Pictures/Camera%20Roll/WP_20150606_11_12_52_Pro.jpg
    2015-11-18 23:03:20  sima@file:///C:/Users/sima/Desktop/Pictures/Camera%20Roll/WP_20150606_11_12_57_Pro.jpg
    2015-11-18 23:03:24  sima@file:///C:/Users/sima/Desktop/Pictures/Camera%20Roll/WP_20150606_11_13_00_Pro.jpg
    2015-11-18 23:03:31  sima@file:///C:/Users/sima/Desktop/Pictures/Camera%20Roll/WP_20150606_11_13_04_Pro.jpg
    2015-11-18 23:03:36  sima@file:///C:/Users/sima/Desktop/Pictures/Camera%20Roll/WP_20150606_11_13_06_Pro.jpg
    2015-11-18 23:03:39  sima@file:///C:/Users/sima/Desktop/Pictures/Camera%20Roll/WP_20150606_11_13_12_Pro.jpg
    2015-11-18 23:03:42  sima@file:///C:/Users/sima/Desktop/Pictures/Camera%20Roll/WP_20150606_11_13_23_Pro.jpg
    2015-11-18 23:03:54  sima@file:///C:/Users/sima/Desktop/Pictures/Camera%20Roll/WP_20150615_21_02_40_Pro.jpg
    2015-11-18 23:04:42  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150210_001.jpg
    2015-11-19 00:05:57  sima@file:///C:/Users/sima/Desktop/DCIM/102NIKON/DSCN0807.JPG
    2015-11-19 00:06:27  sima@file:///C:/Users/sima/Desktop/DCIM/102NIKON/DSCN0749.JPG
    2015-11-19 00:06:30  sima@file:///C:/Users/sima/Desktop/DCIM/102NIKON/DSCN0750.JPG
    2015-11-19 00:07:16  sima@file:///C:/Users/sima/Desktop/DCIM/102NIKON/DSCN0725.JPG
    2015-11-19 00:07:22  sima@file:///C:/Users/sima/Desktop/DCIM/102NIKON/DSCN0740.JPG
    2015-11-19 00:07:25  sima@file:///C:/Users/sima/Desktop/DCIM/102NIKON/DSCN0742.JPG
    2015-11-19 00:07:28  sima@file:///C:/Users/sima/Desktop/DCIM/102NIKON/DSCN0744.JPG
    2015-11-19 00:09:57  sima@file:///C:/Users/sima/Desktop/%D0%94%D0%A0/IMG_9709.JPG
    2015-11-19 00:10:02  sima@file:///C:/Users/sima/Desktop/%D0%94%D0%A0/WP_20150418_004.jpg
    2015-11-21 05:24:35  sima@file:///C:/Users/sima/Desktop/%D0%94%D0%A0/WP_20150210_009.jpg
    2015-11-21 05:24:45  sima@file:///C:/Users/sima/Desktop/%D0%94%D0%A0/WP_20150210_006.jpg
    2015-11-21 05:27:31  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150212_001.jpg
    2015-11-21 05:36:15  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150311_011.jpg
    2015-11-21 05:38:19  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150318_006.jpg
    2015-11-21 05:39:45  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150324_003.jpg
    2015-11-21 05:44:04  sima@file:///C:/Users/sima/Desktop/%D1%84%D0%BE%D1%82%D0%BE%20%D1%81%20%D1%82%D0%B5%D0%BB%D0%B5%D1%84%D0%BE%D0%BD%D0%B0/Camera%20Roll/WP_20150423_004.jpg
    2015-11-21 06:11:55  sima@file:///J:/DCIM/100CANON/IMG_1124.JPG
    2015-11-21 06:14:47  sima@file:///J:/DCIM/100CANON/IMG_1172.JPG
    2015-11-21 06:14:52  sima@file:///J:/DCIM/100CANON/IMG_1175.JPG
    2015-11-21 06:14:58  sima@file:///J:/DCIM/100CANON/IMG_1177.JPG
    2015-11-21 06:15:20  sima@file:///J:/DCIM/100CANON/IMG_1164.JPG
    2015-11-21 21:18:06  sima@file:///C:/Users/sima/AppData/Local/Temp/%7BF257E3CA-8010-48D9-9ADF-5A64AF5F6897%7D.html
    2015-11-21 21:20:47  sima@file:///C:/Users/sima/AppData/Local/Temp/%7B093F8AC7-0728-4F6C-A233-0BC514BF62C2%7D.html
    2015-11-22 08:17:52  sima@file:///d:/Download/The.Vampire.Diaries.S07E07.1080p.rus.LostFilm.TV.mkv
    2015-11-22 14:27:19  sima@file:///C:/Users/sima/Desktop/%D0%94%D0%A0/WP_20151102_14_38_07_Pro.jpg
    2015-11-22 20:03:13  sima@file:///C:/Users/sima/Desktop/Sima/rld-narc.iso
    2015-11-22 21:11:25  sima@file:///D:/Download/FW__%D0%BA%D0%BE%D0%BD%D0%B2%D0%B5%D1%80%D1%82%D0%B0%D1%86%D0%B8%D1%8F_%D0%BF%D1%80%D0%B5%D0%B7%D0%B5%D0%BD%D1%82%D0%B0%D1%86%D0%B8%D0%B9.zip
    2015-11-22 21:12:34  sima@https://post.sberbank.ru/owa/attachment.ashx?id=RgAAAAAah5IRbZ4dT73kKQ4Jaf4PBwDw84WVrs%2f4Tp43l%2bL2M08JAAAAtpsEAADw84WVrs%2f4Tp43l%2bL2M08JAAAqe%2fGjAAAJ&dla=1
    2015-11-22 21:12:59  sima@file:///D:/Download/FW__%D0%BA%D0%BE%D0%BD%D0%B2%D0%B5%D1%80%D1%82%D0%B0%D1%86%D0%B8%D1%8F_%D0%BF%D1%80%D0%B5%D0%B7%D0%B5%D0%BD%D1%82%D0%B0%D1%86%D0%B8%D0%B9/NSZH_PB_dlia_SP_060515.pdf
    2015-11-22 21:15:07  sima@file:///C:/Users/sima/Documents/AdreamSoft%20PDF%20to%20Word/SmartPolis_SbP_obuchaychaiya_prezentacia_060515.docx
    2015-11-22 21:15:14  sima@file:///C:/Users/sima/Documents/AdreamSoft%20PDF%20to%20Word/NSZH_PB_dlia_SP_060515.docx
    2015-11-22 21:17:35  sima@file:///C:/Users/sima/Documents/AdreamSoft%20PDF%20to%20Word/AdreamSoft%20PDF%20to%20Word.zip
    2015-11-22 21:22:54  sima@https://post.sberbank.ru/favicon.ico
    2015-11-22 21:24:05  sima@file:///D:/Download/FW__%D0%B8%D0%BD%D0%B4._%D0%B8%D0%BD%D1%82%D0%B5%D1%80%D0%B2%D1%8C%D1%8E.zip
    2015-11-22 21:24:29  sima@https://post.sberbank.ru/owa/attachment.ashx?id=RgAAAAAah5IRbZ4dT73kKQ4Jaf4PBwDw84WVrs%2f4Tp43l%2bL2M08JAAAAtpsEAADw84WVrs%2f4Tp43l%2bL2M08JAAAqe%2fD4AAAJ&dla=1
    2015-11-23 22:45:39  sima@file:///D:/Download/%D0%BC%D0%B0%D0%BA%D1%81%D0%B8%D0%BC%D0%BE%D0%B2%D0%B8%D1%87/%D0%9C%D0%B0%D0%BA%D1%81%D0%B8%D0%BC%D0%BE%D0%B2%D0%B8%D1%87.zip
    2015-11-23 22:46:07  sima@https://post.sberbank.ru/owa/attachment.ashx?id=RgAAAAAah5IRbZ4dT73kKQ4Jaf4PBwDw84WVrs%2f4Tp43l%2bL2M08JAAAAtpsEAADw84WVrs%2f4Tp43l%2bL2M08JAAAqeunZAAAJ&dla=1
    2015-11-23 23:24:57  sima@file:///D:/Download/torrents/Honda%20CR-V.1995%20%E2%80%93%202001/Honda%20CR-V.1995%20%E2%80%93%202001.doc
    2015-11-24 21:38:17  sima@file:///C:/Users/sima/AppData/Local/Temp/%7B9AF73565-9EF0-42C4-AA4A-09CFAA917C87%7D.html
    2015-11-24 21:41:04  sima@https://post.sberbank.ru/owa/?ae=Item&a=Open&t=IPM.Note&id=RgAAAAAah5IRbZ4dT73kKQ4Jaf4PBwDw84WVrs%2f4Tp43l%2bL2M08JAAAAtpsEAADw84WVrs%2f4Tp43l%2bL2M08JAAAqfJSkAAAA&pspid=_1448368730473_279971049
    2015-11-24 21:42:39  sima@https://post.sberbank.ru/owa/?ae=Item&a=Open&t=IPM.Note&id=RgAAAAAah5IRbZ4dT73kKQ4Jaf4PBwDw84WVrs%2f4Tp43l%2bL2M08JAAAAtpsEAADw84WVrs%2f4Tp43l%2bL2M08JAAAqfJSlAAAA&pspid=_1448368730473_279971049
    2015-11-24 21:45:47  sima@file:///G:/%D0%A0%D0%B0%D1%81%D0%BF%D0%BE%D1%80%D1%8F%D0%B6%D0%B5%D0%BD%D0%B8%D0%B5%20%E2%84%96%20125%20%D0%93%D0%9E%D0%A1%D0%91%20%E2%84%96%208636.doc
    2015-11-24 21:45:53  sima@https://post.sberbank.ru/owa/attachment.ashx?attach=1&id=RgAAAAAah5IRbZ4dT73kKQ4Jaf4PBwDw84WVrs%2f4Tp43l%2bL2M08JAAAAtpsEAADw84WVrs%2f4Tp43l%2bL2M08JAAAqfJShAAAJ&attid0=BAAAAAAA&attcnt=1
    2015-11-24 21:51:15  sima@https://post.sberbank.ru/owa/?ae=Item&a=Open&t=IPM.Note&id=RgAAAAAah5IRbZ4dT73kKQ4Jaf4PBwDw84WVrs%2f4Tp43l%2bL2M08JAAAAtpsEAADw84WVrs%2f4Tp43l%2bL2M08JAAAqfJSeAAAA&pspid=_1448368730473_279971049
    2015-11-24 21:51:50  sima@file:///G:/%D0%9F%D0%90%D0%9C%D0%AF%D0%A2%D0%9A%D0%90_%D1%80%D1%83%D0%BA%D0%BE%D0%B2%D0%BE%D0%B4%D0%B8%D1%82%D0%B5%D0%BB%D1%8E%20%D0%92%D0%A1%D0%9F%20.doc
    2015-11-24 21:52:17  sima@file:///G:/%D0%A1%D0%BE%D0%BE%D0%B1%D1%89%D0%B5%D0%BD%D0%B8%D0%B5_(%D0%B1%D0%B5%D0%B7_%D0%BD%D0%B0%D0%B7%D0%B2%D0%B0%D0%BD%D0%B8%D1%8F).zip
    2015-11-24 21:52:17  sima@https://post.sberbank.ru/owa/attachment.ashx?id=RgAAAAAah5IRbZ4dT73kKQ4Jaf4PBwDw84WVrs%2f4Tp43l%2bL2M08JAAAAtpsEAADw84WVrs%2f4Tp43l%2bL2M08JAAAqfJSYAAAJ&dla=1
    2015-11-24 22:33:45  sima@file:///G:/299-2-%D1%80.rtf
    2015-11-24 22:35:18  sima@https://post.sberbank.ru/owa
    2015-11-24 22:35:31  sima@https://post.sberbank.ru/owa/attachment.ashx?attach=1&id=RgAAAAAah5IRbZ4dT73kKQ4Jaf4PBwDw84WVrs%2f4Tp43l%2bL2M08JAAAAtpsEAADw84WVrs%2f4Tp43l%2bL2M08JAAAqfJSaAAAJ&attid0=BAAAAAAA&attcnt=1
    2015-11-24 22:50:43  sima@file:///D:/Download/%D0%BC%D0%B0%D0%BA%D1%81%D0%B8%D0%BC%D0%BE%D0%B2%D0%B8%D1%87/%D0%9F%D0%BE%D1%8F%D1%81%D0%BD%D0%B5%D0%BD%D0%B8%D1%8F%20%D0%BF%D0%BE%20%D0%97%D0%B5%D0%B8%20(EVE-912864).tif
    2015-11-24 23:22:47  sima@file:///D:/Download/%D0%BC%D0%B0%D0%BA%D1%81%D0%B8%D0%BC%D0%BE%D0%B2%D0%B8%D1%87/EVE-912864%20(%D0%97%D0%B5%D1%8F).docx
    2015-11-24 23:23:32  sima@https://post.sberbank.ru/owa/?ae=Item&a=New&t=IPM.Note&cc=MTQuMy4yNjYuMSxydS1SVSw0Mjk0OTY3Mjk1LEhUTUwsMCww&pspid=_1448368730473_279971049
    2015-11-24 23:23:42  sima@file:///D:/Download/%D0%BC%D0%B0%D0%BA%D1%81%D0%B8%D0%BC%D0%BE%D0%B2%D0%B8%D1%87/86360180_%D0%90%D0%BA%D1%82_%D0%A1%D0%A0_%D0%9C%D0%B0%D0%BA%D1%81%D0%B8%D0%BC%D0%BE%D0%B2%D0%B8%D1%87.doc
    2015-11-24 23:24:52  sima@https://post.sberbank.ru/owa/?ae=Dialog&t=AttachFileDialog
    2015-11-24 23:46:52  sima@file:///D:/Download/%D1%81%D0%BE%D0%B1%D0%B5%D1%81%D0%B5%D0%B4%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D0%B5.docx
    2015-11-26 07:34:49  sima@file:///C:/Users/sima/AppData/Local/Temp/rpt-1.txt


--------[  DirectX ]-----------------------------------------------------------------------------------------------

    amstream.dll                              6.06.7601.17514   Final Retail                         70656  21.11.2010 6:29:07
    bdaplgin.ax                               6.01.7600.16385   Final Retail                         74240  14.07.2009 10:14:10
    d3d8.dll                                  6.01.7600.16385   Final Retail                    1036800  14.07.2009 10:15:08
    d3d8thk.dll                               6.01.7600.16385   Final Retail                      11264  14.07.2009 10:15:08
    d3d9.dll                                  6.01.7601.17514   Final Retail                    1828352  21.11.2010 6:29:19
    d3dim.dll                                 6.01.7600.16385   Final Retail                     386048  14.07.2009 10:15:08
    d3dim700.dll                              6.01.7600.16385   Final Retail                     817664  14.07.2009 10:15:08
    d3dramp.dll                               6.01.7600.16385   Final Retail                     593920  14.07.2009 10:15:08
    d3dxof.dll                                6.01.7600.16385   Final Retail                      53760  14.07.2009 10:15:08
    ddraw.dll                                 6.01.7600.16385   Final Retail                        531968  14.07.2009 10:15:10
    ddrawex.dll                               6.01.7600.16385   Final Retail                      30208  14.07.2009 10:15:10
    devenum.dll                               6.06.7600.16385   Final Retail                         66560  14.07.2009 10:15:10
    dinput.dll                                6.01.7600.16385   Final Retail                        136704  14.07.2009 10:15:11
    dinput8.dll                               6.01.7600.16385   Final Retail                        145408  14.07.2009 10:15:11
    dmband.dll                                6.01.7600.16385   Final Retail                      30720  14.07.2009 10:15:12
    dmcompos.dll                              6.01.7600.16385   Final Retail                      63488  14.07.2009 10:15:12
    dmime.dll                                 6.01.7600.16385   Final Retail                     179712  14.07.2009 10:15:12
    dmloader.dll                              6.01.7600.16385   Final Retail                      38400  14.07.2009 10:15:12
    dmscript.dll                              6.01.7600.16385   Final Retail                      86016  14.07.2009 10:15:12
    dmstyle.dll                               6.01.7600.16385   Final Retail                     105984  14.07.2009 10:15:12
    dmsynth.dll                               6.01.7600.16385   Final Retail                     105472  14.07.2009 10:15:12
    dmusic.dll                                6.01.7600.16385   Final Retail                        101376  14.07.2009 10:15:12
    dplaysvr.exe                              6.01.7600.16385   Final Retail                         29184  14.07.2009 10:14:18
    dplayx.dll                                6.01.7600.16385   Final Retail                     213504  14.07.2009 10:15:12
    dpmodemx.dll                              6.01.7600.16385   Final Retail                         23040  14.07.2009 10:15:12
    dpnaddr.dll                               6.01.7601.17514   Final Retail                       2560  21.11.2010 6:29:06
    dpnet.dll                                 6.01.7600.16385   Final Retail                        376832  14.07.2009 10:15:12
    dpnhpast.dll                              6.01.7600.16385   Final Retail                       7168  14.07.2009 10:15:12
    dpnhupnp.dll                              6.01.7600.16385   Final Retail                       7168  14.07.2009 10:15:12
    dpnlobby.dll                              6.01.7600.16385   Final Retail                       2560  14.07.2009 10:04:52
    dpnsvr.exe                                6.01.7600.16385   Final Retail                         33280  14.07.2009 10:14:18
    dpwsockx.dll                              6.01.7600.16385   Final Retail                         44032  14.07.2009 10:15:12
    dsdmo.dll                                 6.01.7600.16385   Final Retail                     173568  14.07.2009 10:15:13
    dsound.dll                                6.01.7600.16385   Final Retail                        453632  14.07.2009 10:15:13
    dswave.dll                                6.01.7600.16385   Final Retail                      20992  14.07.2009 10:15:13
    dxapi.sys                                 6.01.7600.16385   Final Retail                      13312  14.07.2009 8:25:26
    dxdiagn.dll                               6.01.7601.17514   Final Retail                        210432  21.11.2010 6:29:19
    dxmasf.dll                                12.00.7601.17514  Final Retail                       4096  21.11.2010 6:29:41
    encapi.dll                                6.01.7600.16385   Final Retail                      20992  14.07.2009 10:15:14
    gcdef.dll                                 6.01.7600.16385   Final Retail                        120832  14.07.2009 10:15:22
    iac25_32.ax                               2.00.0005.0053    Final Retail                        197632  14.07.2009 10:14:10
    ir41_32.ax                                4.51.0016.0003    Final Retail                        839680  14.07.2009 10:14:10
    ir41_qc.dll                               4.30.0062.0002    Final Retail                     120320  14.07.2009 10:15:34
    ir41_qcx.dll                              4.30.0062.0002    Final Retail                     120320  14.07.2009 10:15:34
    ir50_32.dll                               5.2562.0015.0055  Final Retail                        746496  14.07.2009 10:15:34
    ir50_qc.dll                               5.00.0063.0048    Final Retail                     200192  14.07.2009 10:15:34
    ir50_qcx.dll                              5.00.0063.0048    Final Retail                     200192  14.07.2009 10:15:34
    ivfsrc.ax                                 5.10.0002.0051    Final Retail                        146944  14.07.2009 10:14:10
    joy.cpl                                   6.01.7600.16385   Final Retail                        138240  14.07.2009 10:14:09
    ks.sys                                    6.01.7601.17514   Final Retail                        190976  21.11.2010 6:29:21
    ksproxy.ax                                6.01.7601.17514   Final Retail                        193536  21.11.2010 6:29:24
    kstvtune.ax                               6.01.7601.17514   Final Retail                         84480  21.11.2010 6:29:38
    ksuser.dll                                6.01.7600.16385   Final Retail                          4608  14.07.2009 10:15:35
    kswdmcap.ax                               6.01.7601.17514   Final Retail                        107008  21.11.2010 6:29:13
    ksxbar.ax                                 6.01.7601.17514   Final Retail                         48640  21.11.2010 6:29:38
    mciqtz32.dll                              6.06.7601.17514   Final Retail                         36352  21.11.2010 6:29:07
    mfc40.dll                                 4.01.0000.6151    Beta Retail                         954752  21.11.2010 6:29:07
    mfc42.dll                                 6.06.8063.0000    Beta Retail                        1136640  14.07.2009 10:15:39
    Microsoft.DirectX.AudioVideoPlayback.dll  5.04.0000.2904    Final Retail                      53248  22.11.2015 20:05:29
    Microsoft.DirectX.Diagnostics.dll         5.04.0000.2904    Final Retail                      12800  22.11.2015 20:05:29
    Microsoft.DirectX.Direct3D.dll            9.05.0132.0000    Final Retail                     473600  22.11.2015 20:05:30
    Microsoft.DirectX.Direct3DX.dll           5.04.0000.3900    Final Retail                    2676224  22.11.2015 20:05:23
    Microsoft.DirectX.Direct3DX.dll           9.04.0091.0000    Final Retail                    2846720  22.11.2015 20:05:24
    Microsoft.DirectX.Direct3DX.dll           9.05.0132.0000    Final Retail                     563712  22.11.2015 20:05:25
    Microsoft.DirectX.Direct3DX.dll           9.06.0168.0000    Final Retail                     567296  22.11.2015 20:05:25
    Microsoft.DirectX.Direct3DX.dll           9.07.0239.0000    Final Retail                     576000  22.11.2015 20:05:25
    Microsoft.DirectX.Direct3DX.dll           9.08.0299.0000    Final Retail                     577024  22.11.2015 20:05:25
    Microsoft.DirectX.Direct3DX.dll           9.09.0376.0000    Final Retail                     577536  22.11.2015 20:05:26
    Microsoft.DirectX.Direct3DX.dll           9.10.0455.0000    Final Retail                     577536  22.11.2015 20:05:26
    Microsoft.DirectX.Direct3DX.dll           9.11.0519.0000    Final Retail                     578560  22.11.2015 20:05:26
    Microsoft.DirectX.Direct3DX.dll           9.12.0589.0000    Final Retail                     578560  22.11.2015 20:05:31
    Microsoft.DirectX.DirectDraw.dll          5.04.0000.2904    Final Retail                     145920  22.11.2015 20:05:31
    Microsoft.DirectX.DirectInput.dll         5.04.0000.2904    Final Retail                     159232  22.11.2015 20:05:31
    Microsoft.DirectX.DirectPlay.dll          5.04.0000.2904    Final Retail                     364544  22.11.2015 20:05:31
    Microsoft.DirectX.DirectSound.dll         5.04.0000.2904    Final Retail                     178176  22.11.2015 20:05:32
    Microsoft.DirectX.dll                     5.04.0000.2904    Final Retail                     223232  22.11.2015 20:05:27
    mpeg2data.ax                              6.06.7601.17514   Final Retail                         72704  21.11.2010 6:29:38
    mpg2splt.ax                               6.06.7601.17514   Final Retail                     199680  21.11.2010 6:29:38
    msdmo.dll                                 6.06.7601.17514   Final Retail                      30720  21.11.2010 6:29:08
    msdvbnp.ax                                6.06.7601.17514   Final Retail                         59904  21.11.2010 6:29:38
    mskssrv.sys                               6.01.7600.16385   Final Retail                          8320  14.07.2009 8:45:08
    mspclock.sys                              6.01.7600.16385   Final Retail                          5888  14.07.2009 8:45:08
    mspqm.sys                                 6.01.7600.16385   Final Retail                          5504  14.07.2009 8:45:07
    mstee.sys                                 6.01.7600.16385   Final Retail                          6144  14.07.2009 8:45:08
    msvidctl.dll                              6.05.7601.17514   Final Retail                       2291712  21.11.2010 6:29:38
    msyuv.dll                                 6.01.7601.17514   Final Retail                      22528  21.11.2010 6:29:04
    pid.dll                                   6.01.7600.16385   Final Retail                      36352  14.07.2009 10:16:12
    psisdecd.dll                              6.06.7600.16385   Final Retail                        465408  14.07.2009 10:16:12
    psisrndr.ax                               6.06.7601.17514   Final Retail                         75776  21.11.2010 6:29:38
    qasf.dll                                  12.00.7601.17514  Final Retail                     206848  21.11.2010 6:29:08
    qcap.dll                                  6.06.7601.17514   Final Retail                        190976  21.11.2010 6:29:12
    qdv.dll                                   6.06.7601.17514   Final Retail                        283136  21.11.2010 6:29:12
    qdvd.dll                                  6.06.7601.17514   Final Retail                        514560  21.11.2010 6:29:06
    qedit.dll                                 6.06.7601.17514   Final Retail                        509440  21.11.2010 6:29:40
    qedwipes.dll                              6.06.7600.16385   Final Retail                     733184  14.07.2009 10:09:35
    quartz.dll                                6.06.7601.17514   Final Retail                       1328128  21.11.2010 6:29:07
    stream.sys                                6.01.7600.16385   Final Retail                         53632  14.07.2009 8:50:57
    swenum.sys                                6.01.7600.16385   Final Retail                         12240  14.07.2009 10:19:10
    vbisurf.ax                                6.01.7601.17514   Final Retail                      33792  21.11.2010 6:29:38
    vfwwdm32.dll                              6.01.7601.17514   Final Retail                         56832  21.11.2010 6:29:12
    wsock32.dll                               6.01.7600.16385   Final Retail                         15360  14.07.2009 10:16:20


--------[ DirectX -  ]---------------------------------------------------------------------------------------------

  [   ]

     DirectDraw:
        DirectDraw                           display
        DirectDraw                       
                                       nvd3dum.dll (9.18.13.4192 - nVIDIA Detonator 41.92)
                                      NVIDIA GeForce 9800 GTX+

     Direct3D:
                                8, 16, 32
        Z-                          16, 24, 32
      Multisample Anti-Aliasing Modes                   MSAA 2x, MSAA 4x, MSAA 8x, CSAA 8x, CSAA 8xQ, CSAA 16x, CSAA 16xQ
                               1 x 1
                              8192 x 8192
       Vertex-                             3.0
                                3.0

     Direct3D:
      Additive Texture Blending                         
      AGP Texturing                                     
      Anisotropic Filtering                             
      Automatic Mipmap Generation                       
      Bilinear Filtering                                
      Cubic Environment Mapping                         
      Cubic Filtering                                    
      Decal-Alpha Texture Blending                      
      Decal Texture Blending                            
      DirectX Texture Compression                        
      DirectX Volumetric Texture Compression             
      Dithering                                         
      Dot3 Texture Blending                             
      Dynamic Textures                                  
      Edge Anti-Aliasing                                
      Environmental Bump Mapping                        
      Environmental Bump Mapping + Luminance            
      Factor Alpha Blending                             
      Geometric Hidden-Surface Removal                   
      Guard Band                                        
      Hardware Scene Rasterization                      
      Hardware Transform & Lighting                     
      Legacy Depth Bias                                 
      Mipmap LOD Bias Adjustments                       
      Mipmapped Cube Textures                           
      Mipmapped Volume Textures                         
      Modulate-Alpha Texture Blending                   
      Modulate Texture Blending                         
      Non-Square Textures                               
      N-Patches                                          
      Perspective Texture Correction                    
      Point Sampling                                    
      Projective Textures                               
      Quintic Bezier Curves & B-Splines                  
      Range-Based Fog                                   
      Rectangular & Triangular Patches                   
      Rendering In Windowed Mode                        
      Scissor Test                                      
      Slope-Scale Based Depth Bias                      
      Specular Flat Shading                             
      Specular Gouraud Shading                          
      Specular Phong Shading                             
      Spherical Mapping                                 
      Stencil Buffers                                   
      Sub-Pixel Accuracy                                
      Subtractive Texture Blending                      
      Table Fog                                         
      Texture Alpha Blending                            
      Texture Clamping                                  
      Texture Mirroring                                 
      Texture Transparency                              
      Texture Wrapping                                  
      Triangle Culling                                   
      Trilinear Filtering                               
      Two-Sided Stencil Test                            
      Vertex Alpha Blending                             
      Vertex Fog                                        
      Vertex Tweening                                    
      Volume Textures                                   
      W-Based Fog                                       
      W-Buffering                                        
      Z-Based Fog                                       
      Z-Bias                                            
      Z-Test                                            

      FourCC:
      3x11                                              
      3x16                                              
      AI44                                              
      AI88                                              
      AIP8                                              
      ATOC                                              
      AV12                                              
      AYUV                                              
      NV12                                              
      NV24                                              
      NVDB                                              
      NVDP                                              
      NVMD                                              
      PLFF                                              
      SSAA                                              
      UYVY                                              
      YUY2                                              
      YV12                                              

     :
                                                   NVIDIA Corporation
                                     http://www.nvidia.com/page/products.html
                                       http://www.nvidia.com/content/drivers/drivers.asp
                                     http://driveragent.com?ref=59


--------[ DirectX -  ]----------------------------------------------------------------------------------------------

  [    ]

     DirectSound:
                                        
                                          
                                         1
      ./.          100 / 200000 
                             8 , 16 , , 
                             8 , 16 , , 
       /                   1 / 0
       /        1 / 0
       /           1 / 0
       /   3D-                0 / 0
       /    3D-    0 / 0
       /    3D-       0 / 0

     DirectSound:
                                
                                      
                                    
      DirectSound3D                                      
      Creative EAX 1.0                                   
      Creative EAX 2.0                                   
      Creative EAX 3.0                                   
      Creative EAX 4.0                                   
      Creative EAX 5.0                                   
      I3DL2                                              
      Sensaura ZoomFX                                    

  [   (HDMI) (   High Definition Audio) ]

     DirectSound:
                                        (HDMI) (   High Definition Audio)
                                          {0.0.0.00000000}.{224c0381-5940-4152-9c0a-8a6ecd4a0bb2}
                                         1
      ./.          100 / 200000 
                             8 , 16 , , 
                             8 , 16 , , 
       /                   1 / 0
       /        1 / 0
       /           1 / 0
       /   3D-                0 / 0
       /    3D-    0 / 0
       /    3D-       0 / 0

     DirectSound:
                                
                                      
                                    
      DirectSound3D                                      
      Creative EAX 1.0                                   
      Creative EAX 2.0                                   
      Creative EAX 3.0                                   
      Creative EAX 4.0                                   
      Creative EAX 5.0                                   
      I3DL2                                              
      Sensaura ZoomFX                                    


--------[ DirectX -  ]--------------------------------------------------------------------------------------------

  [ Microsoft MIDI Mapper [] ]

     DirectMusic:
                                      Microsoft MIDI Mapper []
                                          
                                          
                                           Windows Multimedia
       MIDI                                       16

     DirectMusic:
         GM                  
         Roland GS                 
      DirectSound                                        
        DLS L1                           
        DLS L2                           
        MIDI                                 
         DLS                    
                                         
                                               
                                           
                                       

  [ Microsoft GS Wavetable Synth [] ]

     DirectMusic:
                                      Microsoft GS Wavetable Synth []
                                          
                                          
                                           Windows Multimedia
       MIDI                                       16

     DirectMusic:
         GM                  
         Roland GS                 
      DirectSound                                        
        DLS L1                           
        DLS L2                           
        MIDI                                 
         DLS                    
                                         
                                               
                                           
                                       

  [ Microsoft Synthesizer ]

     DirectMusic:
                                      Microsoft Synthesizer
                                          
                                          
                                           User-Mode Synthesizer
                                             2
       MIDI                                       16000
                                                  1000
                                          

     DirectMusic:
         GM                  
         Roland GS                 
      DirectSound                                       
        DLS L1                          
        DLS L2                          
        MIDI                                 
         DLS                    
                                          
                                               
                                           
                                      


--------[ DirectX -  ]----------------------------------------------------------------------------------------------

  [  ]

     DirectInput:
                                      
                                           
                                        
                                                     3
      /                                    5

     DirectInput:
                                      
      Alias Device                                      
      Polled Device                                     
      Polled Data Format                                
      Attack Force Feedback                              
      Deadband Force Feedback                            
      Fade Force Feedback                                
      Force Feedback                                     
      Saturation Force Feedback                          
      +/- Force Feedback Coefficients                    
      +/- Force Feedback Saturation                      

  [  ]

     DirectInput:
                                      
                                           
                                        
      /                                    128

     DirectInput:
                                      
      Alias Device                                      
      Polled Device                                     
      Polled Data Format                                
      Attack Force Feedback                              
      Deadband Force Feedback                            
      Fade Force Feedback                                
      Force Feedback                                     
      Saturation Force Feedback                          
      +/- Force Feedback Coefficients                    
      +/- Force Feedback Saturation                      

  [ Micr ]

     DirectInput:
                                      Micr
                                           
                                        
                                                     1
      /                                    1024

     DirectInput:
                                      
      Alias Device                                      
      Polled Device                                     
      Polled Data Format                                
      Attack Force Feedback                              
      Deadband Force Feedback                            
      Fade Force Feedback                                
      Force Feedback                                     
      Saturation Force Feedback                          
      +/- Force Feedback Coefficients                    
      +/- Force Feedback Saturation                      

  [ Micr ]

     DirectInput:
                                      Micr
                                           
                                        

     DirectInput:
                                      
      Alias Device                                      
      Polled Device                                     
      Polled Data Format                                
      Attack Force Feedback                              
      Deadband Force Feedback                            
      Fade Force Feedback                                
      Force Feedback                                     
      Saturation Force Feedback                          
      +/- Force Feedback Coefficients                    
      +/- Force Feedback Saturation                      

  [ Micr ]

     DirectInput:
                                      Micr
                                           
                                        
      /                                    1280

     DirectInput:
                                      
      Alias Device                                      
      Polled Device                                     
      Polled Data Format                                
      Attack Force Feedback                              
      Deadband Force Feedback                            
      Fade Force Feedback                                
      Force Feedback                                     
      Saturation Force Feedback                          
      +/- Force Feedback Coefficients                    
      +/- Force Feedback Saturation                      

  [ Micr ]

     DirectInput:
                                      Micr
                                           
                                        

     DirectInput:
                                      
      Alias Device                                      
      Polled Device                                     
      Polled Data Format                                
      Attack Force Feedback                              
      Deadband Force Feedback                            
      Fade Force Feedback                                
      Force Feedback                                     
      Saturation Force Feedback                          
      +/- Force Feedback Coefficients                    
      +/- Force Feedback Saturation                      

  [ Micr ]

     DirectInput:
                                      Micr
                                           
                                        
      /                                    256

     DirectInput:
                                      
      Alias Device                                      
      Polled Device                                     
      Polled Data Format                                
      Attack Force Feedback                              
      Deadband Force Feedback                            
      Fade Force Feedback                                
      Force Feedback                                     
      Saturation Force Feedback                          
      +/- Force Feedback Coefficients                    
      +/- Force Feedback Saturation                      


--------[  Windows ]------------------------------------------------------------------------------------------

  [  ]

    DVD  CD-ROM :
      HL-DT-ST DVD-RAM GH82N ATA Device                 6.1.7601.17514

    IDE ATA/ATAPI :
      ATA Channel 0                                     6.1.7601.17514
      ATA Channel 0                                     6.1.7601.17514
      ATA Channel 0                                     6.1.7601.17514
      ATA Channel 1                                     6.1.7601.17514
      ATA Channel 1                                     6.1.7601.17514
      ATA Channel 1                                     6.1.7601.17514
       Intel(R) ICH8 Serial ATA Storage (2-) - 28256.1.7601.17514
       Intel(R) ICH8 Serial ATA Storage (4-) - 28206.1.7601.17514
         PCI IDE      6.1.7601.17514

    :
      NVIDIA GeForce 9800 GTX+                          9.18.13.4192

     :
      ST31000528AS ATA Device                           6.1.7600.16385
      ST3320418AS ATA Device                            6.1.7600.16385

      :
      Ancillary Function Driver for Winsock             
      Beep                                              
      CNG                                               
      cpuz138                                           
      Hardware Policy Driver                            
      HTTP                                              
      IP Network Address Translator                     
      Kernel Mode Driver Frameworks service             
      KSecDD                                            
      KSecPkg                                           
      LDDM Graphics Subsystem                           
      Link-Layer Topology Discovery Mapper I/O Driver   
      Link-Layer Topology Discovery Responder           
      msisadrv                                          
      NativeWiFi Filter                                 
      NDIS Usermode I/O Protocol                        
      NDProxy                                           
      NETBT                                             
      NSI proxy service driver.                         
      Null                                              
      NvStreamKms                                       
      Parvdm                                            
      PEAUTH                                            
      Performance Counters for Windows Driver           
      Portable WinCDEmu driver                          
      RDP Encoder Mirror Driver                         
      RDPCDD                                            
      Reflector Display Driver used to gain access to graphics data
      Security Driver                                   
      Security Processor Loader Driver                  
      System Attribute Cache                            
      TCP/IP Registry Compatibility                     
      User Mode Driver Frameworks Platform Driver       
      VgaSave                                           
      WFP Lightweight Filter                            
            
                              
                               
                                 
         Windows           
        NetIO Legacy TDI                
        TCP/IP                          
         IPv6 ARP               
          Bitlocker        
        (CLFS)                               
        QoS                           
        NDIS                            
                               

    ,    :
      NVIDIA Virtual Audio Device (Wave Extensible) (WDM)1.2.27.0
      USB Microphone                                    6.1.7601.17514
         High Definition Audio     6.1.7601.17514

    :
       HID                                    6.1.7601.17514
        PS/2                       6.1.7601.17514

    :
      ACPI    x86                        6.1.7600.16385

     USB:
      Intel(R) ICH8 Family USB  -  - 28306.1.7601.17514
      Intel(R) ICH8 Family USB  -  - 28316.1.7601.17514
      Intel(R) ICH8 Family USB  -  - 28326.1.7601.17514
      Intel(R) ICH8 Family USB  -  - 28346.1.7601.17514
      Intel(R) ICH8 Family USB  -  - 28356.1.7601.17514
      Intel(R) ICH8 Family USB2  -  - 28366.1.7601.17514
      Intel(R) ICH8 Family USB2  -  - 283A6.1.7601.17514
       USB-                         6.1.7601.17514
       USB-                         6.1.7601.17514
       USB-                         6.1.7601.17514
       USB-                         6.1.7601.17514
       USB-                         6.1.7601.17514
       USB-                         6.1.7601.17514
       USB-                         6.1.7601.17514
       USB                           6.1.7601.17514
       USB                           6.1.7601.17514

    :
        PnP                         6.1.7600.16385

        :
      HID-                               6.1.7600.16385
      Microsoft PS/2                                6.1.7600.16385

     (COM  LPT):
        (LPT1)                              6.1.7600.16385
        (COM1)                      6.1.7600.16385

    :
      Intel(R) Core(TM)2 Duo CPU     E6550  @ 2.33GHz   6.1.7600.16385
      Intel(R) Core(TM)2 Duo CPU     E6550  @ 2.33GHz   6.1.7600.16385

     :
      ASUS USB-N10 150Mbps 11n Wireless USB dongle      1021.3.912.2012
      RAS                             6.1.7601.17514
      WAN Miniport (IKEv2)                              6.1.7601.17514
       Microsoft ISATAP #2                       6.1.7600.16385
       Microsoft ISATAP                          6.1.7600.16385
       WAN (IP)                                 6.1.7601.17514
       WAN (IPv6)                               6.1.7601.17514
       WAN (L2TP)                               6.1.7601.17514
       WAN (PPPoE)                              6.1.7601.17514
       WAN (PPTP)                               6.1.7601.17514
      - WAN (SSTP)                              6.1.7601.17514
       WAN ( )                    6.1.7601.17514
        Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC (NDIS 6.20)7.2.1127.2008

     :
      CMOS                                         6.1.7601.17514
      Intel(R) 82801 PCI  - 244E                    6.1.7601.17514
      Intel(R) 82802 Firmware               6.1.7601.17514
      Intel(R) ICH8 Family PCI Express Root  1 - 283F6.1.7601.17514
      Intel(R) ICH8 Family PCI Express Root  6 - 28496.1.7601.17514
      Intel(R) ICH8 Family  SMBus - 283E      6.1.7601.17514
      Intel(R) ICH8/ICH8R Family  LPC- - 28106.1.7601.17514
      Intel(R) P965/G965 PCI Express Root  - 29A1   6.1.7601.17514
      Intel(R) P965/G965 Processor to I/O  - 29A06.1.7601.17514
      Microsoft ACPI-                 6.1.7601.17514
      Microsoft System Management BIOS           6.1.7601.17514
      Remote Desktop Device Redirector Bus              6.1.7600.16385
      UMBus                    6.1.7601.17514
      UMBus                                6.1.7601.17514
                               6.1.7601.17514
                                       6.1.7601.17514
                                          6.1.7601.17514
                      6.1.7601.17514
                            6.1.7601.17514
          ()6.1.7601.17514
                               6.1.7600.16385
        ACPI                               6.1.7601.17514
       High Definition Audio (Microsoft)      6.1.7601.17514
                         6.1.7601.17514
                        6.1.7601.17514
                            6.1.7601.17514
         Plug and Play 6.1.7601.17514
                     6.1.7601.17514
                                   6.1.7601.17514
                                   6.1.7601.17514
                                   6.1.7601.17514
                                   6.1.7601.17514
                                   6.1.7601.17514
                                          6.1.7601.17514
                                          6.1.7601.17514
                                         6.1.7601.17514
         ACPI          6.1.7601.17514
       PCI                                          6.1.7601.17514

        :
                           6.1.7600.16385
                           6.1.7600.16385
                           6.1.7600.16385
                           6.1.7600.16385
                           6.1.7600.16385

      :
                                        6.1.7601.17514
                                        6.1.7601.17514
                                        6.1.7601.17514
                                        6.1.7601.17514

     HID (Human Interface Devices):
      HID-               6.1.7600.16385
      HID-               6.1.7600.16385
      HID-               6.1.7600.16385
      HID-                         6.1.7601.17514
      HID-                         6.1.7601.17514
      USB-                               6.1.7601.17514
      USB-                               6.1.7601.17514
      USB-                               6.1.7601.17514

      :
      USB2.0 Camera                                     6.1.7601.17514

    -  IEEE 1394:
      VIA 1394 OHCI- -         6.1.7601.17514

  [ DVD  CD-ROM  / HL-DT-ST DVD-RAM GH82N ATA Device ]

     :
                                        HL-DT-ST DVD-RAM GH82N ATA Device
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          cdrom.inf
       ID                                     IDE\CdRomHL-DT-ST_DVD-RAM_GH82N__________________KU02____
                                     Channel 1, Target 0, Lun 0

  [ IDE ATA/ATAPI  / ATA Channel 0 ]

     :
                                        ATA Channel 0
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          mshdc.inf
       ID                                     Intel-2825
                                     Channel 0

  [ IDE ATA/ATAPI  / ATA Channel 0 ]

     :
                                        ATA Channel 0
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          mshdc.inf
       ID                                     Intel-2820
                                     Channel 0

  [ IDE ATA/ATAPI  / ATA Channel 0 ]

     :
                                        ATA Channel 0
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          mshdc.inf
       ID                                     11ab-6121
                                     Channel 0

  [ IDE ATA/ATAPI  / ATA Channel 1 ]

     :
                                        ATA Channel 1
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          mshdc.inf
       ID                                     11ab-6121
                                     Channel 1

  [ IDE ATA/ATAPI  / ATA Channel 1 ]

     :
                                        ATA Channel 1
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          mshdc.inf
       ID                                     Intel-2825
                                     Channel 1

  [ IDE ATA/ATAPI  / ATA Channel 1 ]

     :
                                        ATA Channel 1
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          mshdc.inf
       ID                                     Intel-2820
                                     Channel 1

  [ IDE ATA/ATAPI  /  Intel(R) ICH8 Serial ATA Storage (2-) - 2825 ]

     :
                                         Intel(R) ICH8 Serial ATA Storage (2-) - 2825
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          mshdc.inf
       ID                                     PCI\VEN_8086&DEV_2825&SUBSYS_72351462&REV_02
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,31,5)
      PCI-                                    Intel 82801HB ICH8 - 2-port SATA Controller [B-0]

     :
      IRQ                                               19
                                                    9480-948F
                                                    9800-980F
                                                    9880-9883
                                                    9C00-9C07
                                                    A000-A003
                                                    A080-A087

  [ IDE ATA/ATAPI  /  Intel(R) ICH8 Serial ATA Storage (4-) - 2820 ]

     :
                                         Intel(R) ICH8 Serial ATA Storage (4-) - 2820
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          mshdc.inf
       ID                                     PCI\VEN_8086&DEV_2820&SUBSYS_72351462&REV_02
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,31,2)
      PCI-                                    Intel 82801HB ICH8 - 4-port SATA Controller [B-0]

     :
      IRQ                                               19
                                                    A480-A48F
                                                    A800-A80F
                                                    A880-A883
                                                    AC00-AC07
                                                    B000-B003
                                                    B080-B087

  [ IDE ATA/ATAPI  /    PCI IDE ]

     :
                                           PCI IDE
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          mshdc.inf
       ID                                     PCI\VEN_11AB&DEV_6121&SUBSYS_612111AB&REV_B1
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(3,0,0)
      PCI-                                    Marvell 88SE6121 Serial ATA II Host Controller

     :
      IRQ                                               17
                                                  FEAFFC00-FEAFFFFF
                                                    D400-D40F
                                                    D480-D483
                                                    D800-D807
                                                    D880-D883
                                                    DC00-DC07

  [  / NVIDIA GeForce 9800 GTX+ ]

     :
                                        NVIDIA GeForce 9800 GTX+
                                            13.10.2015
                                          9.18.13.4192
                                       NVIDIA
      INF-                                          oem4.inf
       ID                                     PCI\VEN_10DE&DEV_0613&SUBSYS_00000000&REV_A2
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(1,0,0)
      PCI-                                    nVIDIA GeForce 9800 GTX+ Video Adapter

     :
      IRQ                                               16
                                                  000A0000-000BFFFF
                                                  D0000000-DFFFFFFF
                                                  FA000000-FBFFFFFF
                                                  FD000000-FDFFFFFF
                                                    03B0-03BB
                                                    03C0-03DF
                                                    CC00-CC7F

  [   / ST31000528AS ATA Device ]

     :
                                        ST31000528AS ATA Device
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          disk.inf
       ID                                     IDE\DiskST31000528AS____________________________CC38____
                                     Channel 0, Target 0, Lun 0

  [   / ST3320418AS ATA Device ]

     :
                                        ST3320418AS ATA Device
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          disk.inf
       ID                                     IDE\DiskST3320418AS_____________________________CC38____
                                     Channel 1, Target 0, Lun 0

  [    / Ancillary Function Driver for Winsock ]

     :
                                        Ancillary Function Driver for Winsock

  [    / Beep ]

     :
                                        Beep

  [    / CNG ]

     :
                                        CNG

  [    / cpuz138 ]

     :
                                        cpuz138

  [    / Hardware Policy Driver ]

     :
                                        Hardware Policy Driver

  [    / HTTP ]

     :
                                        HTTP

  [    / IP Network Address Translator ]

     :
                                        IP Network Address Translator

  [    / Kernel Mode Driver Frameworks service ]

     :
                                        Kernel Mode Driver Frameworks service

  [    / KSecDD ]

     :
                                        KSecDD

  [    / KSecPkg ]

     :
                                        KSecPkg

  [    / LDDM Graphics Subsystem ]

     :
                                        LDDM Graphics Subsystem

  [    / Link-Layer Topology Discovery Mapper I/O Driver ]

     :
                                        Link-Layer Topology Discovery Mapper I/O Driver

  [    / Link-Layer Topology Discovery Responder ]

     :
                                        Link-Layer Topology Discovery Responder

  [    / msisadrv ]

     :
                                        msisadrv

  [    / NativeWiFi Filter ]

     :
                                        NativeWiFi Filter

  [    / NDIS Usermode I/O Protocol ]

     :
                                        NDIS Usermode I/O Protocol

  [    / NDProxy ]

     :
                                        NDProxy

  [    / NETBT ]

     :
                                        NETBT

  [    / NSI proxy service driver. ]

     :
                                        NSI proxy service driver.

  [    / Null ]

     :
                                        Null

  [    / NvStreamKms ]

     :
                                        NvStreamKms

  [    / Parvdm ]

     :
                                        Parvdm

  [    / PEAUTH ]

     :
                                        PEAUTH

  [    / Performance Counters for Windows Driver ]

     :
                                        Performance Counters for Windows Driver

  [    / Portable WinCDEmu driver ]

     :
                                        Portable WinCDEmu driver

  [    / RDP Encoder Mirror Driver ]

     :
                                        RDP Encoder Mirror Driver

  [    / RDPCDD ]

     :
                                        RDPCDD

  [    / Reflector Display Driver used to gain access to graphics data ]

     :
                                        Reflector Display Driver used to gain access to graphics data

  [    / Security Driver ]

     :
                                        Security Driver

  [    / Security Processor Loader Driver ]

     :
                                        Security Processor Loader Driver

  [    / System Attribute Cache ]

     :
                                        System Attribute Cache

  [    / TCP/IP Registry Compatibility ]

     :
                                        TCP/IP Registry Compatibility

  [    / User Mode Driver Frameworks Platform Driver ]

     :
                                        User Mode Driver Frameworks Platform Driver

  [    / VgaSave ]

     :
                                        VgaSave

  [    / WFP Lightweight Filter ]

     :
                                        WFP Lightweight Filter

  [    /        ]

     :
                                              

  [    /    ]

     :
                                          

  [    /    ]

     :
                                          

  [    /    ]

     :
                                          

  [    /    Windows ]

     :
                                           Windows

  [    /   NetIO Legacy TDI ]

     :
                                          NetIO Legacy TDI

  [    /   TCP/IP ]

     :
                                          TCP/IP

  [    /    IPv6 ARP ]

     :
                                           IPv6 ARP

  [    /     Bitlocker ]

     :
                                            Bitlocker

  [    /   (CLFS) ]

     :
                                          (CLFS)

  [    /   QoS ]

     :
                                          QoS

  [    /   NDIS ]

     :
                                          NDIS

  [    /    ]

     :
                                          

  [ ,     / NVIDIA Virtual Audio Device (Wave Extensible) (WDM) ]

     :
                                        NVIDIA Virtual Audio Device (Wave Extensible) (WDM)
                                            24.11.2014
                                          1.2.27.0
                                       NVIDIA
      INF-                                          oem6.inf
       ID                                     USB\VID_0955&PID_9000

  [ ,     / USB Microphone ]

     :
                                        USB Microphone
                                            19.11.2010
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          wdma_usb.inf
       ID                                     USB\VID_1E4E&PID_0109&REV_0002&MI_02
                                     0000.001d.0007.002.000.000.000.000.000

  [ ,     /    High Definition Audio ]

     :
                                           High Definition Audio
                                            19.11.2010
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          hdaudio.inf
       ID                                     HDAUDIO\FUNC_01&VEN_10EC&DEV_0888&SUBSYS_14627235&REV_1000
                                       High Definition Audio

  [  /  HID ]

     :
                                         HID
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          keyboard.inf
       ID                                     HID\VID_045E&PID_0745&REV_0633&MI_00

  [  /   PS/2 ]

     :
                                          PS/2
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          keyboard.inf
       ID                                     ACPI\PNP0303
      PnP-                                    101/102-Key or MS Natural Keyboard

     :
      IRQ                                               01
                                                    0060-0060
                                                    0064-0064

  [  / ACPI    x86 ]

     :
                                        ACPI    x86
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          hal.inf
       ID                                     acpiapic

  [  USB / Intel(R) ICH8 Family USB  -  - 2830 ]

     :
                                        Intel(R) ICH8 Family USB  -  - 2830
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          usbport.inf
       ID                                     PCI\VEN_8086&DEV_2830&SUBSYS_72351462&REV_02
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,29,0)
      PCI-                                    Intel 82801HB ICH8 - USB Universal Host Controller [B-0]

     :
      IRQ                                               23
                                                    B800-B81F

  [  USB / Intel(R) ICH8 Family USB  -  - 2831 ]

     :
                                        Intel(R) ICH8 Family USB  -  - 2831
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          usbport.inf
       ID                                     PCI\VEN_8086&DEV_2831&SUBSYS_72351462&REV_02
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,29,1)
      PCI-                                    Intel 82801HB ICH8 - USB Universal Host Controller [B-0]

     :
      IRQ                                               19
                                                    B480-B49F

  [  USB / Intel(R) ICH8 Family USB  -  - 2832 ]

     :
                                        Intel(R) ICH8 Family USB  -  - 2832
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          usbport.inf
       ID                                     PCI\VEN_8086&DEV_2832&SUBSYS_72351462&REV_02
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,29,2)
      PCI-                                    Intel 82801HB ICH8 - USB Universal Host Controller [B-0]

     :
      IRQ                                               18
                                                    B400-B41F

  [  USB / Intel(R) ICH8 Family USB  -  - 2834 ]

     :
                                        Intel(R) ICH8 Family USB  -  - 2834
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          usbport.inf
       ID                                     PCI\VEN_8086&DEV_2834&SUBSYS_72351462&REV_02
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,26,0)
      PCI-                                    Intel 82801HB ICH8 - USB Universal Host Controller [B-0]

     :
      IRQ                                               16
                                                    BC00-BC1F

  [  USB / Intel(R) ICH8 Family USB  -  - 2835 ]

     :
                                        Intel(R) ICH8 Family USB  -  - 2835
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          usbport.inf
       ID                                     PCI\VEN_8086&DEV_2835&SUBSYS_72351462&REV_02
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,26,1)
      PCI-                                    Intel 82801HB ICH8 - USB Universal Host Controller [B-0]

     :
      IRQ                                               21
                                                    B880-B89F

  [  USB / Intel(R) ICH8 Family USB2  -  - 2836 ]

     :
                                        Intel(R) ICH8 Family USB2  -  - 2836
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          usbport.inf
       ID                                     PCI\VEN_8086&DEV_2836&SUBSYS_72351462&REV_02
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,29,7)
      PCI-                                    Intel 82801HB ICH8 - USB2 Enhanced Host Controller [B-0]

     :
      IRQ                                               23
                                                  F9FFF800-F9FFFBFF

  [  USB / Intel(R) ICH8 Family USB2  -  - 283A ]

     :
                                        Intel(R) ICH8 Family USB2  -  - 283A
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          usbport.inf
       ID                                     PCI\VEN_8086&DEV_283A&SUBSYS_72351462&REV_02
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,26,7)
      PCI-                                    Intel 82801HB ICH8 - USB2 Enhanced Host Controller [B-0]

     :
      IRQ                                               18
                                                  F9FFFC00-F9FFFFFF

  [  USB /  USB- ]

     :
                                         USB-
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          usbport.inf
       ID                                     USB\ROOT_HUB&VID8086&PID2832&REV0002

  [  USB /  USB- ]

     :
                                         USB-
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          usbport.inf
       ID                                     USB\ROOT_HUB20&VID8086&PID2836&REV0002

  [  USB /  USB- ]

     :
                                         USB-
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          usbport.inf
       ID                                     USB\ROOT_HUB20&VID8086&PID283A&REV0002

  [  USB /  USB- ]

     :
                                         USB-
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          usbport.inf
       ID                                     USB\ROOT_HUB&VID8086&PID2835&REV0002

  [  USB /  USB- ]

     :
                                         USB-
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          usbport.inf
       ID                                     USB\ROOT_HUB&VID8086&PID2830&REV0002

  [  USB /  USB- ]

     :
                                         USB-
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          usbport.inf
       ID                                     USB\ROOT_HUB&VID8086&PID2831&REV0002

  [  USB /  USB- ]

     :
                                         USB-
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          usbport.inf
       ID                                     USB\ROOT_HUB&VID8086&PID2834&REV0002

  [  USB /  USB  ]

     :
                                         USB 
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          usb.inf
       ID                                     USB\VID_045E&PID_0745&REV_0633
                                     Port_#0002.Hub_#0005

  [  USB /  USB  ]

     :
                                         USB 
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          usb.inf
       ID                                     USB\VID_1E4E&PID_0109&REV_0002
                                     Port_#0002.Hub_#0007

  [  /   PnP ]

     :
                                          PnP
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          monitor.inf
       ID                                     MONITOR\ACR0053

  [      / HID-  ]

     :
                                        HID- 
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          msmouse.inf
       ID                                     HID\VID_045E&PID_0745&REV_0633&MI_01&Col01

  [      / Microsoft PS/2  ]

     :
                                        Microsoft PS/2 
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          msmouse.inf
       ID                                     ACPI\PNP0F03
      PnP-                                    Microsoft PS/2 Port Mouse

     :
      IRQ                                               12

  [  (COM  LPT) /   (LPT1) ]

     :
                                          (LPT1)
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          msports.inf
       ID                                     ACPI\PNP0400
      PnP-                                    Parallel Port

     :
                                                    0378-037F

  [  (COM  LPT) /   (COM1) ]

     :
                                          (COM1)
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          msports.inf
       ID                                     ACPI\PNP0501
      PnP-                                    16550A-compatible UART Serial Port

     :
      IRQ                                               04
                                                    03F8-03FF

  [  / Intel(R) Core(TM)2 Duo CPU     E6550  @ 2.33GHz ]

     :
                                        Intel(R) Core(TM)2 Duo CPU     E6550  @ 2.33GHz
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          cpu.inf
       ID                                     ACPI\GenuineIntel_-_x86_Family_6_Model_15

  [  / Intel(R) Core(TM)2 Duo CPU     E6550  @ 2.33GHz ]

     :
                                        Intel(R) Core(TM)2 Duo CPU     E6550  @ 2.33GHz
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          cpu.inf
       ID                                     ACPI\GenuineIntel_-_x86_Family_6_Model_15

  [   / ASUS USB-N10 150Mbps 11n Wireless USB dongle ]

     :
                                        ASUS USB-N10 150Mbps 11n Wireless USB dongle
                                            12.09.2012
                                          1021.3.912.2012
                                       Realtek Semiconductor Corp.
      INF-                                          oem2.inf
       ID                                     USB\VID_0B05&PID_17BA&REV_0200
                                     Port_#0006.Hub_#0007

  [   / RAS   ]

     :
                                        RAS Async Adapter
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          netrasa.inf
       ID                                     SW\{eeab7790-c514-11d1-b42b-00805fc1270e}

  [   / WAN Miniport (IKEv2) ]

     :
                                        WAN Miniport (IKEv2)
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          netavpna.inf
       ID                                     ms_agilevpnminiport

  [   /  Microsoft ISATAP #2 ]

     :
                                         Microsoft ISATAP #2
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          nettun.inf
       ID                                     *ISATAP

  [   /  Microsoft ISATAP ]

     :
                                         Microsoft ISATAP
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          nettun.inf
       ID                                     *ISATAP

  [   /  WAN (IP) ]

     :
                                        WAN Miniport (IP)
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          netrasa.inf
       ID                                     ms_ndiswanip

  [   /  WAN (IPv6) ]

     :
                                        WAN Miniport (IPv6)
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          netrasa.inf
       ID                                     ms_ndiswanipv6

  [   /  WAN (L2TP) ]

     :
                                        WAN Miniport (L2TP)
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          netrasa.inf
       ID                                     ms_l2tpminiport

  [   /  WAN (PPPoE) ]

     :
                                        WAN Miniport (PPPOE)
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          netrasa.inf
       ID                                     ms_pppoeminiport

  [   /  WAN (PPTP) ]

     :
                                        WAN Miniport (PPTP)
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          netrasa.inf
       ID                                     ms_pptpminiport

  [   / - WAN (SSTP) ]

     :
                                        WAN Miniport (SSTP)
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          netsstpa.inf
       ID                                     ms_sstpminiport

  [   /  WAN ( ) ]

     :
                                        WAN Miniport (Network Monitor)
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          netrasa.inf
       ID                                     ms_ndiswanbh

  [   /   Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC (NDIS 6.20) ]

     :
                                          Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC (NDIS 6.20)
                                            26.02.2008
                                          7.2.1127.2008
                                       Microsoft
      INF-                                          netrtx32.inf
       ID                                     PCI\VEN_10EC&DEV_8167&SUBSYS_235C1462&REV_10
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(4,2,0)
      PCI-                                    Realtek RTL8169/8110 Gigabit Ethernet Adapter

     :
      IRQ                                               21
                                                  FEBFFC00-FEBFFCFF
                                                    E800-E8FF

  [   / CMOS   ]

     :
                                        CMOS  
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ACPI\PNP0B00
      PnP-                                    Real-Time Clock

     :
      IRQ                                               08
                                                    0070-0071

  [   / Intel(R) 82801 PCI  - 244E ]

     :
                                        Intel(R) 82801 PCI  - 244E
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     PCI\VEN_8086&DEV_244E&SUBSYS_72351462&REV_F2
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,30,0)
      PCI-                                    Intel 82801HB I/O Controller Hub 8 (ICH8) [B-0]

     :
                                                  FEB00000-FEBFFFFF
                                                    E000-EFFF

  [   / Intel(R) 82802 Firmware  ]

     :
                                        Intel(R) 82802 Firmware 
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ACPI\INT0800
      PnP-                                    Intel Flash EEPROM

     :
                                                  FFB00000-FFBFFFFF
                                                  FFF00000-FFFFFFFF

  [   / Intel(R) ICH8 Family PCI Express Root  1 - 283F ]

     :
                                        Intel(R) ICH8 Family PCI Express Root  1 - 283F
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     PCI\VEN_8086&DEV_283F&SUBSYS_72351462&REV_02
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,28,0)
      PCI-                                    Intel 82801HB ICH8 - PCI Express Root Port 1 [B-0]

     :
      IRQ                                               131071

  [   / Intel(R) ICH8 Family PCI Express Root  6 - 2849 ]

     :
                                        Intel(R) ICH8 Family PCI Express Root  6 - 2849
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     PCI\VEN_8086&DEV_2849&SUBSYS_72351462&REV_02
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,28,5)
      PCI-                                    Intel 82801HB ICH8 - PCI Express Root Port 6 [B-0]

     :
      IRQ                                               131071
                                                  FEA00000-FEAFFFFF
                                                    D000-DFFF

  [   / Intel(R) ICH8 Family  SMBus - 283E ]

     :
                                        Intel(R) ICH8 Family  SMBus - 283E
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     PCI\VEN_8086&DEV_283E&SUBSYS_72351462&REV_02
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,31,3)
      PCI-                                    Intel 82801HB ICH8 - SMBus Controller [B-0]

     :
      IRQ                                               05
                                                  F9FFF400-F9FFF4FF
                                                    0400-041F

  [   / Intel(R) ICH8/ICH8R Family  LPC- - 2810 ]

     :
                                        Intel(R) ICH8/ICH8R Family  LPC- - 2810
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     PCI\VEN_8086&DEV_2810&SUBSYS_72351462&REV_02
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,31,0)
      PCI-                                    Intel 82801HB ICH8 - LPC Bridge [B-0]

  [   / Intel(R) P965/G965 PCI Express Root  - 29A1 ]

     :
                                        Intel(R) P965/G965 PCI Express Root  - 29A1
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     PCI\VEN_8086&DEV_29A1&SUBSYS_00008086&REV_02
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,1,0)
      PCI-                                    Intel G965/P965 Chipset - PCI Express Root Port [C-2]

     :
      IRQ                                               131071
                                                  000A0000-000BFFFF
                                                  D0000000-DFFFFFFF
                                                  FA000000-FE9FFFFF
                                                    03B0-03BB
                                                    03C0-03DF
                                                    C000-CFFF

  [   / Intel(R) P965/G965 Processor to I/O  - 29A0 ]

     :
                                        Intel(R) P965/G965 Processor to I/O  - 29A0
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     PCI\VEN_8086&DEV_29A0&SUBSYS_72351462&REV_02
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,0,0)
      PCI-                                    Intel G965/P965 Chipset - Memory Controller Hub [C-2]

  [   / Microsoft ACPI-  ]

     :
                                        Microsoft ACPI- 
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          acpi.inf
       ID                                     ACPI_HAL\PNP0C08
      PnP-                                    ACPI Driver/BIOS

     :
      IRQ                                               100
      IRQ                                               101
      IRQ                                               102
      IRQ                                               103
      IRQ                                               104
      IRQ                                               105
      IRQ                                               106
      IRQ                                               107
      IRQ                                               108
      IRQ                                               109
      IRQ                                               110
      IRQ                                               111
      IRQ                                               112
      IRQ                                               113
      IRQ                                               114
      IRQ                                               115
      IRQ                                               116
      IRQ                                               117
      IRQ                                               118
      IRQ                                               119
      IRQ                                               120
      IRQ                                               121
      IRQ                                               122
      IRQ                                               123
      IRQ                                               124
      IRQ                                               125
      IRQ                                               126
      IRQ                                               127
      IRQ                                               128
      IRQ                                               129
      IRQ                                               130
      IRQ                                               131
      IRQ                                               132
      IRQ                                               133
      IRQ                                               134
      IRQ                                               135
      IRQ                                               136
      IRQ                                               137
      IRQ                                               138
      IRQ                                               139
      IRQ                                               140
      IRQ                                               141
      IRQ                                               142
      IRQ                                               143
      IRQ                                               144
      IRQ                                               145
      IRQ                                               146
      IRQ                                               147
      IRQ                                               148
      IRQ                                               149
      IRQ                                               150
      IRQ                                               151
      IRQ                                               152
      IRQ                                               153
      IRQ                                               154
      IRQ                                               155
      IRQ                                               156
      IRQ                                               157
      IRQ                                               158
      IRQ                                               159
      IRQ                                               160
      IRQ                                               161
      IRQ                                               162
      IRQ                                               163
      IRQ                                               164
      IRQ                                               165
      IRQ                                               166
      IRQ                                               167
      IRQ                                               168
      IRQ                                               169
      IRQ                                               170
      IRQ                                               171
      IRQ                                               172
      IRQ                                               173
      IRQ                                               174
      IRQ                                               175
      IRQ                                               176
      IRQ                                               177
      IRQ                                               178
      IRQ                                               179
      IRQ                                               180
      IRQ                                               181
      IRQ                                               182
      IRQ                                               183
      IRQ                                               184
      IRQ                                               185
      IRQ                                               186
      IRQ                                               187
      IRQ                                               188
      IRQ                                               189
      IRQ                                               190
      IRQ                                               81
      IRQ                                               82
      IRQ                                               83
      IRQ                                               84
      IRQ                                               85
      IRQ                                               86
      IRQ                                               87
      IRQ                                               88
      IRQ                                               89
      IRQ                                               90
      IRQ                                               91
      IRQ                                               92
      IRQ                                               93
      IRQ                                               94
      IRQ                                               95
      IRQ                                               96
      IRQ                                               97
      IRQ                                               98
      IRQ                                               99

  [   / Microsoft System Management BIOS  ]

     :
                                        Microsoft System Management BIOS 
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ROOT\mssmbios

  [   / Remote Desktop Device Redirector Bus ]

     :
                                        Remote Desktop Device Redirector Bus
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          rdpbus.inf
       ID                                     ROOT\RDPBUS

  [   / UMBus    ]

     :
                                        UMBus   
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          umbus.inf
       ID                                     root\umbus

  [   / UMBus  ]

     :
                                        UMBus 
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          umbus.inf
       ID                                     UMB\UMBUS

  [   /   ]

     :
                                         
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ACPI\PNP0C04
      PnP-                                    Numeric Data Processor

     :
      IRQ                                               13
                                                    00F0-00FF

  [   /   ]

     :
                                         
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ACPI\PNP0800
      PnP-                                    PC Speaker

     :
                                                    0061-0061

  [   /   ]

     :
                                         
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ROOT\VOLMGR

  [   /     ]

     :
                                           
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ROOT\RDP_KBD

  [   /     ]

     :
                                           
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ROOT\RDP_MOU

  [   /     () ]

     :
                                            ()
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ROOT\vdrvroot

  [   /      ]

     :
                                            
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          blbdrive.inf
       ID                                     ROOT\BLBDRIVE

  [   /   ACPI ]

     :
                                          ACPI
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ACPI\PNP0C0C
      PnP-                                    Power Button

  [   /  High Definition Audio (Microsoft) ]

     :
                                         High Definition Audio (Microsoft)
                                            19.11.2010
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          hdaudbus.inf
       ID                                     PCI\VEN_8086&DEV_284B&SUBSYS_72351462&REV_02
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,27,0)
      PCI-                                    Intel 82801HB ICH8 - High Definition Audio Controller [B-0]

     :
      IRQ                                               22
                                                  F9FF8000-F9FFBFFF

  [   /      ]

     :
                                            
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ACPI\PNP0200
      PnP-                                    DMA Controller

     :
      DMA                                               04
                                                    0000-000F
                                                    0081-0083
                                                    0087-0087
                                                    0089-008B
                                                    008F-008F
                                                    00C0-00DF

  [   /     ]

     :
                                           
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     LPTENUM\MicrosoftRawPort958A
                                     LPT1

  [   /    ]

     :
                                          
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          compositebus.inf
       ID                                     ROOT\CompositeBus

  [   /    Plug and Play ]

     :
                                           Plug and Play
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     root\swenum

  [   /    ]

     :
                                          
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ACPI\PNP0000
      PnP-                                    Programmable Interrupt Controller

     :
                                                    0020-0021
                                                    00A0-00A1

  [   /    ]

     :
                                          
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ACPI\PNP0C02
      PnP-                                    Motherboard Resources

     :
                                                  E0000000-EFFFFFFF

  [   /    ]

     :
                                          
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ACPI\PNP0C02
      PnP-                                    Motherboard Resources

     :
                                                  FEC00000-FEC00FFF
                                                  FEE00000-FEE00FFF

  [   /    ]

     :
                                          
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ACPI\PNP0C02
      PnP-                                    Motherboard Resources

     :
                                                  FED1C000-FED1FFFF
                                                  FED20000-FED8FFFF
                                                    0010-001F
                                                    0022-003F
                                                    0044-005F
                                                    0062-0063
                                                    0065-006F
                                                    0072-007F
                                                    0080-0080
                                                    0084-0086
                                                    0088-0088
                                                    008C-008E
                                                    0090-009F
                                                    00A2-00BF
                                                    00E0-00EF
                                                    0480-04BF
                                                    04D0-04D1
                                                    0800-087F

  [   /    ]

     :
                                          
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ACPI\PNP0C02
      PnP-                                    Motherboard Resources

     :
                                                  FFC00000-FFEFFFFF

  [   /    ]

     :
                                          
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ACPI\PNP0C02
      PnP-                                    Motherboard Resources

     :
                                                    0A10-0AEF
                                                    0AE0-0AEF

  [   /   ]

     :
                                         
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ACPI\PNP0C01
      PnP-                                    System Board Extension

     :
                                                  00000000-0009FFFF
                                                  000C0000-000CFFFF
                                                  000E0000-000FFFFF
                                                  00100000-CFFFFFFF

  [   /   ]

     :
                                         
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ACPI\PNP0C01
      PnP-                                    System Board Extension

     :
                                                  FED14000-FED19FFF

  [   /   ]

     :
                                         
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ACPI\PNP0100
      PnP-                                    System Timer

     :
      IRQ                                               00
                                                    0040-0043

  [   /    ACPI ]

     :
                                           ACPI
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ACPI\FixedButton

  [   /  PCI ]

     :
                                         PCI
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          machine.inf
       ID                                     ACPI\PNP0A08
      PnP-                                    ACPI Three-wire Device Bus

     :
                                                  000A0000-000BFFFF
                                                  000D0000-000DFFFF
                                                  D0000000-FFFFFFFF
                                                    0000-0CF7
                                                    0D00-FFFF

  [      /     ]

     :
                                           
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          volsnap.inf
       ID                                     STORAGE\VolumeSnapshot

  [      /     ]

     :
                                           
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          volsnap.inf
       ID                                     STORAGE\VolumeSnapshot

  [      /     ]

     :
                                           
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          volsnap.inf
       ID                                     STORAGE\VolumeSnapshot

  [      /     ]

     :
                                           
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          volsnap.inf
       ID                                     STORAGE\VolumeSnapshot

  [      /     ]

     :
                                           
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          volsnap.inf
       ID                                     STORAGE\VolumeSnapshot

  [    /   ]

     :
                                         
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          volume.inf
       ID                                     STORAGE\Volume

  [    /   ]

     :
                                         
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          volume.inf
       ID                                     STORAGE\Volume

  [    /   ]

     :
                                         
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          volume.inf
       ID                                     STORAGE\Volume

  [    /   ]

     :
                                         
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          volume.inf
       ID                                     STORAGE\Volume

  [  HID (Human Interface Devices) / HID-   ]

     :
                                        HID-  
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          hidserv.inf
       ID                                     HID\VID_045E&PID_0745&REV_0633&MI_02&Col01

  [  HID (Human Interface Devices) / HID-   ]

     :
                                        HID-  
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          hidserv.inf
       ID                                     HID\VID_045E&PID_0745&REV_0633&MI_02&Col02

  [  HID (Human Interface Devices) / HID-   ]

     :
                                        HID-  
                                            21.06.2006
                                          6.1.7600.16385
                                       Microsoft
      INF-                                          hidserv.inf
       ID                                     HID\VID_045E&PID_0745&REV_0633&MI_01&Col02

  [  HID (Human Interface Devices) / HID-  ]

     :
                                        HID- 
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          input.inf
       ID                                     HID\VID_045E&PID_0745&REV_0633&MI_02&Col03

  [  HID (Human Interface Devices) / HID-  ]

     :
                                        HID- 
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          input.inf
       ID                                     HID\VID_045E&PID_0745&REV_0633&MI_02&Col04

  [  HID (Human Interface Devices) / USB-  ]

     :
                                        USB- 
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          input.inf
       ID                                     USB\VID_045E&PID_0745&REV_0633&MI_00
                                     0000.001d.0001.002.000.000.000.000.000

  [  HID (Human Interface Devices) / USB-  ]

     :
                                        USB- 
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          input.inf
       ID                                     USB\VID_045E&PID_0745&REV_0633&MI_01
                                     0000.001d.0001.002.000.000.000.000.000

  [  HID (Human Interface Devices) / USB-  ]

     :
                                        USB- 
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          input.inf
       ID                                     USB\VID_045E&PID_0745&REV_0633&MI_02
                                     0000.001d.0001.002.000.000.000.000.000

  [    / USB2.0 Camera ]

     :
                                        USB2.0 Camera
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          usbvideo.inf
       ID                                     USB\VID_1E4E&PID_0109&REV_0002&MI_00
                                     0000.001d.0007.002.000.000.000.000.000

  [ -  IEEE 1394 / VIA 1394 OHCI- - ]

     :
                                        VIA 1394 OHCI- -
                                            21.06.2006
                                          6.1.7601.17514
                                       Microsoft
      INF-                                          1394.inf
       ID                                     PCI\VEN_1106&DEV_3044&SUBSYS_235D1462&REV_C0
                                     @system32\drivers\pci.sys,#65536;PCI bus %1, device %2, function %3;(4,3,0)
      PCI-                                    VIA VT6306/6307 Fire II IEEE1394 Host Controller

     :
      IRQ                                               20
                                                  FEBFF000-FEBFF7FF
                                                    EC00-EC7F


--------[   ]---------------------------------------------------------------------------------------

     PCI:
       0,  30,  0                  Intel 82801HB I/O Controller Hub 8 (ICH8) [B-0]
       0,  31,  5                  Intel 82801HB ICH8 - 2-port SATA Controller [B-0]
       0,  31,  2                  Intel 82801HB ICH8 - 4-port SATA Controller [B-0]
       0,  27,  0                  Intel 82801HB ICH8 - High Definition Audio Controller [B-0]
       0,  31,  0                  Intel 82801HB ICH8 - LPC Bridge [B-0]
       0,  28,  0                  Intel 82801HB ICH8 - PCI Express Root Port 1 [B-0]
       0,  28,  5                  Intel 82801HB ICH8 - PCI Express Root Port 6 [B-0]
       0,  31,  3                  Intel 82801HB ICH8 - SMBus Controller [B-0]
       0,  26,  0                  Intel 82801HB ICH8 - USB Universal Host Controller [B-0]
       0,  26,  1                  Intel 82801HB ICH8 - USB Universal Host Controller [B-0]
       0,  29,  0                  Intel 82801HB ICH8 - USB Universal Host Controller [B-0]
       0,  29,  1                  Intel 82801HB ICH8 - USB Universal Host Controller [B-0]
       0,  29,  2                  Intel 82801HB ICH8 - USB Universal Host Controller [B-0]
       0,  26,  7                  Intel 82801HB ICH8 - USB2 Enhanced Host Controller [B-0]
       0,  29,  7                  Intel 82801HB ICH8 - USB2 Enhanced Host Controller [B-0]
       0,  0,  0                   Intel G965/P965 Chipset - Memory Controller Hub [C-2]
       0,  1,  0                   Intel G965/P965 Chipset - PCI Express Root Port [C-2]
       3,  0,  0                   Marvell 88SE6121 Serial ATA II Host Controller
       1,  0,  0                   nVIDIA GeForce 9800 GTX+ Video Adapter
       4,  2,  0                   Realtek RTL8169/8110 Gigabit Ethernet Adapter
       4,  3,  0                   VIA VT6306/6307 Fire II IEEE1394 Host Controller

     PnP:
      PNP0303                                           101/102-Key or MS Natural Keyboard
      PNP0501                                           16550A-compatible UART Serial Port
      PNP0C08                                           ACPI Driver/BIOS
      PNP0A08                                           ACPI Three-wire Device Bus
      PNP0200                                           DMA Controller
      INT0800                                           Intel Flash EEPROM
      GENUINEINTEL_-_X86_FAMILY_6_MODEL_15_-_INTEL(R)_CORE(TM)2_DUO_CPU_____E6550__@_2.33GHZIntel(R) Core(TM)2 Duo CPU     E6550  @ 2.33GHz
      GENUINEINTEL_-_X86_FAMILY_6_MODEL_15_-_INTEL(R)_CORE(TM)2_DUO_CPU_____E6550__@_2.33GHZIntel(R) Core(TM)2 Duo CPU     E6550  @ 2.33GHz
      PNP0F03                                           Microsoft PS/2 Port Mouse
      PNP0C02                                           Motherboard Resources
      PNP0C02                                           Motherboard Resources
      PNP0C02                                           Motherboard Resources
      PNP0C02                                           Motherboard Resources
      PNP0C02                                           Motherboard Resources
      PNP0C04                                           Numeric Data Processor
      PNP0400                                           Parallel Port
      PNP0800                                           PC Speaker
      PNP0C0C                                           Power Button
      PNP0000                                           Programmable Interrupt Controller
      PNP0B00                                           Real-Time Clock
      PNP0C01                                           System Board Extension
      PNP0C01                                           System Board Extension
      PNP0100                                           System Timer
      ISATAP                                             Microsoft ISATAP #2
      ISATAP                                             Microsoft ISATAP
      FIXEDBUTTON                                          ACPI

     LPT PnP:
      MICROSOFTRAWPORT                                     

     USB:
      0B05 17BA                                         ASUS USB-N10 150Mbps 11n Wireless USB dongle
      1E4E 0109                                         USB Microphone
      1E4E 0109                                         USB2.0 Camera
      045E 0745                                         USB- 
      045E 0745                                         USB- 
      045E 0745                                         USB- 
      045E 0745                                          USB 
      1E4E 0109                                          USB 

    :
      COM1                                                (COM1)
      LPT1                                                (LPT1)


--------[  PCI ]----------------------------------------------------------------------------------------------

  [ Intel 82801HB I/O Controller Hub 8 (ICH8) [B-0] ]

     :
                                      Intel 82801HB I/O Controller Hub 8 (ICH8) [B-0]
                                                 PCI
       /  /                        0 / 30 / 0
      ID                                      8086-244E
                               0000-0000
                                         0604 (PCI/PCI Bridge)
                                                  F2
      Fast Back-to-Back Transactions                     

     :
      66-                                     
      Bus Mastering                                     

  [ Intel 82801HB ICH8 - 2-port SATA Controller [B-0] ]

     :
                                      Intel 82801HB ICH8 - 2-port SATA Controller [B-0]
                                                 PCI
       /  /                        0 / 31 / 5
      ID                                      8086-2825
                               1462-7235
                                         0101 (IDE Controller)
                                                  02
      Fast Back-to-Back Transactions                    , 

     :
      66-                                    
      Bus Mastering                                     

  [ Intel 82801HB ICH8 - 4-port SATA Controller [B-0] ]

     :
                                      Intel 82801HB ICH8 - 4-port SATA Controller [B-0]
                                                 PCI
       /  /                        0 / 31 / 2
      ID                                      8086-2820
                               1462-7235
                                         0101 (IDE Controller)
                                                  02
      Fast Back-to-Back Transactions                    , 

     :
      66-                                    
      Bus Mastering                                     

  [ Intel 82801HB ICH8 - High Definition Audio Controller [B-0] ]

     :
                                      Intel 82801HB ICH8 - High Definition Audio Controller [B-0]
                                                 PCI Express 1.0
       /  /                        0 / 27 / 0
      ID                                      8086-284B
                               1462-7235
                                         0403 (High Definition Audio)
                                                  02
      Fast Back-to-Back Transactions                     

     :
      66-                                     
      Bus Mastering                                     

  [ Intel 82801HB ICH8 - LPC Bridge [B-0] ]

     :
                                      Intel 82801HB ICH8 - LPC Bridge [B-0]
                                                 PCI
       /  /                        0 / 31 / 0
      ID                                      8086-2810
                               1462-7235
                                         0601 (PCI/ISA Bridge)
                                                  02
      Fast Back-to-Back Transactions                     

     :
      66-                                     
      Bus Mastering                                     

  [ Intel 82801HB ICH8 - PCI Express Root Port 1 [B-0] ]

     :
                                      Intel 82801HB ICH8 - PCI Express Root Port 1 [B-0]
                                                 PCI
       /  /                        0 / 28 / 0
      ID                                      8086-283F
                               0000-0000
                                         0604 (PCI/PCI Bridge)
                                                  02
      Fast Back-to-Back Transactions                     

     :
      66-                                     
      Bus Mastering                                     

  [ Intel 82801HB ICH8 - PCI Express Root Port 6 [B-0] ]

     :
                                      Intel 82801HB ICH8 - PCI Express Root Port 6 [B-0]
                                                 PCI
       /  /                        0 / 28 / 5
      ID                                      8086-2849
                               0000-0000
                                         0604 (PCI/PCI Bridge)
                                                  02
      Fast Back-to-Back Transactions                     

     :
      66-                                     
      Bus Mastering                                     

  [ Intel 82801HB ICH8 - SMBus Controller [B-0] ]

     :
                                      Intel 82801HB ICH8 - SMBus Controller [B-0]
                                                 PCI
       /  /                        0 / 31 / 3
      ID                                      8086-283E
                               1462-7235
                                         0C05 (SMBus Controller)
                                                  02
      Fast Back-to-Back Transactions                    , 

     :
      66-                                     
      Bus Mastering                                     

  [ Intel 82801HB ICH8 - USB Universal Host Controller [B-0] ]

     :
                                      Intel 82801HB ICH8 - USB Universal Host Controller [B-0]
                                                 PCI
       /  /                        0 / 26 / 0
      ID                                      8086-2834
                               1462-7235
                                         0C03 (USB Controller)
                                                  02
      Fast Back-to-Back Transactions                    , 

     :
      66-                                     
      Bus Mastering                                     

  [ Intel 82801HB ICH8 - USB Universal Host Controller [B-0] ]

     :
                                      Intel 82801HB ICH8 - USB Universal Host Controller [B-0]
                                                 PCI
       /  /                        0 / 26 / 1
      ID                                      8086-2835
                               1462-7235
                                         0C03 (USB Controller)
                                                  02
      Fast Back-to-Back Transactions                    , 

     :
      66-                                     
      Bus Mastering                                     

  [ Intel 82801HB ICH8 - USB Universal Host Controller [B-0] ]

     :
                                      Intel 82801HB ICH8 - USB Universal Host Controller [B-0]
                                                 PCI
       /  /                        0 / 29 / 0
      ID                                      8086-2830
                               1462-7235
                                         0C03 (USB Controller)
                                                  02
      Fast Back-to-Back Transactions                    , 

     :
      66-                                     
      Bus Mastering                                     

  [ Intel 82801HB ICH8 - USB Universal Host Controller [B-0] ]

     :
                                      Intel 82801HB ICH8 - USB Universal Host Controller [B-0]
                                                 PCI
       /  /                        0 / 29 / 1
      ID                                      8086-2831
                               1462-7235
                                         0C03 (USB Controller)
                                                  02
      Fast Back-to-Back Transactions                    , 

     :
      66-                                     
      Bus Mastering                                     

  [ Intel 82801HB ICH8 - USB Universal Host Controller [B-0] ]

     :
                                      Intel 82801HB ICH8 - USB Universal Host Controller [B-0]
                                                 PCI
       /  /                        0 / 29 / 2
      ID                                      8086-2832
                               1462-7235
                                         0C03 (USB Controller)
                                                  02
      Fast Back-to-Back Transactions                    , 

     :
      66-                                     
      Bus Mastering                                     

  [ Intel 82801HB ICH8 - USB2 Enhanced Host Controller [B-0] ]

     :
                                      Intel 82801HB ICH8 - USB2 Enhanced Host Controller [B-0]
                                                 PCI
       /  /                        0 / 26 / 7
      ID                                      8086-283A
                               1462-7235
                                         0C03 (USB Controller)
                                                  02
      Fast Back-to-Back Transactions                    , 

     :
      66-                                     
      Bus Mastering                                     

  [ Intel 82801HB ICH8 - USB2 Enhanced Host Controller [B-0] ]

     :
                                      Intel 82801HB ICH8 - USB2 Enhanced Host Controller [B-0]
                                                 PCI
       /  /                        0 / 29 / 7
      ID                                      8086-2836
                               1462-7235
                                         0C03 (USB Controller)
                                                  02
      Fast Back-to-Back Transactions                    , 

     :
      66-                                     
      Bus Mastering                                     

  [ Intel G965/P965 Chipset - Memory Controller Hub [C-2] ]

     :
                                      Intel G965/P965 Chipset - Memory Controller Hub [C-2]
                                                 PCI
       /  /                        0 / 0 / 0
      ID                                      8086-29A0
                               1462-7235
                                         0600 (Host/PCI Bridge)
                                                  02
      Fast Back-to-Back Transactions                    , 

     :
      66-                                     
      Bus Mastering                                     

  [ Intel G965/P965 Chipset - PCI Express Root Port [C-2] ]

     :
                                      Intel G965/P965 Chipset - PCI Express Root Port [C-2]
                                                 PCI
       /  /                        0 / 1 / 0
      ID                                      8086-29A1
                               0000-0000
                                         0604 (PCI/PCI Bridge)
                                                  02
      Fast Back-to-Back Transactions                     

     :
      66-                                     
      Bus Mastering                                     

  [ Marvell 88SE6121 Serial ATA II Host Controller ]

     :
                                      Marvell 88SE6121 Serial ATA II Host Controller
                                                 PCI Express 1.0 x1
       /  /                        3 / 0 / 0
      ID                                      11AB-6121
                               11AB-6121
                                         0101 (IDE Controller)
                                                  B1
      Fast Back-to-Back Transactions                     

     :
      66-                                     
      Bus Mastering                                     

  [ nVIDIA GeForce 9800 GTX+ Video Adapter ]

     :
                                      nVIDIA GeForce 9800 GTX+ Video Adapter
                                                 PCI Express 2.0 x16
       /  /                        1 / 0 / 0
      ID                                      10DE-0613
                               0000-0000
                                         0300 (VGA Display Controller)
                                                  A2
      Fast Back-to-Back Transactions                     

     :
      66-                                     
      Bus Mastering                                     

  [ Realtek RTL8169/8110 Gigabit Ethernet Adapter ]

     :
                                      Realtek RTL8169/8110 Gigabit Ethernet Adapter
                                                 PCI
       /  /                        4 / 2 / 0
      ID                                      10EC-8167
                               1462-235C
                                         0200 (Ethernet Controller)
                                                  10
      Fast Back-to-Back Transactions                    , 

     :
      66-                                    
      Bus Mastering                                     

  [ VIA VT6306/6307 Fire II IEEE1394 Host Controller ]

     :
                                      VIA VT6306/6307 Fire II IEEE1394 Host Controller
                                                 PCI
       /  /                        4 / 3 / 0
      ID                                      1106-3044
                               1462-235D
                                         0C00 (FireWire Controller)
                                                  C0
      Fast Back-to-Back Transactions                     

     :
      66-                                     
      Bus Mastering                                     


--------[  USB ]----------------------------------------------------------------------------------------------

  [  USB  (Microsoft 2.4GHz Transceiver v7.0) ]

     :
                                       USB 
      ID                                      045E-0745
                                         03 / 01 (Human Interface Device)
                                      01
                                           Microsoft
                                                 Microsoft 2.4GHz Transceiver v7.0
        USB                         2.00
                                         Full  (USB 1.1)

  [  USB  (USB2.0 Camera) ]

     :
                                       USB 
      ID                                      1E4E-0109
                                         EF / 02 (Interface Association Descriptor)
                                      01
                                           Etron Technology, Inc.
                                                 USB2.0 Camera
        USB                         2.00
                                         High  (USB 2.0)

  [ ASUS USB-N10 150Mbps 11n Wireless USB dongle (802.11n WLAN Adapter) ]

     :
                                      ASUS USB-N10 150Mbps 11n Wireless USB dongle
      ID                                      0B05-17BA
                                         FF / FF
                                      FF
                                           Realtek
                                                 802.11n WLAN Adapter
                                           00e04c000001
        USB                         2.00
                                         High  (USB 2.0)


--------[   ]-------------------------------------------------------------------------------------------

    DMA 04                                   
    IRQ 00                                
    IRQ 01                                 PS/2
    IRQ 04                                 (COM1)
    IRQ 05                                        Intel(R) ICH8 Family  SMBus - 283E
    IRQ 08                               CMOS  
    IRQ 100                              Microsoft ACPI- 
    IRQ 101                              Microsoft ACPI- 
    IRQ 102                              Microsoft ACPI- 
    IRQ 103                              Microsoft ACPI- 
    IRQ 104                              Microsoft ACPI- 
    IRQ 105                              Microsoft ACPI- 
    IRQ 106                              Microsoft ACPI- 
    IRQ 107                              Microsoft ACPI- 
    IRQ 108                              Microsoft ACPI- 
    IRQ 109                              Microsoft ACPI- 
    IRQ 110                              Microsoft ACPI- 
    IRQ 111                              Microsoft ACPI- 
    IRQ 112                              Microsoft ACPI- 
    IRQ 113                              Microsoft ACPI- 
    IRQ 114                              Microsoft ACPI- 
    IRQ 115                              Microsoft ACPI- 
    IRQ 116                              Microsoft ACPI- 
    IRQ 117                              Microsoft ACPI- 
    IRQ 118                              Microsoft ACPI- 
    IRQ 119                              Microsoft ACPI- 
    IRQ 12                               Microsoft PS/2 
    IRQ 120                              Microsoft ACPI- 
    IRQ 121                              Microsoft ACPI- 
    IRQ 122                              Microsoft ACPI- 
    IRQ 123                              Microsoft ACPI- 
    IRQ 124                              Microsoft ACPI- 
    IRQ 125                              Microsoft ACPI- 
    IRQ 126                              Microsoft ACPI- 
    IRQ 127                              Microsoft ACPI- 
    IRQ 128                              Microsoft ACPI- 
    IRQ 129                              Microsoft ACPI- 
    IRQ 13                                
    IRQ 130                              Microsoft ACPI- 
    IRQ 131                              Microsoft ACPI- 
    IRQ 131071                           Intel(R) ICH8 Family PCI Express Root  1 - 283F
    IRQ 131071                           Intel(R) ICH8 Family PCI Express Root  6 - 2849
    IRQ 131071                           Intel(R) P965/G965 PCI Express Root  - 29A1
    IRQ 132                              Microsoft ACPI- 
    IRQ 133                              Microsoft ACPI- 
    IRQ 134                              Microsoft ACPI- 
    IRQ 135                              Microsoft ACPI- 
    IRQ 136                              Microsoft ACPI- 
    IRQ 137                              Microsoft ACPI- 
    IRQ 138                              Microsoft ACPI- 
    IRQ 139                              Microsoft ACPI- 
    IRQ 140                              Microsoft ACPI- 
    IRQ 141                              Microsoft ACPI- 
    IRQ 142                              Microsoft ACPI- 
    IRQ 143                              Microsoft ACPI- 
    IRQ 144                              Microsoft ACPI- 
    IRQ 145                              Microsoft ACPI- 
    IRQ 146                              Microsoft ACPI- 
    IRQ 147                              Microsoft ACPI- 
    IRQ 148                              Microsoft ACPI- 
    IRQ 149                              Microsoft ACPI- 
    IRQ 150                              Microsoft ACPI- 
    IRQ 151                              Microsoft ACPI- 
    IRQ 152                              Microsoft ACPI- 
    IRQ 153                              Microsoft ACPI- 
    IRQ 154                              Microsoft ACPI- 
    IRQ 155                              Microsoft ACPI- 
    IRQ 156                              Microsoft ACPI- 
    IRQ 157                              Microsoft ACPI- 
    IRQ 158                              Microsoft ACPI- 
    IRQ 159                              Microsoft ACPI- 
    IRQ 16                                        Intel(R) ICH8 Family USB  -  - 2834
    IRQ 16                                        NVIDIA GeForce 9800 GTX+
    IRQ 160                              Microsoft ACPI- 
    IRQ 161                              Microsoft ACPI- 
    IRQ 162                              Microsoft ACPI- 
    IRQ 163                              Microsoft ACPI- 
    IRQ 164                              Microsoft ACPI- 
    IRQ 165                              Microsoft ACPI- 
    IRQ 166                              Microsoft ACPI- 
    IRQ 167                              Microsoft ACPI- 
    IRQ 168                              Microsoft ACPI- 
    IRQ 169                              Microsoft ACPI- 
    IRQ 17                                           PCI IDE
    IRQ 170                              Microsoft ACPI- 
    IRQ 171                              Microsoft ACPI- 
    IRQ 172                              Microsoft ACPI- 
    IRQ 173                              Microsoft ACPI- 
    IRQ 174                              Microsoft ACPI- 
    IRQ 175                              Microsoft ACPI- 
    IRQ 176                              Microsoft ACPI- 
    IRQ 177                              Microsoft ACPI- 
    IRQ 178                              Microsoft ACPI- 
    IRQ 179                              Microsoft ACPI- 
    IRQ 18                                        Intel(R) ICH8 Family USB  -  - 2832
    IRQ 18                                        Intel(R) ICH8 Family USB2  -  - 283A
    IRQ 180                              Microsoft ACPI- 
    IRQ 181                              Microsoft ACPI- 
    IRQ 182                              Microsoft ACPI- 
    IRQ 183                              Microsoft ACPI- 
    IRQ 184                              Microsoft ACPI- 
    IRQ 185                              Microsoft ACPI- 
    IRQ 186                              Microsoft ACPI- 
    IRQ 187                              Microsoft ACPI- 
    IRQ 188                              Microsoft ACPI- 
    IRQ 189                              Microsoft ACPI- 
    IRQ 19                                        Intel(R) ICH8 Family USB  -  - 2831
    IRQ 19                                         Intel(R) ICH8 Serial ATA Storage (2-) - 2825
    IRQ 19                                         Intel(R) ICH8 Serial ATA Storage (4-) - 2820
    IRQ 190                              Microsoft ACPI- 
    IRQ 20                                        VIA 1394 OHCI- -
    IRQ 21                                          Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC (NDIS 6.20)
    IRQ 21                                        Intel(R) ICH8 Family USB  -  - 2835
    IRQ 22                                         High Definition Audio (Microsoft)
    IRQ 23                                        Intel(R) ICH8 Family USB  -  - 2830
    IRQ 23                                        Intel(R) ICH8 Family USB2  -  - 2836
    IRQ 81                               Microsoft ACPI- 
    IRQ 82                               Microsoft ACPI- 
    IRQ 83                               Microsoft ACPI- 
    IRQ 84                               Microsoft ACPI- 
    IRQ 85                               Microsoft ACPI- 
    IRQ 86                               Microsoft ACPI- 
    IRQ 87                               Microsoft ACPI- 
    IRQ 88                               Microsoft ACPI- 
    IRQ 89                               Microsoft ACPI- 
    IRQ 90                               Microsoft ACPI- 
    IRQ 91                               Microsoft ACPI- 
    IRQ 92                               Microsoft ACPI- 
    IRQ 93                               Microsoft ACPI- 
    IRQ 94                               Microsoft ACPI- 
    IRQ 95                               Microsoft ACPI- 
    IRQ 96                               Microsoft ACPI- 
    IRQ 97                               Microsoft ACPI- 
    IRQ 98                               Microsoft ACPI- 
    IRQ 99                               Microsoft ACPI- 
     00000000-0009FFFF              
     000A0000-000BFFFF                       PCI
     000A0000-000BFFFF                      NVIDIA GeForce 9800 GTX+
     000A0000-000BFFFF               Intel(R) P965/G965 PCI Express Root  - 29A1
     000C0000-000CFFFF              
     000D0000-000DFFFF                       PCI
     000E0000-000FFFFF              
     00100000-CFFFFFFF              
     D0000000-DFFFFFFF             Intel(R) P965/G965 PCI Express Root  - 29A1
     D0000000-DFFFFFFF             NVIDIA GeForce 9800 GTX+
     D0000000-FFFFFFFF                       PCI
     E0000000-EFFFFFFF               
     F9FF8000-F9FFBFFF              High Definition Audio (Microsoft)
     F9FFF400-F9FFF4FF             Intel(R) ICH8 Family  SMBus - 283E
     F9FFF800-F9FFFBFF             Intel(R) ICH8 Family USB2  -  - 2836
     F9FFFC00-F9FFFFFF             Intel(R) ICH8 Family USB2  -  - 283A
     FA000000-FBFFFFFF             NVIDIA GeForce 9800 GTX+
     FA000000-FE9FFFFF             Intel(R) P965/G965 PCI Express Root  - 29A1
     FD000000-FDFFFFFF             NVIDIA GeForce 9800 GTX+
     FEA00000-FEAFFFFF             Intel(R) ICH8 Family PCI Express Root  6 - 2849
     FEAFFC00-FEAFFFFF                PCI IDE
     FEB00000-FEBFFFFF             Intel(R) 82801 PCI  - 244E
     FEBFF000-FEBFF7FF             VIA 1394 OHCI- -
     FEBFFC00-FEBFFCFF               Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC (NDIS 6.20)
     FEC00000-FEC00FFF               
     FED14000-FED19FFF              
     FED1C000-FED1FFFF               
     FED20000-FED8FFFF               
     FEE00000-FEE00FFF               
     FFB00000-FFBFFFFF             Intel(R) 82802 Firmware 
     FFC00000-FFEFFFFF               
     FFF00000-FFFFFFFF             Intel(R) 82802 Firmware 
     0000-000F                           
     0000-0CF7                                 PCI
     0010-001F                         
     0020-0021                         
     0022-003F                         
     0040-0043                        
     0044-005F                         
     0060-0060                         PS/2
     0061-0061                        
     0062-0063                         
     0064-0064                         PS/2
     0065-006F                         
     0070-0071                       CMOS  
     0072-007F                         
     0080-0080                         
     0081-0083                           
     0084-0086                         
     0087-0087                           
     0088-0088                         
     0089-008B                           
     008C-008E                         
     008F-008F                           
     0090-009F                         
     00A0-00A1                         
     00A2-00BF                         
     00C0-00DF                           
     00E0-00EF                         
     00F0-00FF                        
     0378-037F                         (LPT1)
     03B0-03BB                                NVIDIA GeForce 9800 GTX+
     03B0-03BB                         Intel(R) P965/G965 PCI Express Root  - 29A1
     03C0-03DF                                NVIDIA GeForce 9800 GTX+
     03C0-03DF                         Intel(R) P965/G965 PCI Express Root  - 29A1
     03F8-03FF                         (COM1)
     0400-041F                       Intel(R) ICH8 Family  SMBus - 283E
     0480-04BF                         
     04D0-04D1                         
     0800-087F                         
     0A10-0AEF                         
     0AE0-0AEF                         
     0D00-FFFF                                 PCI
     9480-948F                        Intel(R) ICH8 Serial ATA Storage (2-) - 2825
     9800-980F                        Intel(R) ICH8 Serial ATA Storage (2-) - 2825
     9880-9883                        Intel(R) ICH8 Serial ATA Storage (2-) - 2825
     9C00-9C07                        Intel(R) ICH8 Serial ATA Storage (2-) - 2825
     A000-A003                        Intel(R) ICH8 Serial ATA Storage (2-) - 2825
     A080-A087                        Intel(R) ICH8 Serial ATA Storage (2-) - 2825
     A480-A48F                        Intel(R) ICH8 Serial ATA Storage (4-) - 2820
     A800-A80F                        Intel(R) ICH8 Serial ATA Storage (4-) - 2820
     A880-A883                        Intel(R) ICH8 Serial ATA Storage (4-) - 2820
     AC00-AC07                        Intel(R) ICH8 Serial ATA Storage (4-) - 2820
     B000-B003                        Intel(R) ICH8 Serial ATA Storage (4-) - 2820
     B080-B087                        Intel(R) ICH8 Serial ATA Storage (4-) - 2820
     B400-B41F                       Intel(R) ICH8 Family USB  -  - 2832
     B480-B49F                       Intel(R) ICH8 Family USB  -  - 2831
     B800-B81F                       Intel(R) ICH8 Family USB  -  - 2830
     B880-B89F                       Intel(R) ICH8 Family USB  -  - 2835
     BC00-BC1F                       Intel(R) ICH8 Family USB  -  - 2834
     C000-CFFF                       Intel(R) P965/G965 PCI Express Root  - 29A1
     CC00-CC7F                       NVIDIA GeForce 9800 GTX+
     D000-DFFF                       Intel(R) ICH8 Family PCI Express Root  6 - 2849
     D400-D40F                          PCI IDE
     D480-D483                          PCI IDE
     D800-D807                          PCI IDE
     D880-D883                          PCI IDE
     DC00-DC07                          PCI IDE
     E000-EFFF                       Intel(R) 82801 PCI  - 244E
     E800-E8FF                         Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC (NDIS 6.20)
     EC00-EC7F                       VIA 1394 OHCI- -


--------[  ]--------------------------------------------------------------------------------------------------------

  [  HID ]

     :
                                       HID
                                           IBM enhanced (101- or 102-key) keyboard
                                     US
        ANSI                             1251 - @%SystemRoot%\system32\mlang.dll,-4611
        OEM                              866 - @%SystemRoot%\system32\mlang.dll,-4645
                                         1
                                         31

  [ HID-  ]

     :
                                            HID- 
                                         5
                                              
                                         0
                                     500 msec
       X / Y                                       0 / 0
                                 3

     :
                               
      ''                                
                
                                            
                   
                                              
      Sonar                                             


--------[  ]----------------------------------------------------------------------------------------------------

  [ Fax ]

     :
                                             Fax
                                      
                                  
                                            SHRFAX:
                                         Microsoft Shared Fax Driver (v4.00)
                                           Fax
                                         winprint
                                     
                                             10:00 - 10:00
                                               1
                                 0
                                                  

     :
                                            Letter, 8.5 x 11 in
                                              
                                          200 x 200 dpi Mono

  [ Microsoft XPS Document Writer ]

     :
                                             Microsoft XPS Document Writer
                                      
                                  
                                            XPSPort:
                                         Microsoft XPS Document Writer (v6.00)
                                           Microsoft XPS Document Writer
                                         winprint
                                     
                                             
                                               1
                                 0
                                                  

     :
                                            A4, 210 x 297 mm
                                              
                                          600 x 600 dpi Color

  [   OneNote 2010 ( ) ]

     :
                                               OneNote 2010
                                      
                                  
                                            nul:
                                         Send To Microsoft OneNote 2010 Driver (v6.00)
                                             OneNote 2010
                                         winprint
                                     
                                             10:00 - 10:00
                                               1
                                 0
                                                  

     :
                                            A4, 210 x 297 mm
                                              
                                          600 x 600 dpi Color


--------[  ]------------------------------------------------------------------------------------------------

    BCSSync                            Registry\Common\Run      C:\Program Files\Microsoft Office\Office14\BCSSync.exe /DelayServices
    Cmaudio8788                        Registry\Common\Run      RunDll32 cmicnfgp.cpl,CMICtrlWnd 
    Cmaudio8788GX                      Registry\Common\Run      C:\Windows\system\HsMgr.exe Envoke
    NvBackend                          Registry\Common\Run      C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe 
    ShadowPlay                         Registry\Common\Run      C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap.dll,ShadowPlayOnSystemStart


--------[  ]---------------------------------------------------------------------------------------------

  [ AutoKMS ]

     :
                                               AutoKMS
                                                  
                                           C:\Windows\AutoKMS.exe
                                     
                                            
                                             
                                        
                                               sima
                                         26.11.2015 7:15:56
                                         

     :
       #1                                           


--------[   ]-------------------------------------------------------------------------------------

    Torrent                                                                                     3.2.0  
    AdreamSoft PDF to Word (Build 2.6.0.0)                                                              
    ASUS Xonar D1 Audio Driver                                                                          
    Download Master version 6.5.2.1475                                                      6.5.2.1475  
    Microsoft .NET Framework 4 Client Profile RUS Language Pack [ ()]           4.0.30319  
    Microsoft .NET Framework 4 Client Profile                                                4.0.30319  
    Microsoft .NET Framework 4 Client Profile                                                4.0.30319  
    Microsoft .NET Framework 4 Extended RUS Language Pack [ ()]                 4.0.30319  
    Microsoft .NET Framework 4 Extended                                                      4.0.30319  
    Microsoft .NET Framework 4 Extended                                                      4.0.30319  
    Microsoft Office Access MUI (Russian) 2010 [ ()]                       14.0.4763.1000  
    Microsoft Office Excel MUI (Russian) 2010 [ ()]                        14.0.4763.1000  
    Microsoft Office Groove MUI (Russian) 2010 [ ()]                       14.0.4763.1000  
    Microsoft Office InfoPath MUI (Russian) 2010 [ ()]                     14.0.4763.1000  
    Microsoft Office OneNote MUI (Russian) 2010 [ ()]                      14.0.4763.1000  
    Microsoft Office Outlook Connector [ ()]                               14.0.6123.5001  
    Microsoft Office Outlook MUI (Russian) 2010 [ ()]                      14.0.4763.1000  
    Microsoft Office PowerPoint MUI (Russian) 2010 [ ()]                   14.0.4763.1000  
    Microsoft Office Professional Plus 2010                                             14.0.4763.1000  
    Microsoft Office Proof (English) 2010                                               14.0.4763.1000  
    Microsoft Office Proof (German) 2010 [ ()]                          14.0.4763.1000  
    Microsoft Office Proof (Russian) 2010 [ ()]                            14.0.4763.1000  
    Microsoft Office Proof (Ukrainian) 2010 [ ()]                      14.0.4763.1000  
    Microsoft Office Proofing (Russian) 2010 [ ()]                         14.0.4763.1000  
    Microsoft Office Publisher MUI (Russian) 2010 [ ()]                    14.0.4763.1000  
    Microsoft Office Shared MUI (Russian) 2010 [ ()]                       14.0.4763.1000  
    Microsoft Office Word MUI (Russian) 2010 [ ()]                         14.0.4763.1000  
    Microsoft Office   2010                                         14.0.4763.1000  
    Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219                             10.0.40219  
    Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106                          11.0.51106.1  
    Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106                           11.0.51106  
    Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106                              11.0.51106  
    Mozilla Firefox 42.0 (x86 ru)                                                                 42.0  
    Mozilla Maintenance Service                                                            42.0.0.5780  
    Narco Terror                                                                                     1  
    NVIDIA GeForce Experience 2.2.2 [ ()]                                           2.2.2  
    NVIDIA GeForce Experience Service [ ()]                                       17.12.8  
    NVIDIA Install Application [ ()]                                      2.1002.172.1382  
    NVIDIA LED Visualizer 1.0 [ ()]                                                   1.0  
    NVIDIA Network Service [ ()]                                                      2.2  
    NVIDIA PhysX                                                                             9.13.1220  
    NVIDIA ShadowPlay 17.12.8 [ ()]                                               17.12.8  
    NVIDIA Stereoscopic 3D Driver                                                         7.17.12.6514  
    NVIDIA Update Core [ ()]                                                      17.12.8  
    NVIDIA Virtual Audio 1.2.27 [ ()]                                              1.2.27  
    NVIDIA   341.92 [ ()]                                        341.92  
    NVIDIA  3D Vision 341.92 [ ()]                                          341.92  
    NVIDIA   3D Vision 340.50 [ ()]                              340.50  
    NVIDIA    PhysX 9.13.1220 [ ()]              9.13.1220  
    OpenAL                                                                                              
    SHIELD Streaming [ ()]                                                       4.0.1000  
    SHIELD Wireless Controller Driver [ ()]                                       17.12.8  
    Trine 2 Complete Story Collectors Edition v 2.01 build 447 [ ()]     v 2.01 build 447  
    Win7codecs                                                                                   1.2.1  
     NVIDIA 17.12.8 [ ()]                                               17.12.8  
      NVIDIA 341.92 [ ()]                                          341.92  
        Microsoft.NET Framework 4 - RUS                       4.0.30319  
        Microsoft.NET Framework 4 - RUS                        4.0.30319  


--------[  ]----------------------------------------------------------------------------------------------------

    Microsoft Developer Network                                             VYBBJ-TRJPB-QFQRF-QFT4D-H3GVB
    Microsoft Internet Explorer 8.0.7601.17514                              FJGCP-4DFJD-GJY49-VJBQ7-HYRR2
    Microsoft Windows 7 Ultimate                                            FJGCP-4DFJD-GJY49-VJBQ7-HYRR2


--------[   ]-------------------------------------------------------------------------------------------------

    _SLN              Microsoft Visual Studio Solution                                 
    _SLN60            Microsoft Visual Studio 6.0 Solution                             
    _SLN70            Microsoft Visual Studio .NET 2002 Solution                       
    _SLN71            Microsoft Visual Studio .NET 2003 Solution                       
    _SLN80            Microsoft Visual Studio 2005 Solution                            
    _VBXSLN80         Microsoft Visual Basic Express 2005 Solution                     
    _VCPPXSLN80       Microsoft Visual C++ Express 2005 Solution                       
    _VCSXSLN80        Microsoft Visual C# Express 2005 Solution                        
    _VJSXSLN80        Microsoft Visual J# Express 2005 Solution                        
    _VSTASLN80        Microsoft Visual Studio 2005 Tools for Applications Solution     
    _VWDXSLN80        Microsoft Visual Web Developer Express 2005 Solution             
    386               Virtual Device Driver                                            
    3G2               3GPP2 Audio/Video                                                video/3gpp2
    3GP               3GPP Audio/Video                                                 video/3gpp
    3GP2              3GPP2 Audio/Video                                                video/3gpp2
    3GPP              3GPP Audio/Video                                                 video/3gpp
    AAC               ADTS Audio                                                       audio/vnd.dlna.adts
    AC3               Video Clip                                                       audio/x-ac3
    ACCDA             Microsoft Access Add-in                                          application/msaccess.addin
    ACCDB             Microsoft Access                                       application/msaccess
    ACCDC             Microsoft Access Signed Package                                  application/msaccess.cab
    ACCDE             Microsoft Access ACCDE Database                                  application/msaccess.exec
    ACCDR             Microsoft Access Runtime Application                             application/msaccess.runtime
    ACCDT             Microsoft Access Template                                        application/msaccess.template
    ACCDU             Microsoft Access Add-in Data                                     
    ACCDW             Microsoft Access Web Application                                 application/msaccess.webapplication
    ACCFT             Microsoft Access Template                                        application/msaccess.ftemplate
    ACL               AutoCorrect List File                                            
    ADE               Microsoft Access Project Extension                               application/msaccess
    ADN               Microsoft Access Blank Project Template                          
    ADP               Microsoft Access Project                                         application/msaccess
    ADT               ADTS Audio                                                       audio/vnd.dlna.adts
    ADTS              ADTS Audio                                                       audio/vnd.dlna.adts
    AIF               AIFF Format Sound                                                audio/aiff
    AIFC              AIFF Format Sound                                                audio/aiff
    AIFF              AIFF Format Sound                                                audio/aiff
    ALAC              Audio file                                                       
    ANI               Animated Cursor                                                  
    ANX               Video Clip                                                       audio/x-ogg
    APE               Video Clip                                                       
    APPLICATION       Application Manifest                                             application/x-ms-application
    APPREF-MS         Application Reference                                            
    ASA               ASA File                                                         
    ASF               Windows Media Audio/Video file                                   video/x-ms-asf
    ASP               ASP File                                                         
    ASX               Windows Media Audio/Video playlist                               video/x-ms-asf
    AU                AU Format Sound                                                  audio/basic
    AVI               Video Clip                                                       video/avi
    AW                Answer Wizard File                                               
    AXA               Video Clip                                                       audio/x-ogg
    AXV               Video Clip                                                       audio/x-ogg
    BAT               Windows Batch File                                               
    BDF               BDF File                                                         
    BIK               BIK File                                                         
    BLG               Performance Monitor File                                         
    BMP               Bitmap Image                                                     image/bmp
    C2R               C2R File                                                         
    CAB               Cabinet File                                                     
    CAMP              WCS Viewing Condition Profile                                    
    CAT               Security Catalog                                                 application/vnd.ms-pki.seccat
    CDA               CD Audio Track                                                   
    CDMP              WCS Device Profile                                               
    CDX               CDX File                                                         
    CER               Security Certificate                                             application/x-x509-ca-cert
    CHESSTITANSSAVE-MS  .ChessTitansSave-ms                                              
    CHK               Recovered File Fragments                                         
    CHM               Compiled HTML Help file                                          
    CMD               Windows Command Script                                           
    COM               MS-DOS Application                                               
    COMFYCAKESSAVE-MS  .ComfyCakesSave-ms                                               
    COMPOSITEFONT     Composite Font File                                              
    CONTACT           Contact File                                                     text/x-ms-contact
    CPL               Control Panel Item                                               
    CRD               Information Card                                                 
    CRDS              Information Card Store                                           
    CRL               Certificate Revocation List                                      application/pkix-crl
    CRT               Security Certificate                                             application/x-x509-ca-cert
    CRTX               Microsoft Office Chart                                    
    CSS               Cascading Style Sheet Document                                   text/css
    CSV                Microsoft Excel                                               
    CUR               Cursor                                                           
    D2V               D2V File                                                         
    DB                Data Base File                                                   
    DER               Security Certificate                                             application/x-x509-ca-cert
    DESKLINK          Desktop Shortcut                                                 
    DET                 Office                                               
    DIAGCAB           Diagnostic Cabinet                                               
    DIAGCFG           Diagnostic Configuration                                         
    DIAGPKG           Diagnostic Document                                              
    DIB               Bitmap Image                                                     image/bmp
    DIC               Text Document                                                    
    DIVX              Video Clip                                                       video/avi
    DLL               Application Extension                                            application/x-msdownload
    DMF               DMF File                                                         
    DOC                Microsoft Word 97-2003                                  application/msword
    DOCHTML            Microsoft Word   HTML                           
    DOCM               Microsoft Word                       application/vnd.ms-word.document.macroEnabled.12
    DOCMHTML          DOCMHTML File                                                    
    DOCX               Microsoft Word                                          application/vnd.openxmlformats-officedocument.wordprocessingml.document
    DOCXML             Microsoft Word   XML                            
    DOT                Microsoft Word 97-2003                                    application/msword
    DOTHTML            Microsoft Word   HTML                             
    DOTM               Microsoft Word                         application/vnd.ms-word.template.macroEnabled.12
    DOTX               Microsoft Word                                            application/vnd.openxmlformats-officedocument.wordprocessingml.template
    DQY                 ODBC  Microsoft Excel                            
    DRC               DRC File                                                         
    DRV               Device Driver                                                    
    DSA               DSA File                                                         
    DSM               DSM File                                                         
    DSN               Microsoft OLE DB Provider for ODBC Drivers                       
    DSS               DSS File                                                         
    DSV               DSV File                                                         
    DVR               Microsoft Recorded TV Show                                       
    DVR-MS            Microsoft Recorded TV Show                                       
    DWFX              XPS Document                                                     model/vnd.dwfx+xps
    EASMX             XPS Document                                                     model/vnd.easmx+xps
    EDRWX             XPS Document                                                     model/vnd.edrwx+xps
    ELM               Microsoft Office Themes File                                     
    EMF               EMF File                                                         
    EML                                                       
    EPRTX             XPS Document                                                     model/vnd.eprtx+xps
    EVO               Video Clip                                                       application/x-evo
    EVT               EVT File                                                         
    EVTX              EVTX File                                                        
    EXC               Text Document                                                    
    EXE               Application                                                      application/x-msdownload
    FDM                 Outlook                                        
    FLAC              Video Clip                                                       audio/x-flac
    FLC               FLC File                                                         
    FLI               FLI File                                                         
    FLIC              FLIC File                                                        
    FLV               FLV File                                                         video/x-flv
    FON               Font file                                                        
    FREECELLSAVE-MS   .FreeCellSave-ms                                                 
    GADGET            Windows Gadget                                                   
    GCSX                 Microsoft Office SmartArt                  
    GFS                 Microsoft SharePoint Workspace                    
    GIF               GIF Image                                                        image/gif
    GLK                Microsoft SharePoint Workspace                             
    GLOX                Microsoft Office SmartArt                          
    GMMP              WCS Gamut Mapping Profile                                        
    GQSX              -  Microsoft Office SmartArt                 
    GRA                Microsoft Graph                                        
    GROUP             Contact Group File                                               text/x-ms-group
    GRP               Microsoft Program Group                                          
    GRV                Microsoft SharePoint Workspace                              application/vnd.groove-injector
    GSA                  Microsoft SharePoint Workspace             
    GTA                 Microsoft SharePoint Workspace                
    H1C               Windows Help Collection Definition File                          
    H1D               Windows Help Validator File                                      
    H1F               Windows Help Include File                                        
    H1H               Windows Help Merged Hierarchy                                    
    H1K               Windows Help Index File                                          
    H1Q               Windows Help Merged Query Index                                  
    H1S               Compiled Windows Help file                                       
    H1T               Windows Help Table of Contents File                              
    H1V               Windows Help Virtual Topic Definition File                       
    H1W               Windows Help Merged Keyword Index                                
    HD                Video Clip                                                       
    HDMOV             Video Clip                                                       video/quicktime
    HEARTSSAVE-MS     .HeartsSave-ms                                                   
    HLP               Help File                                                        
    HOL                Outlook                                                
    HTA               HTML Application                                                 application/hta
    HTM               HTML Document                                                    text/html
    HTML              HTML Document                                                    text/html
    HXA               Microsoft Help Attribute Definition File                         application/xml
    HXC               Microsoft Help Collection Definition File                        application/xml
    HXD               Microsoft Help Validator File                                    application/octet-stream
    HXE               Microsoft Help Samples Definition File                           application/xml
    HXF               Microsoft Help Include File                                      application/xml
    HXH               Microsoft Help Merged Hierarchy File                             application/octet-stream
    HXI               Microsoft Help Compiled Index File                               application/octet-stream
    HXK               Microsoft Help Index File                                        application/xml
    HXQ               Microsoft Help Merged Query Index File                           application/octet-stream
    HXR               Microsoft Help Merged Attribute Index File                       application/octet-stream
    HXS               Microsoft Help Compiled Storage File                             application/octet-stream
    HXT               Microsoft Help Table of Contents File                            application/xml
    HXV               Microsoft Help Virtual Topic Definition File                     application/xml
    HXW               Microsoft Help Attribute Definition File                         application/octet-stream
    ICC               ICC Profile                                                      
    ICL               Icon Library                                                     
    ICM               ICC Profile                                                      
    ICO               Icon                                                             image/x-icon
    ICS                iCalendar                                                   text/calendar
    IMG               Disc Image File                                                  
    INF               Setup Information                                                
    INFOPATHXML        Microsoft InfoPath                                         application/ms-infopath.xml
    INI               Configuration Settings                                           
    IQY                -  Microsoft Excel                             text/x-ms-iqy
    ISO               Disc Image File                                                  
    IVF               IVF File                                                         
    JFIF              JPEG Image                                                       image/jpeg
    JNT               Journal Document                                                 
    JOB               Task Scheduler Task Object                                       
    JOD               Microsoft.Jet.OLEDB.4.0                                          
    JPE               JPEG Image                                                       image/jpeg
    JPEG              JPEG Image                                                       image/jpeg
    JPG               JPEG Image                                                       image/jpeg
    JPS               JPS File                                                         image/jps
    JS                JScript Script File                                              
    JSE               JScript Encoded File                                             
    JTP               Journal Template                                                 
    JTX               XPS Document                                                     application/x-jtx+xps
    K3G               K3G File                                                         video/mp4
    LABEL             Property List                                                    
    LACCDB            Microsoft Access Record-Locking Information                      
    LDB               Microsoft Access Record-Locking Information                      
    LEX               Dictionary File                                                  
    LIBRARY-MS        Library Folder                                                   application/windows-library+xml
    LNK               Shortcut                                                         
    LOG               Text Document                                                    
    M1V               Movie Clip                                                       video/mpeg
    M2P               Movie Clip                                                       video/mpeg
    M2T               AVCHD Video                                                      video/vnd.dlna.mpeg-tts
    M2TS              AVCHD Video                                                      video/vnd.dlna.mpeg-tts
    M2V               Movie Clip                                                       video/mpeg
    M3U               M3U file                                                         audio/x-mpegurl
    M4A               MPEG-4 Audio                                                     audio/mp4
    M4V               MP4 Video                                                        video/mp4
    MAD               Microsoft Access Module Shortcut                                 
    MAF               Microsoft Access Form Shortcut                                   
    MAG               Microsoft Access Diagram Shortcut                                
    MAHJONGTITANSSAVE-MS  .MahjongTitansSave-ms                                            
    MAM               Microsoft Access Macro Shortcut                                  
    MAPIMAIL          Mail Service                                                     
    MAQ               Microsoft Access Query Shortcut                                  
    MAR               Microsoft Access Report Shortcut                                 
    MAS               Microsoft Access Stored Procedure Shortcut                       
    MAT               Microsoft Access Table Shortcut                                  
    MAU               MAU File                                                         
    MAV               Microsoft Access View Shortcut                                   
    MAW               Microsoft Access Data Access Page Shortcut                       
    MCL               MCL File                                                         
    MDA               Microsoft Access Add-in                                          application/msaccess
    MDB               Microsoft Access Database                                        application/msaccess
    MDBHTML           Microsoft Access HTML Document                                   
    MDE               Microsoft Access MDE Database                                    application/msaccess
    MDN               Microsoft Access Blank Database Template                         
    MDT               Microsoft Access Add-in Data                                     
    MDW               Microsoft Access Workgroup Information                           
    MGC               Media Catalog File                                               
    MHT               MHTML Document                                                   message/rfc822
    MHTML             MHTML Document                                                   message/rfc822
    MID               MIDI Sequence                                                    audio/mid
    MIDI              MIDI Sequence                                                    audio/mid
    MIG               Migration Store                                                  
    MINESWEEPERSAVE-MS  .MinesweeperSave-ms                                              
    MKA               Matroska File                                                    audio/x-matroska
    MKV               Matroska File                                                    video/x-matroska
    MLC               Language Pack File_                                              
    MML               Media Catalog File                                               
    MMW               Media Catalog File                                               
    MOD               Movie Clip                                                       video/mpeg
    MOV               QuickTime Movie                                                  video/quicktime
    MP2               MP3 Format Sound                                                 audio/mpeg
    MP2V              Movie Clip                                                       video/mpeg
    MP3               MP3 Format Sound                                                 audio/mpeg
    MP4               MP4 Video                                                        video/mp4
    MP4V              MP4 Video                                                        video/mp4
    MPA               Movie Clip                                                       video/mpeg
    MPC               Video Clip                                                       audio/x-musepack
    MPE               Movie Clip                                                       video/mpeg
    MPEG              Movie Clip                                                       video/mpeg
    MPF               Clip Organizer Media Package File                                application/vnd.ms-mediapackage
    MPG               Movie Clip                                                       video/mpeg
    MPO               MPO File                                                         image/mpo
    MPV2              Movie Clip                                                       video/mpeg
    MQV               MQV File                                                         video/mp4
    MSC               Microsoft Common Console Document                                
    MSDVD             MSDVD File                                                       
    MSG                Outlook                                                  
    MSI               Windows Installer Package                                        
    MSP               Windows Installer Patch                                          
    MSRCINCIDENT      Windows Remote Assistance Invitation                             
    MSSTYLES          Windows Visual Style File                                        
    MSU               Microsoft Update Standalone Package                              
    MTS               AVCHD Video                                                      video/vnd.dlna.mpeg-tts
    MYDOCS            MyDocs Drop Target                                               
    NFO               MSInfo Configuration File                                        
    NK2                 Outlook                                         
    OCX               ActiveX control                                                  
    ODC               Microsoft Office Data Connection                                 text/x-ms-odc
    ODCCUBEFILE       ODCCUBEFILE File                                                 
    ODCDATABASEFILE   ODCDATABASEFILE File                                             
    ODCNEWFILE        ODCNEWFILE File                                                  
    ODCTABLEFILE      ODCTABLEFILE File                                                
    ODP                OpenDocument                                         application/vnd.oasis.opendocument.presentation
    ODS                 OpenDocument                                 application/vnd.oasis.opendocument.spreadsheet
    ODT                OpenDocument                                               application/vnd.oasis.opendocument.text
    OFS                 Outlook                                             
    OFT                 Outlook                                          
    OGA               Video Clip                                                       audio/x-ogg
    OGG               Video Clip                                                       audio/x-ogg
    OGV               Video Clip                                                       audio/x-ogg
    OLS                 Microsoft                                           application/vnd.ms-publisher
    ON2               Video Clip                                                       video/avi
    ONE                Microsoft OneNote                                         application/msonenote
    ONEPKG             Microsoft OneNote                                              
    ONETOC             Microsoft OneNote 2003                                
    ONETOC2            Microsoft OneNote                                     
    OPC               Microsoft Clean-up Wizard File                                   
    OQY                 OLAP  Microsoft Excel                            
    OSDX              OpenSearch Description File                                      application/opensearchdescription+xml
    OST                 Outlook                                              
    OTF               OpenType Font file                                               
    OTM                 Outlook VBA                                         
    P10               Certificate Request                                              application/pkcs10
    P12               Personal Information Exchange                                    application/x-pkcs12
    P7B               PKCS #7 Certificates                                             application/x-pkcs7-certificates
    P7C               Digital ID File                                                  application/pkcs7-mime
    P7M               PKCS #7 MIME Message                                             application/pkcs7-mime
    P7R               Certificate Request Response                                     application/x-pkcs7-certreqresp
    P7S               PKCS #7 Signature                                                application/pkcs7-signature
    PAB                  Outlook                                    
    PBK               Dial-Up Phonebook                                                
    PCB               PCB File                                                         
    PERFMONCFG        Performance Monitor Configuration                                
    PFM               Type 1 Font file                                                 
    PFX               Personal Information Exchange                                    application/x-pkcs12
    PIF               Shortcut to MS-DOS Program                                       
    PKO               Public Key Security Object                                       application/vnd.ms-pki.pko
    PNF               Precompiled Setup Information                                    
    PNG               PNG Image                                                        image/png
    PNS               PNS File                                                         image/pns
    POT                Microsoft PowerPoint 97-2003                              application/vnd.ms-powerpoint
    POTHTML           HTML- Microsoft PowerPoint                                 
    POTM                Microsoft PowerPoint        application/vnd.ms-powerpoint.template.macroEnabled.12
    POTX               Microsoft PowerPoint                                      application/vnd.openxmlformats-officedocument.presentationml.template
    PPA                Microsoft PowerPoint 97-2003                          application/vnd.ms-powerpoint
    PPAM               Microsoft PowerPoint                                  application/vnd.ms-powerpoint.addin.macroEnabled.12
    PPS                 Microsoft PowerPoint 97-2003                       application/vnd.ms-powerpoint
    PPSM                Microsoft PowerPoint            application/vnd.ms-powerpoint.slideshow.macroEnabled.12
    PPSX                Microsoft PowerPoint                               application/vnd.openxmlformats-officedocument.presentationml.slideshow
    PPT                Microsoft PowerPoint 97-2003                         application/vnd.ms-powerpoint
    PPTHTML           HTML- Microsoft PowerPoint                               
    PPTM               Microsoft PowerPoint              application/vnd.ms-powerpoint.presentation.macroEnabled.12
    PPTMHTML          PPTMHTML File                                                    
    PPTX               Microsoft PowerPoint                                 application/vnd.openxmlformats-officedocument.presentationml.presentation
    PPTXML            XML- Microsoft PowerPoint                             
    PRF               PICS Rules File                                                  application/pics-rules
    PRINTEREXPORT     Printer Migration File                                           
    PS1               PS1 File                                                         
    PS1XML            PS1XML File                                                      
    PSC1              PSC1 File                                                        application/PowerShell
    PSD1              PSD1 File                                                        
    PSM1              PSM1 File                                                        
    PST                 Outlook                                              
    PUB                Microsoft Publisher                                     application/vnd.ms-publisher
    PUBHTML           PUBHTML File                                                     
    PUBMHTML          PUBMHTML File                                                    
    PURBLEPAIRSSAVE-MS  .PurblePairsSave-ms                                              
    PURBLESHOPSAVE-MS  .PurbleShopSave-ms                                               
    PWZ                Microsoft PowerPoint                                      application/vnd.ms-powerpoint
    QDS               Directory Query                                                  
    RA                RA File                                                          audio/vnd.rn-realaudio
    RAM               RAM File                                                         audio/vnd.rn-realaudio
    RAT               Rating System File                                               application/rat-file
    RDP               Remote Desktop Connection                                        
    REG               Registration Entries                                             
    RELS              XML Document                                                     
    RESMONCFG         Resource Monitor Configuration                                   
    RLE               RLE File                                                         
    RLL               Application Extension                                            
    RM                RM File                                                          application/vnd.rn-realmedia
    RMI               MIDI Sequence                                                    audio/mid
    RMM               RMM File                                                         audio/x.pn-realaudio
    RMVB              RMVB File                                                        video/vnd.rn-realvideo
    RNX               RNX File                                                         audio/vnd.rn-realplayer
    RP                RP File                                                          audio/vnd.rn-realpix
    RPM               RPM File                                                         audio/x-pn-realaudio-plugin
    RQY                 OLE DB  Microsoft Excel                          text/x-ms-rqy
    RT                RT File                                                          text/vnd.rn-realtext
    RTF                RTF                                                       application/msword
    RV                RV File                                                          video/vnd.rn-realvideo
    SCF               Windows Explorer Command                                         
    SCP               Text Document                                                    
    SCR               Screen saver                                                     
    SCT               Windows Script Component                                         text/scriptlet
    SDF               SQL Server Compact Edition Database File                         
    SEARCHCONNECTOR-MS  Search Connector Folder                                          application/windows-search-connector+xml
    SEARCH-MS         Saved Search                                                     
    SFCACHE           ReadyBoost Cache File                                            
    SHTML             SHTML File                                                       text/html
    SLDM               Microsoft PowerPoint                    application/vnd.ms-powerpoint.slide.macroEnabled.12
    SLDX               Microsoft PowerPoint                                       application/vnd.openxmlformats-officedocument.presentationml.slide
    SLK                  Microsoft Excel SLK                        application/vnd.ms-excel
    SLN               Microsoft Visual Studio Solution                                 text/plain
    SLUPKG-MS         XrML Digital License Package                                     application/x-ms-license
    SMI               SMI File                                                         application/vnd.rn-realmedia
    SMIL              SMIL File                                                        application/vnd.rn-realmedia
    SMK               SMK File                                                         
    SND               AU Format Sound                                                  audio/basic
    SOLITAIRESAVE-MS  .SolitaireSave-ms                                                
    SPC               PKCS #7 Certificates                                             application/x-pkcs7-certificates
    SPIDERSOLITAIRESAVE-MS  .SpiderSolitaireSave-ms                                          
    SPX               Video Clip                                                       audio/x-spx
    SST               Microsoft Serialized Certificate Store                           application/vnd.ms-pki.certstore
    STL               Certificate Trust List                                           application/vnd.ms-pki.stl
    SUO               Visual Studio Solution User Options                              
    SYS               System file                                                      
    THEME             Windows Theme File                                               
    THEMEPACK         Windows Theme Pack                                               
    THMX               Microsoft Office                                            application/vnd.ms-officetheme
    TIF               TIF File                                                         image/tiff
    TIFF              TIFF File                                                        image/tiff
    TS                MPEG-2 TS Video                                                  video/vnd.dlna.mpeg-tts
    TTA               TTA File                                                         
    TTC               TrueType Collection Font file                                    
    TTF               TrueType Font file                                               
    TTS               MPEG-2 TS Video                                                  video/vnd.dlna.mpeg-tts
    TXT               Text Document                                                    text/plain
    UDL               Microsoft Data Link                                              
    URL               URL File                                                         
    URLS              URLS File                                                        
    UXDC              UXDC File                                                        
    VBE               VBScript Encoded File                                            
    VBS               VBScript Script File                                             
    VCF                vCard                                                       text/x-vcard
    VCG                Microsoft SharePoint Workspace                          application/vnd.groove-vcard
    VCS                vCalendar                                                   
    VDX               Microsoft Visio Document                                         application/vnd.ms-visio.viewer
    VSCONTENT         Visual Studio Community Content Installer File                   application/xml
    VSD               Microsoft Visio Document                                         application/vnd.ms-visio.viewer
    VSI               Visual Studio Community Content Installer File                   application/ms-vsi
    VSS               Microsoft Visio Document                                         application/vnd.ms-visio.viewer
    VST               Microsoft Visio Document                                         application/vnd.ms-visio.viewer
    VSTO              VSTO Deployment Manifest                                         application/x-ms-vsto
    VSX               Microsoft Visio Document                                         application/vnd.ms-visio.viewer
    VTX               Microsoft Visio Document                                         application/vnd.ms-visio.viewer
    VXD               Virtual Device Driver                                            
    WAB               Address Book File                                                
    WAV               Wave Sound                                                       audio/wav
    WAX               Windows Media Audio shortcut                                     audio/x-ms-wax
    WBCAT             Windows Backup Catalog File                                      
    WBK                  Microsoft Word                          application/msword
    WCX               Workspace Configuration File                                     
    WDP               Windows Media Photo                                              image/vnd.ms-photo
    WEBPNP            Web Point And Print File                                         
    WIZ                Microsoft Word                                            application/msword
    WIZHTML           Microsoft Access HTML Template                                   
    WLL               WLL File                                                         
    WM                Windows Media Audio/Video file                                   video/x-ms-wm
    WMA               Windows Media Audio file                                         audio/x-ms-wma
    WMD               Windows Media Player Download Package                            application/x-ms-wmd
    WMDB              Windows Media Library                                            
    WMF               WMF File                                                         
    WMS               Windows Media Player Skin File                                   
    WMV               Windows Media Audio/Video file                                   video/x-ms-wmv
    WMX               Windows Media Audio/Video playlist                               video/x-ms-wmx
    WMZ               Windows Media Player Skin Package                                application/x-ms-wmz
    WPL               Windows Media playlist                                           application/vnd.ms-wpl
    WSC               Windows Script Component                                         text/scriptlet
    WSF               Windows Script File                                              
    WSH               Windows Script Host Settings File                                
    WTV               Windows Recorded TV Show                                         
    WTX               Text Document                                                    
    WVX               Windows Media Audio/Video playlist                               video/x-ms-wvx
    XAML              Windows Markup File                                              application/xaml+xml
    XBAP              XAML Browser Application                                         application/x-ms-xbap
    XEVGENXML         XEVGENXML File                                                   
    XHT               XHT File                                                         application/xhtml+xml
    XHTML             XHTML File                                                       application/xhtml+xml
    XLA                Microsoft Excel                                       application/vnd.ms-excel
    XLAM               Microsoft Excel                                       application/vnd.ms-excel.addin.macroEnabled.12
    XLD                 Microsoft Excel 5.0                                application/vnd.ms-excel
    XLK                  Microsoft Excel                             application/vnd.ms-excel
    XLL                Microsoft Excel XLL                                   application/vnd.ms-excel
    XLM                Microsoft Excel 4.0                                       application/vnd.ms-excel
    XLS                Microsoft Excel 97-2003                                     application/vnd.ms-excel
    XLSB                Microsoft Excel                                    application/vnd.ms-excel.sheet.binary.macroEnabled.12
    XLSHTML            Microsoft Excel   HTML                          
    XLSM               Microsoft Excel                          application/vnd.ms-excel.sheet.macroEnabled.12
    XLSMHTML          XLSMHTML File                                                    
    XLSX               Microsoft Excel                                             application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
    XLT                Microsoft Excel                                           application/vnd.ms-excel
    XLTHTML            Microsoft Excel   HTML                            
    XLTM               Microsoft Excel                        application/vnd.ms-excel.template.macroEnabled.12
    XLTX               Microsoft Excel                                           application/vnd.openxmlformats-officedocument.spreadsheetml.template
    XLW                 Microsoft Excel                                  application/vnd.ms-excel
    XLXML              Microsoft Excel   XML                               
    XML               XML Document                                                     text/xml
    XPS               XPS Document                                                     application/vnd.ms-xpsdocument
    XRM-MS            XrML Digital License                                             text/xml
    XSF                  Microsoft InfoPath                        
    XSL               XSL Stylesheet                                                   text/xml
    XSN                 Microsoft InfoPath                                  
    XTP               Microsoft InfoPath Template Part File                            
    XTP2              Microsoft InfoPath Template Part File                            
    ZFSENDTOTARGET    Compressed (zipped) Folder SendTo Target                         
    ZIP               Compressed (zipped) Folder                                       application/x-zip-compressed


--------[    ]--------------------------------------------------------------------------------------

  [ Windows Media Center ]

     :
                                                     Windows Media Center
                                                  1.0.0.0
                                                   Microsoft Corporation
      Copyright                                          2009
      URL                                               http://go.microsoft.com/fwlink/?LinkId=124093
                                                   ProgramFiles
      XML                                               MediaCenter.Gadget\ru-RU\gadget.xml

  [  ]

     :
                                                     
                                                  1.0.0.0
                                                   Microsoft Corporation
      Copyright                                          2009
      URL                                               http://go.microsoft.com/fwlink/?LinkId=124093
                                                   ProgramFiles
      XML                                               Currency.Gadget\ru-RU\gadget.xml

  [  ]

     :
                                                     
                                                     .
                                                  1.0.0.0
                                                   Microsoft Corporation
      Copyright                                          2009
      URL                                               http://go.microsoft.com/fwlink/?LinkId=124093
                                                   ProgramFiles
      XML                                               PicturePuzzle.Gadget\ru-RU\gadget.xml

  [   - ]

     :
                                                       -
                                                   ,     .
                                                  1.1.0.0
                                                   Microsoft Corporation
      Copyright                                          2009
      URL                                               http://go.microsoft.com/fwlink/?LinkId=124093
                                                   ProgramFiles
      XML                                               RSSFeeds.Gadget\ru-RU\gadget.xml

  [   ]

     :
                                                      
                                                      (RAM).
                                                  1.0.0.0
                                                   Microsoft Corporation
      Copyright                                          2009
      URL                                               http://go.microsoft.com/fwlink/?LinkId=124093
                                                   ProgramFiles
      XML                                               CPU.Gadget\ru-RU\gadget.xml

  [  ]

     :
                                                     
                                                  .
                                                  1.1.0.0
                                                   Microsoft Corporation
      Copyright                                          2009
      URL                                               http://go.microsoft.com/fwlink/?LinkId=124093
                                                   ProgramFiles
      XML                                               Calendar.Gadget\ru-RU\gadget.xml

  [  ]

     :
                                                     
                                                      .
                                                  1.1.0.0
                                                   Microsoft Corporation
      Copyright                                          2009
      URL                                               http://go.microsoft.com/fwlink/?LinkId=124093
                                                   ProgramFiles
      XML                                               Weather.Gadget\ru-RU\gadget.xml

  [   ]

     :
                                                      
                                                     .
                                                  1.0.0.0
                                                   Microsoft Corporation
      Copyright                                          2009
      URL                                               http://go.microsoft.com/fwlink/?LinkId=124093
                                                   ProgramFiles
      XML                                               SlideShow.Gadget\ru-RU\gadget.xml

  [  ]

     :
                                                     
                                                          .
                                                  1.0.0.0
                                                   Microsoft Corporation
      Copyright                                          2009
      URL                                               http://go.microsoft.com/fwlink/?LinkId=124093
                                                   ProgramFiles
      XML                                               Clock.Gadget\ru-RU\gadget.xml


--------[  Windows ]----------------------------------------------------------------------------------------

      :
                                              Microsoft Windows 7 Ultimate
                                       Service Pack 1
      Winlogon Shell                                    explorer.exe
          (UAC)  
                                   

       (DEP, NX, EDB):
                                        
                                        
       ( )                       
       ( )                        


--------[  Windows ]------------------------------------------------------------------------------------------

    (Automatic Update)                                                                             
    Definition Update for Windows Defender - KB915597 (Definition 1.207.973.0)                    28.09.2015
       Windows (KB958488)                                                          22.11.2015


--------[  ]--------------------------------------------------------------------------------------------------

     Windows                              6.1.7600.16385  


--------[   ]--------------------------------------------------------------------------------------------

    Microsoft Windows Defender                6.1.7600.16385(win7_rtm.090713-1255)


--------[   ]--------------------------------------------------------------------------------------

     :
                                      ()
                            (UTC+09:00) 
                               Last Sunday of October 3:00:00
                                    Last Sunday of March 2:00:00

    :
       (.)                                      
       (.)                                      Russian
       (ISO 639)                                    ru

    /:
       (.)                                    
       (.)                                    Russia
       (ISO 3166)                                 RU
                                               7

     :
        (.)                          
        (.)                          Russian Ruble
         (.)                   .
         (ISO 4217)                RUB
                                      123456789,00.
                         -123456789,00.

    :
                                           H:mm:ss
                                       dd.MM.yyyy
                                        d MMMM yyyy '.'
                                       123456789.00
                          -123456789.00
                                            first; second; third
                                               0123456789

     :
                                       / 
                                           / 
                                              / 
                                           / 
                                            / 
                                            / 
                                        / 

    :
                                             / 
                                            / 
                                              / 
                                             / 
                                                / 
                                               / 
                                               / 
                                            / 
                                           / 
                                            / 
                                             / 
                                            / 

    :
                                            Gregorian (localized)
                                 A4
                                        


--------[  ]---------------------------------------------------------------------------------------------------

    ALLUSERSPROFILE           C:\ProgramData
    APPDATA                   C:\Users\sima\AppData\Roaming
    COMMANDER_DRIVE           C:
    COMMANDER_EXE             C:\my_programs\TC\TOTALCMD.EXE
    COMMANDER_INI             C:\my_programs\TC\wincmd.ini
    COMMANDER_PATH            C:\my_programs\TC
    CommonProgramFiles        C:\Program Files\Common Files
    COMPUTERNAME              VLADIMIR
    ComSpec                   C:\Windows\system32\cmd.exe
    FP_NO_HOST_CHECK          NO
    HOMEDRIVE                 C:
    HOMEPATH                  \Users\sima
    LOCALAPPDATA              C:\Users\sima\AppData\Local
    LOGONSERVER               \\VLADIMIR
    NUMBER_OF_PROCESSORS      2
    OS                        Windows_NT
    Path                      C:\Program Files\NVIDIA Corporation\PhysX\Common;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\
    PATHEXT                   .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
    PROCESSOR_ARCHITECTURE    x86
    PROCESSOR_IDENTIFIER      x86 Family 6 Model 15 Stepping 11, GenuineIntel
    PROCESSOR_LEVEL           6
    PROCESSOR_REVISION        0f0b
    ProgramData               C:\ProgramData
    ProgramFiles              C:\Program Files
    PSModulePath              C:\Windows\system32\WindowsPowerShell\v1.0\Modules\
    PUBLIC                    C:\Users\Public
    SESSIONNAME               Console
    SystemDrive               C:
    SystemRoot                C:\Windows
    TEMP                      C:\Users\sima\AppData\Local\Temp
    TMP                       C:\Users\sima\AppData\Local\Temp
    USERDOMAIN                vladimir
    USERNAME                  sima
    USERPROFILE               C:\Users\sima
    windir                    C:\Windows
    windows_tracing_flags     3
    windows_tracing_logfile   C:\BVTBin\Tests\installpackage\csilogfile.log


--------[   ]-------------------------------------------------------------------------------------------

    Windows CardSpace                                  -    .
    Xonar D1 Audio Center                     Xonar D1 Audio Center Program
                                         -, DVD  ,      ,  ,   ,  .
                                 
                            .      .
     Windows                           ,       .
                                                Windows.
                                .
                                     ,       .
                .
                                  .
                           Windows.
                                   ,         .
     Windows                                 
                                                .
                         ,      .
                                      , ,       .
                                            , ,  ,   ,     .
        ''''                ''''   , ,       .
      NVIDIA                     NVIDIA.
                             
                                    .
                                 ,       .
           RemoteApp          RemoteApp
                                          Microsoft Outlook
                                  Windows    .
                                .
                          ,      ,     ,  ,      .
                                 
                             .
                                .
                                               , ,  .
               .   ,   , ,    .
                                           .
                                 ,   .
                                .
                              ,    
                          ,    .
      Windows                       ,    ,   .
                                       .
                                  ( ).
                     .
             ,            .
      BitLocker                       BitLocker.
                                           ,    .
                                                .
                                          .
                      ,  ,  ,   .


--------[  ]-----------------------------------------------------------------------------------------------------

    C:       245        168      ?  ?
    D:        33         21      ?  ?
    E:      2223        322      ?  ?


--------[   ]---------------------------------------------------------------------------------------------

  [ autoexec.bat ]

    REM Dummy file for NTVDM

  [ config.sys ]

    FILES=40

  [ autoexec.nt ]

    @echo off
    
    REM AUTOEXEC.BAT is not used to initialize the MS-DOS environment.
    REM AUTOEXEC.NT is used to initialize the MS-DOS environment unless a
    REM different startup file is specified in an application's PIF.
    
    REM Install CD ROM extensions
    lh %SystemRoot%\system32\mscdexnt.exe
    
    REM Install network redirector (load before dosx.exe)
    lh %SystemRoot%\system32\redir
    
    REM Install DPMI support
    lh %SystemRoot%\system32\dosx
    
    REM The following line enables Sound Blaster 2.0 support on NTVDM.
    REM The command for setting the BLASTER environment is as follows:
    REM    SET BLASTER=A220 I5 D1 P330
    REM    where:
    REM        A    specifies the sound blaster's base I/O port
    REM        I    specifies the interrupt request line
    REM        D    specifies the 8-bit DMA channel
    REM        P    specifies the MPU-401 base I/O port
    REM        T    specifies the type of sound blaster card
    REM                 1 - Sound Blaster 1.5
    REM                 2 - Sound Blaster Pro I
    REM                 3 - Sound Blaster 2.0
    REM                 4 - Sound Blaster Pro II
    REM                 6 - SOund Blaster 16/AWE 32/32/64
    REM
    REM    The default value is A220 I5 D1 T3 and P330.  If any of the switches is
    REM    left unspecified, the default value will be used. (NOTE, since all the
    REM    ports are virtualized, the information provided here does not have to
    REM    match the real hardware setting.)  NTVDM supports Sound Blaster 2.0 only.
    REM    The T switch must be set to 3, if specified.
    SET BLASTER=A220 I5 D1 P330 T3
    
    REM To disable the sound blaster 2.0 support on NTVDM, specify an invalid
    REM SB base I/O port address.  For example:
    REM    SET BLASTER=A0

  [ config.nt ]

    REM Windows MS-DOS Startup File
    REM
    REM CONFIG.SYS vs CONFIG.NT
    REM CONFIG.SYS is not used to initialize the MS-DOS environment.
    REM CONFIG.NT is used to initialize the MS-DOS environment unless a
    REM different startup file is specified in an application's PIF.
    REM
    REM ECHOCONFIG
    REM By default, no information is displayed when the MS-DOS environment
    REM is initialized. To display CONFIG.NT/AUTOEXEC.NT information, add
    REM the command echoconfig to CONFIG.NT or other startup file.
    REM
    REM NTCMDPROMPT
    REM When you return to the command prompt from a TSR or while running an
    REM MS-DOS-based application, Windows runs COMMAND.COM. This allows the
    REM TSR to remain active. To run CMD.EXE, the Windows command prompt,
    REM rather than COMMAND.COM, add the command ntcmdprompt to CONFIG.NT or
    REM other startup file.
    REM
    REM DOSONLY
    REM By default, you can start any type of application when running
    REM COMMAND.COM. If you start an application other than an MS-DOS-based
    REM application, any running TSR may be disrupted. To ensure that only
    REM MS-DOS-based applications can be started, add the command dosonly to
    REM CONFIG.NT or other startup file.
    REM
    REM EMM
    REM You can use EMM command line to configure EMM(Expanded Memory Manager).
    REM The syntax is:
    REM
    REM EMM = [A=AltRegSets] [B=BaseSegment] [RAM]
    REM
    REM     AltRegSets
    REM         specifies the total Alternative Mapping Register Sets you
    REM         want the system to support. 1 <= AltRegSets <= 255. The
    REM         default value is 8.
    REM     BaseSegment
    REM         specifies the starting segment address in the Dos conventional
    REM         memory you want the system to allocate for EMM page frames.
    REM         The value must be given in Hexdecimal.
    REM         0x1000 <= BaseSegment <= 0x4000. The value is rounded down to
    REM         16KB boundary. The default value is 0x4000
    REM     RAM
    REM         specifies that the system should only allocate 64Kb address
    REM         space from the Upper Memory Block(UMB) area for EMM page frames
    REM         and leave the rests(if available) to be used by DOS to support
    REM         loadhigh and devicehigh commands. The system, by default, would
    REM         allocate all possible and available UMB for page frames.
    REM
    REM     The EMM size is determined by pif file(either the one associated
    REM     with your application or _default.pif). If the size from PIF file
    REM     is zero, EMM will be disabled and the EMM line will be ignored.
    REM
    dos=high, umb
    device=%SystemRoot%\system32\himem.sys
    files=40

  [ system.ini ]

    ; for 16-bit app support
    [386Enh]
    woafont=dosapp.fon
    EGA80WOA.FON=EGA80WOA.FON
    EGA40WOA.FON=EGA40WOA.FON
    CGA80WOA.FON=CGA80WOA.FON
    CGA40WOA.FON=CGA40WOA.FON
    
    [drivers]
    wave=mmdrv.dll
    timer=timer.drv
    
    [mci]

  [ win.ini ]

    ; for 16-bit app support
    [fonts]
    [extensions]
    [mci extensions]
    [files]
    [Mail]
    MAPI=1
    CMCDLLNAME32=mapi32.dll
    CMC=1
    MAPIX=1
    MAPIXVER=1.0.0.1
    OLEMessaging=1
    [MCI Extensions.BAK]
    3g2=MPEGVideo
    3gp=MPEGVideo
    3gp2=MPEGVideo
    3gpp=MPEGVideo
    aac=MPEGVideo
    adt=MPEGVideo
    adts=MPEGVideo
    m2t=MPEGVideo
    m2ts=MPEGVideo
    m2v=MPEGVideo
    m4a=MPEGVideo
    m4v=MPEGVideo
    mod=MPEGVideo
    mov=MPEGVideo
    mp4=MPEGVideo
    mp4v=MPEGVideo
    mts=MPEGVideo
    ts=MPEGVideo
    tts=MPEGVideo

  [ hosts ]

    

  [ lmhosts.sam ]

    
    
    
    


--------[   ]---------------------------------------------------------------------------------------------

    Administrative Tools         C:\Users\sima\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    AppData                      C:\Users\sima\AppData\Roaming
    Cache                        C:\Users\sima\AppData\Local\Microsoft\Windows\Temporary Internet Files
    CD Burning                   C:\Users\sima\AppData\Local\Microsoft\Windows\Burn\Burn
    Common Administrative Tools  C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    Common AppData               C:\ProgramData
    Common Desktop               C:\Users\Public\Desktop
    Common Documents             C:\Users\Public\Documents
    Common Favorites             C:\Users\sima\Favorites
    Common Files                 C:\Program Files\Common Files
    Common Music                 C:\Users\Public\Music
    Common Pictures              C:\Users\Public\Pictures
    Common Programs              C:\ProgramData\Microsoft\Windows\Start Menu\Programs
    Common Start Menu            C:\ProgramData\Microsoft\Windows\Start Menu
    Common Startup               C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
    Common Templates             C:\ProgramData\Microsoft\Windows\Templates
    Common Video                 C:\Users\Public\Videos
    Cookies                      C:\Users\sima\AppData\Roaming\Microsoft\Windows\Cookies
    Desktop                      C:\Users\sima\Desktop
    Device                       C:\Windows\inf
    Favorites                    C:\Users\sima\Favorites
    Fonts                        C:\Windows\Fonts
    History                      C:\Users\sima\AppData\Local\Microsoft\Windows\History
    Local AppData                C:\Users\sima\AppData\Local
    My Documents                 C:\Users\sima\Documents
    My Music                     C:\Users\sima\Music
    My Pictures                  C:\Users\sima\Pictures
    My Video                     C:\Users\sima\Videos
    NetHood                      C:\Users\sima\AppData\Roaming\Microsoft\Windows\Network Shortcuts
    PrintHood                    C:\Users\sima\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
    Profile                      C:\Users\sima
    Program Files                C:\Program Files
    Programs                     C:\Users\sima\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
    Recent                       C:\Users\sima\AppData\Roaming\Microsoft\Windows\Recent
    Resources                    C:\Windows\resources
    SendTo                       C:\Users\sima\AppData\Roaming\Microsoft\Windows\SendTo
    Start Menu                   C:\Users\sima\AppData\Roaming\Microsoft\Windows\Start Menu
    Startup                      C:\Users\sima\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    System                       C:\Windows\system32
    Temp                         C:\Users\sima\AppData\Local\Temp\
    Templates                    C:\Users\sima\AppData\Roaming\Microsoft\Windows\Templates
    Windows                      C:\Windows


--------[   ]-------------------------------------------------------------------------------------------

             1          2015-09-28 01:22:18                                  Windows Search Service          1010:  Windows Search     .    
             1          2015-09-28 01:22:18                                  Windows Search Service          1004:  Windows Search     (:   ).    
               1          2015-09-28 01:22:18                                  Windows Search Service          1008:  Windows Search        (:   ).    
             1          2015-09-28 01:22:20                                  ESENT                           102: Windows (2036) Windows:   (6.01.7601.0000)    (0).  
                     2015-09-28 01:22:23                                  Software Protection Platform Service  1004:       .   =OEM Certificate   =391c32e3-e599-4a7a-bab9-c3ce90ac0463  
             1          2015-09-28 01:22:23                                  Windows Search Service          1005:  Windows Search     .    
             1          2015-09-28 01:22:23                                  Windows Search Service          1003:  Windows Search .   
                         2015-09-28 01:22:49                                  WinMgmt                         
                     2015-09-28 01:22:49                                  Software Protection Platform Service  1016:      .   ACID=7cfd4696-69a9-4af7-af36-ff3d12b6b6c8  PKeyId=0ca46e7e-df96-cc96-a424-01b15016caa4  
                     2015-09-28 01:22:49                                  Software Protection Platform Service  1033:   ,       override-only.   =(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet-Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicensing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs-clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA)    =55c92734-d682-4d71-983e-d6ec3f16059f   SKU=7cfd4696-69a9-4af7-af36-ff3d12b6b6c8  
                     2015-09-28 01:22:49                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43200)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 01:22:50                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 01:22:51                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 01:22:52                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43200)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 01:22:52                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 01:22:53                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43200)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])]    
                     2015-09-28 01:22:54                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 01:22:54                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 01:22:55                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 01:22:55                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43200)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 01:22:56                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 01:22:56                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 01:22:57                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 01:22:58                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 01:23:05                                  Winlogon                        4101:  Windows .  
                     2015-09-28 01:23:05                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-09-28 01:23:05                                  Desktop Window Manager          9003:       ,        
             1          2015-09-28 01:23:09                                  ESENT                           102: WinMail (2248) WindowsMail0:   (6.01.7601.0000)    (0).  
             3          2015-09-28 01:23:10                                  ESENT                           210: WinMail (2248) WindowsMail0:    .  
             3          2015-09-28 01:23:10                                  ESENT                           220: WinMail (2248) WindowsMail0:    C:\Users\sima\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore (: 2 Mb).  
             3          2015-09-28 01:23:10                                  ESENT                           221: WinMail (2248) WindowsMail0:    C:\Users\sima\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore.  
             3          2015-09-28 01:23:10                                  ESENT                           223: WinMail (2248) WindowsMail0:      (: C:\Users\sima\AppData\Local\Microsoft\Windows Mail\edb00001.log - C:\Users\sima\AppData\Local\Microsoft\Windows Mail\edb00001.log).   
             3          2015-09-28 01:23:10                                  ESENT                           225: WinMail (2248) WindowsMail0:    .   
             3          2015-09-28 01:23:10                                  ESENT                           213: WinMail (2248) WindowsMail0:    .  
             1          2015-09-28 01:23:15                                  ESENT                           103: WinMail (2248) WindowsMail0:    (0).  
                     2015-09-28 01:24:06                                  SecurityCenter                  1:     Windows .  
                     2015-09-28 01:24:12                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: AuditPolicyGPManagedStubs.Interop  
                     2015-09-28 01:24:13                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: BDATunePIA  
                     2015-09-28 01:24:13                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: ehCIR  
                     2015-09-28 01:24:13                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: ehiProxy  
                     2015-09-28 01:24:15                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: ehExtHost  
                     2015-09-28 01:24:16                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter  
                     2015-09-28 01:24:16                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter.UI  
                     2015-09-28 01:24:16                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: ehiUserXp  
                     2015-09-28 01:24:16                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: ehRecObj  
                     2015-09-28 01:24:16                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: mcepg  
                     2015-09-28 01:24:16                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: mcstore  
                     2015-09-28 01:24:16                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: mcstoredb  
                     2015-09-28 01:24:16                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: ehiVidCtl  
                     2015-09-28 01:24:16                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: ehiExtens  
                     2015-09-28 01:24:17                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: ehiActivScp  
                     2015-09-28 01:24:17                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: ehiBmlDataCarousel  
                     2015-09-28 01:24:17                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: ehiiTv  
                     2015-09-28 01:24:18                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: ehiTVMSMusic  
                     2015-09-28 01:24:18                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter.iTv.Hosting  
                     2015-09-28 01:24:18                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: ehiUPnP  
                     2015-09-28 01:24:18                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: ehiwmp  
                     2015-09-28 01:24:18                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: ehiWUapi  
                     2015-09-28 01:24:19                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter.Shell  
                     2015-09-28 01:24:19                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter.Interop  
                     2015-09-28 01:24:19                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter.ITVVM  
                     2015-09-28 01:24:19                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter.Playback  
                     2015-09-28 01:24:19                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter.TV.Tuners.Interop  
                     2015-09-28 01:24:19                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter.Sports  
                     2015-09-28 01:24:20                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: ehshell  
                     2015-09-28 01:24:20                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Mcx2Dvcs  
                     2015-09-28 01:24:20                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter.iTv  
                     2015-09-28 01:24:20                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter.iTv.Media  
                     2015-09-28 01:24:20                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: LoadMxf  
                     2015-09-28 01:24:21                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: MCESidebarCtrl  
                     2015-09-28 01:24:21                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: mcGlidHostObj  
                     2015-09-28 01:24:21                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: mcplayerinterop  
                     2015-09-28 01:24:22                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: mcupdate  
                     2015-09-28 01:24:22                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.ApplicationId.Framework  
                     2015-09-28 01:24:23                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.ApplicationId.RuleWizard  
                     2015-09-28 01:24:23                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel  
                     2015-09-28 01:24:23                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper  
                     2015-09-28 01:24:23                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager  
                     2015-09-28 01:24:23                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop  
                     2015-09-28 01:24:23                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.GroupPolicy.AdmTmplEditor  
                     2015-09-28 01:24:23                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.GroupPolicy.Interop  
                     2015-09-28 01:24:24                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.GroupPolicy.Reporting  
                     2015-09-28 01:24:24                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: SecurityAuditPoliciesSnapIn  
                     2015-09-28 01:24:25                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter.Bml  
                     2015-09-28 01:24:26                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter.Mheg  
                     2015-09-28 01:24:27                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard  
                     2015-09-28 01:24:29                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: SrpUxSnapIn  
                     2015-09-28 01:24:40                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-09-28 01:27:22                                  EventSystem                     
                     2015-09-28 01:27:22                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-09-28 01:27:25                                  WinMgmt                         
                     2015-09-28 01:27:26                                  Winlogon                        4101:  Windows .  
                     2015-09-28 01:27:26                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-09-28 01:27:28                                  WinMgmt                         
             1          2015-09-28 01:27:39                                  ESENT                           102: Windows (1876) Windows:   (6.01.7601.0000)    (0).  
             3          2015-09-28 01:27:39                                  ESENT                           300: Windows (1876) Windows:     .  
             3          2015-09-28 01:27:39                                  ESENT                           301: Windows (1876) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             1          2015-09-28 01:27:40                                  Windows Search Service          1003:  Windows Search .   
             3          2015-09-28 01:27:40                                  ESENT                           302: Windows (1876) Windows:    .  
                     2015-09-28 01:28:40                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-09-28 01:28:40                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                         2015-09-28 01:29:07                                  WinMgmt                         
                     2015-09-28 01:29:27                                  Software Protection Platform Service  900:      .    
                     2015-09-28 01:29:28                                  SecurityCenter                  1:     Windows .  
                     2015-09-28 01:29:29                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-09-28 01:29:30                                  Software Protection Platform Service  1033:   ,       override-only.   =(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet-Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicensing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs-clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA)    =55c92734-d682-4d71-983e-d6ec3f16059f   SKU=7cfd4696-69a9-4af7-af36-ff3d12b6b6c8  
                     2015-09-28 01:29:30                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 01:29:30                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-09-28 01:33:26                                  System Restore                  8194:     ( = D:\from C\my_programs\setup\office\Office 2010\Microsoft Office 2010 x86\setup.exe C\my_programs\setup\office\Office 2010\Microsoft Office 2010 x86\setup.exe" ;  = Installed Microsoft Office   2010).  
                     2015-09-28 01:33:29                                  Customer Experience Improvement Program  
                     2015-09-28 01:33:33  sima                            MsiInstaller                    1040:    Windows: C:\MSOCache\All Users\{90140000-006E-0419-0000-0000000FF1CE}-C\OfficeMUI.msi.   : 1948.  
                     2015-09-28 01:34:06  sima                            MsiInstaller                    11707: : Microsoft Office Shared MUI (Russian) 2010 --    .  
                     2015-09-28 01:34:06  sima                            MsiInstaller                    1033:  Windows   . : Microsoft Office Shared MUI (Russian) 2010. : 14.0.4763.1000. : 1049. : Microsoft Corporation.    : 0.  
                     2015-09-28 01:34:06  sima                            MsiInstaller                    1040:    Windows: C:\MSOCache\All Users\{90140000-0018-0419-0000-0000000FF1CE}-C\PowerPointMUI.msi.   : 1948.  
                     2015-09-28 01:34:06                           MsiInstaller                    1042:    Windows: C:\MSOCache\All Users\{90140000-006E-0419-0000-0000000FF1CE}-C\OfficeMUI.msi.   : 1948.  
                     2015-09-28 01:34:08                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-09-28 01:34:08                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-09-28 01:34:12  sima                            MsiInstaller                    11707: : Microsoft Office PowerPoint MUI (Russian) 2010 --    .  
                     2015-09-28 01:34:12  sima                            MsiInstaller                    1033:  Windows   . : Microsoft Office PowerPoint MUI (Russian) 2010. : 14.0.4763.1000. : 1049. : Microsoft Corporation.    : 0.  
                     2015-09-28 01:34:12  sima                            MsiInstaller                    1040:    Windows: C:\MSOCache\All Users\{90140000-0016-0419-0000-0000000FF1CE}-C\ExcelMUI.msi.   : 1948.  
                     2015-09-28 01:34:12                           MsiInstaller                    1042:    Windows: C:\MSOCache\All Users\{90140000-0018-0419-0000-0000000FF1CE}-C\PowerPointMUI.msi.   : 1948.  
                     2015-09-28 01:34:20  sima                            MsiInstaller                    11707: : Microsoft Office Excel MUI (Russian) 2010 --    .  
                     2015-09-28 01:34:20  sima                            MsiInstaller                    1033:  Windows   . : Microsoft Office Excel MUI (Russian) 2010. : 14.0.4763.1000. : 1049. : Microsoft Corporation.    : 0.  
                     2015-09-28 01:34:20  sima                            MsiInstaller                    1040:    Windows: C:\MSOCache\All Users\{90140000-00BA-0419-0000-0000000FF1CE}-C\GrooveMUI.msi.   : 1948.  
                     2015-09-28 01:34:20                           MsiInstaller                    1042:    Windows: C:\MSOCache\All Users\{90140000-0016-0419-0000-0000000FF1CE}-C\ExcelMUI.msi.   : 1948.  
                     2015-09-28 01:34:27  sima                            MsiInstaller                    11707: : Microsoft Office Groove MUI (Russian) 2010 --    .  
                     2015-09-28 01:34:27  sima                            MsiInstaller                    1033:  Windows   . : Microsoft Office Groove MUI (Russian) 2010. : 14.0.4763.1000. : 1049. : Microsoft Corporation.    : 0.  
                     2015-09-28 01:34:27  sima                            MsiInstaller                    1040:    Windows: C:\MSOCache\All Users\{90140000-001A-0419-0000-0000000FF1CE}-C\OutlookMUI.msi.   : 1948.  
                     2015-09-28 01:34:27                           MsiInstaller                    1042:    Windows: C:\MSOCache\All Users\{90140000-00BA-0419-0000-0000000FF1CE}-C\GrooveMUI.msi.   : 1948.  
                     2015-09-28 01:34:32                                  Software Protection Platform Service  903:     .    
                     2015-09-28 01:34:35  sima                            MsiInstaller                    11707: : Microsoft Office Outlook MUI (Russian) 2010 --    .  
                     2015-09-28 01:34:35  sima                            MsiInstaller                    1033:  Windows   . : Microsoft Office Outlook MUI (Russian) 2010. : 14.0.4763.1000. : 1049. : Microsoft Corporation.    : 0.  
                     2015-09-28 01:34:35  sima                            MsiInstaller                    1040:    Windows: C:\MSOCache\All Users\{90140000-002C-0419-0000-0000000FF1CE}-C\Proof.uk\Proof.msi.   : 1948.  
                     2015-09-28 01:34:35                           MsiInstaller                    1042:    Windows: C:\MSOCache\All Users\{90140000-001A-0419-0000-0000000FF1CE}-C\OutlookMUI.msi.   : 1948.  
                     2015-09-28 01:34:39  sima                            MsiInstaller                    11707: Product: Microsoft Office Proof (Ukrainian) 2010 -- Installation operation completed successfully.  
                     2015-09-28 01:34:39  sima                            MsiInstaller                    1033:  Windows   . : Microsoft Office Proof (Ukrainian) 2010. : 14.0.4763.1000. : 1058. : Microsoft Corporation.    : 0.  
                     2015-09-28 01:34:39  sima                            MsiInstaller                    1040:    Windows: C:\MSOCache\All Users\{90140000-002C-0419-0000-0000000FF1CE}-C\Proof.ru\Proof.msi.   : 1948.  
                     2015-09-28 01:34:39                           MsiInstaller                    1042:    Windows: C:\MSOCache\All Users\{90140000-002C-0419-0000-0000000FF1CE}-C\Proof.uk\Proof.msi.   : 1948.  
                     2015-09-28 01:34:42  sima                            MsiInstaller                    11707: Product: Microsoft Office Proof (Russian) 2010 -- Installation operation completed successfully.  
                     2015-09-28 01:34:42  sima                            MsiInstaller                    1033:  Windows   . : Microsoft Office Proof (Russian) 2010. : 14.0.4763.1000. : 1049. : Microsoft Corporation.    : 0.  
                     2015-09-28 01:34:42  sima                            MsiInstaller                    1040:    Windows: C:\MSOCache\All Users\{90140000-002C-0419-0000-0000000FF1CE}-C\Proof.de\Proof.msi.   : 1948.  
                     2015-09-28 01:34:42                           MsiInstaller                    1042:    Windows: C:\MSOCache\All Users\{90140000-002C-0419-0000-0000000FF1CE}-C\Proof.ru\Proof.msi.   : 1948.  
                     2015-09-28 01:34:44  sima                            MsiInstaller                    11707: Product: Microsoft Office Proof (German) 2010 -- Installation operation completed successfully.  
                     2015-09-28 01:34:44  sima                            MsiInstaller                    1033:  Windows   . : Microsoft Office Proof (German) 2010. : 14.0.4763.1000. : 1031. : Microsoft Corporation.    : 0.  
                     2015-09-28 01:34:44  sima                            MsiInstaller                    1040:    Windows: C:\MSOCache\All Users\{90140000-002C-0419-0000-0000000FF1CE}-C\Proof.en\Proof.msi.   : 1948.  
                     2015-09-28 01:34:44                           MsiInstaller                    1042:    Windows: C:\MSOCache\All Users\{90140000-002C-0419-0000-0000000FF1CE}-C\Proof.de\Proof.msi.   : 1948.  
                     2015-09-28 01:34:48  sima                            MsiInstaller                    11707: Product: Microsoft Office Proof (English) 2010 -- Installation operation completed successfully.  
                     2015-09-28 01:34:48  sima                            MsiInstaller                    1033:  Windows   . : Microsoft Office Proof (English) 2010. : 14.0.4763.1000. : 1033. : Microsoft Corporation.    : 0.  
                     2015-09-28 01:34:48  sima                            MsiInstaller                    1040:    Windows: C:\MSOCache\All Users\{90140000-002C-0419-0000-0000000FF1CE}-C\Proofing.msi.   : 1948.  
                     2015-09-28 01:34:48                           MsiInstaller                    1042:    Windows: C:\MSOCache\All Users\{90140000-002C-0419-0000-0000000FF1CE}-C\Proof.en\Proof.msi.   : 1948.  
                     2015-09-28 01:34:50  sima                            MsiInstaller                    11707: : Microsoft Office Proofing (Russian) 2010 --    .  
                     2015-09-28 01:34:50  sima                            MsiInstaller                    1033:  Windows   . : Microsoft Office Proofing (Russian) 2010. : 14.0.4763.1000. : 1049. : Microsoft Corporation.    : 0.  
                     2015-09-28 01:34:50  sima                            MsiInstaller                    1040:    Windows: C:\MSOCache\All Users\{90140000-0044-0419-0000-0000000FF1CE}-C\InfoPathMUI.msi.   : 1948.  
                     2015-09-28 01:34:50                           MsiInstaller                    1042:    Windows: C:\MSOCache\All Users\{90140000-002C-0419-0000-0000000FF1CE}-C\Proofing.msi.   : 1948.  
                     2015-09-28 01:35:01  sima                            MsiInstaller                    11707: : Microsoft Office InfoPath MUI (Russian) 2010 --    .  
                     2015-09-28 01:35:01  sima                            MsiInstaller                    1033:  Windows   . : Microsoft Office InfoPath MUI (Russian) 2010. : 14.0.4763.1000. : 1049. : Microsoft Corporation.    : 0.  
                     2015-09-28 01:35:01  sima                            MsiInstaller                    1040:    Windows: C:\MSOCache\All Users\{90140000-0015-0419-0000-0000000FF1CE}-C\AccessMUI.msi.   : 1948.  
                     2015-09-28 01:35:01                           MsiInstaller                    1042:    Windows: C:\MSOCache\All Users\{90140000-0044-0419-0000-0000000FF1CE}-C\InfoPathMUI.msi.   : 1948.  
                     2015-09-28 01:35:09  sima                            MsiInstaller                    11707: : Microsoft Office Access MUI (Russian) 2010 --    .  
                     2015-09-28 01:35:09  sima                            MsiInstaller                    1033:  Windows   . : Microsoft Office Access MUI (Russian) 2010. : 14.0.4763.1000. : 1049. : Microsoft Corporation.    : 0.  
                     2015-09-28 01:35:09  sima                            MsiInstaller                    1040:    Windows: C:\MSOCache\All Users\{90140000-00A1-0419-0000-0000000FF1CE}-C\OneNoteMUI.msi.   : 1948.  
                     2015-09-28 01:35:09                           MsiInstaller                    1042:    Windows: C:\MSOCache\All Users\{90140000-0015-0419-0000-0000000FF1CE}-C\AccessMUI.msi.   : 1948.  
                     2015-09-28 01:35:14  sima                            MsiInstaller                    11707: : Microsoft Office OneNote MUI (Russian) 2010 --    .  
                     2015-09-28 01:35:14  sima                            MsiInstaller                    1033:  Windows   . : Microsoft Office OneNote MUI (Russian) 2010. : 14.0.4763.1000. : 1049. : Microsoft Corporation.    : 0.  
                     2015-09-28 01:35:14  sima                            MsiInstaller                    1040:    Windows: C:\MSOCache\All Users\{90140000-0019-0419-0000-0000000FF1CE}-C\PublisherMUI.msi.   : 1948.  
                     2015-09-28 01:35:14                           MsiInstaller                    1042:    Windows: C:\MSOCache\All Users\{90140000-00A1-0419-0000-0000000FF1CE}-C\OneNoteMUI.msi.   : 1948.  
                     2015-09-28 01:35:20  sima                            MsiInstaller                    11707: : Microsoft Office Publisher MUI (Russian) 2010 --    .  
                     2015-09-28 01:35:20  sima                            MsiInstaller                    1033:  Windows   . : Microsoft Office Publisher MUI (Russian) 2010. : 14.0.4763.1000. : 1049. : Microsoft Corporation.    : 0.  
                     2015-09-28 01:35:20  sima                            MsiInstaller                    1040:    Windows: C:\MSOCache\All Users\{90140000-001B-0419-0000-0000000FF1CE}-C\WordMUI.msi.   : 1948.  
                     2015-09-28 01:35:20                           MsiInstaller                    1042:    Windows: C:\MSOCache\All Users\{90140000-0019-0419-0000-0000000FF1CE}-C\PublisherMUI.msi.   : 1948.  
                     2015-09-28 01:35:28  sima                            MsiInstaller                    11707: : Microsoft Office Word MUI (Russian) 2010 --    .  
                     2015-09-28 01:35:28  sima                            MsiInstaller                    1033:  Windows   . : Microsoft Office Word MUI (Russian) 2010. : 14.0.4763.1000. : 1049. : Microsoft Corporation.    : 0.  
                     2015-09-28 01:35:28  sima                            MsiInstaller                    1040:    Windows: C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.   : 1948.  
                     2015-09-28 01:35:28                           MsiInstaller                    1042:    Windows: C:\MSOCache\All Users\{90140000-001B-0419-0000-0000000FF1CE}-C\WordMUI.msi.   : 1948.  
                     2015-09-28 01:36:31                                  VSS                             8224:  VSS  - - .    
                     2015-09-28 01:36:49                                  Software Protection Platform Service  900:      .    
                     2015-09-28 01:36:51                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-09-28 01:36:51                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 01:36:51                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-09-28 01:40:03                                  VSS                             8224:  VSS  - - .    
                         2015-09-28 01:40:15                                  SideBySide                      33:       "C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL".      "Microsoft.VC90.ATL,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.08"".   sxstrace.exe   .  
                         2015-09-28 01:40:20                                  SideBySide                      33:       "C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL".      "Microsoft.VC90.ATL,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.08"".   sxstrace.exe   .  
                     2015-09-28 01:40:41                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-09-28 01:40:42                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-09-28 01:40:50                                  Office Software Protection Platform Service  8206: Token Store not found. Recreating empty Token Store.    
                     2015-09-28 01:40:50                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-09-28 01:40:50                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Generic Rights Account Certificate (Private)  License Id=5f7130f8-17f4-4735-8fd9-98272e7fd5e5  
                     2015-09-28 01:40:50                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Generic Rights Account Certificate (Public)  License Id=09713a06-3d2a-47c9-b20a-2bfe94dd18f2  
                     2015-09-28 01:40:50                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Generic Security Processor Certificate (Private)  License Id=cb9c4ceb-1b86-4457-8918-cb2fb95ad5af  
                     2015-09-28 01:40:50                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Generic Security Processor Certificate (Public)  License Id=c6134e36-57f5-4705-87d9-2f3f08efc83d  
                     2015-09-28 01:40:50                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=CLIENT-PKC Issuance License  License Id=9e54f6ea-be00-4909-84d0-3cbce8e57e5d  
                     2015-09-28 01:40:50                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=CLIENT-PLUGIN-MANIFEST Issuance License  License Id=27f341f4-c27b-4fde-a556-3a5ee00ebd8c  
                     2015-09-28 01:40:50                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=CLIENT-PPD Issuance License  License Id=9508580c-068f-4ddf-b7b8-df89ac541bbc  
                     2015-09-28 01:40:50                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=CLIENT-RAC Issuance License  License Id=95c2c6b8-ea2f-431d-8902-eeafc6376965  
                     2015-09-28 01:40:50                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=CLIENT-ROOT Issuance License  License Id=80e74f83-3c1f-448d-bacd-5bb3d73fdcc4  
                     2015-09-28 01:40:50                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=CLIENT-SPC Issuance License  License Id=57d6dc1b-f556-4f5b-935b-3b379fd9dda8  
                     2015-09-28 01:40:50                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=CLIENT-STIL Issuance License  License Id=285583cd-fc43-4806-ace6-d247b7edd434  
                     2015-09-28 01:40:50                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=CLIENT-UL Issuance License  License Id=4961cc30-d690-43be-910c-8e2db01fc5ad  
                     2015-09-28 01:40:50                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=CLIENT-UL-OEM Issuance License  License Id=9fb32152-3abd-4c4c-a5e1-467a1c50eb30  
                     2015-09-28 01:40:50                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=CLIENT-UL-OOB Issuance License  License Id=7e3094cf-ce3e-4ed4-8c8c-20c2be1add03  
                     2015-09-28 01:40:50                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=CLIENT-UL-PHN Issuance License  License Id=812f33a7-edaf-404b-a05a-f4397954033c  
                     2015-09-28 01:40:50                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=CLIENT-WGALIC Issuance License  License Id=770c4fab-e917-4899-a2cc-a76b894d5d3d  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=XrML 2.1 License - Product Key Configuration  License Id=8d0bdca0-33c9-43bd-8729-9871bba08c71  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Office 14 UL-Volume License (Public)  License Id=e2e326c2-ca6a-4577-a305-9d1e03fc5773  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Office 14 UL-Volume License (Private)  License Id=82bb1ddf-033e-4de5-a65f-88465f74aecf  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Office 14 UL-OOB License (Public)  License Id=7bcc5eee-f730-4c93-97c4-877e27333324  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Office 14 UL-OOB License (Private)  License Id=2453acfb-0e3f-49b2-9a78-209b1ff3908c  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Office 14 - Product PPD License (Security-SPP-Component-SKU-OfficeProPlus-KMS_Client)  License Id=cb7fd957-6868-58b3-086e-cd303db4a8c5  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=XrML 2.1 License - {msft:sl/RAC/VOLUME/PRIVATE}  License Id=eb981526-3397-447c-9e08-67f546a23f65  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=XrML 2.1 License - {msft:sl/RAC/VOLUME/PRIVATE}  License Id=eb981526-3397-447c-9e08-67f546a23f65  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Office 14 Publishing License (Public)  License Id=d8f1b81d-bca4-4879-aea8-3845a14c4824  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Office 14 Publishing License (Private)  License Id=3ff0b18b-c7e1-470a-96e1-fc6fc346ed5a  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Office 14 UL-PHN License (Public)  License Id=64026624-f349-46f0-87db-37442cf6f3da  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Office 14 UL-PHN License (Private)  License Id=98aa5ac0-0173-4df5-a223-670bb3bdef16  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Office 14 UL-OOB License (Public)  License Id=70202bca-2321-4f18-a3ff-29cd3ba38307  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Office 14 UL-OOB License (Private)  License Id=4d9f9ff4-b7f5-452b-9587-8d2b38dd0c45  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Office 14 - Product PPD License (Security-SPP-Component-SKU-OfficeProPlus-MAK)  License Id=f27036d3-9c72-40d1-4b15-fb058ead0470  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Office 14 Publishing License (Public)  License Id=ba56ca2a-1bcc-42a6-942b-a028288538f0  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Office 14 Publishing License (Private)  License Id=3e5fd99c-6695-4e20-acd9-aac39450e8f0  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Office 14 UL-PHN License (Public)  License Id=eaa7248f-f01e-49f9-b4a7-3b91e93071f4  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Office 14 UL-PHN License (Private)  License Id=19f33eae-0433-486d-88b7-cdab1d569835  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Office 14 UL-OOB License (Public)  License Id=4637b7ac-35d2-4b4b-90d0-cc565abde0a6  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Office 14 UL-OOB License (Private)  License Id=f68958fc-afc0-46fd-b92b-12fa0f2b21c7  
                     2015-09-28 01:40:51                                  Office Software Protection Platform Service  1004: The Software Protection service has successfully installed the license.  License Title=Office 14 - Product PPD License (Security-SPP-Component-SKU-OfficeProPlusAcad-MAK)  License Id=54369957-b369-15be-8690-2342fef6c903  
                     2015-09-28 01:40:53                                  Office Software Protection Platform Service  1016: Proof of Purchase installed successfully.   ACID=6f327760-8c5c-417c-9b61-836a98287e0c  PKeyId=bf9e64e9-452c-4e05-8f74-16eb7fbf2726  
                         2015-09-28 01:40:54                                  SideBySide                      33:       "C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL".      "Microsoft.VC90.ATL,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.08"".   sxstrace.exe   .  
                     2015-09-28 01:40:54                                  Office Software Protection Platform Service  1025: Grace period has been started. Grace days=30  Grace type=5.  
                     2015-09-28 01:40:54                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-09-28 01:40:54                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43200)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 01:41:21                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43200)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                         2015-09-28 01:41:23                                  WinMgmt                         
             1          2015-09-28 01:41:58                                  ESENT                           103: Windows (1876) Windows:    (0).  
             1          2015-09-28 01:41:58                                  Windows Search Service          1013:  Windows Search  .   
             1          2015-09-28 01:41:59                                  ESENT                           102: Windows (2984) Windows:   (6.01.7601.0000)    (0).  
             1          2015-09-28 01:41:59                                  Windows Search Service          1003:  Windows Search .   
                     2015-09-28 01:42:00  sima                            MsiInstaller                    11707: : Microsoft Office Professional Plus 2010 --    .  
                     2015-09-28 01:42:00  sima                            MsiInstaller                    1033:  Windows   . : Microsoft Office Professional Plus 2010. : 14.0.4763.1000. : 0. : Microsoft Corporation.    : 0.  
                     2015-09-28 01:42:00                           MsiInstaller                    1042:    Windows: C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.   : 1948.  
                     2015-09-28 01:42:13                                  Software Protection Platform Service  903:     .    
                     2015-09-28 01:44:29                                  Windows Error Reporting         1001:   ,  0   : MpTelemetry  :     CAB: 0     :  P1: 8024001f  P2: EndSearch  P3: Search  P4: 6.1.7601.17514  P5: MpSigDwn.dll  P6: 6.1.7600.16385  P7: Windows Defender  P8:   P9:   P10:      :  C:\Windows\Temp\MPTelemetrySubmit\client_manifest.txt        :  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_8024001f_73aea48bd74c52b523f34668a59a345e9e5b5_cab_0f9fe5e2     :     : 0   : 04c6f273-6537-11e5-976b-0019db4d6dee   : 6  
                     2015-09-28 01:44:34                                  Windows Error Reporting         1001:   ,  0   : WindowsUpdateFailure  :     CAB: 0     :  P1: 7.5.7601.17514  P2: 8024001f  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 101  P6: Unmanaged  P7:   P8:   P9:   P10:      :        :       :     : 0   : 07b5f731-6537-11e5-976b-0019db4d6dee   : 0  
                     2015-09-28 01:44:34                                  Windows Error Reporting         1001:   ,  0   : WindowsUpdateFailure  :     CAB: 0     :  P1: 7.5.7601.17514  P2: 8024001f  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 101  P6: Unmanaged  P7:   P8:   P9:   P10:      :        :  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_7.5.7601.17514_78efc842cf92e79bab1c4f2fb5bd805f263a65_cab_0deff94b     :     : 0   : 07b5f731-6537-11e5-976b-0019db4d6dee   : 6  
                     2015-09-28 01:49:34                                  Windows Error Reporting         1001:   ,  0   : MpTelemetry  :     CAB: 0     :  P1: 8024001f  P2: EndSearch  P3: Search  P4: 6.1.7601.17514  P5: MpSigDwn.dll  P6: 6.1.7600.16385  P7: Windows Defender  P8:   P9:   P10:      :        :  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_8024001f_73aea48bd74c52b523f34668a59a345e9e5b5_0b388e25     :     : 0   : baaa1877-6537-11e5-976b-0019db4d6dee   : 6  
                     2015-09-28 01:49:39                                  Windows Error Reporting         1001:   ,  0   : WindowsUpdateFailure  :     CAB: 0     :  P1: 7.5.7601.17514  P2: 8024001f  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 101  P6: Unmanaged  P7:   P8:   P9:   P10:      :        :       :     : 0   : bd7ee357-6537-11e5-976b-0019db4d6dee   : 0  
                     2015-09-28 01:49:39                                  Windows Error Reporting         1001:   ,  0   : WindowsUpdateFailure  :     CAB: 0     :  P1: 7.5.7601.17514  P2: 8024001f  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 101  P6: Unmanaged  P7:   P8:   P9:   P10:      :        :  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_7.5.7601.17514_78efc842cf92e79bab1c4f2fb5bd805f263a65_0274a372     :     : 0   : bd7ee357-6537-11e5-976b-0019db4d6dee   : 6  
                     2015-09-28 02:05:17                                  System Restore                  8194:     ( = C:\Users\sima\AppData\Local\Temp\{0E418A3A-532A-4452-8A55-E980AC027C3A}\Setup.exe  -media_path:"F:\windows\Driver\" -tempdisk1folder:"C:\Users\sima\AppData\Local\Temp\{0E418A3A-532A-4452-8A55-E980AC027C3A}\";  =  REALTEK 11n USB Wireless LAN Software).  
                     2015-09-28 02:05:40  sima                            MsiInstaller                    1040:    Windows: F:\windows\Driver\EAP\EAP-FAST.msi.   : 1392.  
                     2015-09-28 02:05:41  sima                            Microsoft-Windows-RestartManager  10000:   0 - 2015-09-27T17:05:41.476562500Z.  
                     2015-09-28 02:05:43  sima                            MsiInstaller                    11707: Product: Cisco EAP-FAST Module -- Installation completed successfully.  
                     2015-09-28 02:05:43  sima                            MsiInstaller                    1033:  Windows   . : Cisco EAP-FAST Module. : 2.2.14. : 1033. : Cisco Systems, Inc..    : 0.  
                     2015-09-28 02:05:43  sima                            MsiInstaller                    1040:    Windows: F:\windows\Driver\EAP\EAP-PEAP.msi.   : 2052.  
                     2015-09-28 02:05:43  sima                            Microsoft-Windows-RestartManager  10001:   0,  2015-09-27T17:05:41.476562500Z.  
                     2015-09-28 02:05:43                           MsiInstaller                    1042:    Windows: F:\windows\Driver\EAP\EAP-FAST.msi.   : 1392.  
                     2015-09-28 02:05:44  sima                            Microsoft-Windows-RestartManager  10000:   0 - 2015-09-27T17:05:44.164062500Z.  
                     2015-09-28 02:05:45  sima                            MsiInstaller                    11707: Product: Cisco PEAP Module -- Installation completed successfully.  
                     2015-09-28 02:05:45  sima                            MsiInstaller                    1033:  Windows   . : Cisco PEAP Module. : 1.1.6. : 1033. : Cisco Systems, Inc..    : 0.  
                     2015-09-28 02:05:45  sima                            MsiInstaller                    1040:    Windows: F:\windows\Driver\EAP\EAP-LEAP.msi.   : 2612.  
                     2015-09-28 02:05:45  sima                            Microsoft-Windows-RestartManager  10001:   0,  2015-09-27T17:05:44.164062500Z.  
                     2015-09-28 02:05:45                           MsiInstaller                    1042:    Windows: F:\windows\Driver\EAP\EAP-PEAP.msi.   : 2052.  
                     2015-09-28 02:05:46  sima                            Microsoft-Windows-RestartManager  10000:   0 - 2015-09-27T17:05:46.117187500Z.  
                     2015-09-28 02:05:47  sima                            MsiInstaller                    11707: Product: Cisco LEAP Module -- Installation completed successfully.  
                     2015-09-28 02:05:47  sima                            MsiInstaller                    1033:  Windows   . : Cisco LEAP Module. : 1.0.19. : 1033. : Cisco Systems, Inc..    : 0.  
                     2015-09-28 02:05:47  sima                            Microsoft-Windows-RestartManager  10001:   0,  2015-09-27T17:05:46.117187500Z.  
                     2015-09-28 02:05:47                           MsiInstaller                    1042:    Windows: F:\windows\Driver\EAP\EAP-LEAP.msi.   : 2612.  
                     2015-09-28 02:07:34                                  Microsoft-Windows-CAPI2         4097:      :: : <E=premium-server@thawte.com, CN=Thawte Premium Server CA, OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, S=Western Cape, C=ZA>;  SHA1: <627F8D7827656399D27D7F9044C9FEB3F33EFA9A>.  
                     2015-09-28 02:08:22                                  VSS                             8224:  VSS  - - .    
                     2015-09-28 02:08:25                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-09-28 02:08:25                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-09-28 02:15:25                                  .NET Runtime Optimization Service  1130: .NET Runtime Optimization Service (2.0.50727.5420) - Installed from repository: Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets  
                     2015-09-28 02:19:37                                  Windows Error Reporting         1001:   ,  0   : MpTelemetry  :     CAB: 0     :  P1: 8024001f  P2: EndSearch  P3: Search  P4: 6.1.7601.17514  P5: MpSigDwn.dll  P6: 6.1.7600.16385  P7: Windows Defender  P8:   P9:   P10:      :        :  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_8024001f_73aea48bd74c52b523f34668a59a345e9e5b5_0f7810de     :     : 0   : ed4ee8e9-653b-11e5-976b-0019db4d6dee   : 6  
                     2015-09-28 02:19:38                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-09-28 02:19:38                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-09-28 02:19:40                                  Windows Error Reporting         1001:   ,  0   : WindowsUpdateFailure  :     CAB: 0     :  P1: 7.5.7601.17514  P2: 8024001f  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 101  P6: Unmanaged  P7:   P8:   P9:   P10:      :        :       :     : 0   : ef1d711d-653b-11e5-976b-0019db4d6dee   : 0  
                     2015-09-28 02:19:40                                  Windows Error Reporting         1001:   ,  0   : WindowsUpdateFailure  :     CAB: 0     :  P1: 7.5.7601.17514  P2: 8024001f  P3: 00000000-0000-0000-0000-000000000000  P4: Scan  P5: 101  P6: Unmanaged  P7:   P8:   P9:   P10:      :        :  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_7.5.7601.17514_78efc842cf92e79bab1c4f2fb5bd805f263a65_0c301d71     :     : 0   : ef1d711d-653b-11e5-976b-0019db4d6dee   : 6  
                     2015-09-28 02:19:41                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-09-28 02:20:41                                  EventSystem                     
                     2015-09-28 02:20:41                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-09-28 02:20:47                                  Winlogon                        4101:  Windows .  
                     2015-09-28 02:20:47                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-09-28 02:20:57                                  WinMgmt                         
                     2015-09-28 02:21:00                                  WinMgmt                         
             1          2015-09-28 02:21:12                                  ESENT                           102: Windows (2288) Windows:   (6.01.7601.0000)    (0).  
             3          2015-09-28 02:21:12                                  ESENT                           300: Windows (2288) Windows:     .  
             3          2015-09-28 02:21:12                                  ESENT                           301: Windows (2288) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00056.log.  
             3          2015-09-28 02:21:12                                  ESENT                           301: Windows (2288) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00057.log.  
             3          2015-09-28 02:21:12                                  ESENT                           301: Windows (2288) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-09-28 02:21:12                                  ESENT                           302: Windows (2288) Windows:    .  
             1          2015-09-28 02:21:13                                  Windows Search Service          1003:  Windows Search .   
                         2015-09-28 02:22:16                                  WinMgmt                         
                     2015-09-28 02:23:05                                  Software Protection Platform Service  900:      .    
                     2015-09-28 02:23:06                                  SecurityCenter                  1:     Windows .  
                     2015-09-28 02:23:07                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-09-28 02:23:08                                  Software Protection Platform Service  1033:   ,       override-only.   =(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet-Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicensing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs-clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA)    =55c92734-d682-4d71-983e-d6ec3f16059f   SKU=7cfd4696-69a9-4af7-af36-ff3d12b6b6c8  
                     2015-09-28 02:23:08                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 02:23:08                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-09-28 02:25:04                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-09-28 02:25:04                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-09-28 02:28:09                                  Software Protection Platform Service  903:     .    
                     2015-09-28 02:29:03  sima                            Microsoft-Windows-LoadPerf      1000: C    Outlook (Outlook)  .         ,   .  
                     2015-09-28 02:29:22  sima                            MsiInstaller                    1040:    Windows: {51C7AD07-C3F6-4635-8E8A-231306D810FE}.   : 1052.  
                     2015-09-28 02:29:26  sima                            Microsoft-Windows-RestartManager  10000:   0 - 2015-09-27T17:29:26.134828100Z.  
                     2015-09-28 02:29:54  sima                            MsiInstaller                    11724: Product: Cisco LEAP Module -- Removal completed successfully.  
                     2015-09-28 02:29:54  sima                            MsiInstaller                    1034:  Windows   . : Cisco LEAP Module. : 1.0.19. : 1033. : Cisco Systems, Inc..    : 0.  
                     2015-09-28 02:29:54  sima                            Microsoft-Windows-RestartManager  10001:   0,  2015-09-27T17:29:26.134828100Z.  
                     2015-09-28 02:29:54                           MsiInstaller                    1042:    Windows: {51C7AD07-C3F6-4635-8E8A-231306D810FE}.   : 1052.  
                     2015-09-28 02:29:55  sima                            MsiInstaller                    1040:    Windows: {ED5776D5-59B4-46B7-AF81-5F2D94D7C640}.   : 2276.  
                     2015-09-28 02:29:55  sima                            Microsoft-Windows-RestartManager  10000:   0 - 2015-09-27T17:29:55.619203100Z.  
                     2015-09-28 02:30:04  sima                            MsiInstaller                    11724: Product: Cisco PEAP Module -- Removal completed successfully.  
                     2015-09-28 02:30:04  sima                            MsiInstaller                    1034:  Windows   . : Cisco PEAP Module. : 1.1.6. : 1033. : Cisco Systems, Inc..    : 0.  
                     2015-09-28 02:30:04  sima                            Microsoft-Windows-RestartManager  10001:   0,  2015-09-27T17:29:55.619203100Z.  
                     2015-09-28 02:30:04                           MsiInstaller                    1042:    Windows: {ED5776D5-59B4-46B7-AF81-5F2D94D7C640}.   : 2276.  
                     2015-09-28 02:30:05  sima                            MsiInstaller                    1040:    Windows: {64BF0187-F3D2-498B-99EA-163AF9AE6EC9}.   : 3040.  
                     2015-09-28 02:30:05  sima                            Microsoft-Windows-RestartManager  10000:   0 - 2015-09-27T17:30:05.587953100Z.  
                     2015-09-28 02:30:14  sima                            MsiInstaller                    11724: Product: Cisco EAP-FAST Module -- Removal completed successfully.  
                     2015-09-28 02:30:14  sima                            MsiInstaller                    1034:  Windows   . : Cisco EAP-FAST Module. : 2.2.14. : 1033. : Cisco Systems, Inc..    : 0.  
                     2015-09-28 02:30:14  sima                            Microsoft-Windows-RestartManager  10001:   0,  2015-09-27T17:30:05.587953100Z.  
                     2015-09-28 02:30:14                           MsiInstaller                    1042:    Windows: {64BF0187-F3D2-498B-99EA-163AF9AE6EC9}.   : 3040.  
                     2015-09-28 02:32:50                                  Microsoft-Windows-CAPI2         4109:       :: : <OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US>  Sha1: <742C3192E607E424EB4549542BE1BBC53E6174E2>.  
                     2015-09-28 02:32:50                                  Microsoft-Windows-CAPI2         4109:       :: : <E=premium-server@thawte.com, CN=Thawte Premium Server CA, OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, S=Western Cape, C=ZA>  Sha1: <627F8D7827656399D27D7F9044C9FEB3F33EFA9A>.  
                     2015-09-28 02:32:50                                  Microsoft-Windows-CAPI2         4108:      :: : <OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US>  Sha1: <4F65566336DB6598581D584A596C87934D5F2AB4>.  
                     2015-09-28 02:32:50                                  Microsoft-Windows-CAPI2         4097:      :: : <CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US>;  SHA1: <4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5>.  
                     2015-09-28 02:34:24                                  Microsoft-Windows-CAPI2         4097:      :: : <CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE>;  SHA1: <D4DE20D05E66FC53FE1A50882C78DB2852CAE474>.  
                     2015-09-28 02:38:11                                  Software Protection Platform Service  900:      .    
                     2015-09-28 02:38:12                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-09-28 02:38:12                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 02:38:12                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-09-28 02:42:52                                  System Restore                  8194:     ( = C:\Windows\system32\svchost.exe -k netsvcs;  =   Windows).  
                     2015-09-28 02:43:12                                  Software Protection Platform Service  903:     .    
                     2015-09-28 02:46:05                                  VSS                             8224:  VSS  - - .    
                     2015-09-28 04:55:58                                  Desktop Window Manager          9010:  (   Windows)          
                     2015-09-28 04:55:58                                  Desktop Window Manager          9013:       ,          
                     2015-09-28 04:59:18                                  Microsoft-Windows-Defrag        258:           
                         2015-09-28 05:02:48                                  SideBySide                      33:       "c:\my_programs\TC\Programs\Piriform\Recuva\Recuva64.exe".      "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"".   sxstrace.exe   .  
                     2015-09-28 05:08:56                                  VSS                             8224:  VSS  - - .    
                     2015-09-28 05:25:03                                  Microsoft-Windows-Defrag        258:        MusicVideo (D:)  
                     2015-09-28 05:25:05                                  Microsoft-Windows-Defrag        258:          (G:)  
                     2015-09-28 05:39:54                                  Microsoft-Windows-Defrag        258:        (C:)  
                     2015-09-28 05:40:32                                  Microsoft-Windows-Defrag        258:        Tatyana (E:)  
                     2015-09-28 05:59:47                                  Microsoft-Windows-Defrag        258:         (C:)  
                     2015-09-28 06:38:19                                  Desktop Window Manager          9010:  (Heroes of Might and Magic III)          
                     2015-09-28 06:38:19                                  Desktop Window Manager          9013:       ,          
                     2015-09-28 06:49:31                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-09-28 06:49:31                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-09-28 06:49:33                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-09-28 07:17:17                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-09-28 07:17:18                                  EventSystem                     
                     2015-09-28 07:17:20                                  WinMgmt                         
                     2015-09-28 07:17:23                                  WinMgmt                         
                     2015-09-28 07:18:54                                  Windows Error Reporting         1001:   ,  0   : PnPDeviceProblemCode  :     CAB: 0     :  P1: x86  P2: ACPI\PNP0F03  P3: {4d36e96f-e325-11ce-bfc1-08002be10318}  P4: 00000018  P5: i8042prt.sys  P6: 6.1.7600.16385  P7: 07-13-2009  P8:   P9:   P10:      :  C:\Windows\Temp\DMI8582.tmp.log.xml  C:\Windows\Temp\LOG8592.tmp  C:\Windows\inf\msmouse.inf        :  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_4211c7cc86e4ee2d1ea5342443c32a211342d6_cab_05b285d0     :     : 0   : bca89ddc-6565-11e5-8631-fc028a355a4a   : 6  
                     2015-09-28 07:19:10                                  Windows Error Reporting         1001:   ,  0   : PnPDeviceProblemCode  :     CAB: 0     :  P1: x86  P2: ACPI\PNP0303  P3: {4d36e96b-e325-11ce-bfc1-08002be10318}  P4: 00000018  P5: i8042prt.sys  P6: 6.1.7600.16385  P7: 07-13-2009  P8:   P9:   P10:      :  C:\Windows\Temp\DMIC1B0.tmp.log.xml  C:\Windows\Temp\LOGC1C0.tmp  C:\Windows\inf\keyboard.inf        :  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_af89869c32d914a38ff0d62d3577cfaa5761f093_cab_064ec1cf     :     : 0   : c5d50a26-6565-11e5-8631-fc028a355a4a   : 6  
                     2015-09-28 07:19:14                                  Windows Error Reporting         1001:   ,  0   : PnPDriverNotFound  :     CAB: 0     :  P1: x86  P2: USB\VID_0B05&PID_17BA&REV_0200  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :  C:\Windows\Temp\DMID1CD.tmp.log.xml        :  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_a6f7da6553333d43263b59da96ea8225897d110_cab_00fad1ec     :     : 0   : c84a76f6-6565-11e5-8631-fc028a355a4a   : 6  
                     2015-09-28 07:19:22                                  Software Protection Platform Service  900:      .    
                     2015-09-28 07:19:22                                  VSS                             8212:    :     BITS Writer   {4969d978-be47-48b0-b100-f328f07ac1e0}     .    :        :       : {4969d978-be47-48b0-b100-f328f07ac1e0}      : BITS Writer  
                     2015-09-28 07:19:23                                  SecurityCenter                  1:     Windows .  
             1          2015-09-28 07:19:23                                  Windows Search Service          1003:  Windows Search .   
                     2015-09-28 07:19:25                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (DirectExperience)   =63f7d6b3-2b29-5864-50cf-9f7231237dbe  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (MathRecognizerEventsLicensing)   =4a69babc-79ff-d8d0-e21f-1ad764610ba5  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (MCLicense)   =7e746adc-aded-b4e0-f905-958045b82a91  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (MediaCenter)   =e3d4363f-c347-a427-5719-d0714ad4e28b  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (Microsoft-Windows-AuxiliaryDisplay)   =bb84a932-2455-c803-5571-28702ab9ef37  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (Microsoft-Windows-OfflineFiles-Core)   =fde9a948-da42-4dda-8551-5bc37d07ed22  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (Microsoft-Windows-SensorsLicense)   =50e07dda-3e8f-7f35-e0e3-93d2d5801978  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (MobilePCMobilityCenter)   =3dbac6e0-a3bc-8c89-90b5-5e95e1e4456f  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (MobilePCPresentationSettings)   =829de4ec-c68f-e5b5-bfc8-09faa229aa76  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (NetworkProjection)   =8f41e452-9780-ff52-fa7f-3f473959bbee  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (OMD-API)   =d8762de4-0e0c-3d1f-83f9-324bc2106432  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (PeerDist-Common)   =4d6bd88a-7817-3bec-4a2f-f8205a547e77  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (Personalization)   =e424241c-3885-725a-612f-a597a877aabe  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (Printing-Spooler-Pmc-Licensing)   =65904b29-a3f7-213d-2a08-c712954e716c  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 - Product PPD License (Security-SPP-Component-SKU-Ultimate)   =74157d48-6669-3402-ad14-3bebda8a41fe  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (Shell-InBoxGames-Shanghai)   =1e225bb2-e9ec-bccb-10c7-31e31f130411  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (Shell-MultiplayerInboxGames-Backgammon)   =d072ce44-f705-7add-335e-136c2e855698  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (Shell-MultiplayerInboxGames-Checkers)   =03b522b9-d4bb-923c-91ae-dd77b3052a7c  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (Shell-MultiplayerInboxGames-Common)   =9aceec39-efab-7316-fdd6-47c29a3f828e  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (Shell-MultiplayerInboxGames-Spades)   =57aca662-fb9d-50ea-2066-6c03661814fb  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (Shell-PremiumInBoxGames-Chess)   =38613765-1943-566a-04f5-cdf3dd436fd5  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (SnippingToolLicensing)   =9503a4e9-5367-9f58-682a-c903313a1221  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (StickyNotesLicensing)   =60bd071d-89a5-36a5-9ab8-5e94b8ceb81d  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (TabletPC-MathInputLicensing)   =bf82650e-f5b5-7940-7b18-7d061958ea98  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (TabletPCAccessories)   =69ac1b04-f36a-2bd1-b7ec-1ae9ee709361  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (TabletPCCoreInkRecognitionLicensing)   =8d61ad59-f947-03ff-1472-fb4bda47aae4  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (TabletPCInputPanel)   =3f2a5d05-fdc9-722d-1bae-26480a09b361  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (TabletPCInputPersonalization)   =e04832c7-38ba-a7cf-b6a8-dc0589faf247  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (TerminalServices-DeviceRedirection-Licenses)   =c4ddee78-55b7-8e06-319f-e099efa3c9f5  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (TerminalServices-RemoteApplications-ClientSku)   =ecc500af-315e-7a7b-bd54-66c5d4f35480  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (VirtualPC-licensing)   =31745652-42b3-9db0-f12a-3cfcbebb5ee7  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(TM) - Component PPD License (VirtualXP-licensing)   =6b9b822b-3a52-cdf6-1a20-2c3ca2b44ad2  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 Publishing License (Public)   =b1bd3323-2f75-49aa-b89b-f6e452927940  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 Publishing License (Private)   =7d3e66ea-c89d-4365-b58e-46e20a488542  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Public)   =e00d921c-3aa0-45b9-b5a7-d5ff389e3f96  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Private)   =c006fbad-9886-45cb-a4df-59938356f609  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-PHN License (Public)   =87ac09b9-9d15-44b6-aa78-ead6ab1b4df7  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-PHN License (Private)   =d6544d8c-4c9f-4e75-9841-8f1ad9c451a0  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 Publishing License (Public)   =0a798e1b-1de1-4e8b-ba68-32b651cfbed9  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 Publishing License (Private)   =256218cc-7de7-459e-9774-231af2c8e1f8  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Public)   =eeb65037-25a7-46c3-a238-afda79e61c1c  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Private)   =9724faa7-8e02-4204-bdd5-4dd9d421a767  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-PHN License (Public)   =52267a1a-511f-4a6b-901c-efb315629db3  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-PHN License (Private)   =14ebdd25-3bb6-4882-b9f2-782e07ac7ef7  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Public)   =3469e52a-9b86-4565-b3b2-8afa3008f5dd  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Private)   =0de4bb14-bbac-44e9-833b-df5316757946  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OEM License (Public)   =e5f288dc-adb9-4fad-af52-af46c00edf5e  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OEM License (Private)   =f675d432-c009-4149-81a3-55e5dc5e3c75  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Public)   =8df162e2-5c1a-481c-bbaf-95c7f36be6cc  
                     2015-09-28 07:19:28                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Private)   =72bc21af-3a71-4083-98aa-e0164889e432  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OEM License (Public)   =4fba48fb-e36a-452f-adcf-69c9d053809b  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OEM License (Private)   =7909f91f-bbe4-4400-af7e-c2609d9bce7e  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 Publishing License (Public)   =9a8ba6d0-d783-4c28-9b3a-ac029544249f  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 Publishing License (Private)   =e93ab8ab-1f4d-4719-ac5f-256b76fe2e04  
                     2015-09-28 07:19:29                                  Windows Error Reporting         1001:   ,  0   : PnPRequestAdditionalSoftware  :     CAB: 0     :  P1: x86  P2: USB\VID_045E&PID_0745&REV_0633&MI_00  P3: 6.1.1.0  P4: 0419  P5: input.inf  P6: *  P7:   P8:   P9:   P10:      :        :  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_4f57b7d2785d7eb3e51b125fe731be6335839_cab_01470c46     :     : 0   : d131bf0e-6565-11e5-8631-fc028a355a4a   : 6  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Public)   =7acfc5cb-cfbf-4978-832c-5b8a5e1b512b  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Private)   =ab47a1b9-d593-4218-807b-c4e8024c5a39  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-PHN License (Public)   =787fda90-3e3b-4d0b-8538-e91e884367ca  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-PHN License (Private)   =5e039d2a-2ecb-4fa1-9af8-8eb3f5453aa4  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 Publishing License (Public)   =fce510f8-81ee-43f1-b4c2-ec898f0187fe  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 Publishing License (Private)   =467e4914-43b5-4529-81ed-1bc59a01e1c5  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Public)   =51b0a7a0-11e1-4c11-a023-eec31c81c57f  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Private)   =c46996cb-1b81-4e26-8bec-5457c02a2ab9  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-PHN License (Public)   =199f7b97-56f1-4c4c-8cc8-b12b4962f51c  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-PHN License (Private)   =774ab00f-d6ee-4dc0-9896-b948ae40e2d1  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 Publishing License (Public)   =2e8657aa-1e85-4162-accc-6ddcfa7ed61d  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 Publishing License (Private)   =669f9437-c2bd-4e9e-858c-74951270d2e9  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 Publishing License (Public)   =248b04e7-253e-4d53-ac19-60b6dfd46bba  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 Publishing License (Private)   =68bf082a-4090-40f9-b87e-17e531d973a4  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Public)   =0bb74cf9-e689-4a7c-9b65-c16d13d14d4f  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Private)   =762214fc-bd4f-4c26-b5c6-de5346dbe604  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-PHN License (Public)   =70576cb1-f623-43b4-a3e4-4c2e7ffe2524  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-PHN License (Private)   =4700dab6-e592-4dd4-86ef-4f5a0501c1b7  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 Publishing License (Public)   =53e4fcbe-1ca8-4335-a8e6-3bcb84d2d284  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 Publishing License (Private)   =b6120521-805f-4e92-956a-16947f53013e  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Public)   =1accec05-32da-4a80-9754-534027bc8cc8  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Private)   =d68cbca9-8b83-442b-8419-0c5908713474  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-PHN License (Public)   =6ee7f3c0-2493-4bf4-bbf1-e03cdc360fbe  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-PHN License (Private)   =ebe2aae0-0f0b-410b-9843-04e2e786d9f3  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 Publishing License (Public)   =cafe5272-9688-414c-bc80-5f4780e205c1  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 Publishing License (Private)   =9cf96d3e-7a77-426b-b925-7841d5959655  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Public)   =6e1f5901-07c2-498b-8205-f361465b0e6f  
                     2015-09-28 07:19:29                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Private)   =74bab940-6638-471a-a9cb-694877a8f758  
                     2015-09-28 07:19:30                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Public)   =8c8b4834-7b25-4ab7-a621-3f28a31a405a  
                     2015-09-28 07:19:30                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Private)   =9ea74c90-c11b-402c-8838-b9eb475d62bd  
                     2015-09-28 07:19:30                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Public)   =117692fa-a5ae-4fc8-8abf-70b8467cc86e  
                     2015-09-28 07:19:30                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-OOB License (Private)   =2c8720d1-0145-417d-80c7-afa0244d9430  
                     2015-09-28 07:19:30                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-PHN License (Public)   =41f4bc92-0666-4898-8584-8df2d25a1087  
                     2015-09-28 07:19:30                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-PHN License (Private)   =c9f73d15-6529-4783-af23-6a8545e0cd65  
                     2015-09-28 07:19:30                                  Windows Error Reporting         1001:   ,  0   : PnPRequestAdditionalSoftware  :     CAB: 0     :  P1: x86  P2: USB\VID_045E&PID_0745&REV_0633&MI_01  P3: 6.1.1.0  P4: 0419  P5: input.inf  P6: *  P7:   P8:   P9:   P10:      :        :  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_2095f4f99e29b5ff18f42a7ae02537ede12281e7_cab_02ff10ba     :     : 0   : d1e22d12-6565-11e5-8631-fc028a355a4a   : 6  
                     2015-09-28 07:19:30                                  Windows Error Reporting         1001:   ,  0   : PnPRequestAdditionalSoftware  :     CAB: 0     :  P1: x86  P2: USB\VID_045E&PID_0745&REV_0633&MI_02  P3: 6.1.1.0  P4: 0419  P5: input.inf  P6: *  P7:   P8:   P9:   P10:      :        :  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_3e50f45edde8c2448819bf543d1dae65849bebfd_cab_059f12dd     :     : 0   : d2333d06-6565-11e5-8631-fc028a355a4a   : 6  
                     2015-09-28 07:19:30                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-PHN License (Public)   =d1b511f9-b601-47db-b7dc-8c1112a72516  
                     2015-09-28 07:19:30                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 UL-PHN License (Private)   =3a63489a-22dc-4cca-88ec-761a9a570871  
                     2015-09-28 07:19:30                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 Publishing License (Public)   =f9e7281a-ff94-4e5c-8652-755c799e8abc  
                     2015-09-28 07:19:30                                  Software Protection Platform Service  1004:       .   =Windows(R) 7 Publishing License (Private)   =fd73be9e-8e61-409a-969b-e1ce3cde3739  
                     2015-09-28 07:19:32                                  Windows Error Reporting         1001:   ,  0   : PnPGenericDriverFound  :     CAB: 0     :  P1: x86  P2: USB\VID_1E4E&PID_0109&REV_0002&MI_00  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :        :  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_8165a3ccd0f3c8899cadd67225307fc53a8ef7d6_cab_025b1946     :     : 0   : d32ff64a-6565-11e5-8631-fc028a355a4a   : 6  
                     2015-09-28 07:19:37                                  Windows Error Reporting         1001:   ,  0   : PnPRequestAdditionalSoftware  :     CAB: 0     :  P1: x86  P2: HID\VID_045E&PID_0745&REV_0633&MI_02&Col03  P3: 6.1.1.0  P4: 0419  P5: input.inf  P6: *  P7:   P8:   P9:   P10:      :        :  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_1282a7150c4fc4b1ba8f5bed63f5df3bb748d67_cab_05b72c22     :     : 0   : d60e4a92-6565-11e5-8631-fc028a355a4a   : 6  
                     2015-09-28 07:19:37                                  Windows Error Reporting         1001:   ,  0   : PnPRequestAdditionalSoftware  :     CAB: 0     :  P1: x86  P2: HID\VID_045E&PID_0745&REV_0633&MI_02&Col04  P3: 6.1.1.0  P4: 0419  P5: input.inf  P6: *  P7:   P8:   P9:   P10:      :        :  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_8b5e66184b98bf845bc9e93f4ac69f936e96539_cab_01632d5a     :     : 0   : d63df99a-6565-11e5-8631-fc028a355a4a   : 6  
                     2015-09-28 07:19:46                                  Software Protection Platform Service  1016:      .   ACID=ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8  PKeyId=debce1f8-0879-5409-b223-6d0dc6cb430b  
                     2015-09-28 07:19:48                                  Software Protection Platform Service  1025:   .  =30   =5.  
                     2015-09-28 07:19:48                                  Software Protection Platform Service  1033:   ,       override-only.   =(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet-Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicensing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs-clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA)    =55c92734-d682-4d71-983e-d6ec3f16059f   SKU=ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8  
                     2015-09-28 07:19:48                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 )(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43200)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 07:19:48                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-09-28 07:20:08                                  System Restore                  8195:    ( = C:\Windows\system32\oobe\setup.exe;  = ).  
                     2015-09-28 07:20:08                                  VSS                             8212:    :     Registry Writer   {afbab4a2-367d-4d15-a586-71dbb18f8485}     .    :        :       : {afbab4a2-367d-4d15-a586-71dbb18f8485}      : Registry Writer  
                     2015-09-28 07:20:08                                  VSS                             8212:    :     COM+ REGDB Writer   {542da469-d3e1-473c-9f4f-7847f01fc64f}     .    :        :       : {542da469-d3e1-473c-9f4f-7847f01fc64f}      : COM+ REGDB Writer  
                     2015-09-28 07:20:08                                  VSS                             8212:    :     ASR Writer   {be000cbe-11fe-4426-9c58-531aa6355fc4}     .    :        :       : {be000cbe-11fe-4426-9c58-531aa6355fc4}      : ASR Writer  
                     2015-09-28 07:20:08                                  VSS                             8212:    :     Shadow Copy Optimization Writer   {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}     .    :        :       : {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}      : Shadow Copy Optimization Writer  
                     2015-09-28 07:20:08                                  System Restore                  8196:    ( = C:\Windows\system32\oobe\setup.exe;  = ).  
                         2015-09-28 07:20:11                                  .NET Runtime Optimization Service  1107: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Failed to execute command from the offline queue: install "Microsoft.MediaCenter.Shell, Version=6.1.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /queue:1.  The error returned was    . (Exception from HRESULT: 0x8007045B) .  
                         2015-09-28 07:20:11                                  .NET Runtime Optimization Service  1107: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Failed to execute command from the offline queue: install "Microsoft.MediaCenter.iTV.Media, Version=6.1.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=x86" /queue:1.  The error returned was    . (Exception from HRESULT: 0x8007045B) .  
                         2015-09-28 07:20:11                                  .NET Runtime Optimization Service  1107: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Failed to execute command from the offline queue: install "Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager, Version=6.1.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /queue:1.  The error returned was    . (Exception from HRESULT: 0x8007045B) .  
                         2015-09-28 07:20:11                                  .NET Runtime Optimization Service  1107: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Failed to execute command from the offline queue: install "ehiBmlDataCarousel, Version=6.1.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /queue:1.  The error returned was    . (Exception from HRESULT: 0x8007045B) .  
                         2015-09-28 07:20:11                                  .NET Runtime Optimization Service  1107: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Failed to execute command from the offline queue: install "ehiUPnP, Version=6.1.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /queue:1.  The error returned was    . (Exception from HRESULT: 0x8007045B) .  
                         2015-09-28 07:20:11                                  .NET Runtime Optimization Service  1107: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Failed to execute command from the offline queue: install "Microsoft.MediaCenter.UI, Version=6.1.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /queue:1.  The error returned was    . (Exception from HRESULT: 0x8007045B) .  
                     2015-09-28 07:20:11                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-09-28 07:22:00                                  EventSystem                     
                     2015-09-28 07:22:00                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-09-28 07:22:03                                  WinMgmt                         
                     2015-09-28 07:22:06                                  WinMgmt                         
                     2015-09-28 07:22:08                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 1 [(0 )(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43200)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 07:22:08                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 1 [(0 )(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43200)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 23:27:01                                  EventSystem                     
                     2015-09-28 23:27:01                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-09-28 23:27:03                                  Winlogon                        4101:  Windows .  
                     2015-09-28 23:27:03                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-09-28 23:27:06                                  WinMgmt                         
                     2015-09-28 23:27:07                                  WinMgmt                         
             1          2015-09-28 23:27:18                                  ESENT                           102: Windows (2496) Windows:   (6.01.7601.0000)    (0).  
             3          2015-09-28 23:27:18                                  ESENT                           300: Windows (2496) Windows:     .  
             3          2015-09-28 23:27:18                                  ESENT                           301: Windows (2496) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00119.log.  
             3          2015-09-28 23:27:18                                  ESENT                           301: Windows (2496) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0011A.log.  
             1          2015-09-28 23:27:19                                  Windows Search Service          1003:  Windows Search .   
             3          2015-09-28 23:27:19                                  ESENT                           301: Windows (2496) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-09-28 23:27:19                                  ESENT                           302: Windows (2496) Windows:    .  
                         2015-09-28 23:28:35                                  WinMgmt                         
                     2015-09-28 23:29:07                                  Software Protection Platform Service  900:      .    
                     2015-09-28 23:29:09                                  SecurityCenter                  1:     Windows .  
                     2015-09-28 23:29:09                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-09-28 23:29:09                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-28 23:29:09                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-09-28 23:31:12                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-09-28 23:31:12                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-09-28 23:34:09                                  Software Protection Platform Service  903:     .    
                     2015-09-28 23:40:36                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-09-28 23:40:36                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-09-28 23:40:37                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-09-29 18:58:48                                  EventSystem                     
                     2015-09-29 18:58:48                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-09-29 18:58:52                                  Winlogon                        4101:  Windows .  
                     2015-09-29 18:58:52                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-09-29 18:58:54                                  WinMgmt                         
                     2015-09-29 18:58:54                                  WinMgmt                         
             1          2015-09-29 18:59:02                                  ESENT                           102: Windows (2296) Windows:   (6.01.7601.0000)    (0).  
             1          2015-09-29 18:59:02                                  Windows Search Service          1003:  Windows Search .   
             3          2015-09-29 18:59:02                                  ESENT                           300: Windows (2296) Windows:     .  
             3          2015-09-29 18:59:02                                  ESENT                           301: Windows (2296) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-09-29 18:59:02                                  ESENT                           302: Windows (2296) Windows:    .  
                         2015-09-29 19:00:29                                  WinMgmt                         
                     2015-09-29 19:00:55                                  Software Protection Platform Service  900:      .    
                     2015-09-29 19:00:56                                  SecurityCenter                  1:     Windows .  
                     2015-09-29 19:00:56                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-09-29 19:00:57                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-29 19:00:57                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-09-29 19:03:01                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-09-29 19:03:01                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-09-29 19:05:57                                  Software Protection Platform Service  903:     .    
                     2015-09-29 19:26:25                                  VSS                             8224:  VSS  - - .    
                     2015-09-29 19:31:54                                  VSS                             8224:  VSS  - - .    
                     2015-09-29 19:36:40                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-09-29 19:36:40                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-09-29 20:31:52  sima                            Microsoft-Windows-RestartManager  10000:   1 - 2015-09-29T11:31:52.348632800Z.  
                     2015-09-29 20:32:17  sima                            Microsoft-Windows-RestartManager  10001:   1,  2015-09-29T11:31:52.348632800Z.  
                     2015-09-29 20:35:24                                  Microsoft-Windows-CAPI2         4097:      :: : <CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US>;  SHA1: <0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43>.  
                     2015-09-29 20:46:09                                  Outlook                         30:    C:\Users\sima\AppData\Local\Microsoft\Outlook\aofso.pst   : The store was last opened on a different machine.  
                     2015-09-29 20:46:09                                  Outlook                         30:    C:\Users\sima\AppData\Local\Microsoft\Outlook\aofso.pst   : The store was last opened on a different machine.  
                     2015-09-29 20:46:18                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-09-29 20:46:19                                  Outlook                         31:   C:\Users\sima\AppData\Local\Microsoft\Outlook\aofso.pst   .  
                     2015-09-29 20:46:19                                  Outlook                         29:     C:\Users\sima\AppData\Local\Microsoft\Outlook\aofso.pst     : Index reset (or catalog signature changed), re-push entire store.  
                     2015-09-29 20:46:19                                  Outlook                         45: Outlook   :   :  Microsoft VBA  Outlook :  ProgID: Microsoft.VbaAddinForOutlook.1 GUID: {799ED9EA-FB5E-11D1-B7D6-00C04FC2AAE2}   : 09 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\ADDINS\OUTLVBA.DLL   (): 47  :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 47  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 281  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 32  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 15  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 32  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 31   
                     2015-09-29 20:46:21                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-09-29 20:46:21                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-09-29 20:46:21                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 40615)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-29 20:46:22                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 40615)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-29 20:51:22                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 0  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 47  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 0  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 16  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 0  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 0   
                     2015-09-29 20:51:22                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 40610)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-29 20:51:23                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 40610)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-29 20:54:52                                  Outlook                         30:    D:\from C\doc\local\Outlook\aofso.pst   : The store was last opened on a different machine.  
                     2015-09-29 20:54:53                                  Outlook                         30:    D:\from C\doc\local\Outlook\aofso.pst   : The store was last opened on a different machine.  
                     2015-09-29 20:54:53                                  Outlook                         31:   D:\from C\doc\local\Outlook\aofso.pst   .  
                     2015-09-29 20:55:03                                  Outlook                         38:     : D:\from C\doc\local\Outlook\aofso.pst. : Added: 756, Deleted: 0, Modified: 0, Compared: 773, Version: 14.0.4760.1000.  
                     2015-09-29 20:57:12                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 0  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 15  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 0  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 0  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 16  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 0   
                     2015-09-29 20:57:12                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 40604)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-29 20:57:13                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 40604)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-29 21:00:38                                  Outlook                         30:    D:\from C\doc\local\Outlook\aofso.pst   : The store was last opened on a different machine.  
                     2015-09-29 21:00:40                                  Outlook                         38:     : D:\from C\doc\local\Outlook\aofso.pst. : Added: 562, Deleted: 0, Modified: 1, Compared: 803, Version: 14.0.4760.1000.  
                     2015-09-29 21:04:33                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 16  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 0  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 16  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 0  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 0  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 0   
                     2015-09-29 21:04:33                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 40597)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-29 21:04:34                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 40597)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-29 21:09:40                                  Outlook                         29:     C:\Users\sima\Documents\aofso.pst     : Newly created store.  
                     2015-09-29 21:09:44                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 16  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 0  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 0  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 16  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 0  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 0   
                     2015-09-29 21:09:44                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 40592)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                       2015-09-29 21:09:44                                  Outlook                         27: Calendar Folder Created  
                     2015-09-29 21:09:45                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 40592)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-29 21:09:46                                  Outlook                         31:   C:\Users\sima\Documents\aofso.pst   .  
                     2015-09-29 21:09:46                                  Outlook                         29:     C:\Users\sima\Documents\aofso.pst     : MAPI Start Page scope version changed.  
                     2015-09-29 21:09:46                                  Outlook                         29:     C:\Users\sima\Documents\aofso.pst     : Index reset (or catalog signature changed), re-push entire store.  
                     2015-09-29 21:10:30                                  Outlook                         30:    D:\from C\doc\local\Outlook\aofso.pst   : The store was last opened on a different machine.  
                     2015-09-29 21:10:33                                  Outlook                         38:     : D:\from C\doc\local\Outlook\aofso.pst. : Added: 537, Deleted: 0, Modified: 0, Compared: 807, Version: 14.0.4760.1000.  
                     2015-09-29 22:27:14                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-09-29 22:27:14                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-09-29 22:27:15                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-09-30 11:08:49                                  EventSystem                     
                     2015-09-30 11:08:49                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-09-30 11:08:50                                  Winlogon                        4101:  Windows .  
                     2015-09-30 11:08:50                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-09-30 11:08:52                                  WinMgmt                         
                     2015-09-30 11:08:52                                  WinMgmt                         
             1          2015-09-30 11:09:00                                  ESENT                           102: Windows (2364) Windows:   (6.01.7601.0000)    (0).  
             3          2015-09-30 11:09:00                                  ESENT                           300: Windows (2364) Windows:     .  
             3          2015-09-30 11:09:00                                  ESENT                           301: Windows (2364) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0015D.log.  
             3          2015-09-30 11:09:00                                  ESENT                           301: Windows (2364) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             1          2015-09-30 11:09:01                                  Windows Search Service          1003:  Windows Search .   
             3          2015-09-30 11:09:01                                  ESENT                           302: Windows (2364) Windows:    .  
                         2015-09-30 11:10:32                                  WinMgmt                         
                     2015-09-30 11:10:53                                  Software Protection Platform Service  900:      .    
                     2015-09-30 11:10:53                                  SecurityCenter                  1:     Windows .  
                     2015-09-30 11:10:54                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-09-30 11:10:54                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-09-30 11:10:54                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-09-30 11:13:09                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-09-30 11:13:09                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-09-30 11:15:55                                  Software Protection Platform Service  903:     .    
                     2015-09-30 11:57:49                                  Microsoft-Windows-Defrag        258:           
                     2015-09-30 12:07:22                                  VSS                             8224:  VSS  - - .    
                     2015-09-30 12:14:58                                  Microsoft-Windows-Defrag        258:        MusicVideo (D:)  
                     2015-09-30 12:15:03                                  Microsoft-Windows-Defrag        258:          (G:)  
                     2015-09-30 12:37:44                                  Microsoft-Windows-Defrag        258:        (C:)  
                     2015-09-30 12:47:44                                  Microsoft-Windows-Defrag        258:        Tatyana (E:)  
                     2015-09-30 15:13:17                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-09-30 15:13:17                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-09-30 15:13:18                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-01 23:14:03                                  EventSystem                     
                     2015-10-01 23:14:03                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-01 23:14:04                                  Winlogon                        4101:  Windows .  
                     2015-10-01 23:14:04                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-01 23:14:05                                  WinMgmt                         
                     2015-10-01 23:14:06                                  WinMgmt                         
             1          2015-10-01 23:14:13                                  ESENT                           102: Windows (2324) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-01 23:14:13                                  ESENT                           300: Windows (2324) Windows:     .  
             3          2015-10-01 23:14:13                                  ESENT                           301: Windows (2324) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-01 23:14:13                                  ESENT                           302: Windows (2324) Windows:    .  
             1          2015-10-01 23:14:14                                  Windows Search Service          1003:  Windows Search .   
                         2015-10-01 23:15:47                                  WinMgmt                         
                     2015-10-01 23:16:07                                  Software Protection Platform Service  900:      .    
                     2015-10-01 23:16:08                                  SecurityCenter                  1:     Windows .  
                     2015-10-01 23:16:09                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-01 23:16:09                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-01 23:16:09                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-01 23:18:12                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-01 23:18:12                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-01 23:21:09                                  Software Protection Platform Service  903:     .    
                     2015-10-01 23:22:24                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-01 23:22:24                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-01 23:42:13                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-01 23:42:14                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 16  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 109  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 0  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 0  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 16  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 0   
                     2015-10-01 23:42:14                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-01 23:42:14                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-01 23:42:14                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 37559)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-01 23:42:15                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 37559)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-01 23:47:18  sima                            MsiInstaller                    11708: : Win7codecs --    .  
                     2015-10-01 23:47:18  sima                            MsiInstaller                    1033:  Windows   . : Win7codecs. : 2.1.0. : 1049. : .    : 1602.  
                     2015-10-01 23:47:57  sima                            MsiInstaller                    1040:    Windows: C:\ProgramData\Win7codecs\{BCF65A28-F742-41A4-BFCE-2E02513DA5D2}\Win7codecs.msi.   : 1152.  
                     2015-10-01 23:48:11                                  System Restore                  8194:     ( = C:\Windows\system32\msiexec.exe /V;  = Installed Win7codecs.).  
                     2015-10-01 23:48:12  sima                            Microsoft-Windows-RestartManager  10000:   0 - 2015-10-01T14:48:12.015625000Z.  
                     2015-10-01 23:48:24  sima                            Microsoft-Windows-RestartManager  10001:   0,  2015-10-01T14:48:12.015625000Z.  
                     2015-10-01 23:48:24                           MsiInstaller                    1042:    Windows: C:\ProgramData\Win7codecs\{BCF65A28-F742-41A4-BFCE-2E02513DA5D2}\Win7codecs.msi.   : 1152.  
                     2015-10-01 23:48:30  sima                            MsiInstaller                    11707: : Win7codecs --    .  
                     2015-10-01 23:48:30  sima                            MsiInstaller                    1033:  Windows   . : Win7codecs. : 1.2.1. : 1049. : .    : 0.  
                     2015-10-01 23:51:17                                  VSS                             8224:  VSS  - - .    
                     2015-10-02 00:08:24  sima                            MsiInstaller                    1040:    Windows: C:\Program Files\MSECache\OlkConnector\olc.msi.   : 3724.  
                     2015-10-02 00:08:31                                  System Restore                  8194:     ( = C:\Windows\system32\msiexec.exe /V;  = : Microsoft Office Outlook Connector).  
                     2015-10-02 00:08:31  sima                            Microsoft-Windows-RestartManager  10000:   0 - 2015-10-01T15:08:31.523437500Z.  
             1          2015-10-02 00:08:40                                  ESENT                           103: Windows (2324) Windows:    (0).  
             1          2015-10-02 00:08:40                                  Windows Search Service          1013:  Windows Search  .   
             1          2015-10-02 00:08:41                                  ESENT                           102: Windows (3512) Windows:   (6.01.7601.0000)    (0).  
                     2015-10-02 00:08:42  sima                            Microsoft-Windows-RestartManager  10001:   0,  2015-10-01T15:08:31.523437500Z.  
                     2015-10-02 00:08:42                           MsiInstaller                    1042:    Windows: C:\Program Files\MSECache\OlkConnector\olc.msi.   : 3724.  
             1          2015-10-02 00:08:42                                  Windows Search Service          1003:  Windows Search .   
                     2015-10-02 00:09:08  sima                            MsiInstaller                    11707: : Microsoft Office Outlook Connector --   .  
                     2015-10-02 00:09:08  sima                            MsiInstaller                    1033:  Windows   . : Microsoft Office Outlook Connector. : 14.0.6123.5001. : 1049. : Microsoft Corporation.    : 0.  
                     2015-10-02 00:10:53                                  Outlook                         29:     C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook.ost     : Newly created store.  
                     2015-10-02 00:10:54                                  Outlook                         31:   C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook.ost   .  
                     2015-10-02 00:10:54                                  Outlook                         29:     C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook.ost     : MAPI Start Page scope version changed.  
                     2015-10-02 00:10:54                                  Outlook                         29:     C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook.ost     : Index reset (or catalog signature changed), re-push entire store.  
                     2015-10-02 00:10:54                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 37530)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-02 00:10:55                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 0  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 0  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 0  : COM Addin for Microsoft Outlook Hotmail Connector : COM Addin for Microsoft Outlook Hotmail Connector ProgID: MSNCON.Addin.1 GUID: {DC67367A-8B15-47BC-B7F8-0BA0435A504A}   : 03 HKLM: 1 : C:\PROGRA~1\COMMON~1\SYSTEM\MSMAPI\MSNCON32.DLL   (): 62  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 0  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 0  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 0   
                     2015-10-02 00:10:55                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 37530)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-02 00:11:37                                  VSS                             8224:  VSS  - - .    
                     2015-10-02 00:14:24                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 0  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 15  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 0  : COM Addin for Microsoft Outlook Hotmail Connector : COM Addin for Microsoft Outlook Hotmail Connector ProgID: MSNCON.Addin.1 GUID: {DC67367A-8B15-47BC-B7F8-0BA0435A504A}   : 03 HKLM: 1 : C:\PROGRA~1\COMMON~1\SYSTEM\MSMAPI\MSNCON32.DLL   (): 0  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 16  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 0  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 16   
                     2015-10-02 00:14:24                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 37527)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-02 00:14:25                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 37527)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-02 00:18:14                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 0  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 0  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 0  : COM Addin for Microsoft Outlook Hotmail Connector : COM Addin for Microsoft Outlook Hotmail Connector ProgID: MSNCON.Addin.1 GUID: {DC67367A-8B15-47BC-B7F8-0BA0435A504A}   : 03 HKLM: 1 : C:\PROGRA~1\COMMON~1\SYSTEM\MSMAPI\MSNCON32.DLL   (): 31  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 0  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 0  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 0   
                     2015-10-02 00:18:14                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 37523)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-02 00:18:15                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 37523)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-02 00:22:04                                  Outlook                         29:     C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook0.ost     : Newly created store.  
                     2015-10-02 00:22:05                                  Outlook                         31:   C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook0.ost   .  
                     2015-10-02 00:22:05                                  Outlook                         29:     C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook0.ost     : MAPI Start Page scope version changed.  
                     2015-10-02 00:22:05                                  Outlook                         29:     C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook0.ost     : Index reset (or catalog signature changed), re-push entire store.  
             1          2015-10-02 00:25:40                                  ESENT                           102: WinMail (2448) WindowsMail0:   (6.01.7601.0000)    (0).  
             3          2015-10-02 00:25:41                                  ESENT                           210: WinMail (2448) WindowsMail0:    .  
             3          2015-10-02 00:25:41                                  ESENT                           220: WinMail (2448) WindowsMail0:    C:\Users\sima\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore (: 2 Mb).  
             3          2015-10-02 00:25:41                                  ESENT                           221: WinMail (2448) WindowsMail0:    C:\Users\sima\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore.  
             3          2015-10-02 00:25:41                                  ESENT                           223: WinMail (2448) WindowsMail0:      (: C:\Users\sima\AppData\Local\Microsoft\Windows Mail\edb00002.log - C:\Users\sima\AppData\Local\Microsoft\Windows Mail\edb00002.log).   
             3          2015-10-02 00:25:41                                  ESENT                           224: WinMail (2448) WindowsMail0:      C:\Users\sima\AppData\Local\Microsoft\Windows Mail\edb00001.log  C:\Users\sima\AppData\Local\Microsoft\Windows Mail\edb00001.log.   
             3          2015-10-02 00:25:41                                  ESENT                           213: WinMail (2448) WindowsMail0:    .  
             1          2015-10-02 00:25:42                                  ESENT                           103: WinMail (2448) WindowsMail0:    (0).  
                     2015-10-02 00:27:39                                  Outlook                         30:    C:\Users\sima\AppData\Local\Microsoft\Outlook\aofso.pst   : The store was last opened on a different machine.  
                     2015-10-02 00:27:39                                  Outlook                         30:    C:\Users\sima\AppData\Local\Microsoft\Outlook\aofso.pst   : The store was last opened on a different machine.  
                     2015-10-02 00:27:42                                  Outlook                         38:     : C:\Users\sima\AppData\Local\Microsoft\Outlook\aofso.pst. : Added: 756, Deleted: 0, Modified: 0, Compared: 773, Version: 14.0.4760.1000.  
                     2015-10-02 00:29:40                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-02 00:29:40                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-02 00:29:42                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-03 22:30:13                                  EventSystem                     
                     2015-10-03 22:30:13                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-03 22:30:14                                  WinMgmt                         
                     2015-10-03 22:30:14                                  Winlogon                        4101:  Windows .  
                     2015-10-03 22:30:14                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-03 22:30:15                                  WinMgmt                         
             1          2015-10-03 22:30:23                                  ESENT                           102: Windows (2476) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-03 22:30:23                                  ESENT                           300: Windows (2476) Windows:     .  
             3          2015-10-03 22:30:23                                  ESENT                           301: Windows (2476) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0017C.log.  
             3          2015-10-03 22:30:24                                  ESENT                           301: Windows (2476) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0017D.log.  
             3          2015-10-03 22:30:24                                  ESENT                           301: Windows (2476) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-03 22:30:24                                  ESENT                           302: Windows (2476) Windows:    .  
             1          2015-10-03 22:30:25                                  Windows Search Service          1003:  Windows Search .   
                         2015-10-03 22:31:56                                  WinMgmt                         
                     2015-10-03 22:32:15                                  Software Protection Platform Service  900:      .    
                     2015-10-03 22:32:15                                  SecurityCenter                  1:     Windows .  
                     2015-10-03 22:32:16                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-03 22:32:17                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-03 22:32:17                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-03 22:34:22                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-03 22:34:22                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-03 22:37:17                                  Software Protection Platform Service  903:     .    
                     2015-10-03 22:54:55                                  Microsoft-Windows-Defrag        258:         (C:)  
                     2015-10-03 22:55:20                                  Microsoft-Windows-Defrag        258:           
                     2015-10-03 23:05:10                                  VSS                             8224:  VSS  - - .    
                     2015-10-03 23:10:28                                  Microsoft-Windows-Defrag        258:        MusicVideo (D:)  
                     2015-10-03 23:10:30                                  Microsoft-Windows-Defrag        258:          (G:)  
                     2015-10-03 23:13:57                                  Outlook                         30:    C:\Users\sima\Documents\aofso.pst   : Automatic Reconciliation.  
                     2015-10-03 23:13:58                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-03 23:13:58                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 16  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 62  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 0  : COM Addin for Microsoft Outlook Hotmail Connector : COM Addin for Microsoft Outlook Hotmail Connector ProgID: MSNCON.Addin.1 GUID: {DC67367A-8B15-47BC-B7F8-0BA0435A504A}   : 03 HKLM: 1 : C:\PROGRA~1\COMMON~1\SYSTEM\MSMAPI\MSNCON32.DLL   (): 0  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 0  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 0  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 16   
                     2015-10-03 23:13:58                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-03 23:13:58                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-03 23:13:59                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 34707)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-03 23:13:59                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 34707)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-03 23:14:22                                  Outlook                         38:     : C:\Users\sima\Documents\aofso.pst. : Added: 0, Deleted: 0, Modified: 0, Compared: 35, Version: 14.0.4760.1000.  
                     2015-10-04 01:14:33                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 34587)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-04 01:14:34                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 34587)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-04 01:39:58                                  Microsoft-Windows-CAPI2         4100:         <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/02FAF3E291435468607857694DF5E45B68851868.crt>.  
                     2015-10-04 01:39:58                                  Microsoft-Windows-CAPI2         4097:      :: : <CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE>;  SHA1: <02FAF3E291435468607857694DF5E45B68851868>.  
                     2015-10-04 01:39:58                                  Microsoft-Windows-CAPI2         4100:         <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/02FAF3E291435468607857694DF5E45B68851868.crt>.  
                     2015-10-04 02:01:27                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-04 02:01:27                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-04 02:01:28                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-04 13:34:16                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-04 13:34:17                                  EventSystem                     
                     2015-10-04 13:34:18                                  Winlogon                        4101:  Windows .  
                     2015-10-04 13:34:18                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-04 13:34:19                                  WinMgmt                         
                     2015-10-04 13:34:20                                  WinMgmt                         
             1          2015-10-04 13:34:27                                  ESENT                           102: Windows (2380) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-04 13:34:27                                  ESENT                           300: Windows (2380) Windows:     .  
             3          2015-10-04 13:34:27                                  ESENT                           301: Windows (2380) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001A2.log.  
             3          2015-10-04 13:34:28                                  ESENT                           301: Windows (2380) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-04 13:34:28                                  ESENT                           302: Windows (2380) Windows:    .  
             1          2015-10-04 13:34:29                                  Windows Search Service          1003:  Windows Search .   
                         2015-10-04 13:36:03                                  WinMgmt                         
                     2015-10-04 13:36:21                                  Software Protection Platform Service  900:      .    
                     2015-10-04 13:36:22                                  SecurityCenter                  1:     Windows .  
                     2015-10-04 13:36:23                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-04 13:36:23                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-04 13:36:23                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-04 13:37:45                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-04 13:37:45                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-04 13:37:45                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-04 13:37:45                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 33844)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-04 13:37:46                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 33844)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-04 13:38:27                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-04 13:38:28                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-04 13:41:23                                  Software Protection Platform Service  903:     .    
                     2015-10-04 14:13:03                                  VSS                             8224:  VSS  - - .    
                     2015-10-04 23:03:06                                  VSS                             8224:  VSS  - - .    
                     2015-10-04 23:39:50                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 0  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 93  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 0  : COM Addin for Microsoft Outlook Hotmail Connector : COM Addin for Microsoft Outlook Hotmail Connector ProgID: MSNCON.Addin.1 GUID: {DC67367A-8B15-47BC-B7F8-0BA0435A504A}   : 03 HKLM: 1 : C:\PROGRA~1\COMMON~1\SYSTEM\MSMAPI\MSNCON32.DLL   (): 47  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 0  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 16  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 16   
                     2015-10-04 23:39:50                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 33242)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-04 23:39:51                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 33242)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-04 23:40:43                                  Microsoft-Windows-CAPI2         4097:      :: : <CN=Class 2 Primary CA, O=Certplus, C=FR>;  SHA1: <74207441729CDD92EC7931D823108DC28192E2BB>.  
                     2015-10-04 23:40:53                                  Microsoft-Windows-CAPI2         4097:      :: : <CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US>;  SHA1: <5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25>.  
                     2015-10-04 23:45:35                                  Outlook                         30:    C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook0.ost   : Automatic Reconciliation.  
                     2015-10-04 23:45:42                                  Outlook                         38:     : C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook0.ost. : Added: 0, Deleted: 0, Modified: 0, Compared: 1323, Version: 14.0.4760.1000.  
                     2015-10-04 23:49:16                                  Microsoft-Windows-CAPI2         4097:      :: : <CN=GeoTrust Global CA, O=GeoTrust Inc., C=US>;  SHA1: <DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212>.  
                     2015-10-05 00:02:15                                  Outlook                         30:    C:\Users\sima\AppData\Local\Microsoft\Outlook\aofso.pst   : Automatic Reconciliation.  
                     2015-10-05 00:02:19                                  Outlook                         38:     : C:\Users\sima\AppData\Local\Microsoft\Outlook\aofso.pst. : Added: 0, Deleted: 0, Modified: 0, Compared: 787, Version: 14.0.4760.1000.  
                     2015-10-05 00:27:52                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-05 00:27:52                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-05 00:54:44                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 33167)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-05 00:54:45                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 33167)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-05 01:07:17                                  Winlogon                        4004:        .  
                     2015-10-05 01:07:27                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-05 01:07:27                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-05 01:07:28                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-05 08:16:27                                  EventSystem                     
                     2015-10-05 08:16:27                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-05 08:16:28                                  Winlogon                        4101:  Windows .  
                     2015-10-05 08:16:28                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-05 08:16:29                                  WinMgmt                         
                     2015-10-05 08:16:30                                  WinMgmt                         
             1          2015-10-05 08:16:39                                  ESENT                           102: Windows (2392) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-05 08:16:39                                  ESENT                           300: Windows (2392) Windows:     .  
             3          2015-10-05 08:16:39                                  ESENT                           301: Windows (2392) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-05 08:16:40                                  ESENT                           302: Windows (2392) Windows:    .  
             1          2015-10-05 08:16:41                                  Windows Search Service          1003:  Windows Search .   
                         2015-10-05 08:18:12                                  WinMgmt                         
                     2015-10-05 08:18:31                                  Software Protection Platform Service  900:      .    
                     2015-10-05 08:18:32                                  SecurityCenter                  1:     Windows .  
                     2015-10-05 08:18:33                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-05 08:18:33                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-05 08:18:33                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-05 08:20:36                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-05 08:20:36                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-05 08:23:33                                  Software Protection Platform Service  903:     .    
                         2015-10-05 08:34:34                                  SideBySide                      33:       "c:\my_programs\setup\driver\audio\xonar d1 audio center\Program\CmElv64.exe".      "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"".   sxstrace.exe   .  
                     2015-10-05 08:44:06                                  VSS                             8224:  VSS  - - .    
                     2015-10-05 08:49:30                                  VSS                             8224:  VSS  - - .    
                     2015-10-05 08:54:17                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-05 08:54:17                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-05 12:03:06                                  Windows Error Reporting         1001:   ,  0   : NetworkDiagnosticsFrameworkV3  :     CAB: 0     :  P1: Microsoft  P2: Dot3HelperClass [1.0]  P3: 2  P4: 0  P5: {00000000-0000-0000-0000-000000000000}  P6: Dot3HelperClass [1.0]  P7: {4DA030B8-86E5-4b6a-A879-2FFF8443B527}  P8: rt86win7.sys  P9: 7.2.1127.2008 13/07/2009  P10:      :  C:\Windows\System32\NDF\{FA459CD3-BBEA-45D2-9A44-901F1EBF2797}-WER-10052015-1203.etl        :  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Microsoft_b2de465acc5b3f187d73841861b62329b8dd8e_cab_04bbbbde     :     : 0   : 991b86b6-6b0d-11e5-9050-0019db4d6dee   : 6  
                     2015-10-05 12:03:06                                  Windows Error Reporting         1001:   ,  0   : NetworkDiagnosticsFrameworkV3  :     CAB: 0     :  P1: Microsoft  P2: Dot3HelperClass [1.0]  P3: 2  P4: 8008F906  P5: {07D37F7B-FA5E-4443-BDA7-AB107B29AFB9}  P6: AutoConfig Helper Class [1.0]  P7: {7452F6E5-11BC-4b8b-877B-8BC9EEE51DBF}  P8: rtwlanu.sys  P9: 1021.3.912.2012 19/06/2013  P10:      :  C:\Windows\System32\NDF\{FA459CD3-BBEA-45D2-9A44-901F1EBF2797}-WER-10052015-1203.etl        :  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Microsoft_6be4cfbd5979f84b5d628eda1643a8e8826956_cab_04bbbc7b     :     : 0   : 991b86b7-6b0d-11e5-9050-0019db4d6dee   : 6  
                     2015-10-05 12:14:58                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-05 12:14:59                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-05 12:14:59                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-05 12:14:59                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 32486)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-05 12:15:00                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 32486)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-05 17:36:23                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-05 17:36:23                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-05 17:36:24                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-07 07:26:18                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-07 07:26:19                                  EventSystem                     
                     2015-10-07 07:26:21                                  Winlogon                        4101:  Windows .  
                     2015-10-07 07:26:21                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-07 07:26:22                                  WinMgmt                         
                     2015-10-07 07:26:23                                  WinMgmt                         
             1          2015-10-07 07:26:30                                  ESENT                           102: Windows (2596) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-07 07:26:30                                  ESENT                           300: Windows (2596) Windows:     .  
             3          2015-10-07 07:26:30                                  ESENT                           301: Windows (2596) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             1          2015-10-07 07:26:31                                  Windows Search Service          1003:  Windows Search .   
             3          2015-10-07 07:26:31                                  ESENT                           302: Windows (2596) Windows:    .  
                     2015-10-07 07:27:19                                  Windows Error Reporting         1001:   ,  0   : PnPDriverNotFound  :     CAB: 0     :  P1: x86  P2: USB\VID_0421&PID_0661&REV_0100&MI_01  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :  C:\Users\sima\AppData\Local\Temp\DMI1F3B.tmp.log.xml        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_57448590ed1dd54dcd7291d31e98d431ea6ad_cab_0e152016     :     : 0   : 6703f85a-6c79-11e5-8fe4-0019db4d6dee   : 4  
                     2015-10-07 07:27:19                                  Windows Error Reporting         1001:   ,  0   : PnPDriverNotFound  :     CAB: 0     :  P1: x86  P2: USB\VID_0421&PID_0661&REV_0100&MI_02  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :  C:\Users\sima\AppData\Local\Temp\DMI2026.tmp.log.xml        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_e58e673b1c4c68b36399206f8dc612478c7468d_cab_0e152083     :     : 0   : 6703f85b-6c79-11e5-8fe4-0019db4d6dee   : 4  
                     2015-10-07 07:27:19                                  Windows Error Reporting         1001:   ,  0   : PnPDriverNotFound  :     CAB: 0     :  P1: x86  P2: USB\VID_0421&PID_0661&REV_0100&MI_03  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :  C:\Users\sima\AppData\Local\Temp\DMI20D3.tmp.log.xml        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_eb6df0d4125184bb2fe9619130cef4625ad14046_cab_0e15214e     :     : 0   : 6703f85c-6c79-11e5-8fe4-0019db4d6dee   : 4  
                     2015-10-07 07:27:30                                  Windows Error Reporting         1001:   ,  0   : PnPGenericDriverFound  :     CAB: 0     :  P1: x86  P2: USB\VID_0421&PID_0661&REV_0100&MI_00  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_bb323f1f3e7f3095796147286d13e8faee2d720_cab_0e154d5f     :     : 0   : 6e01e5ca-6c79-11e5-8fe4-0019db4d6dee   : 4  
                         2015-10-07 07:28:05                                  WinMgmt                         
                     2015-10-07 07:28:23                                  Software Protection Platform Service  900:      .    
                     2015-10-07 07:28:24                                  SecurityCenter                  1:     Windows .  
                     2015-10-07 07:28:25                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-07 07:28:25                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-07 07:28:25                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-07 07:30:30                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-07 07:30:30                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-07 07:33:25                                  Software Protection Platform Service  903:     .    
                     2015-10-07 07:36:33                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-07 07:36:33                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-07 07:36:33                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-07 07:36:34                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 29885)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-07 07:36:34                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 29885)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-07 07:48:05                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 15  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 94  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 0  : COM Addin for Microsoft Outlook Hotmail Connector : COM Addin for Microsoft Outlook Hotmail Connector ProgID: MSNCON.Addin.1 GUID: {DC67367A-8B15-47BC-B7F8-0BA0435A504A}   : 03 HKLM: 1 : C:\PROGRA~1\COMMON~1\SYSTEM\MSMAPI\MSNCON32.DLL   (): 16  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 0  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 0  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 0   
                     2015-10-07 07:48:05                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 29873)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-07 07:48:06                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 29873)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-07 07:49:17                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-07 07:49:17                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-07 07:49:18                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-07 10:25:49                                  EventSystem                     
                     2015-10-07 10:25:49                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-07 10:25:51                                  Winlogon                        4101:  Windows .  
                     2015-10-07 10:25:51                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-07 10:25:52                                  WinMgmt                         
                     2015-10-07 10:25:54                                  WinMgmt                         
             1          2015-10-07 10:26:00                                  ESENT                           102: Windows (2420) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-07 10:26:00                                  ESENT                           300: Windows (2420) Windows:     .  
             3          2015-10-07 10:26:00                                  ESENT                           301: Windows (2420) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001A3.log.  
             3          2015-10-07 10:26:01                                  ESENT                           301: Windows (2420) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-07 10:26:01                                  ESENT                           302: Windows (2420) Windows:    .  
             1          2015-10-07 10:26:02                                  Windows Search Service          1003:  Windows Search .   
                         2015-10-07 10:27:35                                  WinMgmt                         
                     2015-10-07 10:27:54                                  Software Protection Platform Service  900:      .    
                     2015-10-07 10:27:55                                  SecurityCenter                  1:     Windows .  
                     2015-10-07 10:27:56                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-07 10:27:56                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-07 10:27:56                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-07 10:30:00                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-07 10:30:00                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-07 10:32:56                                  Software Protection Platform Service  903:     .    
                     2015-10-07 11:12:30                                  Microsoft-Windows-Defrag        258:           
                     2015-10-07 11:13:39                                  Microsoft-Windows-Defrag        258:         (C:)  
                     2015-10-07 11:22:09                                  VSS                             8224:  VSS  - - .    
                     2015-10-07 11:27:50                                  Microsoft-Windows-Defrag        258:        MusicVideo (D:)  
                     2015-10-07 11:27:53                                  Microsoft-Windows-Defrag        258:          (G:)  
                     2015-10-07 12:59:25                                  Microsoft-Windows-Defrag        258:           
                     2015-10-07 13:07:00                                  Microsoft-Windows-Defrag        258:        MusicVideo (D:)  
                     2015-10-07 13:07:02                                  Microsoft-Windows-Defrag        258:          (G:)  
                     2015-10-07 13:46:11                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-07 13:46:11                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-07 13:46:12                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-08 07:34:51                                  EventSystem                     
                     2015-10-08 07:34:51                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-08 07:34:52                                  Winlogon                        4101:  Windows .  
                     2015-10-08 07:34:52                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-08 07:34:53                                  WinMgmt                         
                     2015-10-08 07:34:55                                  WinMgmt                         
             1          2015-10-08 07:35:01                                  ESENT                           102: Windows (2516) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-08 07:35:01                                  ESENT                           300: Windows (2516) Windows:     .  
             3          2015-10-08 07:35:01                                  ESENT                           301: Windows (2516) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-08 07:35:01                                  ESENT                           302: Windows (2516) Windows:    .  
             1          2015-10-08 07:35:02                                  Windows Search Service          1003:  Windows Search .   
                         2015-10-08 07:36:35                                  WinMgmt                         
                     2015-10-08 07:36:56                                  Software Protection Platform Service  900:      .    
                     2015-10-08 07:36:56                                  SecurityCenter                  1:     Windows .  
                     2015-10-08 07:36:57                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-08 07:36:57                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-08 07:36:57                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-08 07:39:06                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-08 07:39:06                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-08 07:41:57                                  Software Protection Platform Service  903:     .    
                     2015-10-08 07:59:53                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 15  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 78  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 0  : COM Addin for Microsoft Outlook Hotmail Connector : COM Addin for Microsoft Outlook Hotmail Connector ProgID: MSNCON.Addin.1 GUID: {DC67367A-8B15-47BC-B7F8-0BA0435A504A}   : 03 HKLM: 1 : C:\PROGRA~1\COMMON~1\SYSTEM\MSMAPI\MSNCON32.DLL   (): 0  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 0  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 16  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 0   
                     2015-10-08 07:59:53                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-08 07:59:53                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-08 07:59:53                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-08 07:59:54                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 28421)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-08 07:59:54                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 28421)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-08 08:01:15                                  Outlook                         51:          ,   (5 .). : msncon.dll :   MAPI : 35469   
                     2015-10-08 08:59:17                                  Microsoft-Windows-Defrag        258:           
                     2015-10-08 09:27:52                                  Microsoft-Windows-Defrag        258:           
                     2015-10-08 09:35:59                                  Microsoft-Windows-Defrag        258:        MusicVideo (D:)  
                     2015-10-08 09:36:01                                  Microsoft-Windows-Defrag        258:          (G:)  
                     2015-10-08 09:37:43                                  VSS                             8224:  VSS  - - .    
                     2015-10-08 10:06:02                                  Microsoft-Windows-Defrag        258:           
                     2015-10-08 10:13:44                                  Microsoft-Windows-Defrag        258:        MusicVideo (D:)  
                     2015-10-08 10:13:46                                  Microsoft-Windows-Defrag        258:          (G:)  
                     2015-10-08 10:27:19                                  Microsoft-Windows-Defrag        258:        (C:)  
                     2015-10-08 10:27:47                                  Microsoft-Windows-Defrag        258:        Tatyana (E:)  
                     2015-10-08 22:06:46                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-08 22:06:46                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-08 23:15:52                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-08 23:15:53                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-08 23:15:53                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-09 07:44:23                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-09 07:44:24                                  EventSystem                     
                     2015-10-09 07:44:25                                  Winlogon                        4101:  Windows .  
                     2015-10-09 07:44:25                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-09 07:44:26                                  WinMgmt                         
                     2015-10-09 07:44:28                                  WinMgmt                         
             1          2015-10-09 07:44:34                                  ESENT                           102: Windows (2620) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-09 07:44:34                                  ESENT                           300: Windows (2620) Windows:     .  
             3          2015-10-09 07:44:34                                  ESENT                           301: Windows (2620) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             1          2015-10-09 07:44:35                                  Windows Search Service          1003:  Windows Search .   
             3          2015-10-09 07:44:35                                  ESENT                           302: Windows (2620) Windows:    .  
                         2015-10-09 07:46:08                                  WinMgmt                         
                     2015-10-09 07:46:28                                  Software Protection Platform Service  900:      .    
                     2015-10-09 07:46:29                                  SecurityCenter                  1:     Windows .  
                     2015-10-09 07:46:30                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-09 07:46:30                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-09 07:46:30                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-09 07:48:42                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-09 07:48:42                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-09 07:51:30                                  Software Protection Platform Service  903:     .    
                     2015-10-09 09:02:03                                  System Restore                  8194:     ( = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation;  =   ).  
                     2015-10-09 09:02:03                                  System Restore                  8212:       .  
                     2015-10-09 09:05:03                                  VSS                             8224:  VSS  - - .    
                     2015-10-10 00:16:16                                  Desktop Window Manager          9010:  (2780)          
                     2015-10-10 00:16:16                                  Desktop Window Manager          9013:       ,          
                     2015-10-10 00:20:25                                  Desktop Window Manager          9010:  (2780)          
                     2015-10-10 00:20:25                                  Desktop Window Manager          9013:       ,          
                     2015-10-10 00:40:16                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-10 00:40:16                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-10 00:40:17                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-10 09:16:38                                  EventSystem                     
                     2015-10-10 09:16:38                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-10 09:16:39                                  Winlogon                        4101:  Windows .  
                     2015-10-10 09:16:39                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-10 09:16:40                                  WinMgmt                         
                     2015-10-10 09:16:40                                  WinMgmt                         
             1          2015-10-10 09:16:45                                  ESENT                           102: Windows (2520) Windows:   (6.01.7601.0000)    (0).  
             1          2015-10-10 09:16:46                                  Windows Search Service          1003:  Windows Search .   
             3          2015-10-10 09:16:46                                  ESENT                           300: Windows (2520) Windows:     .  
             3          2015-10-10 09:16:46                                  ESENT                           301: Windows (2520) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-10 09:16:46                                  ESENT                           302: Windows (2520) Windows:    .  
                         2015-10-10 09:18:21                                  WinMgmt                         
                     2015-10-10 09:18:42                                  Software Protection Platform Service  900:      .    
                     2015-10-10 09:18:43                                  SecurityCenter                  1:     Windows .  
                     2015-10-10 09:18:44                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-10 09:18:44                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-10 09:18:44                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-10 09:20:42                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-10 09:20:42                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-10 09:21:44                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-10 09:21:44                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-10 09:21:46                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-11 08:57:07                                  EventSystem                     
                     2015-10-11 08:57:07                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-11 08:57:09                                  Winlogon                        4101:  Windows .  
                     2015-10-11 08:57:09                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-11 08:57:11                                  WinMgmt                         
                     2015-10-11 08:57:13                                  WinMgmt                         
             1          2015-10-11 08:57:18                                  ESENT                           102: Windows (2416) Windows:   (6.01.7601.0000)    (0).  
             1          2015-10-11 08:57:18                                  Windows Search Service          1003:  Windows Search .   
             3          2015-10-11 08:57:18                                  ESENT                           300: Windows (2416) Windows:     .  
             3          2015-10-11 08:57:18                                  ESENT                           301: Windows (2416) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-11 08:57:18                                  ESENT                           302: Windows (2416) Windows:    .  
                         2015-10-11 08:58:54                                  WinMgmt                         
                     2015-10-11 08:59:14                                  Software Protection Platform Service  900:      .    
                     2015-10-11 08:59:15                                  SecurityCenter                  1:     Windows .  
                     2015-10-11 08:59:16                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-11 08:59:16                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-11 08:59:16                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-11 09:01:29                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-11 09:01:30                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-11 09:01:48                                  Windows Error Reporting         1001:   ,  0   : NetworkDiagnosticsFrameworkV3  :     CAB: 0     :  P1: Microsoft  P2: Dot3HelperClass [1.0]  P3: 2  P4: 0  P5: {00000000-0000-0000-0000-000000000000}  P6: Dot3HelperClass [1.0]  P7: {4DA030B8-86E5-4b6a-A879-2FFF8443B527}  P8: rt86win7.sys  P9: 7.2.1127.2008 13/07/2009  P10:      :        :  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Microsoft_b2de465acc5b3f187d73841861b62329b8dd8e_046880d5     :     : 0   : 43cd1fbe-6fab-11e5-87d1-0019db4d6dee   : 6  
                     2015-10-11 09:01:48                                  Windows Error Reporting         1001:   ,  0   : NetworkDiagnosticsFrameworkV3  :     CAB: 0     :  P1: Microsoft  P2: Dot3HelperClass [1.0]  P3: 2  P4: 8008F906  P5: {07D37F7B-FA5E-4443-BDA7-AB107B29AFB9}  P6: AutoConfig Helper Class [1.0]  P7: {7452F6E5-11BC-4b8b-877B-8BC9EEE51DBF}  P8: rtwlanu.sys  P9: 1021.3.912.2012 19/06/2013  P10:      :        :  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Microsoft_6be4cfbd5979f84b5d628eda1643a8e8826956_04688171     :     : 0   : 43cd1fbf-6fab-11e5-87d1-0019db4d6dee   : 6  
                     2015-10-11 09:04:04                                  Software Protection Platform Service  903:     .    
                     2015-10-11 09:42:29                                  Microsoft-Windows-Defrag        258:         (C:)  
                     2015-10-11 09:54:09                                  VSS                             8224:  VSS  - - .    
                     2015-10-11 12:26:50                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-11 12:26:50                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-11 12:27:13                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-11 12:27:13                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-11 12:27:14                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-12 13:29:42                                  EventSystem                     
                     2015-10-12 13:29:42                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-12 13:29:43                                  Winlogon                        4101:  Windows .  
                     2015-10-12 13:29:43                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-12 13:29:45                                  WinMgmt                         
                     2015-10-12 13:29:48                                  WinMgmt                         
             1          2015-10-12 13:29:53                                  ESENT                           102: Windows (2400) Windows:   (6.01.7601.0000)    (0).  
             1          2015-10-12 13:29:53                                  Windows Search Service          1003:  Windows Search .   
             3          2015-10-12 13:29:53                                  ESENT                           300: Windows (2400) Windows:     .  
             3          2015-10-12 13:29:53                                  ESENT                           301: Windows (2400) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-12 13:29:53                                  ESENT                           302: Windows (2400) Windows:    .  
                         2015-10-12 13:31:29                                  WinMgmt                         
                     2015-10-12 13:31:51                                  Software Protection Platform Service  900:      .    
                     2015-10-12 13:31:53                                  SecurityCenter                  1:     Windows .  
                     2015-10-12 13:31:54                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-12 13:31:54                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-12 13:31:54                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-12 13:33:56                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-12 13:33:56                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-12 13:36:54                                  Software Protection Platform Service  903:     .    
                     2015-10-12 14:17:39                                  VSS                             8224:  VSS  - - .    
                     2015-10-12 22:02:13                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-12 22:02:13                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-12 22:14:26                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 15  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 47  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 0  : COM Addin for Microsoft Outlook Hotmail Connector : COM Addin for Microsoft Outlook Hotmail Connector ProgID: MSNCON.Addin.1 GUID: {DC67367A-8B15-47BC-B7F8-0BA0435A504A}   : 03 HKLM: 1 : C:\PROGRA~1\COMMON~1\SYSTEM\MSMAPI\MSNCON32.DLL   (): 0  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 16  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 0  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 0   
                     2015-10-12 22:14:26                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-12 22:14:26                                  Outlook                         30:    C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook0.ost   : Automatic Reconciliation.  
                     2015-10-12 22:14:26                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-12 22:14:26                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-12 22:14:27                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 21807)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-12 22:14:27                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 21807)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-12 22:14:34                                  Outlook                         38:     : C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook0.ost. : Added: 0, Deleted: 0, Modified: 0, Compared: 1322, Version: 14.0.4760.1000.  
                     2015-10-12 22:14:38                                  Outlook                         30:    C:\Users\sima\AppData\Local\Microsoft\Outlook\aofso.pst   : Automatic Reconciliation.  
                     2015-10-12 22:14:42                                  Outlook                         38:     : C:\Users\sima\AppData\Local\Microsoft\Outlook\aofso.pst. : Added: 0, Deleted: 0, Modified: 0, Compared: 792, Version: 14.0.4760.1000.  
                     2015-10-12 23:32:29                                  Windows Error Reporting         1001:   ,  0   : PnPDriverNotFound  :     CAB: 0     :  P1: x86  P2: USB\VID_0421&PID_066E&REV_0011  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :  C:\Users\sima\AppData\Local\Temp\DMI111A.tmp.log.xml        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_c9a6673a80476a99882c74d1e535ed4d56cf29c6_cab_0ba01187     :     : 0   : 10923b75-70ee-11e5-bdcc-0019db4d6dee   : 4  
                     2015-10-12 23:50:12                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 21711)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-12 23:50:13                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 21711)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-13 00:15:05                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 21686)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-13 00:15:05                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 21686)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-13 00:15:10                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 21686)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-13 00:15:11                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 21686)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-13 00:32:58                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-13 00:32:58                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-13 00:32:59                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-13 18:51:38                                  EventSystem                     
                     2015-10-13 18:51:38                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-13 18:51:40                                  Winlogon                        4101:  Windows .  
                     2015-10-13 18:51:40                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-13 18:51:42                                  WinMgmt                         
                     2015-10-13 18:51:44                                  WinMgmt                         
             1          2015-10-13 18:51:51                                  ESENT                           102: Windows (2476) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-13 18:51:51                                  ESENT                           300: Windows (2476) Windows:     .  
             3          2015-10-13 18:51:51                                  ESENT                           301: Windows (2476) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001A4.log.  
             3          2015-10-13 18:51:51                                  ESENT                           301: Windows (2476) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001A5.log.  
             3          2015-10-13 18:51:52                                  ESENT                           301: Windows (2476) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-13 18:51:52                                  ESENT                           302: Windows (2476) Windows:    .  
             1          2015-10-13 18:51:53                                  Windows Search Service          1003:  Windows Search .   
                         2015-10-13 18:53:20                                  WinMgmt                         
                     2015-10-13 18:53:45                                  Software Protection Platform Service  900:      .    
                     2015-10-13 18:53:46                                  SecurityCenter                  1:     Windows .  
                     2015-10-13 18:53:47                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-13 18:53:47                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-13 18:53:47                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-13 18:55:49                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-13 18:55:49                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-13 18:58:20                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-13 18:58:20                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-13 18:58:47                                  Software Protection Platform Service  903:     .    
                     2015-10-13 19:24:59                                  VSS                             8224:  VSS  - - .    
                     2015-10-13 22:13:44                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-13 22:13:44                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 15  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 31  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 0  : COM Addin for Microsoft Outlook Hotmail Connector : COM Addin for Microsoft Outlook Hotmail Connector ProgID: MSNCON.Addin.1 GUID: {DC67367A-8B15-47BC-B7F8-0BA0435A504A}   : 03 HKLM: 1 : C:\PROGRA~1\COMMON~1\SYSTEM\MSMAPI\MSNCON32.DLL   (): 0  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 16  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 0  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 0   
                     2015-10-13 22:13:45                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-13 22:13:45                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-13 22:13:45                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 20368)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-13 22:13:46                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 20368)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-13 22:30:00                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 20351)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-13 22:30:01                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 20351)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-13 22:56:57                                  Microsoft-Windows-CAPI2         4097:      :: : <OU=Equifax Secure Certificate Authority, O=Equifax, C=US>;  SHA1: <D23209AD23D314232174E40D7F9D62139786633A>.  
                     2015-10-13 23:37:48                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 20284)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-13 23:37:49                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 20284)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-13 23:48:21                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 20273)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-13 23:48:22                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 20273)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-13 23:50:05                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 20271)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-13 23:50:05                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 20271)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-13 23:50:26                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 20271)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-13 23:50:27                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 20271)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-13 23:53:04                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 20268)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-13 23:53:05                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 20268)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-14 00:33:12                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-14 00:33:13                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-14 00:33:13                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-14 10:18:46                                  EventSystem                     
                     2015-10-14 10:18:46                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-14 10:18:48                                  Winlogon                        4101:  Windows .  
                     2015-10-14 10:18:48                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-14 10:18:51                                  WinMgmt                         
                     2015-10-14 10:18:53                                  WinMgmt                         
             1          2015-10-14 10:18:59                                  ESENT                           102: Windows (2632) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-14 10:18:59                                  ESENT                           300: Windows (2632) Windows:     .  
             3          2015-10-14 10:18:59                                  ESENT                           301: Windows (2632) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001A6.log.  
             3          2015-10-14 10:19:01                                  ESENT                           301: Windows (2632) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-14 10:19:01                                  ESENT                           302: Windows (2632) Windows:    .  
             1          2015-10-14 10:19:02                                  Windows Search Service          1003:  Windows Search .   
                     2015-10-14 10:19:31                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-14 10:19:31                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-14 10:19:32                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-14 10:20:46                                  EventSystem                     
                     2015-10-14 10:20:46                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-14 10:20:48                                  Winlogon                        4101:  Windows .  
                     2015-10-14 10:20:48                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-14 10:20:51                                  WinMgmt                         
                     2015-10-14 10:20:53                                  WinMgmt                         
             1          2015-10-14 10:20:59                                  ESENT                           102: Windows (2752) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-14 10:20:59                                  ESENT                           300: Windows (2752) Windows:     .  
             3          2015-10-14 10:20:59                                  ESENT                           301: Windows (2752) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             1          2015-10-14 10:21:00                                  Windows Search Service          1003:  Windows Search .   
             3          2015-10-14 10:21:00                                  ESENT                           302: Windows (2752) Windows:    .  
                     2015-10-14 10:21:19                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-14 10:21:20                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-14 10:21:20                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-14 10:21:20                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 19640)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-14 10:21:21                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 19640)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                         2015-10-14 10:22:34                                  WinMgmt                         
                     2015-10-14 10:22:53                                  Software Protection Platform Service  900:      .    
                     2015-10-14 10:22:55                                  SecurityCenter                  1:     Windows .  
                     2015-10-14 10:22:55                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-14 10:22:55                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-14 10:22:55                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-14 10:24:58                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-14 10:24:58                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-14 10:27:55                                  Software Protection Platform Service  903:     .    
                     2015-10-14 11:18:41                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 19583)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-14 11:18:42                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 19583)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-14 13:13:40                                  Microsoft-Windows-Defrag        258:         (C:)  
                     2015-10-14 13:14:22                                  Microsoft-Windows-Defrag        258:           
                     2015-10-14 13:24:01                                  VSS                             8224:  VSS  - - .    
                     2015-10-14 13:30:25                                  Microsoft-Windows-Defrag        258:        MusicVideo (D:)  
                     2015-10-14 13:30:29                                  Microsoft-Windows-Defrag        258:          (G:)  
                     2015-10-14 13:46:58                                  Microsoft-Windows-Defrag        258:        (C:)  
                     2015-10-14 13:55:16                                  Microsoft-Windows-Defrag        258:        Tatyana (E:)  
                     2015-10-14 17:21:08                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-14 17:21:08                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-15 01:34:16                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-15 01:34:16                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-15 01:34:17                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-15 07:32:21                                  EventSystem                     
                     2015-10-15 07:32:21                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-15 07:32:23                                  Winlogon                        4101:  Windows .  
                     2015-10-15 07:32:23                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-15 07:32:24                                  WinMgmt                         
                     2015-10-15 07:32:26                                  WinMgmt                         
             1          2015-10-15 07:32:33                                  ESENT                           102: Windows (2540) Windows:   (6.01.7601.0000)    (0).  
             1          2015-10-15 07:32:33                                  Windows Search Service          1003:  Windows Search .   
             3          2015-10-15 07:32:33                                  ESENT                           300: Windows (2540) Windows:     .  
             3          2015-10-15 07:32:33                                  ESENT                           301: Windows (2540) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-15 07:32:33                                  ESENT                           302: Windows (2540) Windows:    .  
                         2015-10-15 07:34:08                                  WinMgmt                         
                     2015-10-15 07:34:27                                  Software Protection Platform Service  900:      .    
                     2015-10-15 07:34:28                                  SecurityCenter                  1:     Windows .  
                     2015-10-15 07:34:28                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-15 07:34:28                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-15 07:34:28                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-15 07:36:46                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-15 07:36:46                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-15 07:39:28                                  Software Protection Platform Service  903:     .    
                     2015-10-15 07:55:50                                  Microsoft-Windows-Defrag        258:           
                     2015-10-15 08:05:24                                  VSS                             8224:  VSS  - - .    
                     2015-10-15 08:11:10                                  Microsoft-Windows-Defrag        258:        MusicVideo (D:)  
                     2015-10-15 08:11:13                                  Microsoft-Windows-Defrag        258:          (G:)  
                     2015-10-15 08:28:07                                  Microsoft-Windows-Defrag        258:        (C:)  
                     2015-10-15 08:28:30                                  Microsoft-Windows-Defrag        258:        Tatyana (E:)  
                     2015-10-15 10:05:58                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-15 10:05:59                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-15 10:05:59                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-18 21:41:31                                  EventSystem                     
                     2015-10-18 21:41:31                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-18 21:41:33                                  Winlogon                        4101:  Windows .  
                     2015-10-18 21:41:33                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-18 21:41:39                                  WinMgmt                         
                     2015-10-18 21:41:39                                  WinMgmt                         
             1          2015-10-18 21:41:45                                  ESENT                           102: Windows (2868) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-18 21:41:45                                  ESENT                           300: Windows (2868) Windows:     .  
             3          2015-10-18 21:41:45                                  ESENT                           301: Windows (2868) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             1          2015-10-18 21:41:46                                  Windows Search Service          1003:  Windows Search .   
             3          2015-10-18 21:41:46                                  ESENT                           302: Windows (2868) Windows:    .  
                         2015-10-18 21:43:18                                  WinMgmt                         
                     2015-10-18 21:43:24                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-18 21:43:25                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-18 21:43:41                                  Software Protection Platform Service  900:      .    
                     2015-10-18 21:43:42                                  SecurityCenter                  1:     Windows .  
                     2015-10-18 21:43:42                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-18 21:43:42                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-18 21:43:42                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-18 21:45:49                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-18 21:45:49                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-18 21:46:56                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-18 21:46:56                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-18 21:48:42                                  Software Protection Platform Service  903:     .    
                     2015-10-18 22:03:04                                  Microsoft-Windows-Defrag        258:         (C:)  
                     2015-10-18 22:11:42                                  System Restore                  8194:     ( = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation;  =   ).  
                     2015-10-18 22:11:42                                  System Restore                  8212:       .  
                     2015-10-18 22:14:43                                  VSS                             8224:  VSS  - - .    
                     2015-10-18 23:31:08                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-18 23:31:08                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-18 23:31:09                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-19 17:23:04                                  EventSystem                     
                     2015-10-19 17:23:04                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-19 17:23:05                                  Winlogon                        4101:  Windows .  
                     2015-10-19 17:23:05                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-19 17:23:05                                  WinMgmt                         
                     2015-10-19 17:23:06                                  WinMgmt                         
             1          2015-10-19 17:23:12                                  ESENT                           102: Windows (2664) Windows:   (6.01.7601.0000)    (0).  
             1          2015-10-19 17:23:12                                  Windows Search Service          1003:  Windows Search .   
             3          2015-10-19 17:23:12                                  ESENT                           300: Windows (2664) Windows:     .  
             3          2015-10-19 17:23:12                                  ESENT                           301: Windows (2664) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-19 17:23:12                                  ESENT                           302: Windows (2664) Windows:    .  
                         2015-10-19 17:24:48                                  WinMgmt                         
                     2015-10-19 17:25:06                                  Software Protection Platform Service  900:      .    
                     2015-10-19 17:25:07                                  SecurityCenter                  1:     Windows .  
                     2015-10-19 17:25:08                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-19 17:25:08                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-19 17:25:08                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-19 17:27:12                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-19 17:27:12                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-19 17:30:08                                  Software Protection Platform Service  903:     .    
                     2015-10-19 17:52:59                                  VSS                             8224:  VSS  - - .    
                     2015-10-19 17:56:06                                  VSS                             8224:  VSS  - - .    
                     2015-10-19 23:16:18                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-19 23:16:18                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-19 23:16:19                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-20 07:00:27                                  EventSystem                     
                     2015-10-20 07:00:27                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-20 07:00:29                                  Winlogon                        4101:  Windows .  
                     2015-10-20 07:00:29                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-20 07:00:31                                  WinMgmt                         
                     2015-10-20 07:00:33                                  WinMgmt                         
             1          2015-10-20 07:00:38                                  ESENT                           102: Windows (2420) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-20 07:00:38                                  ESENT                           300: Windows (2420) Windows:     .  
             3          2015-10-20 07:00:38                                  ESENT                           301: Windows (2420) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-20 07:00:38                                  ESENT                           302: Windows (2420) Windows:    .  
             1          2015-10-20 07:00:39                                  Windows Search Service          1003:  Windows Search .   
                         2015-10-20 07:02:14                                  WinMgmt                         
                     2015-10-20 07:02:35                                  Software Protection Platform Service  900:      .    
                     2015-10-20 07:02:36                                  SecurityCenter                  1:     Windows .  
                     2015-10-20 07:02:37                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-20 07:02:37                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-20 07:02:37                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-20 07:04:38                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-20 07:04:38                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-20 07:07:37                                  Software Protection Platform Service  903:     .    
                     2015-10-20 08:02:08                                  VSS                             8224:  VSS  - - .    
                     2015-10-20 22:31:12                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-20 22:31:12                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-20 22:31:13                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-21 07:42:56                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-21 07:42:57                                  EventSystem                     
                     2015-10-21 07:42:57                                  Winlogon                        4101:  Windows .  
                     2015-10-21 07:42:57                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-21 07:42:59                                  WinMgmt                         
                     2015-10-21 07:42:59                                  WinMgmt                         
             1          2015-10-21 07:43:04                                  ESENT                           102: Windows (2528) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-21 07:43:04                                  ESENT                           300: Windows (2528) Windows:     .  
             3          2015-10-21 07:43:04                                  ESENT                           301: Windows (2528) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-21 07:43:04                                  ESENT                           302: Windows (2528) Windows:    .  
             1          2015-10-21 07:43:05                                  Windows Search Service          1003:  Windows Search .   
                         2015-10-21 07:43:34                                  WinMgmt                         
                     2015-10-21 07:45:00                                  Software Protection Platform Service  900:      .    
                     2015-10-21 07:45:01                                  SecurityCenter                  1:     Windows .  
                     2015-10-21 07:45:02                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-21 07:45:02                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-21 07:45:02                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-21 07:47:11                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-21 07:47:11                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-21 07:50:02                                  Software Protection Platform Service  903:     .    
                     2015-10-21 09:12:06                                  Microsoft-Windows-Defrag        258:           
                     2015-10-21 09:47:11                                  Microsoft-Windows-Defrag        258:           
                     2015-10-21 09:57:08                                  VSS                             8224:  VSS  - - .    
                     2015-10-21 10:01:56                                  Microsoft-Windows-Defrag        258:        MusicVideo (D:)  
                     2015-10-21 10:02:00                                  Microsoft-Windows-Defrag        258:          (G:)  
                     2015-10-21 10:16:30                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-21 10:16:30                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-21 10:16:31                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-21 12:10:18                                  EventSystem                     
                     2015-10-21 12:10:18                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-21 12:10:19                                  Winlogon                        4101:  Windows .  
                     2015-10-21 12:10:19                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-21 12:10:20                                  WinMgmt                         
                     2015-10-21 12:10:20                                  WinMgmt                         
             1          2015-10-21 12:10:25                                  ESENT                           102: Windows (2712) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-21 12:10:26                                  ESENT                           300: Windows (2712) Windows:     .  
             3          2015-10-21 12:10:26                                  ESENT                           301: Windows (2712) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001A8.log.  
             3          2015-10-21 12:10:26                                  ESENT                           301: Windows (2712) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             1          2015-10-21 12:10:27                                  Windows Search Service          1003:  Windows Search .   
             3          2015-10-21 12:10:27                                  ESENT                           302: Windows (2712) Windows:    .  
                         2015-10-21 12:10:55                                  WinMgmt                         
                     2015-10-21 12:12:21                                  Software Protection Platform Service  900:      .    
                     2015-10-21 12:12:22                                  SecurityCenter                  1:     Windows .  
                     2015-10-21 12:12:23                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-21 12:12:23                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-21 12:12:23                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-21 12:15:00                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-21 12:15:00                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-21 12:17:23                                  Software Protection Platform Service  903:     .    
                     2015-10-21 13:23:33                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-21 13:23:33                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-21 13:23:34                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-21 15:41:16                                  EventSystem                     
                     2015-10-21 15:41:16                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-21 15:41:17                                  Winlogon                        4101:  Windows .  
                     2015-10-21 15:41:17                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-21 15:41:18                                  WinMgmt                         
                     2015-10-21 15:41:18                                  WinMgmt                         
             1          2015-10-21 15:41:23                                  ESENT                           102: Windows (2608) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-21 15:41:23                                  ESENT                           300: Windows (2608) Windows:     .  
             3          2015-10-21 15:41:23                                  ESENT                           301: Windows (2608) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             1          2015-10-21 15:41:24                                  Windows Search Service          1003:  Windows Search .   
             3          2015-10-21 15:41:24                                  ESENT                           302: Windows (2608) Windows:    .  
                         2015-10-21 15:41:53                                  WinMgmt                         
                     2015-10-21 15:43:19                                  Software Protection Platform Service  900:      .    
                     2015-10-21 15:43:20                                  SecurityCenter                  1:     Windows .  
                     2015-10-21 15:43:21                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-21 15:43:21                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-21 15:43:21                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-21 15:45:25                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-21 15:45:25                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-21 15:48:21                                  Software Protection Platform Service  903:     .    
                     2015-10-21 15:58:48                                  Microsoft-Windows-Defrag        258:           
                     2015-10-21 16:06:34                                  Microsoft-Windows-Defrag        258:        MusicVideo (D:)  
                     2015-10-21 16:06:38                                  Microsoft-Windows-Defrag        258:          (G:)  
                     2015-10-21 16:14:20                                  VSS                             8224:  VSS  - - .    
                     2015-10-21 16:35:37                                  Microsoft-Windows-Defrag        258:        (C:)  
                     2015-10-21 16:36:00                                  Microsoft-Windows-Defrag        258:        Tatyana (E:)  
                     2015-10-21 17:49:04                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-21 17:49:04                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-21 17:49:05                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-21 22:47:16                                  EventSystem                     
                     2015-10-21 22:47:16                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-21 22:47:17                                  Winlogon                        4101:  Windows .  
                     2015-10-21 22:47:17                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-21 22:47:18                                  WinMgmt                         
                     2015-10-21 22:47:18                                  WinMgmt                         
             1          2015-10-21 22:47:23                                  ESENT                           102: Windows (2540) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-21 22:47:23                                  ESENT                           300: Windows (2540) Windows:     .  
             3          2015-10-21 22:47:23                                  ESENT                           301: Windows (2540) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             1          2015-10-21 22:47:24                                  Windows Search Service          1003:  Windows Search .   
             3          2015-10-21 22:47:24                                  ESENT                           302: Windows (2540) Windows:    .  
                         2015-10-21 22:47:53                                  WinMgmt                         
                     2015-10-21 22:49:19                                  Software Protection Platform Service  900:      .    
                     2015-10-21 22:49:20                                  SecurityCenter                  1:     Windows .  
                     2015-10-21 22:49:21                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-21 22:49:21                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-21 22:49:21                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-21 22:51:25                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-21 22:51:25                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-21 22:54:21                                  Software Protection Platform Service  903:     .    
                     2015-10-21 23:01:25                                  Windows Error Reporting         1001:   ,  0   : PnPDriverNotFound  :     CAB: 0     :  P1: x86  P2: USB\VID_0421&PID_06FC&REV_0100&MI_01  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :  C:\Users\sima\AppData\Local\Temp\DMI393C.tmp.log.xml        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_8f7f8da8b7429cff38bfcaa1146c769deedd7a34_cab_039239a9     :     : 0   : 372ce198-77fc-11e5-bf19-0019db4d6dee   : 6  
                     2015-10-21 23:01:25                                  Windows Error Reporting         1001:   ,  0   : PnPDriverNotFound  :     CAB: 0     :  P1: x86  P2: USB\VID_0421&PID_06FC&REV_0100&MI_02  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :  C:\Users\sima\AppData\Local\Temp\DMI39BA.tmp.log.xml        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_2f5ecbdf1bce1517eda26bac887f90a875f64c3_cab_039239d8     :     : 0   : 372ce199-77fc-11e5-bf19-0019db4d6dee   : 6  
                     2015-10-21 23:01:25                                  Windows Error Reporting         1001:   ,  0   : PnPDriverNotFound  :     CAB: 0     :  P1: x86  P2: USB\VID_0421&PID_06FC&REV_0100&MI_03  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :  C:\Users\sima\AppData\Local\Temp\DMI3A28.tmp.log.xml        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_30c345e5e3d129c52d52ab899dcb57b9ba0eddc_cab_03923a45     :     : 0   : 372ce19a-77fc-11e5-bf19-0019db4d6dee   : 6  
                     2015-10-21 23:01:38                                  Windows Error Reporting         1001:   ,  0   : PnPGenericDriverFound  :     CAB: 0     :  P1: x86  P2: USB\VID_0421&PID_06FC&REV_0100&MI_00  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_65a713617f7d88de339ec07486b6cad92077e0_cab_03926c23     :     : 0   : 3eea23be-77fc-11e5-bf19-0019db4d6dee   : 6  
                     2015-10-21 23:02:35                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-21 23:02:36                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-21 23:02:36                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-21 23:02:36                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 8799)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-21 23:02:36                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 8799)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-21 23:09:17                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 8792)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-21 23:09:17                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 8792)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-22 00:02:50                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-22 00:02:50                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-22 00:02:51                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-22 06:49:26                                  EventSystem                     
                     2015-10-22 06:49:26                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-22 06:49:27                                  Winlogon                        4101:  Windows .  
                     2015-10-22 06:49:27                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-22 06:49:29                                  WinMgmt                         
                     2015-10-22 06:49:29                                  WinMgmt                         
             1          2015-10-22 06:49:34                                  ESENT                           102: Windows (2560) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-22 06:49:34                                  ESENT                           300: Windows (2560) Windows:     .  
             3          2015-10-22 06:49:34                                  ESENT                           301: Windows (2560) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001D1.log.  
             3          2015-10-22 06:49:34                                  ESENT                           301: Windows (2560) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001D2.log.  
             3          2015-10-22 06:49:34                                  ESENT                           301: Windows (2560) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             1          2015-10-22 06:49:35                                  Windows Search Service          1003:  Windows Search .   
             3          2015-10-22 06:49:35                                  ESENT                           302: Windows (2560) Windows:    .  
                         2015-10-22 06:50:03                                  WinMgmt                         
                     2015-10-22 06:51:29                                  Software Protection Platform Service  900:      .    
                     2015-10-22 06:51:31                                  SecurityCenter                  1:     Windows .  
                     2015-10-22 06:51:32                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-22 06:51:32                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-22 06:51:32                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-22 06:53:38                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-22 06:53:38                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-22 06:54:04                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-22 06:54:05                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-22 06:54:05                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-22 06:54:05                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 8327)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-22 06:54:06                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 8327)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-22 06:56:32                                  Software Protection Platform Service  903:     .    
                     2015-10-22 07:11:53                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 8310)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-22 08:40:42                                  Windows Error Reporting         1001:   ,  0   : ShellBrowserCancel  :     CAB: 0     :  P1: {FBEB8A05-BEEE-4442-804E-409D6C4515E9}  P2: Local  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :  C:\Users\sima\AppData\Local\Temp\WER20E1.tmp.WERInternalMetadata.xml        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppHang_{FBEB8A05-BEEE-4_a5a9b3385cb701f34b3232a38913e74696a11_cab_0fb320f0     :     : 0   : 2392f437-784d-11e5-af2c-0019db4d6dee   : 6  
                     2015-10-22 08:40:42                                  Windows Error Reporting         1001:   ,  0   : ShellBrowserCancel  :     CAB: 0     :  P1: {FBEB8A05-BEEE-4442-804E-409D6C4515E9}  P2: Local  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :        :       :     : 0   : 2392f437-784d-11e5-af2c-0019db4d6dee   : 0  
                     2015-10-22 08:40:47                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-22 08:40:47                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-22 08:40:48                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-22 12:49:03                                  EventSystem                     
                     2015-10-22 12:49:03                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-22 12:49:05                                  Winlogon                        4101:  Windows .  
                     2015-10-22 12:49:05                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-22 12:49:07                                  WinMgmt                         
                     2015-10-22 12:49:07                                  WinMgmt                         
             1          2015-10-22 12:49:14                                  ESENT                           102: Windows (2628) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-22 12:49:14                                  ESENT                           300: Windows (2628) Windows:     .  
             3          2015-10-22 12:49:14                                  ESENT                           301: Windows (2628) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-22 12:49:14                                  ESENT                           302: Windows (2628) Windows:    .  
             1          2015-10-22 12:49:15                                  Windows Search Service          1003:  Windows Search .   
                         2015-10-22 12:50:48                                  WinMgmt                         
                     2015-10-22 12:51:09                                  Software Protection Platform Service  900:      .    
                     2015-10-22 12:51:11                                  SecurityCenter                  1:     Windows .  
                     2015-10-22 12:51:12                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-22 12:51:12                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-22 12:51:12                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-22 12:53:14                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-22 12:53:15                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-22 12:56:12                                  Software Protection Platform Service  903:     .    
                     2015-10-22 13:11:26                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-22 13:11:27                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-22 13:11:27                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-22 13:11:27                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 7950)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-22 13:11:28                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 7950)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-22 13:47:06                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-22 13:47:06                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-22 13:47:07                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-22 20:31:42                                  EventSystem                     
                     2015-10-22 20:31:42                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-22 20:31:43                                  Winlogon                        4101:  Windows .  
                     2015-10-22 20:31:43                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-22 20:31:44                                  WinMgmt                         
                     2015-10-22 20:31:44                                  WinMgmt                         
             1          2015-10-22 20:31:50                                  ESENT                           102: Windows (2612) Windows:   (6.01.7601.0000)    (0).  
             1          2015-10-22 20:31:50                                  Windows Search Service          1003:  Windows Search .   
             3          2015-10-22 20:31:50                                  ESENT                           300: Windows (2612) Windows:     .  
             3          2015-10-22 20:31:50                                  ESENT                           301: Windows (2612) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-22 20:31:50                                  ESENT                           302: Windows (2612) Windows:    .  
                         2015-10-22 20:32:49                                  WinMgmt                         
                     2015-10-22 20:33:45                                  Software Protection Platform Service  900:      .    
                     2015-10-22 20:33:46                                  SecurityCenter                  1:     Windows .  
                     2015-10-22 20:33:46                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-22 20:33:46                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-22 20:33:46                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-22 20:35:51                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-22 20:35:51                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-22 20:38:47                                  Software Protection Platform Service  903:     .    
                     2015-10-22 23:19:36                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-22 23:19:36                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-22 23:19:37                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-24 00:12:25                                  EventSystem                     
                     2015-10-24 00:12:25                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-24 00:12:28                                  WinMgmt                         
                     2015-10-24 00:12:28                                  WinMgmt                         
                     2015-10-24 00:12:28                                  Winlogon                        4101:  Windows .  
                     2015-10-24 00:12:28                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
             1          2015-10-24 00:12:37                                  ESENT                           102: Windows (2636) Windows:   (6.01.7601.0000)    (0).  
             1          2015-10-24 00:12:37                                  Windows Search Service          1003:  Windows Search .   
             3          2015-10-24 00:12:37                                  ESENT                           300: Windows (2636) Windows:     .  
             3          2015-10-24 00:12:37                                  ESENT                           301: Windows (2636) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001D3.log.  
             3          2015-10-24 00:12:37                                  ESENT                           301: Windows (2636) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-24 00:12:37                                  ESENT                           302: Windows (2636) Windows:    .  
                         2015-10-24 00:14:12                                  WinMgmt                         
                     2015-10-24 00:14:29                                  Software Protection Platform Service  900:      .    
                     2015-10-24 00:14:30                                  SecurityCenter                  1:     Windows .  
                     2015-10-24 00:14:31                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-24 00:14:31                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-24 00:14:31                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-24 00:15:00                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-24 00:15:01                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-24 00:15:01                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-24 00:15:01                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 5846)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-24 00:15:01                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 5846)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-24 00:15:53                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-24 00:15:53                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 5846)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])]    
                     2015-10-24 00:15:54                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-24 00:15:55                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 5845)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])]    
                     2015-10-24 00:15:55                                  Office Software Protection Platform Service  903: The Software Protection service has stopped.    
                     2015-10-24 00:15:59                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-24 00:15:59                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-24 00:15:59                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-24 00:16:01                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-24 00:16:02                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 5845)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])]    
                     2015-10-24 00:16:02                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-24 00:16:03                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 5845)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])]    
                     2015-10-24 00:16:04                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/23 15:16, 0, 2, 5845, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-10-24 00:16:04                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 8599448, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-10-24 00:16:05                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/23 15:16, 0, 2, 5845, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-10-24 00:16:05                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/10/23 15:16  
                     2015-10-24 00:16:13                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-10-24 00:16:13                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259200)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-24 00:16:35                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-24 00:16:36                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-24 00:19:31                                  Software Protection Platform Service  903:     .    
                     2015-10-24 01:08:56                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-24 01:08:56                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-24 01:08:57                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-24 10:20:32                                  EventSystem                     
                     2015-10-24 10:20:32                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-24 10:20:36                                  WinMgmt                         
                     2015-10-24 10:20:37                                  Winlogon                        4101:  Windows .  
                     2015-10-24 10:20:37                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-24 10:20:37                                  WinMgmt                         
                     2015-10-24 10:20:37                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-24 10:20:38                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-24 10:20:38                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-24 10:20:38                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-24 10:20:39                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258596)(?)(?)(?)])(1 )(2 )]    
                     2015-10-24 10:20:40                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-24 10:20:41                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258596)(?)(?)(?)])(1 )(2 )]    
                     2015-10-24 10:20:42                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/24 01:20, 0, 1, 258596, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-10-24 10:20:42                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 4405096, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-10-24 10:20:43                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/24 01:20, 0, 1, 258596, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-10-24 10:20:43                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/10/24 01:20  
             1          2015-10-24 10:20:47                                  ESENT                           102: Windows (2840) Windows:   (6.01.7601.0000)    (0).  
             1          2015-10-24 10:20:48                                  Windows Search Service          1003:  Windows Search .   
             3          2015-10-24 10:20:48                                  ESENT                           300: Windows (2840) Windows:     .  
             3          2015-10-24 10:20:48                                  ESENT                           301: Windows (2840) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-24 10:20:48                                  ESENT                           302: Windows (2840) Windows:    .  
                         2015-10-24 10:22:19                                  WinMgmt                         
                     2015-10-24 10:22:38                                  Software Protection Platform Service  900:      .    
                     2015-10-24 10:22:39                                  SecurityCenter                  1:     Windows .  
                     2015-10-24 10:22:40                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-24 10:22:40                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-24 10:22:40                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-24 10:22:57                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-24 10:22:57                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-24 10:27:15                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-24 10:27:15                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-24 10:27:40                                  Software Protection Platform Service  903:     .    
                     2015-10-24 10:27:56                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-24 10:27:56                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-24 10:27:57                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-25 09:03:52                                  EventSystem                     
                     2015-10-25 09:03:52                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-25 09:03:56                                  Winlogon                        4101:  Windows .  
                     2015-10-25 09:03:56                                  WinMgmt                         
                     2015-10-25 09:03:56                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-25 09:03:58                                  WinMgmt                         
                     2015-10-25 09:03:58                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-25 09:03:59                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-25 09:03:59                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-25 09:04:00                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 09:04:01                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 257837)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 09:04:02                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 09:04:03                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 257837)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 09:04:04                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/25 00:04, 0, 1, 257837, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-10-25 09:04:04                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/10/25 00:04  
             1          2015-10-25 09:04:06                                  ESENT                           102: Windows (2840) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-25 09:04:06                                  ESENT                           300: Windows (2840) Windows:     .  
             3          2015-10-25 09:04:06                                  ESENT                           301: Windows (2840) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-25 09:04:06                                  ESENT                           302: Windows (2840) Windows:    .  
             1          2015-10-25 09:04:07                                  Windows Search Service          1003:  Windows Search .   
                     2015-10-25 09:05:18                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-25 09:05:18                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                         2015-10-25 09:05:39                                  WinMgmt                         
                     2015-10-25 09:05:58                                  Software Protection Platform Service  900:      .    
                     2015-10-25 09:05:59                                  SecurityCenter                  1:     Windows .  
                     2015-10-25 09:05:59                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-25 09:05:59                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 09:05:59                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-25 09:08:12                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-25 09:08:12                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-25 09:10:43                                  Windows Error Reporting         1001:   ,  0   : ShellBrowserCancel  :     CAB: 0     :  P1: {FBEB8A05-BEEE-4442-804E-409D6C4515E9}  P2: Local  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppHang_{FBEB8A05-BEEE-4_a5a9b3385cb701f34b3232a38913e74696a11_0ad277b3     :     : 0   : d46a236d-7aac-11e5-a68f-0019db4d6dee   : 6  
                     2015-10-25 09:10:43                                  Windows Error Reporting         1001:   ,  0   : ShellBrowserCancel  :     CAB: 0     :  P1: {FBEB8A05-BEEE-4442-804E-409D6C4515E9}  P2: Local  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :        :       :     : 0   : d46a236d-7aac-11e5-a68f-0019db4d6dee   : 0  
                     2015-10-25 09:11:00                                  Software Protection Platform Service  903:     .    
                     2015-10-25 09:12:24                                  Desktop Window Manager          9009:         (0x40010004)  
                       2015-10-25 09:13:24                                  Wlclntfy                        6005:   winlogon <Sens>         (Logoff).  
                     2015-10-25 09:14:53                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                       2015-10-25 09:14:53                                  Wlclntfy                        6006:   winlogon <Sens>  148 .     (Logoff).  
                     2015-10-25 09:14:55                           Microsoft-Windows-User Profiles Service  1532:    .        
                       2015-10-25 09:14:55                           Microsoft-Windows-User Profiles Service  1530:  Windows ,        .    .   ,    ,    .        -    7 user registry handles leaked from \Registry\User\S-1-5-21-1499224401-2478604990-2095306355-1000: Process 1744 (\Device\HarddiskVolume3\Program Files\Windows Media Player\wmplayer.exe) has opened key \REGISTRY\USER\S-1-5-21-1499224401-2478604990-2095306355-1000 Process 1744 (\Device\HarddiskVolume3\Program Files\Windows Media Player\wmplayer.exe) has opened key \REGISTRY\USER\S-1-5-21-1499224401-2478604990-2095306355-1000\Software\Microsoft\Windows\CurrentVersion\Explorer Process 1744 (\Device\HarddiskVolume3\Program Files\Windows Media Player\wmplayer.exe) has opened key \REGISTRY\USER\S-1-5-21-1499224401-2478604990-2095306355-1000\Software\Microsoft\MediaPlayer\Preferences\DMR Process 1744 (\Device\HarddiskVolume3\Program Files\Windows Media Player\wmplayer.exe) has opened key \REGISTRY\USER\S-1-5-21-1499224401-2478604990-2095306355-1000\Software\Microsoft\MediaPlayer\Preferences\HME Process 1744 (\Device\HarddiskVolume3\Program Files\Windows Media Player\wmplayer.exe) has opened key \REGISTRY\USER\S-1-5-21-1499224401-2478604990-2095306355-1000\Software\Microsoft\MediaPlayer\Health\{D11A0001-5E37-49D8-8D06-9CF176BE11CC} Process 1744 (\Device\HarddiskVolume3\Program Files\Windows Media Player\wmplayer.exe) has opened key \REGISTRY\USER\S-1-5-21-1499224401-2478604990-2095306355-1000\Software\Microsoft\MediaPlayer\Preferences Process 1744 (\Device\HarddiskVolume3\Program Files\Windows Media Player\wmplayer.exe) has opened key \REGISTRY\USER\S-1-5-21-1499224401-2478604990-2095306355-1000\Software\Microsoft\MediaPlayer\Preferences   
                       2015-10-25 09:14:55                           Microsoft-Windows-User Profiles Service  1530:  Windows ,        .    .   ,    ,    .        -    2 user registry handles leaked from \Registry\User\S-1-5-21-1499224401-2478604990-2095306355-1000_Classes: Process 1744 (\Device\HarddiskVolume3\Program Files\Windows Media Player\wmplayer.exe) has opened key \REGISTRY\USER\S-1-5-21-1499224401-2478604990-2095306355-1000_CLASSES Process 1744 (\Device\HarddiskVolume3\Program Files\Windows Media Player\wmplayer.exe) has opened key \REGISTRY\USER\S-1-5-21-1499224401-2478604990-2095306355-1000_CLASSES   
                     2015-10-25 09:15:40                                  EventSystem                     
                     2015-10-25 09:15:40                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-25 09:15:43                                  Winlogon                        4101:  Windows .  
                     2015-10-25 09:15:44                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-25 09:15:44                                  WinMgmt                         
                     2015-10-25 09:15:45                                  WinMgmt                         
                     2015-10-25 09:15:46                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-25 09:15:47                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-25 09:15:47                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-25 09:15:48                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 09:15:49                                  Office Software Protection Platform Service  1040: Hardware has changed from previous boot.   AppId=59a52881-a989-479d-af46-f275c6370663, SkuId=6f327760-8c5c-417c-9b61-836a98287e0c.  
                     2015-10-25 09:15:49                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259189)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 09:15:50                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 09:15:51                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259189)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 09:15:52                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/25 00:15, 0, 1, 259189, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-10-25 09:15:52                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/10/25 00:15  
             1          2015-10-25 09:15:55                                  ESENT                           102: Windows (2804) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-25 09:15:55                                  ESENT                           300: Windows (2804) Windows:     .  
             3          2015-10-25 09:15:55                                  ESENT                           301: Windows (2804) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-25 09:15:55                                  ESENT                           302: Windows (2804) Windows:    .  
             1          2015-10-25 09:15:56                                  Windows Search Service          1003:  Windows Search .   
                         2015-10-25 09:17:27                                  WinMgmt                         
                     2015-10-25 09:17:46                                  Software Protection Platform Service  900:      .    
                     2015-10-25 09:17:47                                  SecurityCenter                  1:     Windows .  
                     2015-10-25 09:17:48                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-25 09:17:48                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 09:17:48                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-25 09:19:58                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-25 09:19:58                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-25 09:21:28                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-25 09:21:28                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-25 09:21:29                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-25 09:23:44                                  EventSystem                     
                     2015-10-25 09:23:44                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-25 09:23:45                                  Winlogon                        4101:  Windows .  
                     2015-10-25 09:23:45                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-25 09:23:47                                  WinMgmt                         
                     2015-10-25 09:23:48                                  WinMgmt                         
                     2015-10-25 09:23:50                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-25 09:23:51                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-25 09:23:51                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-25 09:23:51                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 09:23:51                                  Office Software Protection Platform Service  1040: Hardware has changed from previous boot.   AppId=59a52881-a989-479d-af46-f275c6370663, SkuId=6f327760-8c5c-417c-9b61-836a98287e0c.  
                     2015-10-25 09:23:52                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259193)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 09:23:52                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 09:23:53                                  Windows Error Reporting         1001:   ,  0   : PnPDriverNotFound  :     CAB: 0     :  P1: x86  P2: PCI\VEN_13F6&DEV_8788&SUBSYS_834F1043&REV_00  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :  C:\Users\sima\AppData\Local\Temp\DMIF8E6.tmp.log.xml        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_93c733fead2d23a67d213cfe9e4cc4292a53e9d9_cab_0a84f9a2     :     : 0   : ab54da92-7aae-11e5-b7e6-10c37bc89260   : 6  
                     2015-10-25 09:23:53                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259192)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 09:23:54                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/25 00:23, 0, 1, 259192, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-10-25 09:23:54                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 2328256, 0, 0, 0, 0, 1601/01/01 00:00  
             1          2015-10-25 09:23:54                                  ESENT                           102: Windows (2904) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-25 09:23:54                                  ESENT                           300: Windows (2904) Windows:     .  
             3          2015-10-25 09:23:54                                  ESENT                           301: Windows (2904) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
                     2015-10-25 09:23:55                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/25 00:23, 0, 1, 259192, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-10-25 09:23:55                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/10/25 00:23  
             1          2015-10-25 09:23:55                                  Windows Search Service          1003:  Windows Search .   
             3          2015-10-25 09:23:55                                  ESENT                           302: Windows (2904) Windows:    .  
                     2015-10-25 09:24:35                                  System Restore                  8194:     ( = C:\Windows\system32\DrvInst.exe "4" "0" "C:\Users\sima\AppData\Local\Temp\{4755b594-a792-39f5-e565-5a477439685e}\xonard1.inf" "0" "66b14cf4b" "000005D4" "WinSta0\Default" "000005C0" "208" "c:\my_programs\setup\driver\audio\xonar d1 audio center\softwaredriver\driver";  =    : ASUSTeK ,    ).  
                         2015-10-25 09:24:50                                  WinMgmt                         
                     2015-10-25 09:25:50                                  Software Protection Platform Service  900:      .    
                     2015-10-25 09:25:50                                  SecurityCenter                  1:     Windows .  
                     2015-10-25 09:25:51                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-25 09:25:51                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 09:25:51                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-25 09:27:45                                  VSS                             8224:  VSS  - - .    
                     2015-10-25 09:27:59                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-25 09:27:59                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-25 09:28:37                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-25 09:28:37                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-25 09:28:38                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-25 09:29:42                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-25 09:29:43                                  EventSystem                     
                     2015-10-25 09:29:44                                  Winlogon                        4101:  Windows .  
                     2015-10-25 09:29:44                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-25 09:29:50                                  WinMgmt                         
                     2015-10-25 09:29:52                                  WinMgmt                         
                     2015-10-25 09:30:00                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-25 09:30:01                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-25 09:30:01                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-25 09:30:01                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 09:30:03                                  Office Software Protection Platform Service  1040: Hardware has changed from previous boot.   AppId=59a52881-a989-479d-af46-f275c6370663, SkuId=6f327760-8c5c-417c-9b61-836a98287e0c.  
                     2015-10-25 09:30:03                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259194)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 09:30:04                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 09:30:04                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259194)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 09:30:06                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/25 00:30, 0, 1, 259194, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-10-25 09:30:06                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/10/25 00:30  
                     2015-10-25 09:30:07                                  Windows Error Reporting         1001:   ,  0   : PnPRequestAdditionalSoftware  :     CAB: 0     :  P1: x86  P2: USB\VID_044F&PID_B323&REV_0103  P3: 6.1.1.0  P4: 0419  P5: input.inf  P6: *  P7:   P8:   P9:   P10:      :        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_abc2797e0a7cbe292633d12bb8fe014b3d1514_cab_0bf4db9a     :     : 0   : 8a6e78b0-7aaf-11e5-bcc3-10c37bc89260   : 6  
             1          2015-10-25 09:30:07                                  ESENT                           102: Windows (2932) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-25 09:30:07                                  ESENT                           300: Windows (2932) Windows:     .  
             3          2015-10-25 09:30:07                                  ESENT                           301: Windows (2932) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-25 09:30:07                                  ESENT                           302: Windows (2932) Windows:    .  
                     2015-10-25 09:30:08                                  Windows Error Reporting         1001:   ,  0   : PnPRequestAdditionalSoftware  :     CAB: 0     :  P1: x86  P2: HID\VID_044F&PID_B323&REV_0103  P3: 6.1.1.0  P4: 0419  P5: input.inf  P6: *  P7:   P8:   P9:   P10:      :        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_c2884350b734f532d022832cc2f8209decc182fb_cab_0bf4dddc     :     : 0   : 8a6e78b1-7aaf-11e5-bcc3-10c37bc89260   : 6  
             1          2015-10-25 09:30:08                                  Windows Search Service          1003:  Windows Search .   
                         2015-10-25 09:31:11                                  WinMgmt                         
                     2015-10-25 09:32:00                                  Software Protection Platform Service  900:      .    
                     2015-10-25 09:32:01                                  SecurityCenter                  1:     Windows .  
                     2015-10-25 09:32:02                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-25 09:32:02                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 09:32:02                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-25 09:34:00                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-25 09:34:00                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-25 09:37:02                                  Software Protection Platform Service  903:     .    
                     2015-10-25 11:10:50                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-25 11:10:50                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-25 11:10:50                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-25 19:57:00                                  EventSystem                     
                     2015-10-25 19:57:00                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-25 19:57:01                                  Winlogon                        4101:  Windows .  
                     2015-10-25 19:57:01                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-25 19:57:10                                  WinMgmt                         
                     2015-10-25 19:57:10                                  WinMgmt                         
                     2015-10-25 19:57:12                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-25 19:57:13                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-25 19:57:13                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-25 19:57:13                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 19:57:13                                  Office Software Protection Platform Service  1040: Hardware has changed from previous boot.   AppId=59a52881-a989-479d-af46-f275c6370663, SkuId=6f327760-8c5c-417c-9b61-836a98287e0c.  
                     2015-10-25 19:57:14                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258573)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 19:57:14                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 19:57:15                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258573)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 19:57:16                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/25 10:57, 0, 1, 258573, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
             1          2015-10-25 19:57:16                                  ESENT                           102: Windows (2856) Windows:   (6.01.7601.0000)    (0).  
             1          2015-10-25 19:57:16                                  Windows Search Service          1003:  Windows Search .   
             3          2015-10-25 19:57:16                                  ESENT                           300: Windows (2856) Windows:     .  
             3          2015-10-25 19:57:16                                  ESENT                           301: Windows (2856) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-25 19:57:16                                  ESENT                           302: Windows (2856) Windows:    .  
                     2015-10-25 19:57:17                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/10/25 10:57  
                         2015-10-25 19:57:37                                  WinMgmt                         
                     2015-10-25 19:59:12                                  Software Protection Platform Service  900:      .    
                     2015-10-25 19:59:13                                  SecurityCenter                  1:     Windows .  
                     2015-10-25 19:59:14                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-25 19:59:14                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 19:59:14                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-25 20:00:58                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-25 20:00:58                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-25 20:01:18                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-25 20:01:19                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-25 20:04:14                                  Software Protection Platform Service  903:     .    
                     2015-10-25 20:06:00                                  Windows Error Reporting         1001:   ,  0   : ShellBrowserCancel  :     CAB: 0     :  P1: {F3364BA0-65B9-11CE-A9BA-00AA004AE837}  P2: Local  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :  C:\Users\sima\AppData\Local\Temp\WER81E6.tmp.WERInternalMetadata.xml        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppHang_{F3364BA0-65B9-1_03f722b1c3a9f7342b324b90c4342939636d4_cab_0ea181e6     :     : 0   : 5f4de925-7b08-11e5-8802-0000db4d6dee   : 6  
                     2015-10-25 20:06:00                                  Windows Error Reporting         1001:   ,  0   : ShellBrowserCancel  :     CAB: 0     :  P1: {F3364BA0-65B9-11CE-A9BA-00AA004AE837}  P2: Local  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :        :       :     : 0   : 5f4de925-7b08-11e5-8802-0000db4d6dee   : 0  
                     2015-10-25 23:16:50                                  Office Software Protection Platform Service  1040: Hardware has changed from previous boot.   AppId=59a52881-a989-479d-af46-f275c6370663, SkuId=6f327760-8c5c-417c-9b61-836a98287e0c.  
                     2015-10-25 23:16:50                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-10-25 23:16:50                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259001)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-25 23:19:43                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-25 23:19:43                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-25 23:28:07                                  Desktop Window Manager          9010:  (3336)          
                     2015-10-25 23:28:07                                  Desktop Window Manager          9013:       ,          
                     2015-10-25 23:51:19                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-25 23:51:19                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-25 23:51:35                                  Windows Error Reporting         1001:   ,  0   : NetworkDiagnosticsFrameworkV3  :     CAB: 0     :  P1: Microsoft  P2: AutoConfig Helper Class [1.0]  P3: 2  P4: 8008F906  P5: {07D37F7B-FA5E-4443-BDA7-AB107B29AFB9}  P6: AutoConfig Helper Class [1.0]  P7: {68FC616E-F322-40cc-8D07-75D8EF421B4F}  P8: rtwlanu.sys  P9: 1021.3.912.2012 19/06/2013  P10:      :  C:\Windows\System32\NDF\{D2EDBF38-3370-49C4-A718-53E81D35ADC0}-WER-10252015-2251.etl        :  C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Microsoft_864e653fc4fac42bd428f7e1e66417fa1ad5ff6_cab_04803165     :     : 0   : e2af8c9e-7b27-11e5-8802-0000db4d6dee   : 6  
                     2015-10-26 00:00:18                                  Windows Error Reporting         1001:   ,  0   : ShellBrowserCancel  :     CAB: 0     :  P1: {F3364BA0-65B9-11CE-A9BA-00AA004AE837}  P2: Local  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppHang_{F3364BA0-65B9-1_03f722b1c3a9f7342b324b90c4342939636d4_069c2cbb     :     : 0   : 1a896a1a-7b29-11e5-8802-0000db4d6dee   : 6  
                     2015-10-26 00:00:18                                  Windows Error Reporting         1001:   ,  0   : ShellBrowserCancel  :     CAB: 0     :  P1: {F3364BA0-65B9-11CE-A9BA-00AA004AE837}  P2: Local  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :        :       :     : 0   : 1a896a1a-7b29-11e5-8802-0000db4d6dee   : 0  
                     2015-10-26 00:14:02                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-26 00:14:02                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-26 00:14:04                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-26 08:29:43                                  EventSystem                     
                     2015-10-26 08:29:43                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-26 08:29:44                                  WinMgmt                         
                     2015-10-26 08:29:44                                  Winlogon                        4101:  Windows .  
                     2015-10-26 08:29:44                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-26 08:29:44                                  WinMgmt                         
                     2015-10-26 08:29:46                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-26 08:29:47                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-26 08:29:47                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-26 08:29:47                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-26 08:29:47                                  Office Software Protection Platform Service  1040: Hardware has changed from previous boot.   AppId=59a52881-a989-479d-af46-f275c6370663, SkuId=6f327760-8c5c-417c-9b61-836a98287e0c.  
                     2015-10-26 08:29:47                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258448)(?)(?)(?)])(1 )(2 )]    
                     2015-10-26 08:29:48                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-26 08:29:49                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258448)(?)(?)(?)])(1 )(2 )]    
                     2015-10-26 08:29:50                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/25 23:29, 0, 1, 258448, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-10-26 08:29:50                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 2569864, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-10-26 08:29:51                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/25 23:29, 0, 1, 258448, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-10-26 08:29:51                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/10/25 23:29  
             1          2015-10-26 08:29:51                                  ESENT                           102: Windows (2776) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-26 08:29:51                                  ESENT                           300: Windows (2776) Windows:     .  
             3          2015-10-26 08:29:51                                  ESENT                           301: Windows (2776) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-26 08:29:51                                  ESENT                           302: Windows (2776) Windows:    .  
             1          2015-10-26 08:29:52                                  Windows Search Service          1003:  Windows Search .   
                         2015-10-26 08:30:19                                  WinMgmt                         
                     2015-10-26 08:31:46                                  Software Protection Platform Service  900:      .    
                     2015-10-26 08:31:47                                  SecurityCenter                  1:     Windows .  
                     2015-10-26 08:31:47                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-26 08:31:47                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-26 08:31:47                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-26 08:34:47                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-26 08:34:47                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-26 08:36:47                                  Software Protection Platform Service  903:     .    
                     2015-10-26 09:06:37                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-26 09:06:37                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-26 09:06:38                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-26 14:22:41                                  EventSystem                     
                     2015-10-26 14:22:41                                  Winlogon                        4101:  Windows .  
                     2015-10-26 14:22:41                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-26 14:22:41                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-26 14:22:42                                  WinMgmt                         
                     2015-10-26 14:22:43                                  WinMgmt                         
                     2015-10-26 14:22:43                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-26 14:22:44                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-26 14:22:44                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-26 14:22:44                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-26 14:22:46                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258848)(?)(?)(?)])(1 )(2 )]    
                     2015-10-26 14:22:47                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-26 14:22:48                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258848)(?)(?)(?)])(1 )(2 )]    
                     2015-10-26 14:22:49                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/26 05:22, 0, 1, 258848, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-10-26 14:22:49                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 1877784, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-10-26 14:22:49                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/26 05:22, 0, 1, 258848, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
             1          2015-10-26 14:22:49                                  ESENT                           102: Windows (2544) Windows:   (6.01.7601.0000)    (0).  
             1          2015-10-26 14:22:49                                  Windows Search Service          1003:  Windows Search .   
             3          2015-10-26 14:22:49                                  ESENT                           300: Windows (2544) Windows:     .  
             3          2015-10-26 14:22:49                                  ESENT                           301: Windows (2544) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-26 14:22:49                                  ESENT                           302: Windows (2544) Windows:    .  
                     2015-10-26 14:22:50                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/10/26 05:22  
                     2015-10-26 14:23:06                                  Windows Error Reporting         1001:   ,  0   : PnPDeviceProblemCode  :     CAB: 0     :  P1: x86  P2: USB\UNKNOWN  P3: {36fc9e60-c465-11cf-8056-444553540000}  P4: 0000002B  P5: unknown  P6: unknown  P7: unknown  P8:   P9:   P10:      :  C:\Users\sima\AppData\Local\Temp\DMIA514.tmp.log.xml  C:\Windows\inf\usb.inf        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_a796cc5babf24d790d38cfc7dd844dad2e847e4_cab_0ad9a5a1     :     : 0   : a295c5c6-7ba1-11e5-8cc0-0019db4d6dee   : 6  
                         2015-10-26 14:23:18                                  WinMgmt                         
                     2015-10-26 14:24:43                                  Software Protection Platform Service  900:      .    
                     2015-10-26 14:24:44                                  SecurityCenter                  1:     Windows .  
                     2015-10-26 14:24:45                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-26 14:24:45                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-26 14:24:45                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-26 14:26:54                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-26 14:26:54                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-26 14:27:14                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-26 14:27:14                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-26 14:27:15                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-27 06:52:50                                  EventSystem                     
                     2015-10-27 06:52:50                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-27 06:52:51                                  WinMgmt                         
                     2015-10-27 06:52:51                                  WinMgmt                         
                     2015-10-27 06:52:51                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-27 06:52:52                                  Winlogon                        4101:  Windows .  
                     2015-10-27 06:52:52                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-27 06:52:53                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-27 06:52:53                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-27 06:52:53                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-27 06:52:54                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258210)(?)(?)(?)])(1 )(2 )]    
                     2015-10-27 06:52:55                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-27 06:52:55                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258210)(?)(?)(?)])(1 )(2 )]    
                     2015-10-27 06:52:57                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/26 21:52, 0, 1, 258210, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-10-27 06:52:57                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 2277488, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-10-27 06:52:57                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/26 21:52, 0, 1, 258210, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-10-27 06:52:57                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/10/26 21:52  
             1          2015-10-27 06:52:58                                  ESENT                           102: Windows (2784) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-27 06:52:58                                  ESENT                           300: Windows (2784) Windows:     .  
             3          2015-10-27 06:52:58                                  ESENT                           301: Windows (2784) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-27 06:52:58                                  ESENT                           302: Windows (2784) Windows:    .  
             1          2015-10-27 06:52:59                                  Windows Search Service          1003:  Windows Search .   
                         2015-10-27 06:53:26                                  WinMgmt                         
                     2015-10-27 06:54:52                                  Software Protection Platform Service  900:      .    
                     2015-10-27 06:54:54                                  SecurityCenter                  1:     Windows .  
                     2015-10-27 06:54:54                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-27 06:54:54                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-27 06:54:54                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-27 06:56:14                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 0  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 47  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 0  : COM Addin for Microsoft Outlook Hotmail Connector : COM Addin for Microsoft Outlook Hotmail Connector ProgID: MSNCON.Addin.1 GUID: {DC67367A-8B15-47BC-B7F8-0BA0435A504A}   : 03 HKLM: 1 : C:\PROGRA~1\COMMON~1\SYSTEM\MSMAPI\MSNCON32.DLL   (): 0  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 15  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 0  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 0   
                     2015-10-27 06:56:14                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-10-27 06:56:14                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259197)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-27 06:56:16                                  Outlook                         30:    C:\Users\sima\AppData\Local\Microsoft\Outlook\aofso.pst   : Automatic Reconciliation.  
                     2015-10-27 06:56:17                                  Outlook                         30:    C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook0.ost   : Automatic Reconciliation.  
                     2015-10-27 06:56:28                                  Outlook                         38:     : C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook0.ost. : Added: 0, Deleted: 0, Modified: 0, Compared: 1338, Version: 14.0.4760.1000.  
                     2015-10-27 06:56:36                                  Outlook                         38:     : C:\Users\sima\AppData\Local\Microsoft\Outlook\aofso.pst. : Added: 0, Deleted: 0, Modified: 0, Compared: 798, Version: 14.0.4760.1000.  
                     2015-10-27 06:57:13                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-27 06:57:13                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-27 06:59:55                                  Software Protection Platform Service  903:     .    
                     2015-10-27 07:07:51                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-27 07:07:51                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-27 07:07:52                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-29 13:06:39                                  EventSystem                     
                     2015-10-29 13:06:39                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-29 13:06:40                                  WinMgmt                         
                     2015-10-29 13:06:40                                  Winlogon                        4101:  Windows .  
                     2015-10-29 13:06:40                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-29 13:06:40                                  WinMgmt                         
                     2015-10-29 13:06:41                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-29 13:06:42                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-29 13:06:42                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-29 13:06:42                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-29 13:06:43                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 255947)(?)(?)(?)])(1 )(2 )]    
                     2015-10-29 13:06:43                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-29 13:06:44                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 255947)(?)(?)(?)])(1 )(2 )]    
                     2015-10-29 13:06:45                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/29 04:06, 0, 1, 255947, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-10-29 13:06:45                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/10/29 04:06  
             1          2015-10-29 13:06:47                                  ESENT                           102: Windows (2720) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-29 13:06:47                                  ESENT                           300: Windows (2720) Windows:     .  
             3          2015-10-29 13:06:47                                  ESENT                           301: Windows (2720) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001D4.log.  
             3          2015-10-29 13:06:47                                  ESENT                           301: Windows (2720) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001D5.log.  
             3          2015-10-29 13:06:48                                  ESENT                           301: Windows (2720) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-29 13:06:48                                  ESENT                           302: Windows (2720) Windows:    .  
             1          2015-10-29 13:06:49                                  Windows Search Service          1003:  Windows Search .   
                         2015-10-29 13:07:15                                  WinMgmt                         
                     2015-10-29 13:08:41                                  Software Protection Platform Service  900:      .    
                     2015-10-29 13:08:41                                  SecurityCenter                  1:     Windows .  
                     2015-10-29 13:08:42                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-29 13:08:42                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-29 13:08:42                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-29 13:10:50                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-29 13:10:50                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-29 13:13:42                                  Software Protection Platform Service  903:     .    
                     2015-10-29 13:37:06                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-10-29 13:37:06                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259170)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-29 16:33:09                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258994)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-29 16:33:24                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-29 16:33:24                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-29 16:33:25                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-31 19:16:32                                  EventSystem                     
                     2015-10-31 19:16:32                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-31 19:16:33                                  WinMgmt                         
                     2015-10-31 19:16:33                                  WinMgmt                         
                     2015-10-31 19:16:33                                  Winlogon                        4101:  Windows .  
                     2015-10-31 19:16:33                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-31 19:16:34                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-31 19:16:35                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-31 19:16:35                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-31 19:16:36                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-31 19:16:37                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 255951)(?)(?)(?)])(1 )(2 )]    
                     2015-10-31 19:16:37                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-31 19:16:38                                  Windows Error Reporting         1001:   ,  0   : PnPRequestAdditionalSoftware  :     CAB: 0     :  P1: x86  P2: USB\VID_044F&PID_B323&REV_0103  P3: 6.1.1.0  P4: 0419  P5: input.inf  P6: *  P7:   P8:   P9:   P10:      :        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_abc2797e0a7cbe292633d12bb8fe014b3d1514_0a6d5f13     :     : 0   : 78301b8b-7fb8-11e5-8573-0000db4d6dee   : 6  
                     2015-10-31 19:16:38                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 255951)(?)(?)(?)])(1 )(2 )]    
                     2015-10-31 19:16:38                                  Windows Error Reporting         1001:   ,  0   : PnPRequestAdditionalSoftware  :     CAB: 0     :  P1: x86  P2: HID\VID_044F&PID_B323&REV_0103  P3: 6.1.1.0  P4: 0419  P5: input.inf  P6: *  P7:   P8:   P9:   P10:      :        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_c2884350b734f532d022832cc2f8209decc182fb_0a6d606a     :     : 0   : 78301b8c-7fb8-11e5-8573-0000db4d6dee   : 6  
                     2015-10-31 19:16:39                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/31 10:16, 0, 1, 255951, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-10-31 19:16:39                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 8660712, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-10-31 19:16:40                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/31 10:16, 0, 1, 255951, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-10-31 19:16:40                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 8662376, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-10-31 19:16:40                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/31 10:16, 0, 1, 255951, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
             1          2015-10-31 19:16:40                                  ESENT                           102: Windows (2848) Windows:   (6.01.7601.0000)    (0).  
             3          2015-10-31 19:16:40                                  ESENT                           300: Windows (2848) Windows:     .  
             3          2015-10-31 19:16:40                                  ESENT                           301: Windows (2848) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-31 19:16:40                                  ESENT                           302: Windows (2848) Windows:    .  
                     2015-10-31 19:16:41                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/10/31 10:16  
             1          2015-10-31 19:16:41                                  Windows Search Service          1003:  Windows Search .   
                         2015-10-31 19:17:08                                  WinMgmt                         
                     2015-10-31 19:17:32                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-31 19:17:32                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-31 19:17:33                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-10-31 19:19:38                                  EventSystem                     
                     2015-10-31 19:19:38                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-10-31 19:19:39                                  WinMgmt                         
                     2015-10-31 19:19:40                                  WinMgmt                         
                     2015-10-31 19:19:40                                  Winlogon                        4101:  Windows .  
                     2015-10-31 19:19:40                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-31 19:19:41                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-10-31 19:19:42                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-31 19:19:42                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-10-31 19:19:42                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-31 19:19:43                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259197)(?)(?)(?)])(1 )(2 )]    
                     2015-10-31 19:19:44                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-31 19:19:44                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259197)(?)(?)(?)])(1 )(2 )]    
                     2015-10-31 19:19:46                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/31 10:19, 0, 1, 259197, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-10-31 19:19:46                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 4433120, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-10-31 19:19:46                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/31 10:19, 0, 1, 259197, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-10-31 19:19:46                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/10/31 10:19  
             1          2015-10-31 19:19:47                                  ESENT                           102: Windows (2692) Windows:   (6.01.7601.0000)    (0).  
             1          2015-10-31 19:19:47                                  Windows Search Service          1003:  Windows Search .   
             3          2015-10-31 19:19:47                                  ESENT                           300: Windows (2692) Windows:     .  
             3          2015-10-31 19:19:47                                  ESENT                           301: Windows (2692) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-10-31 19:19:47                                  ESENT                           302: Windows (2692) Windows:    .  
                         2015-10-31 19:20:15                                  WinMgmt                         
                     2015-10-31 19:21:41                                  Software Protection Platform Service  900:      .    
                     2015-10-31 19:21:42                                  SecurityCenter                  1:     Windows .  
                     2015-10-31 19:21:43                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-10-31 19:21:43                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-10-31 19:21:43                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-10-31 19:23:52                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-10-31 19:23:52                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-10-31 19:26:44                                  Software Protection Platform Service  903:     .    
                     2015-10-31 20:08:45                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-10-31 20:08:45                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-10-31 20:08:46                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-01 07:19:38                                  EventSystem                     
                     2015-11-01 07:19:38                                  WinMgmt                         
                     2015-11-01 07:19:38                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-01 07:19:39                                  WinMgmt                         
                     2015-11-01 07:19:39                                  Winlogon                        4101:  Windows .  
                     2015-11-01 07:19:39                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-01 07:19:40                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-01 07:19:41                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-01 07:19:41                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-01 07:19:41                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-01 07:19:42                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258481)(?)(?)(?)])(1 )(2 )]    
                     2015-11-01 07:19:43                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-01 07:19:43                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258481)(?)(?)(?)])(1 )(2 )]    
                     2015-11-01 07:19:45                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/10/31 22:19, 0, 1, 258481, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-01 07:19:45                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/10/31 22:19  
             1          2015-11-01 07:19:46                                  ESENT                           102: Windows (2792) Windows:   (6.01.7601.0000)    (0).  
             1          2015-11-01 07:19:46                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-01 07:19:46                                  ESENT                           300: Windows (2792) Windows:     .  
             3          2015-11-01 07:19:46                                  ESENT                           301: Windows (2792) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-01 07:19:46                                  ESENT                           302: Windows (2792) Windows:    .  
                         2015-11-01 07:20:14                                  WinMgmt                         
                     2015-11-01 07:21:40                                  Software Protection Platform Service  900:      .    
                     2015-11-01 07:21:41                                  SecurityCenter                  1:     Windows .  
                     2015-11-01 07:21:43                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-01 07:21:43                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-01 07:21:43                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-01 07:23:55                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-01 07:23:55                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-01 07:26:43                                  Software Protection Platform Service  903:     .    
                     2015-11-01 09:22:34                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-01 09:22:34                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-01 09:22:35                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-01 09:24:08                                  EventSystem                     
                     2015-11-01 09:24:08                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-01 09:24:11                                  WinMgmt                         
                     2015-11-01 09:24:11                                  WinMgmt                         
                     2015-11-01 09:24:12                                  Winlogon                        4101:  Windows .  
                     2015-11-01 09:24:12                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-01 09:24:12                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-01 09:24:16                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-01 09:24:16                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-01 09:24:16                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-01 09:24:17                                  Office Software Protection Platform Service  1040: Hardware has changed from previous boot.   AppId=59a52881-a989-479d-af46-f275c6370663, SkuId=6f327760-8c5c-417c-9b61-836a98287e0c.  
                     2015-11-01 09:24:17                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259076)(?)(?)(?)])(1 )(2 )]    
                     2015-11-01 09:24:18                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-01 09:24:19                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259076)(?)(?)(?)])(1 )(2 )]    
             1          2015-11-01 09:24:19                                  ESENT                           102: Windows (2676) Windows:   (6.01.7601.0000)    (0).  
             1          2015-11-01 09:24:19                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-01 09:24:19                                  ESENT                           300: Windows (2676) Windows:     .  
             3          2015-11-01 09:24:19                                  ESENT                           301: Windows (2676) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-01 09:24:19                                  ESENT                           302: Windows (2676) Windows:    .  
                     2015-11-01 09:24:20                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/01 00:24, 0, 1, 259076, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-01 09:24:20                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/01 00:24  
                     2015-11-01 09:24:30                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-01 09:24:31                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-01 09:24:31                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-01 09:26:10                                  EventSystem                     
                     2015-11-01 09:26:10                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-01 09:26:11                                  WinMgmt                         
                     2015-11-01 09:26:11                                  WinMgmt                         
                     2015-11-01 09:26:12                                  Winlogon                        4101:  Windows .  
                     2015-11-01 09:26:12                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-01 09:26:12                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-01 09:26:13                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-01 09:26:13                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-01 09:26:13                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-01 09:26:15                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259199)(?)(?)(?)])(1 )(2 )]    
                     2015-11-01 09:26:15                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-01 09:26:16                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259199)(?)(?)(?)])(1 )(2 )]    
                     2015-11-01 09:26:17                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/01 00:26, 0, 1, 259199, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-01 09:26:17                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/01 00:26  
             1          2015-11-01 09:26:18                                  ESENT                           102: Windows (2736) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-01 09:26:18                                  ESENT                           300: Windows (2736) Windows:     .  
             3          2015-11-01 09:26:18                                  ESENT                           301: Windows (2736) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-01 09:26:18                                  ESENT                           302: Windows (2736) Windows:    .  
             1          2015-11-01 09:26:19                                  Windows Search Service          1003:  Windows Search .   
                         2015-11-01 09:27:17                                  WinMgmt                         
                     2015-11-01 09:28:12                                  Software Protection Platform Service  900:      .    
                     2015-11-01 09:28:13                                  SecurityCenter                  1:     Windows .  
                     2015-11-01 09:28:14                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-01 09:28:14                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-01 09:28:14                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-01 09:30:56                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-01 09:30:56                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-01 09:33:14                                  Software Protection Platform Service  903:     .    
                     2015-11-01 09:33:38                                  Windows Error Reporting         1001:   ,  0   : PnPRequestAdditionalSoftware  :     CAB: 0     :  P1: x86  P2: USB\VID_044F&PID_B323&REV_0103  P3: 6.1.1.0  P4: 0419  P5: input.inf  P6: *  P7:   P8:   P9:   P10:      :        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_abc2797e0a7cbe292633d12bb8fe014b3d1514_0c1ba640     :     : 0   : 3132edf8-8030-11e5-af9e-0019db4d6dee   : 6  
                     2015-11-01 09:33:39                                  Windows Error Reporting         1001:   ,  0   : PnPRequestAdditionalSoftware  :     CAB: 0     :  P1: x86  P2: HID\VID_044F&PID_B323&REV_0103  P3: 6.1.1.0  P4: 0419  P5: input.inf  P6: *  P7:   P8:   P9:   P10:      :        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_c2884350b734f532d022832cc2f8209decc182fb_0c1ba7d6     :     : 0   : 3132edf9-8030-11e5-af9e-0019db4d6dee   : 6  
                     2015-11-01 09:34:07                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-01 09:34:07                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-01 09:34:08                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-01 16:14:43                                  EventSystem                     
                     2015-11-01 16:14:43                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-01 16:14:44                                  Winlogon                        4101:  Windows .  
                     2015-11-01 16:14:44                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-01 16:14:45                                  WinMgmt                         
                     2015-11-01 16:14:45                                  WinMgmt                         
                     2015-11-01 16:14:46                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-01 16:14:47                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-01 16:14:47                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-01 16:14:47                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-01 16:14:48                                  Office Software Protection Platform Service  1040: Hardware has changed from previous boot.   AppId=59a52881-a989-479d-af46-f275c6370663, SkuId=6f327760-8c5c-417c-9b61-836a98287e0c.  
                     2015-11-01 16:14:48                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258792)(?)(?)(?)])(1 )(2 )]    
                     2015-11-01 16:14:48                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-01 16:14:49                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258792)(?)(?)(?)])(1 )(2 )]    
                     2015-11-01 16:14:51                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/01 07:14, 0, 1, 258792, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-01 16:14:51                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/01 07:14  
             1          2015-11-01 16:14:51                                  ESENT                           102: Windows (2884) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-01 16:14:51                                  ESENT                           300: Windows (2884) Windows:     .  
             3          2015-11-01 16:14:51                                  ESENT                           301: Windows (2884) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             1          2015-11-01 16:14:52                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-01 16:14:52                                  ESENT                           302: Windows (2884) Windows:    .  
                         2015-11-01 16:15:19                                  WinMgmt                         
                     2015-11-01 16:16:46                                  Software Protection Platform Service  900:      .    
                     2015-11-01 16:16:47                                  SecurityCenter                  1:     Windows .  
                     2015-11-01 16:16:48                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-01 16:16:48                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-01 16:16:48                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-01 16:19:01                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-01 16:19:01                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-01 16:21:48                                  Software Protection Platform Service  903:     .    
                     2015-11-01 16:23:07                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-01 16:23:07                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-01 16:29:45                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 16  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 47  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 0  : COM Addin for Microsoft Outlook Hotmail Connector : COM Addin for Microsoft Outlook Hotmail Connector ProgID: MSNCON.Addin.1 GUID: {DC67367A-8B15-47BC-B7F8-0BA0435A504A}   : 03 HKLM: 1 : C:\PROGRA~1\COMMON~1\SYSTEM\MSMAPI\MSNCON32.DLL   (): 0  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 0  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 0  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 15   
                     2015-11-01 16:29:46                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-11-01 16:29:46                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259186)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-01 20:12:07                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-01 20:12:07                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-01 20:12:08                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-03 06:59:06                                  EventSystem                     
                     2015-11-03 06:59:06                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-03 06:59:10                                  Winlogon                        4101:  Windows .  
                     2015-11-03 06:59:10                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-03 06:59:11                                  WinMgmt                         
                     2015-11-03 06:59:11                                  WinMgmt                         
                     2015-11-03 06:59:11                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-03 06:59:13                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-03 06:59:13                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-03 06:59:13                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-03 06:59:14                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 256876)(?)(?)(?)])(1 )(2 )]    
                     2015-11-03 06:59:14                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-03 06:59:15                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 256876)(?)(?)(?)])(1 )(2 )]    
                     2015-11-03 06:59:16                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/02 21:59, 0, 1, 256876, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-03 06:59:16                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 9378032, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-03 06:59:17                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/02 21:59, 0, 1, 256876, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-03 06:59:17                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 9379696, 0, 0, 0, 0, 1601/01/01 00:00  
             1          2015-11-03 06:59:17                                  ESENT                           102: Windows (2800) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-03 06:59:17                                  ESENT                           300: Windows (2800) Windows:     .  
             3          2015-11-03 06:59:17                                  ESENT                           301: Windows (2800) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001D6.log.  
                     2015-11-03 06:59:18                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/02 21:59, 0, 1, 256876, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-03 06:59:18                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 9380272, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-03 06:59:18                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/02 21:59, 0, 1, 256876, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-03 06:59:18                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/02 21:59  
             3          2015-11-03 06:59:18                                  ESENT                           301: Windows (2800) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001D7.log.  
             3          2015-11-03 06:59:18                                  ESENT                           301: Windows (2800) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             1          2015-11-03 06:59:19                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-03 06:59:19                                  ESENT                           302: Windows (2800) Windows:    .  
                     2015-11-03 06:59:46                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-11-03 06:59:46                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259200)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-03 06:59:46                                  Outlook                         30:    C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook0.ost   : Automatic Reconciliation.  
                     2015-11-03 06:59:48                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 109  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 453  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 47  : COM Addin for Microsoft Outlook Hotmail Connector : COM Addin for Microsoft Outlook Hotmail Connector ProgID: MSNCON.Addin.1 GUID: {DC67367A-8B15-47BC-B7F8-0BA0435A504A}   : 03 HKLM: 1 : C:\PROGRA~1\COMMON~1\SYSTEM\MSMAPI\MSNCON32.DLL   (): 0  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 16  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 15  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 125   
                     2015-11-03 07:00:03                                  Outlook                         38:     : C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook0.ost. : Added: 0, Deleted: 0, Modified: 0, Compared: 1350, Version: 14.0.4760.1000.  
                         2015-11-03 07:00:52                                  WinMgmt                         
                     2015-11-03 07:01:12                                  Software Protection Platform Service  900:      .    
                     2015-11-03 07:01:13                                  SecurityCenter                  1:     Windows .  
                     2015-11-03 07:01:13                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-03 07:01:14                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-03 07:01:14                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-03 07:02:46                                  Outlook                         30:    C:\Users\sima\AppData\Local\Microsoft\Outlook\aofso.pst   : Automatic Reconciliation.  
                     2015-11-03 07:02:51                                  Outlook                         38:     : C:\Users\sima\AppData\Local\Microsoft\Outlook\aofso.pst. : Added: 0, Deleted: 0, Modified: 0, Compared: 790, Version: 14.0.4760.1000.  
                     2015-11-03 07:03:45                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-03 07:03:45                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-03 07:06:09                                  Software Protection Platform Service  903:     .    
                     2015-11-03 07:13:07                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-03 07:13:07                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-03 07:13:08                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-03 22:21:26                                  EventSystem                     
                     2015-11-03 22:21:26                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-03 22:21:28                                  Winlogon                        4101:  Windows .  
                     2015-11-03 22:21:28                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-03 22:21:31                                  WinMgmt                         
                     2015-11-03 22:21:31                                  WinMgmt                         
                     2015-11-03 22:21:32                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-03 22:21:34                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-03 22:21:34                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-03 22:21:34                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-03 22:21:35                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258278)(?)(?)(?)])(1 )(2 )]    
                     2015-11-03 22:21:36                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-03 22:21:37                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258278)(?)(?)(?)])(1 )(2 )]    
                     2015-11-03 22:21:38                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/03 13:21, 0, 1, 258278, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-03 22:21:38                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 3078672, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-03 22:21:38                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/03 13:21, 0, 1, 258278, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-03 22:21:39                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/03 13:21  
             1          2015-11-03 22:21:39                                  ESENT                           102: Windows (2684) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-03 22:21:39                                  ESENT                           300: Windows (2684) Windows:     .  
             3          2015-11-03 22:21:39                                  ESENT                           301: Windows (2684) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001D8.log.  
             3          2015-11-03 22:21:40                                  ESENT                           301: Windows (2684) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             1          2015-11-03 22:21:41                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-03 22:21:41                                  ESENT                           302: Windows (2684) Windows:    .  
                     2015-11-03 22:22:13                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-11-03 22:22:13                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259200)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                         2015-11-03 22:23:12                                  WinMgmt                         
                     2015-11-03 22:23:33                                  Software Protection Platform Service  900:      .    
                     2015-11-03 22:23:33                                  SecurityCenter                  1:     Windows .  
                     2015-11-03 22:23:34                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-03 22:23:34                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-03 22:23:34                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-03 22:25:41                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-03 22:25:41                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-03 22:28:35                                  Software Protection Platform Service  903:     .    
                     2015-11-03 22:38:28                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259184)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-03 22:46:19                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259176)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-03 22:46:20                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259176)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-04 00:08:28                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259094)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-04 02:13:10                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258969)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-04 02:46:58                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-04 02:46:58                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-04 02:47:00                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-04 02:47:57                                  EventSystem                     
                     2015-11-04 02:47:57                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-04 02:47:59                                  Winlogon                        4101:  Windows .  
                     2015-11-04 02:47:59                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-04 02:48:03                                  WinMgmt                         
                     2015-11-04 02:48:03                                  WinMgmt                         
                     2015-11-04 02:48:03                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-04 02:48:04                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-04 02:48:04                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-04 02:48:04                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-04 02:48:05                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258934)(?)(?)(?)])(1 )(2 )]    
                     2015-11-04 02:48:06                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-04 02:48:07                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258934)(?)(?)(?)])(1 )(2 )]    
                     2015-11-04 02:48:09                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/03 17:48, 0, 1, 258934, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-04 02:48:09                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/03 17:48  
             1          2015-11-04 02:48:11                                  ESENT                           102: Windows (3108) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-04 02:48:11                                  ESENT                           300: Windows (3108) Windows:     .  
             3          2015-11-04 02:48:11                                  ESENT                           301: Windows (3108) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001D9.log.  
             3          2015-11-04 02:48:12                                  ESENT                           301: Windows (3108) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-04 02:48:13                                  ESENT                           302: Windows (3108) Windows:    .  
             1          2015-11-04 02:48:14                                  Windows Search Service          1003:  Windows Search .   
                         2015-11-04 02:49:44                                  WinMgmt                         
                     2015-11-04 02:50:04                                  Software Protection Platform Service  900:      .    
                     2015-11-04 02:50:08                                  SecurityCenter                  1:     Windows .  
                     2015-11-04 02:50:08                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-04 02:50:08                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-04 02:50:08                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-04 02:52:23                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-04 02:52:23                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-04 02:55:08                                  Software Protection Platform Service  903:     .    
                     2015-11-04 02:55:51                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-04 02:55:51                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-04 02:55:52                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-04 21:10:37                                  EventSystem                     
                     2015-11-04 21:10:37                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-04 21:10:38                                  Winlogon                        4101:  Windows .  
                     2015-11-04 21:10:38                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-04 21:10:42                                  WinMgmt                         
                     2015-11-04 21:10:42                                  WinMgmt                         
                     2015-11-04 21:10:42                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-04 21:10:43                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-04 21:10:43                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-04 21:10:43                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-04 21:10:46                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258098)(?)(?)(?)])(1 )(2 )]    
                     2015-11-04 21:10:46                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-04 21:10:47                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258098)(?)(?)(?)])(1 )(2 )]    
                     2015-11-04 21:10:48                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/04 12:10, 0, 1, 258098, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-04 21:10:48                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 8091288, 0, 0, 0, 0, 1601/01/01 00:00  
             1          2015-11-04 21:10:48                                  ESENT                           102: Windows (2760) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-04 21:10:48                                  ESENT                           300: Windows (2760) Windows:     .  
             3          2015-11-04 21:10:48                                  ESENT                           301: Windows (2760) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-04 21:10:48                                  ESENT                           302: Windows (2760) Windows:    .  
                     2015-11-04 21:10:49                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/04 12:10, 0, 1, 258098, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-04 21:10:49                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/04 12:10  
             1          2015-11-04 21:10:49                                  Windows Search Service          1003:  Windows Search .   
                         2015-11-04 21:12:24                                  WinMgmt                         
                     2015-11-04 21:12:43                                  Software Protection Platform Service  900:      .    
                     2015-11-04 21:12:44                                  SecurityCenter                  1:     Windows .  
                     2015-11-04 21:12:44                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-04 21:12:44                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-04 21:12:45                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-04 21:14:51                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-04 21:14:52                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-04 21:17:45                                  Software Protection Platform Service  903:     .    
                     2015-11-04 21:51:01                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 16  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 62  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 0  : COM Addin for Microsoft Outlook Hotmail Connector : COM Addin for Microsoft Outlook Hotmail Connector ProgID: MSNCON.Addin.1 GUID: {DC67367A-8B15-47BC-B7F8-0BA0435A504A}   : 03 HKLM: 1 : C:\PROGRA~1\COMMON~1\SYSTEM\MSMAPI\MSNCON32.DLL   (): 0  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 0  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 16  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 0   
                     2015-11-04 21:51:02                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-11-04 21:51:02                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259160)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-04 21:57:05                                  Microsoft-Windows-CAPI2         4100:         <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/503006091D97D4F5AE39F7CBE7927D7D652D3431.crt>.  
                     2015-11-04 21:57:05                                  Microsoft-Windows-CAPI2         4097:      :: : <CN=Entrust.net Certification Authority (2048), OU=(c) 1999 Entrust.net Limited, OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.), O=Entrust.net>;  SHA1: <503006091D97D4F5AE39F7CBE7927D7D652D3431>.  
                     2015-11-04 22:44:43                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-04 22:44:43                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-04 22:44:44                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-05 07:25:33                                  EventSystem                     
                     2015-11-05 07:25:33                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-05 07:25:35                                  Winlogon                        4101:  Windows .  
                     2015-11-05 07:25:35                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-05 07:25:36                                  WinMgmt                         
                     2015-11-05 07:25:38                                  WinMgmt                         
                     2015-11-05 07:25:41                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-05 07:25:42                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-05 07:25:42                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-05 07:25:42                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 07:25:43                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258586)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 07:25:43                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 07:25:44                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258586)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 07:25:47                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/04 22:25, 0, 1, 258586, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-05 07:25:47                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/04 22:25  
             1          2015-11-05 07:25:47                                  ESENT                           102: Windows (2732) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-05 07:25:47                                  ESENT                           300: Windows (2732) Windows:     .  
             3          2015-11-05 07:25:47                                  ESENT                           301: Windows (2732) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             1          2015-11-05 07:25:49                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-05 07:25:49                                  ESENT                           302: Windows (2732) Windows:    .  
                         2015-11-05 07:27:20                                  WinMgmt                         
                     2015-11-05 07:27:40                                  Software Protection Platform Service  900:      .    
                     2015-11-05 07:27:41                                  SecurityCenter                  1:     Windows .  
                     2015-11-05 07:27:42                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-05 07:27:42                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 07:27:42                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-05 07:29:46                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-05 07:29:46                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-05 07:32:42                                  Software Protection Platform Service  903:     .    
                     2015-11-05 07:36:45                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-05 07:36:45                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-05 07:36:46                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-05 09:20:02                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-05 09:20:03                                  EventSystem                     
                     2015-11-05 09:20:03                                  Winlogon                        4101:  Windows .  
                     2015-11-05 09:20:04                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-05 09:20:06                                  WinMgmt                         
                     2015-11-05 09:20:06                                  WinMgmt                         
                     2015-11-05 09:20:07                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-05 09:20:08                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-05 09:20:08                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-05 09:20:08                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 09:20:09                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259086)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 09:20:09                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 09:20:10                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259086)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 09:20:12                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/05 00:20, 0, 1, 259086, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-05 09:20:12                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/05 00:20  
             1          2015-11-05 09:20:15                                  ESENT                           102: Windows (2904) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-05 09:20:15                                  ESENT                           300: Windows (2904) Windows:     .  
             1          2015-11-05 09:20:16                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-05 09:20:16                                  ESENT                           301: Windows (2904) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-05 09:20:16                                  ESENT                           302: Windows (2904) Windows:    .  
                         2015-11-05 09:21:49                                  WinMgmt                         
                     2015-11-05 09:22:07                                  Software Protection Platform Service  900:      .    
                     2015-11-05 09:22:09                                  SecurityCenter                  1:     Windows .  
                     2015-11-05 09:22:12                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-05 09:22:12                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 09:22:12                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-05 09:24:18                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-05 09:24:18                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-05 09:27:12                                  Software Protection Platform Service  903:     .    
                     2015-11-05 10:18:09                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-11-05 10:18:09                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259143)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 11:03:22                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-05 11:03:22                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-05 11:03:23                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-05 12:51:06                                  EventSystem                     
                     2015-11-05 12:51:06                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-05 12:51:07                                  Winlogon                        4101:  Windows .  
                     2015-11-05 12:51:07                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-05 12:51:10                                  WinMgmt                         
                     2015-11-05 12:51:11                                  WinMgmt                         
                     2015-11-05 12:51:11                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-05 12:51:12                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-05 12:51:12                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-05 12:51:12                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 12:51:13                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258989)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 12:51:14                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 12:51:15                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258989)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 12:51:16                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/05 03:51, 0, 1, 258989, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-05 12:51:16                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 4017992, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-05 12:51:17                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/05 03:51, 0, 1, 258989, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-05 12:51:17                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/05 03:51  
             1          2015-11-05 12:51:17                                  ESENT                           102: Windows (2852) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-05 12:51:17                                  ESENT                           300: Windows (2852) Windows:     .  
             3          2015-11-05 12:51:17                                  ESENT                           301: Windows (2852) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             1          2015-11-05 12:51:18                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-05 12:51:18                                  ESENT                           302: Windows (2852) Windows:    .  
                         2015-11-05 12:52:52                                  WinMgmt                         
                     2015-11-05 12:53:11                                  Software Protection Platform Service  900:      .    
                     2015-11-05 12:53:12                                  SecurityCenter                  1:     Windows .  
                     2015-11-05 12:53:13                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-05 12:53:13                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 12:53:13                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-05 12:55:37                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-05 12:55:37                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-05 12:58:13                                  Software Protection Platform Service  903:     .    
                     2015-11-05 14:05:35                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-05 14:05:35                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-05 14:05:36                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-05 14:08:01                                  EventSystem                     
                     2015-11-05 14:08:01                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-05 14:08:04                                  Winlogon                        4101:  Windows .  
                     2015-11-05 14:08:04                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-05 14:08:06                                  WinMgmt                         
                     2015-11-05 14:08:07                                  WinMgmt                         
                     2015-11-05 14:08:07                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-05 14:08:08                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-05 14:08:08                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-05 14:08:08                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 14:08:09                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259124)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 14:08:10                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 14:08:11                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259124)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 14:08:12                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/05 05:08, 0, 1, 259124, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-05 14:08:12                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 8288120, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-05 14:08:13                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/05 05:08, 0, 1, 259124, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-05 14:08:13                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 8288824, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-05 14:08:13                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/05 05:08, 0, 1, 259124, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-05 14:08:13                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 8287288, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-05 14:08:14                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/05 05:08, 0, 1, 259124, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-05 14:08:14                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 8289400, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-05 14:08:14                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/05 05:08, 0, 1, 259124, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-05 14:08:14                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 8288760, 0, 0, 0, 0, 1601/01/01 00:00  
             1          2015-11-05 14:08:14                                  ESENT                           102: Windows (3040) Windows:   (6.01.7601.0000)    (0).  
             1          2015-11-05 14:08:14                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-05 14:08:14                                  ESENT                           300: Windows (3040) Windows:     .  
             3          2015-11-05 14:08:14                                  ESENT                           301: Windows (3040) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-05 14:08:14                                  ESENT                           302: Windows (3040) Windows:    .  
                     2015-11-05 14:08:15                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/05 05:08, 0, 1, 259124, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-05 14:08:15                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 8287352, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-05 14:08:16                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/05 05:08, 0, 1, 259124, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-05 14:08:16                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 8289464, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-05 14:08:16                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/05 05:08, 0, 1, 259124, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-05 14:08:16                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/05 05:08  
                         2015-11-05 14:09:49                                  WinMgmt                         
                     2015-11-05 14:10:15                                  Software Protection Platform Service  900:      .    
                     2015-11-05 14:10:17                                  SecurityCenter                  1:     Windows .  
                     2015-11-05 14:10:17                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-05 14:10:17                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 14:10:17                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-05 14:12:46                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-05 14:12:46                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-05 14:15:17                                  Software Protection Platform Service  903:     .    
                     2015-11-05 14:15:51                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-05 14:15:51                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-05 14:15:52                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-05 21:48:50                                  EventSystem                     
                     2015-11-05 21:48:50                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-05 21:48:53                                  Winlogon                        4101:  Windows .  
                     2015-11-05 21:48:53                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-05 21:48:55                                  WinMgmt                         
                     2015-11-05 21:48:56                                  WinMgmt                         
                     2015-11-05 21:48:57                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-05 21:48:58                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-05 21:48:58                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-05 21:48:58                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 21:48:58                                  Office Software Protection Platform Service  1040: Hardware has changed from previous boot.   AppId=59a52881-a989-479d-af46-f275c6370663, SkuId=6f327760-8c5c-417c-9b61-836a98287e0c.  
                     2015-11-05 21:48:59                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258740)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 21:48:59                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 21:49:00                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258740)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 21:49:02                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/05 12:49, 0, 1, 258740, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-05 21:49:02                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 8947472, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-05 21:49:02                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/05 12:49, 0, 1, 258740, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-05 21:49:03                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/05 12:49  
             1          2015-11-05 21:49:04                                  ESENT                           102: Windows (2840) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-05 21:49:04                                  ESENT                           300: Windows (2840) Windows:     .  
             3          2015-11-05 21:49:04                                  ESENT                           301: Windows (2840) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-05 21:49:04                                  ESENT                           302: Windows (2840) Windows:    .  
             1          2015-11-05 21:49:05                                  Windows Search Service          1003:  Windows Search .   
                         2015-11-05 21:50:36                                  WinMgmt                         
                     2015-11-05 21:50:57                                  Software Protection Platform Service  900:      .    
                     2015-11-05 21:50:58                                  SecurityCenter                  1:     Windows .  
                     2015-11-05 21:50:59                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-05 21:50:59                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 21:50:59                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-05 21:53:10                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-05 21:53:11                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-05 21:55:59                                  Software Protection Platform Service  903:     .    
                     2015-11-05 23:27:37                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-11-05 23:27:37                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259102)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 23:36:34                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259093)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 23:36:58                                  Microsoft-Windows-CAPI2         4097:      :: : <CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE>;  SHA1: <B1BC968BD4F49D622AA89A81F2150152A41D829C>.  
                     2015-11-05 23:37:22                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259092)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 23:38:42                                  Windows Error Reporting         1001:   ,  0   : MSHTMLLAYOUTHARDASSERT  :     CAB: 0     :  P1: iexplore.exe  P2: 8.00.7600.16385 (win7_rtm.090713-1255)  P3: mshtml.dll  P4: 8.00.7600.16385 (win7_rtm.090713-1255)  P5: 0x002C8725  P6:   P7:   P8:   P9:   P10:      :        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportArchive\NonCritical_iexplore.exe_12df8271b62395a348f102b12959f9768e2baf9_0b90cdf8     :     : 0   : e8d025b4-83ca-11e5-a317-0019db4d6dee   : 0  
                     2015-11-05 23:39:01                                  Microsoft-Windows-CAPI2         4097:      :: : <CN=GTE CyberTrust Global Root, OU="GTE CyberTrust Solutions, Inc.", O=GTE Corporation, C=US>;  SHA1: <97817950D81C9670CC34D809CF794431367EF474>.  
                     2015-11-05 23:53:32                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259076)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-05 23:54:22                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259075)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-06 00:04:11                                  Desktop Window Manager          9010:  (Disciples II)          
                     2015-11-06 00:04:11                                  Desktop Window Manager          9013:       ,          
                     2015-11-06 02:37:55                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258912)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-06 03:55:04                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258834)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-06 03:55:25                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258834)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-06 05:00:38                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-06 05:00:38                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-06 05:00:39                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-07 11:48:40                                  EventSystem                     
                     2015-11-07 11:48:40                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-07 11:48:43                                  Winlogon                        4101:  Windows .  
                     2015-11-07 11:48:43                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-07 11:48:45                                  WinMgmt                         
                     2015-11-07 11:48:46                                  WinMgmt                         
                     2015-11-07 11:48:46                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-07 11:48:47                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-07 11:48:47                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-07 11:48:47                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-07 11:48:48                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 256921)(?)(?)(?)])(1 )(2 )]    
                     2015-11-07 11:48:48                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-07 11:48:49                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 256921)(?)(?)(?)])(1 )(2 )]    
                     2015-11-07 11:48:51                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/07 02:48, 0, 1, 256921, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-07 11:48:51                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/07 02:48  
             1          2015-11-07 11:48:53                                  ESENT                           102: Windows (2756) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-07 11:48:53                                  ESENT                           300: Windows (2756) Windows:     .  
             3          2015-11-07 11:48:53                                  ESENT                           301: Windows (2756) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001EF.log.  
             3          2015-11-07 11:48:53                                  ESENT                           301: Windows (2756) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001F0.log.  
             3          2015-11-07 11:48:54                                  ESENT                           301: Windows (2756) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-07 11:48:54                                  ESENT                           302: Windows (2756) Windows:    .  
             1          2015-11-07 11:48:55                                  Windows Search Service          1003:  Windows Search .   
                         2015-11-07 11:50:26                                  WinMgmt                         
                     2015-11-07 11:50:47                                  Software Protection Platform Service  900:      .    
                     2015-11-07 11:50:47                                  SecurityCenter                  1:     Windows .  
                     2015-11-07 11:50:48                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-07 11:50:48                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-07 11:50:48                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-07 11:52:55                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-07 11:52:55                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-07 11:55:48                                  Software Protection Platform Service  903:     .    
                     2015-11-07 14:09:27                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-07 14:09:28                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-07 14:09:29                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-07 17:01:01                                  EventSystem                     
                     2015-11-07 17:01:01                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-07 17:01:04                                  Winlogon                        4101:  Windows .  
                     2015-11-07 17:01:04                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-07 17:01:07                                  WinMgmt                         
                     2015-11-07 17:01:08                                  WinMgmt                         
                     2015-11-07 17:01:08                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-07 17:01:09                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-07 17:01:09                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-07 17:01:09                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-07 17:01:10                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258888)(?)(?)(?)])(1 )(2 )]    
                     2015-11-07 17:01:11                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-07 17:01:12                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258888)(?)(?)(?)])(1 )(2 )]    
                     2015-11-07 17:01:13                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/07 08:01, 0, 1, 258888, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-07 17:01:13                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 4486808, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-07 17:01:14                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/07 08:01, 0, 1, 258888, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-07 17:01:14                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 4487512, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-07 17:01:14                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/07 08:01, 0, 1, 258888, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-07 17:01:14                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 4485976, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-07 17:01:15                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/07 08:01, 0, 1, 258888, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-07 17:01:15                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/07 08:01  
             1          2015-11-07 17:01:16                                  ESENT                           102: Windows (2828) Windows:   (6.01.7601.0000)    (0).  
             1          2015-11-07 17:01:17                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-07 17:01:17                                  ESENT                           300: Windows (2828) Windows:     .  
             3          2015-11-07 17:01:17                                  ESENT                           301: Windows (2828) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001F1.log.  
             3          2015-11-07 17:01:17                                  ESENT                           301: Windows (2828) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-07 17:01:17                                  ESENT                           302: Windows (2828) Windows:    .  
                         2015-11-07 17:02:49                                  WinMgmt                         
                     2015-11-07 17:03:08                                  Software Protection Platform Service  900:      .    
                     2015-11-07 17:03:09                                  SecurityCenter                  1:     Windows .  
                     2015-11-07 17:03:09                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-07 17:03:10                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-07 17:03:10                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-07 17:05:31                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-07 17:05:31                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-07 17:08:10                                  Software Protection Platform Service  903:     .    
                     2015-11-07 18:02:37                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-07 18:02:37                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-07 18:02:38                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-09 06:31:26                                  EventSystem                     
                     2015-11-09 06:31:26                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-09 06:31:30                                  Winlogon                        4101:  Windows .  
                     2015-11-09 06:31:30                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-09 06:31:32                                  WinMgmt                         
                     2015-11-09 06:31:34                                  WinMgmt                         
                     2015-11-09 06:31:34                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-09 06:31:35                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-09 06:31:35                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-09 06:31:35                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-09 06:31:36                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 256950)(?)(?)(?)])(1 )(2 )]    
                     2015-11-09 06:31:36                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-09 06:31:37                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 256950)(?)(?)(?)])(1 )(2 )]    
                     2015-11-09 06:31:39                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/08 21:31, 0, 1, 256950, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-09 06:31:39                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 3503992, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-09 06:31:40                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/08 21:31, 0, 1, 256950, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-09 06:31:40                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/08 21:31  
             1          2015-11-09 06:31:42                                  ESENT                           102: Windows (2852) Windows:   (6.01.7601.0000)    (0).  
             1          2015-11-09 06:31:43                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-09 06:31:43                                  ESENT                           300: Windows (2852) Windows:     .  
             3          2015-11-09 06:31:43                                  ESENT                           301: Windows (2852) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-09 06:31:43                                  ESENT                           302: Windows (2852) Windows:    .  
                     2015-11-09 06:32:20                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-11-09 06:32:20                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259200)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-09 06:32:21                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 140  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 1391  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 234  : COM Addin for Microsoft Outlook Hotmail Connector : COM Addin for Microsoft Outlook Hotmail Connector ProgID: MSNCON.Addin.1 GUID: {DC67367A-8B15-47BC-B7F8-0BA0435A504A}   : 03 HKLM: 1 : C:\PROGRA~1\COMMON~1\SYSTEM\MSMAPI\MSNCON32.DLL   (): 16  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 31  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 31  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 110   
                         2015-11-09 06:33:12                                  WinMgmt                         
                     2015-11-09 06:33:34                                  Software Protection Platform Service  900:      .    
                     2015-11-09 06:33:36                                  SecurityCenter                  1:     Windows .  
                     2015-11-09 06:33:36                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-09 06:33:36                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-09 06:33:36                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                 101        2015-11-09 06:35:12                                  Application Hang                1002:  uTorrent.exe  3.2.0.27636    Windows   .  ,      ,         .     : 950     : 01d11a6d32980a6e     : 14     : C:\Program Files\uTorrent\uTorrent.exe     : 951b15be-8660-11e5-8041-0000db4d6dee    
                     2015-11-09 06:35:12                                  Windows Error Reporting         1001:   ,  0   : AppHangB1  :     CAB: 0     :  P1: uTorrent.exe  P2: 3.2.0.27636  P3: 501089a8  P4: 9376  P5: 0  P6:   P7:   P8:   P9:   P10:      :        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_uTorrent.exe_198f3a18c2ba52e74879af63303f8882521cd23_0ab3de3c     :     : 0   : 951b15be-8660-11e5-8041-0000db4d6dee   : 0  
                     2015-11-09 06:35:39                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-09 06:35:39                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-09 06:38:23                                  Software Protection Platform Service  903:     .    
                     2015-11-09 06:42:28                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259190)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-09 07:05:05                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-09 07:05:05                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-09 07:10:30                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-09 07:10:30                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-09 07:10:31                                  Office Software Protection Platform Service  903: The Software Protection service has stopped.    
                     2015-11-09 07:10:31                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-10 01:26:53                                  EventSystem                     
                     2015-11-10 01:26:53                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-10 01:26:58                                  Winlogon                        4101:  Windows .  
                     2015-11-10 01:26:58                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-10 01:27:00                                  WinMgmt                         
                     2015-11-10 01:27:01                                  WinMgmt                         
                     2015-11-10 01:27:01                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-10 01:27:02                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-10 01:27:02                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-10 01:27:02                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-10 01:27:03                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258065)(?)(?)(?)])(1 )(2 )]    
                     2015-11-10 01:27:04                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-10 01:27:04                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258065)(?)(?)(?)])(1 )(2 )]    
                     2015-11-10 01:27:06                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/09 16:27, 0, 1, 258065, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-10 01:27:07                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/09 16:27  
             1          2015-11-10 01:27:07                                  ESENT                           102: Windows (2916) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-10 01:27:07                                  ESENT                           300: Windows (2916) Windows:     .  
             3          2015-11-10 01:27:07                                  ESENT                           301: Windows (2916) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001F2.log.  
             3          2015-11-10 01:27:08                                  ESENT                           301: Windows (2916) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             1          2015-11-10 01:27:10                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-10 01:27:10                                  ESENT                           302: Windows (2916) Windows:    .  
                     2015-11-10 01:28:24                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-10 01:28:24                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                         2015-11-10 01:28:40                                  WinMgmt                         
                     2015-11-10 01:29:02                                  Software Protection Platform Service  900:      .    
                     2015-11-10 01:29:03                                  SecurityCenter                  1:     Windows .  
                     2015-11-10 01:29:04                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-10 01:29:04                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-10 01:29:04                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-10 01:31:38                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-10 01:31:38                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-10 01:32:11                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-11-10 01:32:11                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259195)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-10 01:34:04                                  Software Protection Platform Service  903:     .    
                     2015-11-10 05:09:03                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-10 05:09:03                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-10 05:09:04                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-11 01:24:53                                  EventSystem                     
                     2015-11-11 01:24:53                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-11 01:24:57                                  Winlogon                        4101:  Windows .  
                     2015-11-11 01:24:57                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-11 01:24:58                                  WinMgmt                         
                     2015-11-11 01:24:59                                  WinMgmt                         
                     2015-11-11 01:25:00                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-11 01:25:02                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-11 01:25:02                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-11 01:25:02                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-11 01:25:03                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 257763)(?)(?)(?)])(1 )(2 )]    
                     2015-11-11 01:25:03                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-11 01:25:04                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 257763)(?)(?)(?)])(1 )(2 )]    
                     2015-11-11 01:25:06                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/10 16:25, 0, 1, 257763, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-11 01:25:06                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/10 16:25  
             1          2015-11-11 01:25:07                                  ESENT                           102: Windows (2892) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-11 01:25:07                                  ESENT                           300: Windows (2892) Windows:     .  
             3          2015-11-11 01:25:07                                  ESENT                           301: Windows (2892) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             1          2015-11-11 01:25:08                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-11 01:25:08                                  ESENT                           302: Windows (2892) Windows:    .  
                         2015-11-11 01:26:39                                  WinMgmt                         
                     2015-11-11 01:27:00                                  Software Protection Platform Service  900:      .    
                     2015-11-11 01:27:02                                  SecurityCenter                  1:     Windows .  
                     2015-11-11 01:27:02                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-11 01:27:02                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-11 01:27:02                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-11 01:29:21                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-11 01:29:22                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-11 01:32:02                                  Software Protection Platform Service  903:     .    
                     2015-11-11 03:09:11                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-11-11 03:09:11                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259096)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-11 04:39:52                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-11 04:39:52                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-11 04:39:53                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-13 13:52:23                                  EventSystem                     
                     2015-11-13 13:52:23                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-13 13:52:27                                  Winlogon                        4101:  Windows .  
                     2015-11-13 13:52:27                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-13 13:52:28                                  WinMgmt                         
                     2015-11-13 13:52:30                                  WinMgmt                         
                     2015-11-13 13:52:30                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-13 13:52:32                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-13 13:52:32                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-13 13:52:32                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-13 13:52:32                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 255573)(?)(?)(?)])(1 )(2 )]    
                     2015-11-13 13:52:33                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-13 13:52:34                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 255573)(?)(?)(?)])(1 )(2 )]    
                     2015-11-13 13:52:35                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/13 04:52, 0, 1, 255573, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-13 13:52:35                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 2241424, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-13 13:52:36                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/13 04:52, 0, 1, 255573, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-13 13:52:36                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 2243088, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-13 13:52:37                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/13 04:52, 0, 1, 255573, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-13 13:52:37                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 2243664, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-13 13:52:37                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/13 04:52, 0, 1, 255573, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-13 13:52:37                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/13 04:52  
             1          2015-11-13 13:52:37                                  ESENT                           102: Windows (2912) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-13 13:52:37                                  ESENT                           300: Windows (2912) Windows:     .  
             3          2015-11-13 13:52:37                                  ESENT                           301: Windows (2912) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-13 13:52:37                                  ESENT                           302: Windows (2912) Windows:    .  
             1          2015-11-13 13:52:38                                  Windows Search Service          1003:  Windows Search .   
                         2015-11-13 13:54:09                                  WinMgmt                         
                     2015-11-13 13:54:30                                  Software Protection Platform Service  900:      .    
                     2015-11-13 13:54:31                                  SecurityCenter                  1:     Windows .  
                     2015-11-13 13:54:32                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-13 13:54:32                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-13 13:54:32                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-13 13:57:01                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-13 13:57:01                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-13 13:59:32                                  Software Protection Platform Service  903:     .    
                     2015-11-13 14:42:05                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-13 14:42:05                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-13 14:42:06                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-14 03:20:51                                  EventSystem                     
                     2015-11-14 03:20:51                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-14 03:20:54                                  Winlogon                        4101:  Windows .  
                     2015-11-14 03:20:54                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-14 03:20:56                                  WinMgmt                         
                     2015-11-14 03:20:57                                  WinMgmt                         
                     2015-11-14 03:20:58                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-14 03:20:59                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-14 03:20:59                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-14 03:20:59                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-14 03:21:00                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258392)(?)(?)(?)])(1 )(2 )]    
                     2015-11-14 03:21:01                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-14 03:21:02                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258392)(?)(?)(?)])(1 )(2 )]    
                     2015-11-14 03:21:04                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/13 18:21, 0, 1, 258392, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-14 03:21:04                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/13 18:21  
             1          2015-11-14 03:21:04                                  ESENT                           102: Windows (2832) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-14 03:21:04                                  ESENT                           300: Windows (2832) Windows:     .  
             3          2015-11-14 03:21:04                                  ESENT                           301: Windows (2832) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-14 03:21:04                                  ESENT                           302: Windows (2832) Windows:    .  
             1          2015-11-14 03:21:05                                  Windows Search Service          1003:  Windows Search .   
                         2015-11-14 03:22:38                                  WinMgmt                         
                     2015-11-14 03:22:59                                  Software Protection Platform Service  900:      .    
                     2015-11-14 03:23:00                                  SecurityCenter                  1:     Windows .  
                     2015-11-14 03:23:01                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-14 03:23:01                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-14 03:23:01                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-14 03:25:11                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-14 03:25:12                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-14 03:28:01                                  Software Protection Platform Service  903:     .    
                     2015-11-14 04:11:29                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-14 04:11:29                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-14 04:11:30                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-15 01:53:24                                  EventSystem                     
                     2015-11-15 01:53:24                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-15 01:53:27                                  Winlogon                        4101:  Windows .  
                     2015-11-15 01:53:27                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-15 01:53:29                                  WinMgmt                         
                     2015-11-15 01:53:30                                  WinMgmt                         
                     2015-11-15 01:53:31                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-15 01:53:32                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-15 01:53:32                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-15 01:53:32                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-15 01:53:33                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 257848)(?)(?)(?)])(1 )(2 )]    
                     2015-11-15 01:53:33                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-15 01:53:34                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 257848)(?)(?)(?)])(1 )(2 )]    
                     2015-11-15 01:53:36                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/14 16:53, 0, 1, 257848, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-15 01:53:36                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/14 16:53  
             1          2015-11-15 01:53:38                                  ESENT                           102: Windows (2892) Windows:   (6.01.7601.0000)    (0).  
             1          2015-11-15 01:53:38                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-15 01:53:38                                  ESENT                           300: Windows (2892) Windows:     .  
             3          2015-11-15 01:53:38                                  ESENT                           301: Windows (2892) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-15 01:53:38                                  ESENT                           302: Windows (2892) Windows:    .  
                         2015-11-15 01:55:11                                  WinMgmt                         
                     2015-11-15 01:55:30                                  Software Protection Platform Service  900:      .    
                     2015-11-15 01:55:32                                  SecurityCenter                  1:     Windows .  
                     2015-11-15 01:55:32                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-15 01:55:32                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-15 01:55:32                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-15 01:57:36                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-15 01:57:36                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-15 01:59:05                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-11-15 01:59:05                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259195)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-15 02:00:20                                  Software Protection Platform Service  903:     .    
                     2015-11-15 09:48:23                                  EventSystem                     
                     2015-11-15 09:48:23                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-15 09:48:26                                  Winlogon                        4101:  Windows .  
                     2015-11-15 09:48:26                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-15 09:48:28                                  WinMgmt                         
                     2015-11-15 09:48:29                                  WinMgmt                         
                     2015-11-15 09:48:34                                  WinMgmt                         
                     2015-11-15 09:48:34                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-15 09:48:35                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-15 09:48:35                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-15 09:48:35                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-15 09:48:36                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258725)(?)(?)(?)])(1 )(2 )]    
                     2015-11-15 09:48:37                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-15 09:48:38                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258725)(?)(?)(?)])(1 )(2 )]    
                     2015-11-15 09:48:39                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/15 00:48, 0, 1, 258725, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-15 09:48:39                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/15 00:48  
             1          2015-11-15 09:48:39                                  ESENT                           102: Windows (2740) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-15 09:48:39                                  ESENT                           300: Windows (2740) Windows:     .  
             3          2015-11-15 09:48:39                                  ESENT                           301: Windows (2740) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             1          2015-11-15 09:48:40                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-15 09:48:40                                  ESENT                           302: Windows (2740) Windows:    .  
                     2015-11-15 09:49:51                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-11-15 09:49:51                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259199)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                         2015-11-15 09:50:02                                  WinMgmt                         
                     2015-11-15 09:50:35                                  Software Protection Platform Service  900:      .    
                     2015-11-15 09:50:35                                  SecurityCenter                  1:     Windows .  
                     2015-11-15 09:50:36                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-15 09:50:36                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-15 09:50:36                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-15 09:52:48                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-15 09:52:48                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-15 09:55:36                                  Software Protection Platform Service  903:     .    
                     2015-11-15 10:04:54                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-15 10:04:54                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-15 11:03:01                                  Microsoft-Windows-Defrag        258:           
                         2015-11-15 11:03:10                                  SideBySide                      33:       "c:\my_programs\setup\driver\audio\xonar d1 audio center\Program\CmElv64.exe".      "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"".   sxstrace.exe   .  
                     2015-11-15 11:08:01                                  Microsoft-Windows-Defrag        258:         (C:)  
                     2015-11-15 11:09:57                                  System Restore                  8194:     ( = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation;  =   ).  
                     2015-11-15 11:09:57                                  System Restore                  8212:       .  
                     2015-11-15 11:12:58                                  VSS                             8224:  VSS  - - .    
                     2015-11-15 11:20:43                                  Microsoft-Windows-Defrag        258:        MusicVideo (D:)  
                     2015-11-15 11:20:55                                  Microsoft-Windows-Defrag        258:          (G:)  
                     2015-11-15 11:21:08                                  Microsoft-Windows-Defrag        258:        Elements (H:)  
                     2015-11-15 11:26:26                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-15 11:26:26                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                 100        2015-11-15 11:31:07                                  Application Error               1000:   : Windebug.exe, : 0.0.0.0,  : 0x3cc0dcc1    : HsSrv.dll, : 1.0.10.323,   0x4ba86d1c   : 0xc0000005   : 0x000010ba    : 0x51c     : 0x01d11f4d8afe5799    : C:\Users\sima\Desktop\Sima\Mortal Combat Ultimate MK6\Windebug.exe    : C:\Windows\system\HsSrv.dll   : ec6774d6-8b40-11e5-b152-0000db4d6dee
                     2015-11-15 11:31:10                                  Windows Error Reporting         1001:   ,  0   : APPCRASH  :     CAB: 0     :  P1: Windebug.exe  P2: 0.0.0.0  P3: 3cc0dcc1  P4: HsSrv.dll  P5: 1.0.10.323  P6: 4ba86d1c  P7: c0000005  P8: 000010ba  P9:   P10:      :        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_Windebug.exe_f743916fb1fa413d83d4759d2a5fd8b6adc4509a_0d826de3     :     : 0   : ec6774d6-8b40-11e5-b152-0000db4d6dee   : 2  
                         2015-11-15 11:32:01                                  Wininit                         1015:    "C:\Windows\system32\lsm.exe"      1.    .  
                     2015-11-15 11:34:40                                  EventSystem                     
                     2015-11-15 11:34:40                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-15 11:34:41                                  Winlogon                        4101:  Windows .  
                     2015-11-15 11:34:41                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-15 11:34:42                                  WinMgmt                         
                     2015-11-15 11:34:43                                  WinMgmt                         
                     2015-11-15 11:34:50                                  WinMgmt                         
                     2015-11-15 11:34:50                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
             1          2015-11-15 11:34:50                                  ESENT                           102: Windows (2100) Windows:   (6.01.7601.0000)    (0).  
                     2015-11-15 11:34:51                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-15 11:34:51                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-15 11:34:51                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
             3          2015-11-15 11:34:51                                  ESENT                           300: Windows (2100) Windows:     .  
             3          2015-11-15 11:34:51                                  ESENT                           301: Windows (2100) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001F7.log.  
             3          2015-11-15 11:34:51                                  ESENT                           301: Windows (2100) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001F8.log.  
             3          2015-11-15 11:34:51                                  ESENT                           301: Windows (2100) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
                     2015-11-15 11:34:52                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259094)(?)(?)(?)])(1 )(2 )]    
             1          2015-11-15 11:34:52                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-15 11:34:52                                  ESENT                           302: Windows (2100) Windows:    .  
                     2015-11-15 11:34:53                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-15 11:34:53                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259094)(?)(?)(?)])(1 )(2 )]    
                     2015-11-15 11:34:54                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/15 02:34, 0, 1, 259094, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-15 11:34:55                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/15 02:34  
                         2015-11-15 11:36:18                                  WinMgmt                         
                     2015-11-15 11:36:51                                  Software Protection Platform Service  900:      .    
                     2015-11-15 11:36:51                                  SecurityCenter                  1:     Windows .  
                     2015-11-15 11:36:53                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-15 11:36:53                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-15 11:36:53                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-15 11:38:54                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-15 11:38:54                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-15 11:38:55                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-15 11:39:01                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-15 20:05:08                                  EventSystem                     
                     2015-11-15 20:05:08                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-15 20:05:14                                  WinMgmt                         
                     2015-11-15 20:05:14                                  Winlogon                        4101:  Windows .  
                     2015-11-15 20:05:14                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-15 20:05:15                                  WinMgmt                         
                     2015-11-15 20:05:15                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-15 20:05:17                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-15 20:05:17                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-15 20:05:17                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-15 20:05:18                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258690)(?)(?)(?)])(1 )(2 )]    
                     2015-11-15 20:05:19                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-15 20:05:20                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258690)(?)(?)(?)])(1 )(2 )]    
                     2015-11-15 20:05:21                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/15 11:05, 0, 1, 258690, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-15 20:05:21                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 4956840, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-15 20:05:22                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/15 11:05, 0, 1, 258690, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-15 20:05:22                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 4957544, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-15 20:05:22                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/15 11:05, 0, 1, 258690, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-15 20:05:22                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 4956008, 0, 0, 0, 0, 1601/01/01 00:00  
             1          2015-11-15 20:05:22                                  ESENT                           102: Windows (2708) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-15 20:05:22                                  ESENT                           300: Windows (2708) Windows:     .  
             3          2015-11-15 20:05:22                                  ESENT                           301: Windows (2708) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001FA.log.  
             3          2015-11-15 20:05:22                                  ESENT                           301: Windows (2708) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
                     2015-11-15 20:05:23                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/15 11:05, 0, 1, 258690, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-15 20:05:23                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/15 11:05  
             1          2015-11-15 20:05:23                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-15 20:05:23                                  ESENT                           302: Windows (2708) Windows:    .  
                         2015-11-15 20:06:54                                  WinMgmt                         
                     2015-11-15 20:07:16                                  Software Protection Platform Service  900:      .    
                     2015-11-15 20:07:17                                  SecurityCenter                  1:     Windows .  
                     2015-11-15 20:07:17                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-15 20:07:17                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-15 20:07:17                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-15 20:09:30                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-15 20:12:17                                  Software Protection Platform Service  903:     .    
                     2015-11-15 21:41:07                                  Windows Error Reporting         1001:   ,  0   : PnPGenericDriverFound  :     CAB: 0     :  P1: x86  P2: USB\VID_1E4E&PID_0109&REV_0002&MI_00  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_8165a3ccd0f3c8899cadd67225307fc53a8ef7d6_cab_0a181783     :     : 0   : 23b57203-8b96-11e5-b0e5-0000db4d6dee   : 6  
                     2015-11-15 21:48:47                                  VSS                             8224:  VSS  - - .    
                     2015-11-15 23:58:08                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-15 23:58:08                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-15 23:58:09                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-16 11:09:59                                  EventSystem                     
                     2015-11-16 11:09:59                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-16 11:10:02                                  Winlogon                        4101:  Windows .  
                     2015-11-16 11:10:02                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-16 11:10:05                                  WinMgmt                         
                     2015-11-16 11:10:06                                  WinMgmt                         
                     2015-11-16 11:10:06                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-16 11:10:08                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-16 11:10:08                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-16 11:10:08                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-16 11:10:09                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258296)(?)(?)(?)])(1 )(2 )]    
                     2015-11-16 11:10:09                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-16 11:10:10                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258296)(?)(?)(?)])(1 )(2 )]    
                     2015-11-16 11:10:12                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/16 02:10, 0, 1, 258296, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-16 11:10:12                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 2597768, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-16 11:10:12                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/16 02:10, 0, 1, 258296, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-16 11:10:12                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/16 02:10  
             1          2015-11-16 11:10:13                                  ESENT                           102: Windows (2856) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-16 11:10:13                                  ESENT                           300: Windows (2856) Windows:     .  
             3          2015-11-16 11:10:13                                  ESENT                           301: Windows (2856) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS001FE.log.  
             1          2015-11-16 11:10:14                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-16 11:10:14                                  ESENT                           301: Windows (2856) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-16 11:10:14                                  ESENT                           302: Windows (2856) Windows:    .  
                         2015-11-16 11:11:46                                  WinMgmt                         
                     2015-11-16 11:12:06                                  Software Protection Platform Service  900:      .    
                     2015-11-16 11:12:07                                  SecurityCenter                  1:     Windows .  
                     2015-11-16 11:12:08                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-16 11:12:08                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-16 11:12:08                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-16 11:14:14                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-16 11:14:15                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-16 11:17:08                                  Software Protection Platform Service  903:     .    
                     2015-11-16 12:19:34                                  VSS                             8224:  VSS  - - .    
                     2015-11-16 15:09:28                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-16 15:09:28                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-16 15:09:29                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-16 15:48:04                                  EventSystem                     
                     2015-11-16 15:48:04                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-16 15:48:10                                  Winlogon                        4101:  Windows .  
                     2015-11-16 15:48:10                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-16 15:48:10                                  WinMgmt                         
                     2015-11-16 15:48:12                                  WinMgmt                         
                     2015-11-16 15:48:12                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-16 15:48:13                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-16 15:48:13                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-16 15:48:13                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-16 15:48:14                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258922)(?)(?)(?)])(1 )(2 )]    
                     2015-11-16 15:48:15                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-16 15:48:16                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258922)(?)(?)(?)])(1 )(2 )]    
                     2015-11-16 15:48:17                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/16 06:48, 0, 1, 258922, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-16 15:48:17                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 7960216, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-16 15:48:18                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/16 06:48, 0, 1, 258922, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-16 15:48:18                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 7960920, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-16 15:48:19                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/16 06:48, 0, 1, 258922, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-16 15:48:19                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 7959384, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-16 15:48:19                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/16 06:48, 0, 1, 258922, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-16 15:48:19                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 7961496, 0, 0, 0, 0, 1601/01/01 00:00  
             1          2015-11-16 15:48:19                                  ESENT                           102: Windows (2776) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-16 15:48:19                                  ESENT                           300: Windows (2776) Windows:     .  
             3          2015-11-16 15:48:19                                  ESENT                           301: Windows (2776) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-16 15:48:19                                  ESENT                           302: Windows (2776) Windows:    .  
                     2015-11-16 15:48:20                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/16 06:48, 0, 1, 258922, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-16 15:48:20                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 7960856, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-16 15:48:20                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/16 06:48, 0, 1, 258922, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-16 15:48:20                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 7959448, 0, 0, 0, 0, 1601/01/01 00:00  
             1          2015-11-16 15:48:20                                  Windows Search Service          1003:  Windows Search .   
                     2015-11-16 15:48:21                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/16 06:48, 0, 1, 258922, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-16 15:48:21                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/16 06:48  
                         2015-11-16 15:49:50                                  WinMgmt                         
                     2015-11-16 15:50:12                                  Software Protection Platform Service  900:      .    
                     2015-11-16 15:50:14                                  SecurityCenter                  1:     Windows .  
                     2015-11-16 15:50:14                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-16 15:50:14                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-16 15:50:14                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-16 15:52:21                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-16 15:52:21                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-16 15:55:14                                  Software Protection Platform Service  903:     .    
                     2015-11-16 16:42:45                                  VSS                             8224:  VSS  - - .    
                     2015-11-16 17:03:38                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-16 17:03:38                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-16 17:03:39                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-16 18:57:26                                  EventSystem                     
                     2015-11-16 18:57:26                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-16 18:57:28                                  Winlogon                        4101:  Windows .  
                     2015-11-16 18:57:28                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-16 18:57:30                                  WinMgmt                         
                     2015-11-16 18:57:31                                  WinMgmt                         
                     2015-11-16 18:57:32                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-16 18:57:33                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-16 18:57:33                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-16 18:57:33                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-16 18:57:34                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259011)(?)(?)(?)])(1 )(2 )]    
                     2015-11-16 18:57:34                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-16 18:57:36                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259011)(?)(?)(?)])(1 )(2 )]    
                     2015-11-16 18:57:37                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/16 09:57, 0, 1, 259011, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-16 18:57:37                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/16 09:57  
             1          2015-11-16 18:57:38                                  ESENT                           102: Windows (2792) Windows:   (6.01.7601.0000)    (0).  
             1          2015-11-16 18:57:38                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-16 18:57:38                                  ESENT                           300: Windows (2792) Windows:     .  
             3          2015-11-16 18:57:38                                  ESENT                           301: Windows (2792) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-16 18:57:38                                  ESENT                           302: Windows (2792) Windows:    .  
                         2015-11-16 18:59:12                                  WinMgmt                         
                     2015-11-16 18:59:32                                  Software Protection Platform Service  900:      .    
                     2015-11-16 18:59:33                                  SecurityCenter                  1:     Windows .  
                     2015-11-16 18:59:33                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-16 18:59:33                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-16 18:59:33                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-16 19:01:40                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-16 19:01:40                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-16 19:04:34                                  Software Protection Platform Service  903:     .    
                     2015-11-16 19:10:43                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-16 19:10:43                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-16 19:11:05                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-16 19:11:05                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-16 19:11:06                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-17 06:38:00                                  EventSystem                     
                     2015-11-17 06:38:00                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-17 06:38:05                                  WinMgmt                         
                     2015-11-17 06:38:05                                  Winlogon                        4101:  Windows .  
                     2015-11-17 06:38:05                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-17 06:38:06                                  WinMgmt                         
                     2015-11-17 06:38:06                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-17 06:38:07                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-17 06:38:07                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-17 06:38:07                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-17 06:38:08                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258500)(?)(?)(?)])(1 )(2 )]    
                     2015-11-17 06:38:09                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-17 06:38:10                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258500)(?)(?)(?)])(1 )(2 )]    
                     2015-11-17 06:38:11                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/16 21:38, 0, 1, 258500, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-17 06:38:11                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/16 21:38  
             1          2015-11-17 06:38:12                                  ESENT                           102: Windows (2776) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-17 06:38:12                                  ESENT                           300: Windows (2776) Windows:     .  
             3          2015-11-17 06:38:12                                  ESENT                           301: Windows (2776) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             1          2015-11-17 06:38:13                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-17 06:38:13                                  ESENT                           302: Windows (2776) Windows:    .  
                         2015-11-17 06:39:47                                  WinMgmt                         
                     2015-11-17 06:40:06                                  Software Protection Platform Service  900:      .    
                     2015-11-17 06:40:08                                  SecurityCenter                  1:     Windows .  
                     2015-11-17 06:40:08                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-17 06:40:08                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-17 06:40:08                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-17 06:42:20                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-17 06:42:20                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-17 06:45:08                                  Software Protection Platform Service  903:     .    
                     2015-11-17 07:02:39                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-17 07:02:40                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-17 07:07:37                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-17 07:07:37                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-17 07:07:38                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-17 17:40:20                                  EventSystem                     
                     2015-11-17 17:40:20                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-17 17:40:26                                  WinMgmt                         
                     2015-11-17 17:40:27                                  Winlogon                        4101:  Windows .  
                     2015-11-17 17:40:27                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-17 17:40:28                                  WinMgmt                         
                     2015-11-17 17:40:29                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-17 17:40:30                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-17 17:40:30                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-17 17:40:30                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-17 17:40:32                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258538)(?)(?)(?)])(1 )(2 )]    
                     2015-11-17 17:40:33                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-17 17:40:34                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258538)(?)(?)(?)])(1 )(2 )]    
                     2015-11-17 17:40:35                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/17 08:40, 0, 1, 258538, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-17 17:40:35                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/17 08:40  
             1          2015-11-17 17:40:37                                  ESENT                           102: Windows (2968) Windows:   (6.01.7601.0000)    (0).  
             1          2015-11-17 17:40:37                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-17 17:40:37                                  ESENT                           300: Windows (2968) Windows:     .  
             3          2015-11-17 17:40:37                                  ESENT                           301: Windows (2968) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-17 17:40:37                                  ESENT                           302: Windows (2968) Windows:    .  
                         2015-11-17 17:42:08                                  WinMgmt                         
                     2015-11-17 17:42:32                                  Software Protection Platform Service  900:      .    
                     2015-11-17 17:42:33                                  SecurityCenter                  1:     Windows .  
                     2015-11-17 17:42:34                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-17 17:42:34                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-17 17:42:34                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-17 17:44:38                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-17 17:44:38                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-17 17:47:34                                  Software Protection Platform Service  903:     .    
                     2015-11-17 18:54:54                                  VSS                             8224:  VSS  - - .    
                     2015-11-17 19:09:03                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-17 19:09:03                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-17 19:09:04                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-17 23:44:07                                  EventSystem                     
                     2015-11-17 23:44:07                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-17 23:44:09                                  Winlogon                        4101:  Windows .  
                     2015-11-17 23:44:09                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-17 23:44:11                                  WinMgmt                         
                     2015-11-17 23:44:12                                  WinMgmt                         
                     2015-11-17 23:44:12                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-17 23:44:13                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-17 23:44:13                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-17 23:44:13                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-17 23:44:14                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258837)(?)(?)(?)])(1 )(2 )]    
                     2015-11-17 23:44:15                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-17 23:44:16                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258837)(?)(?)(?)])(1 )(2 )]    
                     2015-11-17 23:44:17                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/17 14:44, 0, 1, 258837, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-17 23:44:17                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 4161848, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-17 23:44:18                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/17 14:44, 0, 1, 258837, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-17 23:44:18                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 4162552, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-17 23:44:18                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/17 14:44, 0, 1, 258837, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-17 23:44:18                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/17 14:44  
             1          2015-11-17 23:44:19                                  ESENT                           102: Windows (2776) Windows:   (6.01.7601.0000)    (0).  
             1          2015-11-17 23:44:19                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-17 23:44:19                                  ESENT                           300: Windows (2776) Windows:     .  
             3          2015-11-17 23:44:19                                  ESENT                           301: Windows (2776) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-17 23:44:19                                  ESENT                           302: Windows (2776) Windows:    .  
                         2015-11-17 23:45:54                                  WinMgmt                         
                     2015-11-17 23:46:12                                  Software Protection Platform Service  900:      .    
                     2015-11-17 23:46:13                                  SecurityCenter                  1:     Windows .  
                     2015-11-17 23:46:14                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-17 23:46:14                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-17 23:46:14                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-17 23:48:21                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-17 23:48:21                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-17 23:51:14                                  Software Protection Platform Service  903:     .    
                     2015-11-18 00:21:58                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-11-18 00:21:58                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259163)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-18 00:33:14  sima                            Microsoft-Windows-RestartManager  10000:   1 - 2015-11-17T15:33:14.216796800Z.  
                     2015-11-18 00:34:11  sima                            Microsoft-Windows-RestartManager  10001:   1,  2015-11-17T15:33:14.216796800Z.  
                     2015-11-18 00:53:26                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-18 00:53:26                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-18 00:53:28                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-18 18:53:35                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-18 18:53:36                                  EventSystem                     
                     2015-11-18 18:53:37                                  Winlogon                        4101:  Windows .  
                     2015-11-18 18:53:37                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-18 18:53:37                                  WinMgmt                         
                     2015-11-18 18:53:38                                  WinMgmt                         
                     2015-11-18 18:53:39                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-18 18:53:40                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-18 18:53:40                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-18 18:53:40                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-18 18:53:41                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258051)(?)(?)(?)])(1 )(2 )]    
                     2015-11-18 18:53:41                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-18 18:53:42                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258051)(?)(?)(?)])(1 )(2 )]    
                     2015-11-18 18:53:44                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/18 09:53, 0, 1, 258051, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-18 18:53:44                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 4006824, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-18 18:53:44                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/18 09:53, 0, 1, 258051, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-18 18:53:44                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/18 09:53  
             1          2015-11-18 18:53:44                                  ESENT                           102: Windows (2800) Windows:   (6.01.7601.0000)    (0).  
             1          2015-11-18 18:53:44                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-18 18:53:44                                  ESENT                           300: Windows (2800) Windows:     .  
             3          2015-11-18 18:53:44                                  ESENT                           301: Windows (2800) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-18 18:53:44                                  ESENT                           302: Windows (2800) Windows:    .  
                         2015-11-18 18:55:15                                  WinMgmt                         
                     2015-11-18 18:55:39                                  Software Protection Platform Service  900:      .    
                     2015-11-18 18:55:40                                  SecurityCenter                  1:     Windows .  
                     2015-11-18 18:55:41                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-18 18:55:41                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-18 18:55:41                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-18 18:58:04                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-18 18:58:04                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-18 19:00:41                                  Software Protection Platform Service  903:     .    
                     2015-11-18 19:46:05                                  Microsoft-Windows-Defrag        258:           
                         2015-11-18 19:46:34                                  SideBySide                      33:       "d:\GAME\trine 2 complete story collectors edition\tools\luac_x64.exe".      "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"".   sxstrace.exe   .  
                     2015-11-18 19:56:01                                  VSS                             8224:  VSS  - - .    
                     2015-11-18 21:19:06                                  Microsoft-Windows-Defrag        258:           
                     2015-11-18 21:21:55                                  Microsoft-Windows-Defrag        258:         (C:)  
                     2015-11-18 21:26:54                                  Microsoft-Windows-Defrag        258:        MusicVideo (D:)  
                     2015-11-18 21:27:43                                  Microsoft-Windows-Defrag        258:          (G:)  
                     2015-11-18 21:46:46                                  Microsoft-Windows-Defrag        258:        (C:)  
                     2015-11-18 21:47:51                                  Microsoft-Windows-Defrag        258:        Tatyana (E:)  
                     2015-11-19 00:10:48                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-19 00:10:48                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-19 00:10:50                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-21 05:21:47                                  EventSystem                     
                     2015-11-21 05:21:47                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-21 05:21:52                                  WinMgmt                         
                     2015-11-21 05:21:53                                  Winlogon                        4101:  Windows .  
                     2015-11-21 05:21:53                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-21 05:21:55                                  WinMgmt                         
                     2015-11-21 05:21:55                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-21 05:21:56                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-21 05:21:56                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-21 05:21:56                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-21 05:21:58                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 255692)(?)(?)(?)])(1 )(2 )]    
                     2015-11-21 05:21:59                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-21 05:22:00                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 255692)(?)(?)(?)])(1 )(2 )]    
                     2015-11-21 05:22:01                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/20 20:22, 0, 1, 255692, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-21 05:22:01                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/20 20:22  
             1          2015-11-21 05:22:01                                  ESENT                           102: Windows (2836) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-21 05:22:01                                  ESENT                           300: Windows (2836) Windows:     .  
             3          2015-11-21 05:22:02                                  ESENT                           301: Windows (2836) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00202.log.  
             3          2015-11-21 05:22:02                                  ESENT                           301: Windows (2836) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-21 05:22:02                                  ESENT                           302: Windows (2836) Windows:    .  
             1          2015-11-21 05:22:03                                  Windows Search Service          1003:  Windows Search .   
                         2015-11-21 05:23:32                                  WinMgmt                         
                     2015-11-21 05:23:55                                  Software Protection Platform Service  900:      .    
                     2015-11-21 05:23:56                                  SecurityCenter                  1:     Windows .  
                     2015-11-21 05:23:57                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-21 05:23:57                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-21 05:23:57                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-21 05:26:06                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-21 05:26:06                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-21 05:28:57                                  Software Protection Platform Service  903:     .    
                     2015-11-21 05:56:48                                  Desktop Window Manager          9010:  (Heroes of Might and Magic III)          
                     2015-11-21 05:56:48                                  Desktop Window Manager          9013:       ,          
                     2015-11-21 06:12:49                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-21 06:12:49                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-21 06:47:58                                  Microsoft-Windows-Defrag        258:           
                         2015-11-21 06:48:28                                  SideBySide                      33:       "d:\GAME\trine 2 complete story collectors edition\tools\luac_x64.exe".      "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"".   sxstrace.exe   .  
                     2015-11-21 06:55:45                                  Microsoft-Windows-Defrag        258:        MusicVideo (D:)  
                     2015-11-21 06:55:50                                  Microsoft-Windows-Defrag        258:          (G:)  
                     2015-11-21 06:57:54                                  VSS                             8224:  VSS  - - .    
                     2015-11-21 07:24:18                                  Microsoft-Windows-Defrag        258:        (C:)  
                     2015-11-21 07:24:40                                  Microsoft-Windows-Defrag        258:        Tatyana (E:)  
                     2015-11-21 08:47:25                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-21 08:47:25                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-21 08:47:27                                  Office Software Protection Platform Service  903: The Software Protection service has stopped.    
                     2015-11-21 08:47:27                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-21 13:19:53                                  EventSystem                     
                     2015-11-21 13:19:53                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-21 13:19:58                                  WinMgmt                         
                     2015-11-21 13:19:58                                  Winlogon                        4101:  Windows .  
                     2015-11-21 13:19:58                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-21 13:20:00                                  WinMgmt                         
                     2015-11-21 13:20:00                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-21 13:20:01                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-21 13:20:01                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-21 13:20:01                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-21 13:20:03                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258722)(?)(?)(?)])(1 )(2 )]    
                     2015-11-21 13:20:03                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-21 13:20:04                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258722)(?)(?)(?)])(1 )(2 )]    
                     2015-11-21 13:20:06                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/21 04:20, 0, 1, 258722, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-21 13:20:06                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 4236216, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-21 13:20:06                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/21 04:20, 0, 1, 258722, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-21 13:20:06                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 4236920, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-21 13:20:07                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/21 04:20, 0, 1, 258722, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-21 13:20:07                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 4235384, 0, 0, 0, 0, 1601/01/01 00:00  
             1          2015-11-21 13:20:07                                  ESENT                           102: Windows (2656) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-21 13:20:07                                  ESENT                           300: Windows (2656) Windows:     .  
             3          2015-11-21 13:20:07                                  ESENT                           301: Windows (2656) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00205.log.  
             3          2015-11-21 13:20:07                                  ESENT                           301: Windows (2656) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-21 13:20:07                                  ESENT                           302: Windows (2656) Windows:    .  
                     2015-11-21 13:20:08                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/21 04:20, 0, 1, 258722, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-21 13:20:08                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 4237496, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-21 13:20:08                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/21 04:20, 0, 1, 258722, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-21 13:20:08                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 4236856, 0, 0, 0, 0, 1601/01/01 00:00  
             1          2015-11-21 13:20:08                                  Windows Search Service          1003:  Windows Search .   
                     2015-11-21 13:20:09                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/21 04:20, 0, 1, 258722, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-21 13:20:09                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 4235448, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-21 13:20:09                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/21 04:20, 0, 1, 258722, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-21 13:20:09                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/21 04:20  
                         2015-11-21 13:21:36                                  WinMgmt                         
                     2015-11-21 13:22:00                                  Software Protection Platform Service  900:      .    
                     2015-11-21 13:22:02                                  SecurityCenter                  1:     Windows .  
                     2015-11-21 13:22:03                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-21 13:22:03                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-21 13:22:03                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-21 13:22:30                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-21 13:22:31                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-21 13:24:07                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-21 13:24:07                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-21 13:27:03                                  Software Protection Platform Service  903:     .    
                     2015-11-21 13:27:06                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-21 13:27:06                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-21 14:37:19                                  VSS                             8224:  VSS  - - .    
                     2015-11-21 18:57:27                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-21 18:57:28                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-21 18:57:30                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-21 21:01:54                                  EventSystem                     
                     2015-11-21 21:01:54                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-21 21:01:55                                  Winlogon                        4101:  Windows .  
                     2015-11-21 21:01:55                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-21 21:01:57                                  WinMgmt                         
                     2015-11-21 21:01:58                                  WinMgmt                         
                     2015-11-21 21:01:58                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-21 21:01:59                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-21 21:01:59                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-21 21:01:59                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-21 21:02:00                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258739)(?)(?)(?)])(1 )(2 )]    
                     2015-11-21 21:02:01                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-21 21:02:02                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258739)(?)(?)(?)])(1 )(2 )]    
                     2015-11-21 21:02:03                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/21 12:02, 0, 1, 258739, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-21 21:02:03                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/21 12:02  
             1          2015-11-21 21:02:05                                  ESENT                           102: Windows (2752) Windows:   (6.01.7601.0000)    (0).  
             1          2015-11-21 21:02:05                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-21 21:02:05                                  ESENT                           300: Windows (2752) Windows:     .  
             3          2015-11-21 21:02:05                                  ESENT                           301: Windows (2752) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-21 21:02:05                                  ESENT                           302: Windows (2752) Windows:    .  
                         2015-11-21 21:03:36                                  WinMgmt                         
                     2015-11-21 21:03:58                                  Software Protection Platform Service  900:      .    
                     2015-11-21 21:03:59                                  SecurityCenter                  1:     Windows .  
                     2015-11-21 21:04:00                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-21 21:04:00                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-21 21:04:00                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-21 21:06:15                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-21 21:06:15                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-21 21:09:00                                  Software Protection Platform Service  903:     .    
                     2015-11-21 21:15:53                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 15  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 78  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 0  : COM Addin for Microsoft Outlook Hotmail Connector : COM Addin for Microsoft Outlook Hotmail Connector ProgID: MSNCON.Addin.1 GUID: {DC67367A-8B15-47BC-B7F8-0BA0435A504A}   : 03 HKLM: 1 : C:\PROGRA~1\COMMON~1\SYSTEM\MSMAPI\MSNCON32.DLL   (): 0  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 0  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 16  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 0   
                     2015-11-21 21:15:54                                  Outlook                         30:    C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook0.ost   : Automatic Reconciliation.  
                     2015-11-21 21:15:54                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-11-21 21:15:54                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259187)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-21 21:16:02                                  Outlook                         38:     : C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook0.ost. : Added: 0, Deleted: 0, Modified: 0, Compared: 1347, Version: 14.0.4760.1000.  
                     2015-11-21 21:16:25                                  Outlook                         30:    C:\Users\sima\AppData\Local\Microsoft\Outlook\aofso.pst   : Automatic Reconciliation.  
                     2015-11-21 21:16:31                                  Outlook                         38:     : C:\Users\sima\AppData\Local\Microsoft\Outlook\aofso.pst. : Added: 1, Deleted: 0, Modified: 0, Compared: 831, Version: 14.0.4760.1000.  
                     2015-11-21 21:28:18                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-21 21:28:18                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-21 21:28:19                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-22 02:22:32                                  EventSystem                     
                     2015-11-22 02:22:32                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-22 02:22:33                                  Winlogon                        4101:  Windows .  
                     2015-11-22 02:22:33                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-22 02:22:34                                  WinMgmt                         
                     2015-11-22 02:22:35                                  WinMgmt                         
                     2015-11-22 02:22:37                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-22 02:22:38                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-22 02:22:38                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-22 02:22:38                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 02:22:39                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258880)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 02:22:40                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
             1          2015-11-22 02:22:40                                  ESENT                           102: Windows (2764) Windows:   (6.01.7601.0000)    (0).  
                     2015-11-22 02:22:41                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258880)(?)(?)(?)])(1 )(2 )]    
             3          2015-11-22 02:22:41                                  ESENT                           300: Windows (2764) Windows:     .  
             3          2015-11-22 02:22:41                                  ESENT                           301: Windows (2764) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00206.log.  
             3          2015-11-22 02:22:41                                  ESENT                           301: Windows (2764) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00207.log.  
                     2015-11-22 02:22:42                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/21 17:22, 0, 1, 258880, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-22 02:22:42                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 10369760, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-22 02:22:42                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/21 17:22, 0, 1, 258880, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-22 02:22:42                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 10371424, 0, 0, 0, 0, 1601/01/01 00:00  
             3          2015-11-22 02:22:42                                  ESENT                           301: Windows (2764) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-22 02:22:42                                  ESENT                           302: Windows (2764) Windows:    .  
                     2015-11-22 02:22:43                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/21 17:22, 0, 1, 258880, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-22 02:22:43                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/21 17:22  
             1          2015-11-22 02:22:43                                  Windows Search Service          1003:  Windows Search .   
                         2015-11-22 02:24:07                                  WinMgmt                         
                     2015-11-22 02:24:37                                  Software Protection Platform Service  900:      .    
                     2015-11-22 02:24:38                                  SecurityCenter                  1:     Windows .  
                     2015-11-22 02:24:38                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-22 02:24:38                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 02:24:39                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-22 02:26:32                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-22 02:26:32                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-22 02:28:19                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-11-22 02:28:19                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259195)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 02:28:26                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259195)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 02:28:36                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259195)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 02:28:53                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259194)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 02:29:18                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259194)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 02:29:23                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259194)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 02:29:24                                  Software Protection Platform Service  903:     .    
                     2015-11-22 03:51:43                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259111)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 08:13:49                                  EventSystem                     
                     2015-11-22 08:13:49                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-22 08:13:55                                  WinMgmt                         
                     2015-11-22 08:13:55                                  Winlogon                        4101:  Windows .  
                     2015-11-22 08:13:55                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-22 08:13:56                                  WinMgmt                         
                     2015-11-22 08:14:03                                  WinMgmt                         
                     2015-11-22 08:14:03                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-22 08:14:04                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-22 08:14:04                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-22 08:14:04                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 08:14:05                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258849)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 08:14:06                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 08:14:06                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258849)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 08:14:08                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/21 23:14, 0, 1, 258849, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-22 08:14:08                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/21 23:14  
             1          2015-11-22 08:14:13                                  ESENT                           102: Windows (2872) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-22 08:14:13                                  ESENT                           300: Windows (2872) Windows:     .  
             3          2015-11-22 08:14:13                                  ESENT                           301: Windows (2872) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-22 08:14:13                                  ESENT                           302: Windows (2872) Windows:    .  
             1          2015-11-22 08:14:14                                  Windows Search Service          1003:  Windows Search .   
                         2015-11-22 08:15:29                                  WinMgmt                         
                     2015-11-22 08:16:03                                  Software Protection Platform Service  900:      .    
                     2015-11-22 08:16:04                                  SecurityCenter                  1:     Windows .  
                     2015-11-22 08:16:05                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-22 08:16:05                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 08:16:05                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-22 08:18:04                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-22 08:18:04                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-22 08:21:05                                  Software Protection Platform Service  903:     .    
                     2015-11-22 08:21:50                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-22 08:21:50                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-22 08:22:48                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-22 08:22:48                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-22 08:22:49                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-22 08:27:40                                  EventSystem                     
                     2015-11-22 08:27:40                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-22 08:27:41                                  Winlogon                        4101:  Windows .  
                     2015-11-22 08:27:41                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-22 08:27:42                                  WinMgmt                         
                     2015-11-22 08:27:45                                  WinMgmt                         
                     2015-11-22 08:27:46                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-22 08:27:47                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-22 08:27:47                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-22 08:27:47                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 08:27:48                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259187)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 08:27:49                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 08:27:49                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259187)(?)(?)(?)])(1 )(2 )]    
             1          2015-11-22 08:27:50                                  ESENT                           102: Windows (2628) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-22 08:27:50                                  ESENT                           300: Windows (2628) Windows:     .  
             3          2015-11-22 08:27:50                                  ESENT                           301: Windows (2628) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-22 08:27:50                                  ESENT                           302: Windows (2628) Windows:    .  
                     2015-11-22 08:27:51                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/21 23:27, 0, 1, 259187, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-22 08:27:51                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 7377008, 0, 0, 0, 0, 1601/01/01 00:00  
             1          2015-11-22 08:27:51                                  Windows Search Service          1003:  Windows Search .   
                     2015-11-22 08:27:52                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/21 23:27, 0, 1, 259187, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-22 08:27:52                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/21 23:27  
                         2015-11-22 08:29:21                                  WinMgmt                         
                     2015-11-22 08:29:46                                  Software Protection Platform Service  900:      .    
                     2015-11-22 08:29:48                                  SecurityCenter                  1:     Windows .  
                     2015-11-22 08:29:48                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-22 08:29:48                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 08:29:48                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-22 08:31:51                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-22 08:31:52                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-22 08:34:48                                  Software Protection Platform Service  903:     .    
                         2015-11-22 08:57:45                                  SideBySide                      33:       "d:\GAME\trine 2 complete story collectors edition\tools\luac_x64.exe".      "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"".   sxstrace.exe   .  
                     2015-11-22 09:00:34                                  Microsoft-Windows-Defrag        258:         (C:)  
                     2015-11-22 09:07:17                                  VSS                             8224:  VSS  - - .    
                     2015-11-22 09:49:54                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-11-22 09:49:54                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259118)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 09:54:00                                  EventSystem                     
                     2015-11-22 09:54:00                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-22 09:54:02                                  Winlogon                        4101:  Windows .  
                     2015-11-22 09:54:02                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-22 09:54:03                                  WinMgmt                         
                     2015-11-22 09:54:04                                  WinMgmt                         
                     2015-11-22 09:54:10                                  WinMgmt                         
                     2015-11-22 09:54:10                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-22 09:54:11                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-22 09:54:11                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-22 09:54:11                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 09:54:12                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259114)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 09:54:13                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 09:54:14                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259114)(?)(?)(?)])(1 )(2 )]    
             1          2015-11-22 09:54:14                                  ESENT                           102: Windows (2580) Windows:   (6.01.7601.0000)    (0).  
             1          2015-11-22 09:54:14                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-22 09:54:14                                  ESENT                           300: Windows (2580) Windows:     .  
             3          2015-11-22 09:54:14                                  ESENT                           301: Windows (2580) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-22 09:54:14                                  ESENT                           302: Windows (2580) Windows:    .  
                     2015-11-22 09:54:15                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/22 00:54, 0, 1, 259114, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-22 09:54:15                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/22 00:54  
                         2015-11-22 09:55:45                                  WinMgmt                         
                     2015-11-22 09:56:10                                  Software Protection Platform Service  900:      .    
                     2015-11-22 09:56:11                                  SecurityCenter                  1:     Windows .  
                     2015-11-22 09:56:12                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-22 09:56:12                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 09:56:12                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-22 09:58:12                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-22 09:58:12                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-22 10:01:12                                  Software Protection Platform Service  903:     .    
                     2015-11-22 12:45:39                                  EventSystem                     
                     2015-11-22 12:45:39                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-22 12:45:43                                  WinMgmt                         
                     2015-11-22 12:45:43                                  Winlogon                        4101:  Windows .  
                     2015-11-22 12:45:43                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-22 12:45:44                                  WinMgmt                         
                     2015-11-22 12:45:49                                  WinMgmt                         
                     2015-11-22 12:45:50                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-22 12:45:50                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-22 12:45:50                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-22 12:45:50                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 12:45:51                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259029)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 12:45:52                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 12:45:53                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259029)(?)(?)(?)])(1 )(2 )]    
             1          2015-11-22 12:45:54                                  ESENT                           102: Windows (2624) Windows:   (6.01.7601.0000)    (0).  
             1          2015-11-22 12:45:54                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-22 12:45:54                                  ESENT                           300: Windows (2624) Windows:     .  
             3          2015-11-22 12:45:54                                  ESENT                           301: Windows (2624) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-22 12:45:54                                  ESENT                           302: Windows (2624) Windows:    .  
                     2015-11-22 12:45:55                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/22 03:45, 0, 1, 259029, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-22 12:45:55                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/22 03:45  
                         2015-11-22 12:47:24                                  WinMgmt                         
                     2015-11-22 12:47:50                                  Software Protection Platform Service  900:      .    
                     2015-11-22 12:47:51                                  SecurityCenter                  1:     Windows .  
                     2015-11-22 12:47:52                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-22 12:47:52                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 12:47:52                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-22 12:51:29                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-22 12:51:30                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-22 12:52:52                                  Software Protection Platform Service  903:     .    
                     2015-11-22 13:30:49                                  EventSystem                     
                     2015-11-22 13:30:49                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-22 13:30:51                                  Winlogon                        4101:  Windows .  
                     2015-11-22 13:30:51                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-22 13:30:52                                  WinMgmt                         
                     2015-11-22 13:30:53                                  WinMgmt                         
                     2015-11-22 13:30:58                                  WinMgmt                         
                     2015-11-22 13:30:59                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-22 13:31:00                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-22 13:31:00                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-22 13:31:00                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 13:31:00                                  Office Software Protection Platform Service  1040: Hardware has changed from previous boot.   AppId=59a52881-a989-479d-af46-f275c6370663, SkuId=6f327760-8c5c-417c-9b61-836a98287e0c.  
                     2015-11-22 13:31:01                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259155)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 13:31:01                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 13:31:02                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259155)(?)(?)(?)])(1 )(2 )]    
             1          2015-11-22 13:31:03                                  ESENT                           102: Windows (2644) Windows:   (6.01.7601.0000)    (0).  
             1          2015-11-22 13:31:03                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-22 13:31:03                                  ESENT                           300: Windows (2644) Windows:     .  
             3          2015-11-22 13:31:03                                  ESENT                           301: Windows (2644) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-22 13:31:03                                  ESENT                           302: Windows (2644) Windows:    .  
                     2015-11-22 13:31:04                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/22 04:31, 0, 1, 259155, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-22 13:31:04                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/22 04:31  
                         2015-11-22 13:32:24                                  WinMgmt                         
                     2015-11-22 13:32:59                                  Software Protection Platform Service  900:      .    
                     2015-11-22 13:33:00                                  SecurityCenter                  1:     Windows .  
                     2015-11-22 13:33:01                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-22 13:33:01                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 13:33:01                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-22 13:35:11                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-22 13:35:12                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-22 13:38:01                                  Software Protection Platform Service  903:     .    
                         2015-11-22 13:38:06                                  SideBySide                      33:       "C:\my_programs\setup\system ytilit\Speccy64.exe".      "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"".   sxstrace.exe   .  
                         2015-11-22 13:38:20                                  SideBySide                      33:       "C:\my_programs\setup\system ytilit\Speccy64.exe".      "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"".   sxstrace.exe   .  
                         2015-11-22 13:38:20                                  SideBySide                      33:       "C:\my_programs\setup\system ytilit\Speccy64.exe".      "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"".   sxstrace.exe   .  
                         2015-11-22 13:38:21                                  SideBySide                      33:       "C:\my_programs\setup\system ytilit\speccy\Speccy64.exe".      "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"".   sxstrace.exe   .  
                         2015-11-22 13:39:38                                  SideBySide                      33:       "C:\my_programs\setup\system ytilit\speccy\Speccy64.exe".      "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"".   sxstrace.exe   .  
                         2015-11-22 13:39:40                                  SideBySide                      33:       "C:\my_programs\setup\system ytilit\speccy\Speccy64.exe".      "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"".   sxstrace.exe   .  
                         2015-11-22 13:39:40                                  SideBySide                      33:       "C:\my_programs\setup\system ytilit\speccy\Speccy64.exe".      "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"".   sxstrace.exe   .  
                         2015-11-22 13:54:40                                  SideBySide                      33:       "C:\my_programs\setup\system ytilit\speccy\Speccy64.exe".      "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"".   sxstrace.exe   .  
                     2015-11-22 14:06:45                                  System Restore                  8194:     ( = C:\Windows\system32\svchost.exe -k netsvcs;  =   Windows).  
                     2015-11-22 14:09:37  sima                            MsiInstaller                    1040:    Windows: C:\Users\sima\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\netfx_Core_x86.msi.   : 3232.  
                     2015-11-22 14:09:37  sima                            Microsoft-Windows-RestartManager  10000:   0 - 2015-11-22T05:09:37.696304700Z.  
                     2015-11-22 14:09:48  sima                            Microsoft-Windows-LoadPerf      1000: C    {890c10c3-8c2a-4fe3-a36a-9eca153d47cb} (ServiceModel 4.0.0.0)  .         ,   .  
                     2015-11-22 14:09:48  sima                            Microsoft-Windows-LoadPerf      1000: C    SMSvcHost 4.0.0.0 (SMSvcHost 4.0.0.0)  .         ,   .  
                     2015-11-22 14:09:49  sima                            Microsoft-Windows-LoadPerf      1000: C    MSDTC Bridge 4.0.0.0 (MSDTC Bridge 4.0.0.0)  .         ,   .  
                     2015-11-22 14:09:58                                  VSS                             8224:  VSS  - - .    
                     2015-11-22 14:10:57  sima                            MsiInstaller                    11707: : Microsoft .NET Framework 4 Client Profile --   .  
                     2015-11-22 14:10:57  sima                            MsiInstaller                    1033:  Windows   . : Microsoft .NET Framework 4 Client Profile. : 4.0.30319. : 0. : Microsoft Corporation.    : 0.  
                     2015-11-22 14:10:57  sima                            MsiInstaller                    1040:    Windows: C:\Users\sima\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\netfx_Extended_x86.msi.   : 3232.  
                     2015-11-22 14:10:57  sima                            Microsoft-Windows-LoadPerf      1000: C    .NET CLR Networking 4.0.0.0 (.NET CLR Networking 4.0.0.0)  .         ,   .  
                     2015-11-22 14:10:57  sima                            Microsoft-Windows-RestartManager  10001:   0,  2015-11-22T05:09:37.696304700Z.  
                     2015-11-22 14:10:57  sima                            Microsoft-Windows-RestartManager  10000:   0 - 2015-11-22T05:10:57.915054700Z.  
                     2015-11-22 14:10:57                           MsiInstaller                    1042:    Windows: C:\Users\sima\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\netfx_Core_x86.msi.   : 3232.  
                     2015-11-22 14:11:14  sima                            Microsoft-Windows-LoadPerf      1000: C    .NET Memory Cache 4.0 (.NET Memory Cache 4.0)  .         ,   .  
                     2015-11-22 14:11:14  sima                            Microsoft-Windows-LoadPerf      1000: C    Windows Workflow Foundation 4.0.0.0 (Windows Workflow Foundation 4.0.0.0)  .         ,   .  
             1          2015-11-22 14:11:17                                  ASP.NET 4.0.30319.0             1017:  ASP.NET ( 4.0.30319.0) ( : 0x00000404)  
                     2015-11-22 14:11:22  sima                            Microsoft-Windows-LoadPerf      1000: C    aspnet_state (ASP.NET State Service)  .         ,   .  
                     2015-11-22 14:11:25  sima                            Microsoft-Windows-LoadPerf      1000: C    ASP.NET_4.0.30319 (ASP.NET_4.0.30319)  .         ,   .  
                     2015-11-22 14:11:27  sima                            Microsoft-Windows-LoadPerf      1000: C    ASP.NET (ASP.NET)  .         ,   .  
             1          2015-11-22 14:11:27                                  ASP.NET 4.0.30319.0             1019:   ASP.NET ( 4.0.30319.0).      C:\Users\sima\AppData\Local\Temp\ASPNETSetup_00000.log  
               1          2015-11-22 14:11:27                                  ASP.NET 4.0.30319.0             1020:    IIS  ,      IIS   ,  .   ASP.NET    IIS,    IIS    ASP.NET  aspnet_regiis.exe /i.  
                     2015-11-22 14:11:36  sima                            Microsoft-Windows-LoadPerf      1002: C    .NET Data Provider for Oracle (.NET Data Provider for Oracle)    ,   .        .     .  
                     2015-11-22 14:11:36  sima                            MsiInstaller                    11707: : Microsoft .NET Framework 4 Extended --   .  
                     2015-11-22 14:11:36  sima                            MsiInstaller                    1033:  Windows   . : Microsoft .NET Framework 4 Extended. : 4.0.30319. : 0. : Microsoft Corporation.    : 0.  
                     2015-11-22 14:11:36  sima                            Microsoft-Windows-RestartManager  10001:   0,  2015-11-22T05:10:57.915054700Z.  
                     2015-11-22 14:11:36                           MsiInstaller                    1042:    Windows: C:\Users\sima\AppData\Local\Temp\Microsoft .NET Framework 4 Setup_4.0.30319\netfx_Extended_x86.msi.   : 3232.  
                     2015-11-22 14:11:45  sima                            MsiInstaller                    1040:    Windows: C:\189c83ed3dbffb3784\netfx_CoreLP_x86.msi.   : 1428.  
                     2015-11-22 14:11:45  sima                            Microsoft-Windows-RestartManager  10000:   0 - 2015-11-22T05:11:45.836929700Z.  
                     2015-11-22 14:11:52  sima                            MsiInstaller                    11707: : Microsoft .NET Framework 4 Client Profile RUS Language Pack --   .  
                     2015-11-22 14:11:52  sima                            MsiInstaller                    1033:  Windows   . : Microsoft .NET Framework 4 Client Profile RUS Language Pack. : 4.0.30319. : 1049. :  .    : 0.  
                     2015-11-22 14:11:52  sima                            MsiInstaller                    1040:    Windows: C:\189c83ed3dbffb3784\netfx_ExtendedLP_x86.msi.   : 1428.  
                     2015-11-22 14:11:52  sima                            Microsoft-Windows-RestartManager  10001:   0,  2015-11-22T05:11:45.836929700Z.  
                     2015-11-22 14:11:52  sima                            Microsoft-Windows-RestartManager  10000:   0 - 2015-11-22T05:11:52.700210900Z.  
                     2015-11-22 14:11:52                           MsiInstaller                    1042:    Windows: C:\189c83ed3dbffb3784\netfx_CoreLP_x86.msi.   : 1428.  
             1          2015-11-22 14:11:56                                  ASP.NET 4.0.30319.0             1017:  ASP.NET ( 4.0.30319.0) ( : 0x00000404)  
                     2015-11-22 14:11:57  sima                            Microsoft-Windows-LoadPerf      1001:     ASP.NET_4.0.30319 (ASP.NET_4.0.30319)  .        Last Counter  Last Help.  
                     2015-11-22 14:12:01  sima                            Microsoft-Windows-LoadPerf      1001:     aspnet_state (  ASP.NET)  .        Last Counter  Last Help.  
                     2015-11-22 14:12:01  sima                            Microsoft-Windows-LoadPerf      1000: C    aspnet_state (  ASP.NET)  .         ,   .  
                     2015-11-22 14:12:04  sima                            Microsoft-Windows-LoadPerf      1000: C    ASP.NET_4.0.30319 (ASP.NET_4.0.30319)  .         ,   .  
                     2015-11-22 14:12:04  sima                            Microsoft-Windows-LoadPerf      1001:     ASP.NET (ASP.NET)  .        Last Counter  Last Help.  
                     2015-11-22 14:12:06  sima                            Microsoft-Windows-LoadPerf      1000: C    ASP.NET (ASP.NET)  .         ,   .  
             1          2015-11-22 14:12:06                                  ASP.NET 4.0.30319.0             1019:   ASP.NET ( 4.0.30319.0).      C:\Users\sima\AppData\Local\Temp\ASPNETSetup_00001.log  
               1          2015-11-22 14:12:06                                  ASP.NET 4.0.30319.0             1020:    IIS  ,      IIS   ,  .   ASP.NET    IIS,    IIS    ASP.NET  aspnet_regiis.exe /i.  
                     2015-11-22 14:12:07  sima                            MsiInstaller                    11707: : Microsoft .NET Framework 4 Extended RUS Language Pack --   .  
                     2015-11-22 14:12:07  sima                            MsiInstaller                    1033:  Windows   . : Microsoft .NET Framework 4 Extended RUS Language Pack. : 4.0.30319. : 1049. :  .    : 0.  
                     2015-11-22 14:12:07  sima                            Microsoft-Windows-RestartManager  10001:   0,  2015-11-22T05:11:52.700210900Z.  
                     2015-11-22 14:12:07                           MsiInstaller                    1042:    Windows: C:\189c83ed3dbffb3784\netfx_ExtendedLP_x86.msi.   : 1428.  
                     2015-11-22 14:12:47                                  Desktop Window Manager          9002:         
                     2015-11-22 14:13:22                                  NVNetworkService                
                     2015-11-22 14:13:49  sima                            MsiInstaller                    1040:    Windows: C:\NVIDIA\DisplayDriver\341.92\Win8_WinVista_Win7\International\PhysX\PhysX_9.13.1220_SystemSoftware.msi.   : 1256.  
                     2015-11-22 14:14:01  sima                            Microsoft-Windows-RestartManager  10000:   0 - 2015-11-22T05:14:01.337906200Z.  
                     2015-11-22 14:14:04  sima                            MsiInstaller                    11707: : NVIDIA PhysX --   .  
                     2015-11-22 14:14:04  sima                            MsiInstaller                    1033:  Windows   . : NVIDIA PhysX. : 9.13.1220. : 0. : NVIDIA Corporation.    : 0.  
                     2015-11-22 14:14:04  sima                            Microsoft-Windows-RestartManager  10001:   0,  2015-11-22T05:14:01.337906200Z.  
                     2015-11-22 14:14:04                           MsiInstaller                    1042:    Windows: C:\NVIDIA\DisplayDriver\341.92\Win8_WinVista_Win7\International\PhysX\PhysX_9.13.1220_SystemSoftware.msi.   : 1256.  
                     2015-11-22 14:14:17                                  NvStreamSvc                     
                     2015-11-22 14:14:18                                  NvStreamSvc                     
                     2015-11-22 14:14:18                                  NvStreamSvc                     
                     2015-11-22 14:14:19                                  NvStreamSvc                     
                     2015-11-22 14:14:34                                  System Restore                  8194:     ( = C:\NVIDIA\DisplayDriver\341.92\Win8_WinVista_Win7\International\ShadowPlay\DXSETUP.exe /silent;  =  DirectX).  
                     2015-11-22 14:15:58                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-22 14:15:59                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-22 14:17:39                                  VSS                             8224:  VSS  - - .    
                     2015-11-22 14:20:31                                  NvStreamSvc                     
                     2015-11-22 14:20:32                                  NvStreamSvc                     
                     2015-11-22 14:20:32                                  NvStreamSvc                     
                     2015-11-22 14:20:33                                  NvStreamSvc                     
                     2015-11-22 14:20:34                                  NvStreamSvc                     
                     2015-11-22 14:20:34                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-22 14:20:34                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                       2015-11-22 14:20:34                           Microsoft-Windows-User Profiles Service  1530:  Windows ,        .    .   ,    ,    .        -    0 user registry handles leaked from \Registry\User\S-1-5-21-1499224401-2478604990-2095306355-1000:   
                     2015-11-22 14:20:36                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-22 14:21:31                                  EventSystem                     
                     2015-11-22 14:21:31                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-22 14:21:33                                  Winlogon                        4101:  Windows .  
                     2015-11-22 14:21:33                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-22 14:21:35                                  NVNetworkService                
                     2015-11-22 14:21:38                                  NvStreamSvc                     
                     2015-11-22 14:21:38                                  WinMgmt                         
                     2015-11-22 14:21:40                                  NvStreamSvc                     
                     2015-11-22 14:21:45                                  NvStreamSvc                     
                     2015-11-22 14:21:45                                  WinMgmt                         
                     2015-11-22 14:21:49                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-22 14:21:51                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-22 14:21:51                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-22 14:21:51                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 14:21:52                                  Office Software Protection Platform Service  1040: Hardware has changed from previous boot.   AppId=59a52881-a989-479d-af46-f275c6370663, SkuId=6f327760-8c5c-417c-9b61-836a98287e0c.  
                     2015-11-22 14:21:52                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259150)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 14:21:53                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 14:21:54                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259150)(?)(?)(?)])(1 )(2 )]    
             1          2015-11-22 14:21:55                                  ESENT                           102: Windows (3400) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-22 14:21:55                                  ESENT                           300: Windows (3400) Windows:     .  
             3          2015-11-22 14:21:55                                  ESENT                           301: Windows (3400) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
                     2015-11-22 14:21:56                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/22 05:21, 0, 1, 259150, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-22 14:21:56                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 1734688, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-22 14:21:56                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/22 05:21, 0, 1, 259150, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
             3          2015-11-22 14:21:56                                  ESENT                           302: Windows (3400) Windows:    .  
                     2015-11-22 14:21:57                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/22 05:21  
             1          2015-11-22 14:21:58                                  Windows Search Service          1003:  Windows Search .   
                         2015-11-22 14:23:11                                  WinMgmt                         
                     2015-11-22 14:23:47                                  Software Protection Platform Service  900:      .    
                     2015-11-22 14:23:48                                  SecurityCenter                  1:     Windows .  
                     2015-11-22 14:23:49                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-22 14:23:57                                  Software Protection Platform Service  1033:   ,       override-only.   =(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet-Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicensing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs-clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA)    =55c92734-d682-4d71-983e-d6ec3f16059f   SKU=7cfd4696-69a9-4af7-af36-ff3d12b6b6c8  
                     2015-11-22 14:23:57                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 14:23:57                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-22 14:27:51                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-22 14:27:51                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-22 14:28:57                                  Software Protection Platform Service  903:     .    
                     2015-11-22 14:56:01                                  VSS                             8224:  VSS  - - .    
                     2015-11-22 16:53:06                                  Desktop Window Manager          9010:  (BM95.EXE)          
                     2015-11-22 16:53:06                                  Desktop Window Manager          9013:       ,          
                     2015-11-22 17:40:33                                  NvStreamSvc                     
                     2015-11-22 17:40:34                                  NvStreamSvc                     
                     2015-11-22 17:40:34                                  NvStreamSvc                     
                     2015-11-22 17:40:35                                  NvStreamSvc                     
                     2015-11-22 17:40:35                                  NvStreamSvc                     
                     2015-11-22 17:40:35                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-22 17:40:35                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-22 17:40:37                                  NVNetworkService                
                     2015-11-22 17:40:37                                  NVNetworkService                
                     2015-11-22 17:40:37                           Microsoft-Windows-User Profiles Service  1532:    .        
                       2015-11-22 17:40:37                                  NvStreamSvc                     
                     2015-11-22 19:50:52                                  EventSystem                     
                     2015-11-22 19:50:52                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-22 19:50:57                                  NVNetworkService                
                     2015-11-22 19:50:57                                  NvStreamSvc                     
                     2015-11-22 19:50:58                                  NvStreamSvc                     
                     2015-11-22 19:50:59                                  Winlogon                        4101:  Windows .  
                     2015-11-22 19:50:59                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-22 19:51:01                                  NvStreamSvc                     
                     2015-11-22 19:51:02                                  WinMgmt                         
                     2015-11-22 19:51:07                                  WinMgmt                         
                     2015-11-22 19:51:09                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-22 19:51:11                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-22 19:51:11                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-22 19:51:11                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 19:51:13                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258871)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 19:51:13                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 19:51:14                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258871)(?)(?)(?)])(1 )(2 )]    
             1          2015-11-22 19:51:14                                  ESENT                           102: Windows (3504) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-22 19:51:14                                  ESENT                           300: Windows (3504) Windows:     .  
             3          2015-11-22 19:51:14                                  ESENT                           301: Windows (3504) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             1          2015-11-22 19:51:15                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-22 19:51:15                                  ESENT                           302: Windows (3504) Windows:    .  
                     2015-11-22 19:51:16                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/22 10:51, 0, 1, 258871, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-22 19:51:16                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 9282680, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-22 19:51:16                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/22 10:51, 0, 1, 258871, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-22 19:51:16                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/22 10:51  
                         2015-11-22 19:52:36                                  WinMgmt                         
                     2015-11-22 19:53:09                                  Software Protection Platform Service  900:      .    
                     2015-11-22 19:53:10                                  SecurityCenter                  1:     Windows .  
                     2015-11-22 19:53:11                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-22 19:53:12                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 19:53:12                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-22 19:57:15                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-22 19:57:15                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-22 19:58:12                                  Software Protection Platform Service  903:     .    
                     2015-11-22 20:01:13                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-22 20:01:13                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-22 20:03:21  sima                            Microsoft-Windows-RestartManager  10000:   1 - 2015-11-22T11:03:21.412109300Z.  
                         2015-11-22 20:05:03                                  VSS                             8194:    :      IVssWriterCallback.  hr = 0x80070005,   .  .     -        .    :         :       : {e8132975-6f93-4464-a53e-1050253ae220}      : System Writer       : {1819d861-8f24-4f67-ae6c-87b4f106bb79}  
                     2015-11-22 20:05:16                                  System Restore                  8194:     ( = D:\GAME\Narco Terror\_CommonRedist\DirectX\Jun2010\DXSETUP.exe Terror\_CommonRedist\DirectX\Jun2010\DXSETUP.exe";  =  DirectX).  
                     2015-11-22 20:06:18  sima                            MsiInstaller                    1040:    Windows: c:\1f37e5f7af06718a92d89352ae8dc40b\vc_red.msi.   : 312.  
                     2015-11-22 20:06:18  sima                            Microsoft-Windows-RestartManager  10000:   0 - 2015-11-22T11:06:18.453125000Z.  
                     2015-11-22 20:06:21  sima                            MsiInstaller                    1022: : Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 -   "KB2565063"  .  
                     2015-11-22 20:06:21  sima                            MsiInstaller                    1036:  Windows   . : Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219. : 10.0.40219. : 0. : Microsoft Corporation. : KB2565063.    : 0.  
                     2015-11-22 20:06:21  sima                            MsiInstaller                    11707: Product: Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 -- Installation completed successfully.  
                     2015-11-22 20:06:21  sima                            MsiInstaller                    1033:  Windows   . : Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219. : 10.0.40219. : 0. : Microsoft Corporation.    : 0.  
                     2015-11-22 20:06:21  sima                            Microsoft-Windows-RestartManager  10001:   0,  2015-11-22T11:06:18.453125000Z.  
                     2015-11-22 20:06:21                           MsiInstaller                    1042:    Windows: c:\1f37e5f7af06718a92d89352ae8dc40b\vc_red.msi.   : 312.  
                     2015-11-22 20:06:44                                  System Restore                  8194:     ( = D:\GAME\Narco Terror\_CommonRedist\vcredist\2012\vcredist_x86.exe Terror\_CommonRedist\vcredist\2012\vcredist_x86.exe";  = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106).  
                     2015-11-22 20:06:44  sima                            MsiInstaller                    1040:    Windows: C:\ProgramData\Package Cache\{E824E81C-80A4-3DFF-B5F9-4842A9FF5F7F}v11.0.51106\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi.   : 2772.  
                     2015-11-22 20:06:45  sima                            Microsoft-Windows-RestartManager  10000:   0 - 2015-11-22T11:06:45.027343700Z.  
                     2015-11-22 20:06:49  sima                            MsiInstaller                    11707: Product: Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 -- Installation completed successfully.  
                     2015-11-22 20:06:49  sima                            MsiInstaller                    1033:  Windows   . : Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106. : 11.0.51106. : 1033. : Microsoft Corporation.    : 0.  
                     2015-11-22 20:06:49  sima                            MsiInstaller                    1040:    Windows: C:\ProgramData\Package Cache\{6C772996-BFF3-3C8C-860B-B3D48FF05D65}v11.0.51106\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.   : 2772.  
                     2015-11-22 20:06:49  sima                            Microsoft-Windows-RestartManager  10001:   0,  2015-11-22T11:06:45.027343700Z.  
                     2015-11-22 20:06:49  sima                            Microsoft-Windows-RestartManager  10000:   0 - 2015-11-22T11:06:49.501953100Z.  
                     2015-11-22 20:06:49                           MsiInstaller                    1042:    Windows: C:\ProgramData\Package Cache\{E824E81C-80A4-3DFF-B5F9-4842A9FF5F7F}v11.0.51106\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi.   : 2772.  
                     2015-11-22 20:06:51  sima                            MsiInstaller                    11707: Product: Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 -- Installation completed successfully.  
                     2015-11-22 20:06:51  sima                            MsiInstaller                    1033:  Windows   . : Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106. : 11.0.51106. : 1033. : Microsoft Corporation.    : 0.  
                     2015-11-22 20:06:51  sima                            Microsoft-Windows-RestartManager  10001:   0,  2015-11-22T11:06:49.501953100Z.  
                     2015-11-22 20:06:51                           MsiInstaller                    1042:    Windows: C:\ProgramData\Package Cache\{6C772996-BFF3-3C8C-860B-B3D48FF05D65}v11.0.51106\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.   : 2772.  
                     2015-11-22 20:07:15  sima                            Microsoft-Windows-RestartManager  10001:   1,  2015-11-22T11:03:21.412109300Z.  
                     2015-11-22 20:09:52                                  VSS                             8224:  VSS  - - .    
                     2015-11-22 20:47:00                                  VSS                             8224:  VSS  - - .    
                     2015-11-22 21:15:17                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-11-22 21:15:17                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259116)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 21:24:35                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259107)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 21:30:09                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259102)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-22 22:08:56                                  NvStreamSvc                     
                     2015-11-22 22:08:57                                  NvStreamSvc                     
                     2015-11-22 22:08:57                                  NvStreamSvc                     
                     2015-11-22 22:08:58                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-22 22:08:58                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-22 22:08:59                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-23 22:39:03                                  EventSystem                     
                     2015-11-23 22:39:03                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-23 22:39:05                                  Winlogon                        4101:  Windows .  
                     2015-11-23 22:39:05                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-23 22:39:07                                  NVNetworkService                
                     2015-11-23 22:39:08                                  NvStreamSvc                     
                     2015-11-23 22:39:08                                  WinMgmt                         
                     2015-11-23 22:39:09                                  NvStreamSvc                     
                     2015-11-23 22:39:10                                  NvStreamSvc                     
                     2015-11-23 22:39:13                                  WinMgmt                         
                     2015-11-23 22:39:18                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-23 22:39:20                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-23 22:39:20                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-23 22:39:20                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-23 22:39:21                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 257592)(?)(?)(?)])(1 )(2 )]    
                     2015-11-23 22:39:22                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-23 22:39:22                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 257592)(?)(?)(?)])(1 )(2 )]    
             1          2015-11-23 22:39:22                                  ESENT                           102: Windows (3340) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-23 22:39:22                                  ESENT                           300: Windows (3340) Windows:     .  
             3          2015-11-23 22:39:22                                  ESENT                           301: Windows (3340) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00208.log.  
             3          2015-11-23 22:39:23                                  ESENT                           301: Windows (3340) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
                     2015-11-23 22:39:24                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/23 13:39, 0, 1, 257592, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-23 22:39:24                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/23 13:39  
             3          2015-11-23 22:39:24                                  ESENT                           302: Windows (3340) Windows:    .  
             1          2015-11-23 22:39:25                                  Windows Search Service          1003:  Windows Search .   
                         2015-11-23 22:40:42                                  WinMgmt                         
                     2015-11-23 22:41:15                                  Software Protection Platform Service  900:      .    
                     2015-11-23 22:41:16                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-23 22:41:16                                  SecurityCenter                  1:     Windows .  
                     2015-11-23 22:41:16                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-23 22:41:16                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-23 22:43:52                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-23 22:43:52                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-23 22:46:12                                  Software Protection Platform Service  903:     .    
                     2015-11-23 23:02:09                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-11-23 23:02:09                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259178)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-23 23:26:46                                  NvStreamSvc                     
                     2015-11-23 23:26:47                                  NvStreamSvc                     
                     2015-11-23 23:26:47                                  NvStreamSvc                     
                     2015-11-23 23:26:48                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-23 23:26:48                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-23 23:26:49                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-24 21:30:05                                  EventSystem                     
                     2015-11-24 21:30:05                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-24 21:30:09                                  NVNetworkService                
                     2015-11-24 21:30:10                                  Winlogon                        4101:  Windows .  
                     2015-11-24 21:30:10                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-24 21:30:15                                  NvStreamSvc                     
                     2015-11-24 21:30:15                                  WinMgmt                         
                     2015-11-24 21:30:15                                  NvStreamSvc                     
                     2015-11-24 21:30:16                                  NvStreamSvc                     
                     2015-11-24 21:30:18                                  WinMgmt                         
                     2015-11-24 21:30:18                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-24 21:30:19                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-24 21:30:19                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-24 21:30:19                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-24 21:30:21                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 257830)(?)(?)(?)])(1 )(2 )]    
                     2015-11-24 21:30:22                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-24 21:30:23                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 257830)(?)(?)(?)])(1 )(2 )]    
             1          2015-11-24 21:30:23                                  ESENT                           102: Windows (3380) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-24 21:30:23                                  ESENT                           300: Windows (3380) Windows:     .  
             3          2015-11-24 21:30:23                                  ESENT                           301: Windows (3380) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
                     2015-11-24 21:30:24                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/24 12:30, 0, 1, 257830, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-24 21:30:24                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 9906464, 0, 0, 0, 0, 1601/01/01 00:00  
             1          2015-11-24 21:30:24                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-24 21:30:24                                  ESENT                           302: Windows (3380) Windows:    .  
                     2015-11-24 21:30:25                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/24 12:30, 0, 1, 257829, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-24 21:30:25                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 9908128, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-24 21:30:26                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/24 12:30, 0, 1, 257829, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-24 21:30:26                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/24 12:30  
                         2015-11-24 21:31:50                                  WinMgmt                         
                     2015-11-24 21:32:19                                  Software Protection Platform Service  900:      .    
                     2015-11-24 21:32:19                                  SecurityCenter                  1:     Windows .  
                     2015-11-24 21:32:20                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-24 21:32:21                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-24 21:32:21                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-24 21:36:28                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-24 21:36:28                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-24 21:37:21                                  Software Protection Platform Service  903:     .    
                     2015-11-24 21:37:35                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 78  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 422  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 31  : COM Addin for Microsoft Outlook Hotmail Connector : COM Addin for Microsoft Outlook Hotmail Connector ProgID: MSNCON.Addin.1 GUID: {DC67367A-8B15-47BC-B7F8-0BA0435A504A}   : 03 HKLM: 1 : C:\PROGRA~1\COMMON~1\SYSTEM\MSMAPI\MSNCON32.DLL   (): 0  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 16  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 47  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 93   
                     2015-11-24 21:37:35                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-11-24 21:37:35                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259193)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-24 21:46:04                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259185)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-24 21:48:37                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-24 21:48:37                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-24 21:53:40                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259177)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-24 22:35:31                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259135)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-24 22:44:29                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259126)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-24 22:44:34                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259126)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-24 22:50:39                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 0  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 16  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 0  : COM Addin for Microsoft Outlook Hotmail Connector : COM Addin for Microsoft Outlook Hotmail Connector ProgID: MSNCON.Addin.1 GUID: {DC67367A-8B15-47BC-B7F8-0BA0435A504A}   : 03 HKLM: 1 : C:\PROGRA~1\COMMON~1\SYSTEM\MSMAPI\MSNCON32.DLL   (): 0  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 0  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 0  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 15   
                     2015-11-24 22:50:39                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259120)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-24 22:57:22                                  Outlook                         30:    C:\Users\sima\AppData\Local\Microsoft\Outlook\aofso.pst   : Automatic Reconciliation.  
                     2015-11-24 22:57:22                                  Outlook                         30:    C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook0.ost   : Automatic Reconciliation.  
                     2015-11-24 22:57:28                                  Outlook                         38:     : C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook0.ost. : Added: 0, Deleted: 0, Modified: 0, Compared: 1350, Version: 14.0.4760.1000.  
                     2015-11-24 22:57:53                                  Outlook                         38:     : C:\Users\sima\AppData\Local\Microsoft\Outlook\aofso.pst. : Added: 0, Deleted: 0, Modified: 0, Compared: 802, Version: 14.0.4760.1000.  
                     2015-11-24 23:23:42                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259087)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-24 23:28:18                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259083)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-24 23:47:30                                  NvStreamSvc                     
                     2015-11-24 23:47:31                                  NvStreamSvc                     
                     2015-11-24 23:47:31                                  NvStreamSvc                     
                     2015-11-24 23:47:31                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-24 23:47:32                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-24 23:47:32                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-25 09:22:06                                  EventSystem                     
                     2015-11-25 09:22:06                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-25 09:22:12                                  Winlogon                        4101:  Windows .  
                     2015-11-25 09:22:12                                  NVNetworkService                
                     2015-11-25 09:22:12                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-25 09:22:15                                  NvStreamSvc                     
                     2015-11-25 09:22:15                                  WinMgmt                         
                     2015-11-25 09:22:17                                  NvStreamSvc                     
                     2015-11-25 09:22:18                                  WinMgmt                         
                     2015-11-25 09:22:27                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-25 09:22:27                                  NvStreamSvc                     
                     2015-11-25 09:22:28                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
             1          2015-11-25 09:22:28                                  ESENT                           102: Windows (2788) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-25 09:22:28                                  ESENT                           300: Windows (2788) Windows:     .  
             3          2015-11-25 09:22:28                                  ESENT                           301: Windows (2788) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS00209.log.  
                     2015-11-25 09:22:29                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-25 09:22:29                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-25 09:22:29                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258488)(?)(?)(?)])(1 )(2 )]    
                     2015-11-25 09:22:30                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
             3          2015-11-25 09:22:30                                  ESENT                           301: Windows (2788) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-25 09:22:30                                  ESENT                           302: Windows (2788) Windows:    .  
                     2015-11-25 09:22:31                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258488)(?)(?)(?)])(1 )(2 )]    
             1          2015-11-25 09:22:31                                  Windows Search Service          1003:  Windows Search .   
                     2015-11-25 09:22:32                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/25 00:22, 0, 1, 258488, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-25 09:22:32                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/25 00:22  
                         2015-11-25 09:23:51                                  WinMgmt                         
                     2015-11-25 09:24:28                                  Software Protection Platform Service  900:      .    
                     2015-11-25 09:24:29                                  SecurityCenter                  1:     Windows .  
                     2015-11-25 09:24:29                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-25 09:24:29                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-25 09:24:29                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-25 09:28:24                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-25 09:28:24                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-25 09:29:30                                  Software Protection Platform Service  903:     .    
                     2015-11-25 09:40:46                                  NvStreamSvc                     
                     2015-11-25 09:40:47                                  NvStreamSvc                     
                     2015-11-25 09:40:47                                  NvStreamSvc                     
                     2015-11-25 09:40:48                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-25 09:40:48                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-25 09:40:49                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-25 14:41:10                                  EventSystem                     
                     2015-11-25 14:41:10                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-25 14:41:14                                  Winlogon                        4101:  Windows .  
                     2015-11-25 14:41:16                                  NVNetworkService                
                     2015-11-25 14:41:16                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-25 14:41:17                                  NvStreamSvc                     
                     2015-11-25 14:41:18                                  NvStreamSvc                     
                     2015-11-25 14:41:18                                  WinMgmt                         
                     2015-11-25 14:41:21                                  NvStreamSvc                     
                     2015-11-25 14:41:21                                  WinMgmt                         
                     2015-11-25 14:41:23                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-25 14:41:25                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-25 14:41:25                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-25 14:41:25                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-25 14:41:27                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258882)(?)(?)(?)])(1 )(2 )]    
                     2015-11-25 14:41:27                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
             1          2015-11-25 14:41:27                                  ESENT                           102: Windows (3436) Windows:   (6.01.7601.0000)    (0).  
             1          2015-11-25 14:41:27                                  Windows Search Service          1003:  Windows Search .   
             3          2015-11-25 14:41:27                                  ESENT                           300: Windows (3436) Windows:     .  
             3          2015-11-25 14:41:27                                  ESENT                           301: Windows (3436) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-25 14:41:27                                  ESENT                           302: Windows (3436) Windows:    .  
                     2015-11-25 14:41:28                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258882)(?)(?)(?)])(1 )(2 )]    
                     2015-11-25 14:41:29                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/25 05:41, 0, 1, 258882, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-25 14:41:29                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 1997128, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-25 14:41:30                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/25 05:41, 0, 1, 258882, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-25 14:41:30                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/25 05:41  
                         2015-11-25 14:42:55                                  WinMgmt                         
                     2015-11-25 14:43:23                                  Software Protection Platform Service  900:      .    
                     2015-11-25 14:43:25                                  SecurityCenter                  1:     Windows .  
                     2015-11-25 14:43:25                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-25 14:43:26                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-25 14:43:26                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-25 14:46:47                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-25 14:46:47                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-25 14:48:26                                  Software Protection Platform Service  903:     .    
                     2015-11-25 14:54:55                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-25 14:54:56                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-25 15:03:39                                  NvStreamSvc                     
                     2015-11-25 15:03:40                                  NvStreamSvc                     
                     2015-11-25 15:03:40                                  NvStreamSvc                     
                     2015-11-25 15:03:41                                  NvStreamSvc                     
                     2015-11-25 15:03:41                                  Desktop Window Manager          9009:         (0x40010004)  
                     2015-11-25 15:03:41                                  NvStreamSvc                     
                     2015-11-25 15:03:41                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-25 15:03:42                           Microsoft-Windows-User Profiles Service  1532:    .        
                     2015-11-25 23:28:52                                  EventSystem                     
                     2015-11-25 23:28:52                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-25 23:28:55                                  Winlogon                        4101:  Windows .  
                     2015-11-25 23:28:56                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-25 23:28:56                                  NVNetworkService                
                     2015-11-25 23:28:59                                  NvStreamSvc                     
                     2015-11-25 23:28:59                                  NvStreamSvc                     
                     2015-11-25 23:29:00                                  WinMgmt                         
                     2015-11-25 23:29:02                                  WinMgmt                         
                     2015-11-25 23:29:02                                  NvStreamSvc                     
                     2015-11-25 23:29:03                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-25 23:29:05                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-25 23:29:05                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-25 23:29:05                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-25 23:29:07                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258673)(?)(?)(?)])(1 )(2 )]    
                     2015-11-25 23:29:07                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-25 23:29:08                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258673)(?)(?)(?)])(1 )(2 )]    
             1          2015-11-25 23:29:08                                  ESENT                           102: Windows (3464) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-25 23:29:08                                  ESENT                           300: Windows (3464) Windows:     .  
             3          2015-11-25 23:29:08                                  ESENT                           301: Windows (3464) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0025A.log.  
                     2015-11-25 23:29:09                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/25 14:29, 0, 1, 258673, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
             3          2015-11-25 23:29:09                                  ESENT                           301: Windows (3464) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0025B.log.  
             3          2015-11-25 23:29:09                                  ESENT                           301: Windows (3464) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-25 23:29:09                                  ESENT                           302: Windows (3464) Windows:    .  
                     2015-11-25 23:29:10                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 3037168, 0, 0, 0, 0, 1601/01/01 00:00  
                     2015-11-25 23:29:10                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/25 14:29, 0, 1, 258673, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-25 23:29:10                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x8007000D, 0x00050C31, 3037872, 0, 0, 0, 0, 1601/01/01 00:00  
             1          2015-11-25 23:29:10                                  Windows Search Service          1003:  Windows Search .   
                     2015-11-25 23:29:11                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/25 14:29, 0, 1, 258673, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-25 23:29:11                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/25 14:29  
                         2015-11-25 23:30:38                                  WinMgmt                         
                     2015-11-25 23:31:04                                  Software Protection Platform Service  900:      .    
                     2015-11-25 23:31:05                                  SecurityCenter                  1:     Windows .  
                     2015-11-25 23:31:06                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-25 23:31:06                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-25 23:31:06                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-25 23:33:54                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-11-25 23:33:54                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259196)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-25 23:33:55                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 16  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 78  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 0  : COM Addin for Microsoft Outlook Hotmail Connector : COM Addin for Microsoft Outlook Hotmail Connector ProgID: MSNCON.Addin.1 GUID: {DC67367A-8B15-47BC-B7F8-0BA0435A504A}   : 03 HKLM: 1 : C:\PROGRA~1\COMMON~1\SYSTEM\MSMAPI\MSNCON32.DLL   (): 16  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 0  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 0  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 31   
                     2015-11-25 23:35:10                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-25 23:35:10                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-25 23:36:06                                  Software Protection Platform Service  903:     .    
                     2015-11-26 07:15:52                                  EventSystem                     
                     2015-11-26 07:15:52                           Microsoft-Windows-User Profiles Service  1531:     .        
                     2015-11-26 07:15:56                                  Winlogon                        4101:  Windows .  
                     2015-11-26 07:15:56                                  Wlclntfy                        6000:     -    winlogon <SessionEnv>.  
                     2015-11-26 07:15:57                                  NVNetworkService                
                     2015-11-26 07:15:58                                  NvStreamSvc                     
                     2015-11-26 07:15:59                                  WinMgmt                         
                     2015-11-26 07:15:59                                  NvStreamSvc                     
                     2015-11-26 07:16:00                                  NvStreamSvc                     
                     2015-11-26 07:16:01                                  WinMgmt                         
                     2015-11-26 07:16:15                                  WinMgmt                         
                     2015-11-26 07:16:15                                  Office Software Protection Platform Service  900: The Software Protection service is starting.    
                     2015-11-26 07:16:16                                  Office Software Protection Platform Service  1066: Initialization status for service objects.  C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-26 07:16:16                                  Office Software Protection Platform Service  902: The Software Protection service has started.  14.0.370.400  
                     2015-11-26 07:16:17                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-26 07:16:18                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258733)(?)(?)(?)])(1 )(2 )]    
                     2015-11-26 07:16:18                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-26 07:16:19                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 258733)(?)(?)(?)])(1 )(2 )]    
                     2015-11-26 07:16:20                                  Office Software Protection Platform Service  12288: The client has sent an activation request to the key management service machine.  Info:  0x00000000, 0x00000000, 127.0.0.1:1688, c1db8867-8a0c-4b86-9fd9-d4d7354c5472, 2015/11/25 22:16, 0, 1, 258733, 6f327760-8c5c-417c-9b61-836a98287e0c, 5  
                     2015-11-26 07:16:20                                  Office Software Protection Platform Service  12289: The client has processed an activation response from the key management service machine.  Info:  0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2015/11/25 22:16  
             1          2015-11-26 07:16:20                                  ESENT                           102: Windows (3496) Windows:   (6.01.7601.0000)    (0).  
             3          2015-11-26 07:16:20                                  ESENT                           300: Windows (3496) Windows:     .  
             3          2015-11-26 07:16:20                                  ESENT                           301: Windows (3496) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.  
             3          2015-11-26 07:16:20                                  ESENT                           302: Windows (3496) Windows:    .  
             1          2015-11-26 07:16:21                                  Windows Search Service          1003:  Windows Search .   
                     2015-11-26 07:16:23                                  Windows Error Reporting         1001:   ,  0   : PnPGenericDriverFound  :     CAB: 0     :  P1: x86  P2: USB\VID_1E4E&PID_0109&REV_0002&MI_00  P3:   P4:   P5:   P6:   P7:   P8:   P9:   P10:      :        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_8165a3ccd0f3c8899cadd67225307fc53a8ef7d6_0f04b621     :     : 0   : 28a020cd-93c2-11e5-babd-0000db4d6dee   : 6  
                         2015-11-26 07:17:36                                  WinMgmt                         
                     2015-11-26 07:18:28                                  Software Protection Platform Service  900:      .    
                     2015-11-26 07:18:48                                  SecurityCenter                  1:     Windows .  
                     2015-11-26 07:18:49                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-26 07:18:49                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-26 07:18:49                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                     2015-11-26 07:19:22                                  Outlook                         30:    C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook0.ost   : The store was last opened on a different machine.  
               3          2015-11-26 07:20:11                                  Windows Search Service          3036:     <mapi://{S-1-5-21-1499224401-2478604990-2095306355-1000}/> .  :  "",  "SystemIndex"  :    .   .  (HRESULT : 0x80041206) (0x80041206)   
                     2015-11-26 07:20:44                                  Office Software Protection Platform Service  1033: These policies are being excluded since they are only defined with override-only attribute.  Policy Names=(Security-SPP-Reserved-EnableNotificationMode)   App Id=59a52881-a989-479d-af46-f275c6370663  Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c  
                     2015-11-26 07:20:44                                  Office Software Protection Platform Service  1003: The Software Protection service has completed licensing status check.  Application Id=59a52881-a989-479d-af46-f275c6370663  Licensing Status= 1: 191301d3-a579-428c-b0c7-d7988500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f327760-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algorithm/volume/1.0 0x00000000 259196)(?)(?)(?)])(1 )(2 )] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-26 07:20:49                                  Outlook                         45: Outlook   :   :  Microsoft Exchange :  Microsoft Exchange     ,         ProgID: UmOutlookAddin.FormRegionAddin GUID: {F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll   (): 94  : Microsoft Outlook Social Connector :          ,   . ProgID: OscAddin.Connect GUID: {2163EB1F-3FD9-4212-A41F-81D1F933597F}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\SOCIALCONNECTOR.DLL   (): 359  :  OneNote   Outlook :   "  OneNote"  "   "    ProgID: OneNote.OutlookAddin GUID: {B8DD1F2D-BED0-4298-B0D5-9B08F8FAD6CB}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ONBttnOL.dll   (): 62  : COM Addin for Microsoft Outlook Hotmail Connector : COM Addin for Microsoft Outlook Hotmail Connector ProgID: MSNCON.Addin.1 GUID: {DC67367A-8B15-47BC-B7F8-0BA0435A504A}   : 03 HKLM: 1 : C:\PROGRA~1\COMMON~1\SYSTEM\MSMAPI\MSNCON32.DLL   (): 0  :  - Microsoft SharePoint Workspace  Outlook :  - Microsoft SharePoint Workspace  Outlook ProgID: Groove.OutlookProxyAddIn GUID: {E886F1D9-7842-485D-8EDF-9E1C7062A483}   : 03 HKLM: 1 : C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL   (): 16  :       Microsoft SharePoint Server :      Microsoft SharePoint Server      Outlook ProgID: ColleagueImport.ColleagueImportAddin GUID: {EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}   : 03 HKLM: 0 : C:\Program Files\Microsoft Office\Office14\ADDINS\ColleagueImport.dll   (): 16  :  Business Connectivity Services :     Business Connectivity Services. ProgID: BCSAddin.Connect GUID: {9F787EA5-5EA9-4288-A7D7-A110E8A57494}   : 03 HKLM: 1 : C:\Program Files\Microsoft Office\Office14\ADDINS\BCSAddin.dll   (): 78   
               3          2015-11-26 07:20:53                                  Windows Search Service          3036:     <mapi://{S-1-5-21-1499224401-2478604990-2095306355-1000}/> .  :  "",  "SystemIndex"  :      .  (HRESULT : 0x8004362c) (0x8004362c)   
                     2015-11-26 07:21:03                                  Outlook                         38:     : C:\Users\sima\AppData\Local\Microsoft\Outlook\simanovvv_outlook0.ost. : Added: 3, Deleted: 0, Modified: 3, Compared: 1358, Version: 14.0.4760.1000.  
                     2015-11-26 07:22:15                           Microsoft-Windows-LoadPerf      1001:     WmiApRpl (WmiApRpl)  .        Last Counter  Last Help.  
                     2015-11-26 07:22:15                           Microsoft-Windows-LoadPerf      1000: C    WmiApRpl (WmiApRpl)  .         ,   .  
                     2015-11-26 07:23:49                                  Software Protection Platform Service  903:     .    
                         2015-11-26 07:29:23                                  SideBySide                      33:       "C:\my_programs\setup\system ytilit\speccy\Speccy64.exe".      "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"".   sxstrace.exe   .  
                         2015-11-26 07:29:28                                  SideBySide                      33:       "C:\my_programs\setup\system ytilit\speccy\Speccy64.exe".      "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"".   sxstrace.exe   .  
                         2015-11-26 07:31:11                                  SideBySide                      33:       "C:\my_programs\setup\system ytilit\speccy\Speccy64.exe".      "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"".   sxstrace.exe   .  
                     2015-11-26 07:31:34                                  Software Protection Platform Service  900:      .    
                     2015-11-26 07:31:34                                  Software Protection Platform Service  1066:    .  C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000   
                     2015-11-26 07:31:34                                  Software Protection Platform Service  1003:        .   =55c92734-d682-4d71-983e-d6ec3f16059f   = 1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]    
                     2015-11-26 07:31:34                                  Software Protection Platform Service  902:     .  6.1.7601.17514  
                 100        2015-11-26 07:34:49                                  Application Error               1000:   : everest.exe, : 5.2.1750.0,  : 0x2a425e19    : unknown, : 0.0.0.0,   0x00000000   : 0x00000000   : 0x00000000    : 0x978     : 0x01d127d0fe5e906d    : C:\my_programs\setup\system ytilit\EVEREST Ultimate Edition\everest.exe    : unknown   : bc4fc19d-93c4-11e5-babd-0000db4d6dee
                     2015-11-26 07:34:56                                  Windows Error Reporting         1001:   ,  0   : APPCRASH  :     CAB: 0     :  P1: everest.exe  P2: 5.2.1750.0  P3: 2a425e19  P4: StackHash_fb96  P5: 0.0.0.0  P6: 00000000  P7: 00000000  P8: 00000000  P9:   P10:      :        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_everest.exe_32de568a961fa5884ef2eae6c7104b29a82f8e_0d99b217     :     : 0   : bc4fc19d-93c4-11e5-babd-0000db4d6dee   : 0  
                 100        2015-11-26 07:34:57                                  Application Error               1000:   : everest.exe, : 5.2.1750.0,  : 0x2a425e19    : ntdll.dll, : 6.1.7601.17514,   0x4ce7b96e   : 0xc0000005   : 0x00052c26    : 0x978     : 0x01d127d0fe5e906d    : C:\my_programs\setup\system ytilit\EVEREST Ultimate Edition\everest.exe    : C:\Windows\SYSTEM32\ntdll.dll   : c10d74b5-93c4-11e5-babd-0000db4d6dee
                     2015-11-26 07:34:59                                  Windows Error Reporting         1001:   ,  0   : APPCRASH  :     CAB: 0     :  P1: everest.exe  P2: 5.2.1750.0  P3: 2a425e19  P4: ntdll.dll  P5: 6.1.7601.17514  P6: 4ce7b96e  P7: c0000005  P8: 00052c26  P9:   P10:      :        :  C:\Users\sima\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_everest.exe_403020f2a2ce39cdfd79d7b9c729abe346eb139_0b7dbe0d     :     : 0   : c10d74b5-93c4-11e5-babd-0000db4d6dee   : 0  
      Audit Success   12288      2015-09-28 01:22:17                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    : 0x36c   :  C:\Windows\System32\oobe\msoobe.exe     :  2015-09-27T22:22:17.265625000Z   :  2015-09-27T16:22:17.171000000Z          .    Windows,    ,    .           .  
      Audit Success   13824      2015-09-28 01:22:17                                  Microsoft-Windows-Security-Auditing  4720:    .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :      SAM: sima    :  %%1793     : -    :  %%1793    :  %%1793     :  %%1793     :  %%1793     : %%1793     : %%1794       :  %%1794     : 513    : -     UAC:  0x0     UAC:  0x15      :     %%2080    %%2082    %%2084    : %%1793    SID:  -    :  %%1797     :   Privileges  -  
      Audit Success   13824      2015-09-28 01:22:17                                  Microsoft-Windows-Security-Auditing  4722:    .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir  
      Audit Success   13824      2015-09-28 01:22:17                                  Microsoft-Windows-Security-Auditing  4738:    .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir     :      SAM: sima    :  %%1793     : -    :  %%1793    :  %%1793     :  %%1793     :  %%1793     : %%1793     : %%1794       :  %%1794     : 513    : -     UAC:  0x15     UAC:  0x14      :     %%2048    : %%1793    SID:  -    :  %%1797     :   :  -  
      Audit Success   13824      2015-09-28 01:22:17                                  Microsoft-Windows-Security-Auditing  4738:    .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir     :      SAM: sima    :  %%1793     : -    :  %%1793    :  %%1793     :  %%1793     :  %%1793     : %%1793     : %%1794       :  %%1794     : 513    : -     UAC:  0x14     UAC:  0x214      :     %%2089    : %%1793    SID:  -    :  %%1797     :   :  -  
      Audit Success   13824      2015-09-28 01:22:17                                  Microsoft-Windows-Security-Auditing  4738:    .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir     :      SAM: sima    :  %%1793     : -    :  %%1793    :  %%1793     :  %%1793     :  %%1793     : %%1793     : 28.09.2015 2:22:17       :  %%1794     : 513    : -     UAC:  0x214     UAC:  0x214      : -    : -    SID:  -    :  %%1797     :   :  -  
      Audit Success   13824      2015-09-28 01:22:17                                  Microsoft-Windows-Security-Auditing  4724:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir  
      Audit Success   13826      2015-09-28 01:22:17                                  Microsoft-Windows-Security-Auditing  4728:       .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  -    :    :  S-1-5-21-1499224401-2478604990-2095306355-513    :  None    :  vladimir     :   :  -  
      Audit Success   13826      2015-09-28 01:22:17                                  Microsoft-Windows-Security-Auditing  4732:       .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  -    :    :  S-1-5-32-545    :      :  Builtin     :   :  -  
      Audit Success   13826      2015-09-28 01:22:17                                  Microsoft-Windows-Security-Auditing  4732:       .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  -    :    :  S-1-5-32-544    :      :  Builtin     :   :  -  
      Audit Success   13826      2015-09-28 01:22:17                                  Microsoft-Windows-Security-Auditing  4733:       .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  -    :    :  S-1-5-32-545    :      :  Builtin     :   :  -  
      Audit Success   12544      2015-09-28 01:22:18                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 01:22:18                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 01:23:01                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x1c0    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-09-28 01:23:01                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x36f41   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c0    :  C:\Windows\System32\winlogon.exe      :     : WIN-N09L0AS3TIA     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 01:23:01                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x36f82   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c0    :  C:\Windows\System32\winlogon.exe      :     : WIN-N09L0AS3TIA     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 01:23:01                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x36f41    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 01:24:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 01:24:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   103        2015-09-28 01:24:40                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-09-28 01:27:19                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-09-28 01:27:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 01:27:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 01:27:19                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-09-28 01:27:19                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9629  
      Audit Success   12544      2015-09-28 01:27:20                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 01:27:20                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 01:27:20                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-28 01:27:20                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 01:27:21                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 01:27:21                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 01:27:21                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-28 01:27:21                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-09-28 01:27:24                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-09-28 01:27:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 01:27:24                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x230    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-09-28 01:27:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x15f3a   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x230    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 01:27:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x15f8c   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x230    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 01:27:24                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-28 01:27:24                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x15f3a    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-09-28 01:27:25                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-09-28 01:27:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x18094   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 01:27:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 01:27:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 01:27:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 01:27:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 01:29:27                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 01:29:27                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 01:32:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 01:32:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 01:32:55                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 01:32:55                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-09-28 01:33:31                                  Microsoft-Windows-Security-Auditing  4904:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0x918    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0xf80d6  
      Audit Success   13568      2015-09-28 01:33:31                                  Microsoft-Windows-Security-Auditing  4905:       .    Subject    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0x918    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0xf80d6  
      Audit Success   12544      2015-09-28 01:33:32                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 01:33:32                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 01:37:01                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 01:37:01                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 01:40:55                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 01:40:55                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 01:41:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 01:41:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-09-28 02:02:09                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-09-28 02:05:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 02:05:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 02:05:05                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-28 02:05:05                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-09-28 02:05:22                                  Microsoft-Windows-Security-Auditing  4904:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0x148    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0x3bf792  
      Audit Success   13568      2015-09-28 02:05:22                                  Microsoft-Windows-Security-Auditing  4905:       .    Subject    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0x148    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0x3bf792  
      Audit Success   12544      2015-09-28 02:05:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 02:05:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 02:06:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 02:06:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-09-28 02:19:38                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x15f8c      ,   .  ,  ,  .        .  
      Audit Success   103        2015-09-28 02:19:40                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-09-28 02:20:34                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-09-28 02:20:34                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-09-28 02:20:35                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9690  
      Audit Success   12544      2015-09-28 02:20:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x22c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 02:20:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 02:20:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x22c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 02:20:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x22c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 02:20:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x22c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 02:20:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-28 02:20:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-28 02:20:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 02:20:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x22c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 02:20:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 02:20:44                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x204    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-09-28 02:20:44                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x14167   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 02:20:44                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x14167    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-09-28 02:20:51                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12292      2015-09-28 02:20:55                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-09-28 02:20:55                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x22c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 02:20:55                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 02:20:58                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1aa50   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12292      2015-09-28 02:21:01                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-09-28 02:21:12                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x22c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 02:21:12                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 02:23:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x22c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 02:23:05                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12288      2015-09-28 02:24:58                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x438   :  C:\Windows\System32\svchost.exe     :  2015-09-27T17:25:05.500000000Z   :  2015-09-27T17:24:58.211753100Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-09-28 02:24:58                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x438   :  C:\Windows\System32\svchost.exe     :  2015-09-27T17:24:58.211753100Z   :  2015-09-27T17:24:58.211000000Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-09-28 02:24:58                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x438   :  C:\Windows\System32\svchost.exe     :  2015-09-27T17:24:58.211000000Z   :  2015-09-27T17:24:58.211000000Z          .    Windows,    ,    .           .  
      Audit Success   12544      2015-09-28 02:29:21                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x22c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 02:29:21                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 02:34:32                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x22c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 02:34:32                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 02:42:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x22c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 02:42:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 02:42:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x22c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 02:42:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-09-28 02:43:05                                  Microsoft-Windows-Security-Auditing  4904:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0xe38    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0x122ec4  
      Audit Success   13568      2015-09-28 02:43:05                                  Microsoft-Windows-Security-Auditing  4905:       .    Subject    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0xe38    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0x122ec4  
      Audit Success   12544      2015-09-28 04:58:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x22c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 04:58:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 05:05:53                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x22c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 05:05:53                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x22c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 05:05:53                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-28 05:05:53                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 05:06:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x22c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 05:06:24                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 05:55:48                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x22c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 05:55:48                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 06:35:35                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x22c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 06:35:35                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-09-28 06:49:31                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x14167      ,   .  ,  ,  .        .  
      Audit Success   103        2015-09-28 06:49:32                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-09-28 07:16:57                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-09-28 07:16:57                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-09-28 07:16:59                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x26559  
      Audit Success   13826      2015-09-28 07:16:59                                  Microsoft-Windows-Security-Auditing  4731:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7     :    :  S-1-5-32-556    :        :  Builtin    :      SAM:       SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:16:59                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-556    :        :  Builtin     :      SAM: -    SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:16:59                                  Microsoft-Windows-Security-Auditing  4731:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7     :    :  S-1-5-32-547    :       :  Builtin    :      SAM:      SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:16:59                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-547    :       :  Builtin     :      SAM: -    SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:16:59                                  Microsoft-Windows-Security-Auditing  4731:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7     :    :  S-1-5-32-551    :       :  Builtin    :      SAM:      SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:16:59                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-551    :       :  Builtin     :      SAM: -    SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:16:59                                  Microsoft-Windows-Security-Auditing  4731:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7     :    :  S-1-5-32-552    :      :  Builtin    :      SAM:     SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:16:59                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-552    :      :  Builtin     :      SAM: -    SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:16:59                                  Microsoft-Windows-Security-Auditing  4731:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7     :    :  S-1-5-32-555    :         :  Builtin    :      SAM:        SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:16:59                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-555    :         :  Builtin     :      SAM: -    SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:17:00                                  Microsoft-Windows-Security-Auditing  4731:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7     :    :  S-1-5-32-569    :       :  Builtin    :      SAM:      SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:17:00                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-569    :       :  Builtin     :      SAM: -    SID:  -     :   :  -  
      Audit Success   12544      2015-09-28 07:17:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 07:17:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 07:17:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 07:17:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 07:17:16                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 07:17:16                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 07:17:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 07:17:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 07:17:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 07:17:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-28 07:17:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-28 07:17:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-09-28 07:17:19                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-09-28 07:17:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 07:17:19                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-09-28 07:17:20                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-09-28 07:17:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x34722   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 07:19:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 07:19:22                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 07:19:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 07:19:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13824      2015-09-28 07:19:42                                  Microsoft-Windows-Security-Auditing  4738:    .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-21-1499224401-2478604990-2095306355-500     :  Administrator     :  37L4247F27-08     :      SAM: -    :  -     : -    :  -    :  -     :  -     :  -     : -     : -       :  -     : -    : -     UAC:  0x211     UAC:  0x211      : -    : -    SID:  -    :  -     :   :  -  
      Audit Success   12544      2015-09-28 07:20:08                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 07:20:08                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  37L4247F27-08$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1c8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 07:20:08                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-28 07:20:08                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   103        2015-09-28 07:20:11                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-09-28 07:21:10                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-09-28 07:21:10                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 07:21:11                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 07:21:11                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 07:21:11                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-28 07:21:11                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-09-28 07:21:11                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xaed1  
      Audit Success   12544      2015-09-28 07:21:33                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 07:21:33                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 07:21:33                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 07:21:33                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-28 07:21:33                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-28 07:21:33                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 07:22:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 07:22:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-09-28 07:22:02                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-09-28 07:22:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 07:22:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-09-28 07:22:03                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-09-28 07:22:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x21abf   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13824      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4781:    :    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-32-569     :  Builtin      :        :       :   :  -  
      Audit Success   13824      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4781:    :    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-32-573     :  Builtin      : Event Log Readers      :        :   :  -  
      Audit Success   13824      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4738:    .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-21-1499224401-2478604990-2095306355-500     :  Administrator     :  vladimir     :      SAM: Administrator    :  %%1793     : -    :  %%1793    :  %%1793     :  %%1793     :  %%1793     : %%1793     : 21.11.2010 1:56:34       :  %%1794     : 513    : -     UAC:  0x211     UAC:  0x211      : -    : %%1793    SID:  -    :  %%1797     :   :  -  
      Audit Success   13824      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4781:    :    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-21-1499224401-2478604990-2095306355-500     :  vladimir      : Administrator      :      :   :  -  
      Audit Success   13824      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4738:    .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-21-1499224401-2478604990-2095306355-500     :       :  vladimir     :      SAM:     :  %%1793     : -    :  %%1793    :  %%1793     :  %%1793     :  %%1793     : %%1793     : 21.11.2010 1:56:34       :  %%1794     : 513    : -     UAC:  0x211     UAC:  0x211      : -    : %%1793    SID:  -    :  %%1797     :   :  -  
      Audit Success   13824      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4738:    .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-21-1499224401-2478604990-2095306355-501     :  Guest     :  vladimir     :      SAM: Guest    :  %%1793     : -    :  %%1793    :  %%1793     :  %%1793     :  %%1793     : %%1793     : %%1794       :  %%1794     : 513    : -     UAC:  0x215     UAC:  0x215      : -    : %%1793    SID:  -    :  %%1797     :   :  -  
      Audit Success   13824      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4781:    :    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-21-1499224401-2478604990-2095306355-501     :  vladimir      : Guest      :      :   :  -  
      Audit Success   13824      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4738:    .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-21-1499224401-2478604990-2095306355-501     :       :  vladimir     :      SAM:     :  %%1793     : -    :  %%1793    :  %%1793     :  %%1793     :  %%1793     : %%1793     : %%1794       :  %%1794     : 513    : -     UAC:  0x215     UAC:  0x215      : -    : %%1793    SID:  -    :  %%1797     :   :  -  
      Audit Success   13824      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4781:    :    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-32-544     :  Builtin      : Administrators      :      :   :  -  
      Audit Success   13824      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4781:    :    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-32-545     :  Builtin      : Users      :      :   :  -  
      Audit Success   13824      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4781:    :    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-32-546     :  Builtin      : Guests      :      :   :  -  
      Audit Success   13824      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4781:    :    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-32-551     :  Builtin      :        :       :   :  -  
      Audit Success   13824      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4781:    :    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-32-552     :  Builtin      :       :      :   :  -  
      Audit Success   13824      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4781:    :    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-32-555     :  Builtin      :          :         :   :  -  
      Audit Success   13824      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4781:    :    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-32-556     :  Builtin      :         :        :   :  -  
      Audit Success   13824      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4781:    :    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-32-547     :  Builtin      :        :       :   :  -  
      Audit Success   13824      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4781:    :    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-32-558     :  Builtin      : Performance Monitor Users      :        :   :  -  
      Audit Success   13824      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4781:    :    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-32-559     :  Builtin      : Performance Log Users      :        :   :  -  
      Audit Success   13824      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4781:    :    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-32-562     :  Builtin      : Distributed COM Users      :  DCOM     :   :  -  
      Audit Success   13824      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4781:    :    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7      :    :  S-1-5-32-568     :  Builtin      : IIS_IUSRS      : IIS_IUSRS     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-569    :       :  Builtin     :      SAM:      SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-573    :  Event Log Readers    :  Builtin     :      SAM: -    SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-573    :        :  Builtin     :      SAM:       SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-544    :  Administrators    :  Builtin     :      SAM: -    SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-544    :      :  Builtin     :      SAM:     SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-545    :  Users    :  Builtin     :      SAM: -    SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-545    :      :  Builtin     :      SAM:     SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-546    :  Guests    :  Builtin     :      SAM: -    SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-546    :      :  Builtin     :      SAM:     SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-551    :       :  Builtin     :      SAM: -    SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-551    :       :  Builtin     :      SAM:      SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-552    :      :  Builtin     :      SAM: -    SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-552    :      :  Builtin     :      SAM:     SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-555    :         :  Builtin     :      SAM: -    SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-555    :         :  Builtin     :      SAM:        SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-556    :        :  Builtin     :      SAM: -    SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-556    :        :  Builtin     :      SAM:       SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-547    :       :  Builtin     :      SAM: -    SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-547    :       :  Builtin     :      SAM:      SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-558    :  Performance Monitor Users    :  Builtin     :      SAM: -    SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-558    :        :  Builtin     :      SAM:       SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-559    :  Performance Log Users    :  Builtin     :      SAM: -    SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-559    :        :  Builtin     :      SAM:       SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-562    :  Distributed COM Users    :  Builtin     :      SAM: -    SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-562    :   DCOM    :  Builtin     :      SAM:  DCOM    SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-568    :  IIS_IUSRS    :  Builtin     :      SAM: -    SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-568    :  IIS_IUSRS    :  Builtin     :      SAM: IIS_IUSRS    SID:  -     :   :  -  
      Audit Success   13826      2015-09-28 07:22:06                                  Microsoft-Windows-Security-Auditing  4735:      .    :    :  S-1-5-18     :  WIN-N09L0AS3TIA$     :  WORKGROUP    :  0x3e7    :    :  S-1-5-32-569    :       :  Builtin     :      SAM: -    SID:  -     :   :  -  
      Audit Success   12288      2015-09-28 23:26:52                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-09-28 23:26:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-09-28 23:26:52                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9495  
      Audit Success   12544      2015-09-28 23:26:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 23:26:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 23:26:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 23:26:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-28 23:26:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-28 23:26:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 23:27:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 23:27:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 23:27:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-28 23:27:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-09-28 23:27:01                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-09-28 23:27:02                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x208    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-09-28 23:27:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x147bf   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x208    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 23:27:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x147bf    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-09-28 23:27:04                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-09-28 23:27:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 23:27:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-09-28 23:27:05                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-09-28 23:27:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1b9dd   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-28 23:27:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 23:27:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-28 23:29:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-28 23:29:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-09-28 23:40:36                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x147bf      ,   .  ,  ,  .        .  
      Audit Success   103        2015-09-28 23:40:37                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-09-29 18:58:44                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-09-29 18:58:44                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-29 18:58:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-29 18:58:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-29 18:58:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-29 18:58:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-29 18:58:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-29 18:58:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-29 18:58:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-29 18:58:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-29 18:58:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-29 18:58:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-09-29 18:58:45                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9999  
      Audit Success   12290      2015-09-29 18:58:50                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-09-29 18:58:50                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x248    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-09-29 18:58:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1376f   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x248    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-29 18:58:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1376f    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-09-29 18:58:53                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-09-29 18:58:53                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-09-29 18:58:53                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-29 18:58:53                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-29 18:58:54                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1a7e0   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-29 18:59:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-29 18:59:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-29 19:00:55                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-29 19:00:55                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-29 19:23:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-29 19:23:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-29 19:23:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-29 19:23:24                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-29 19:28:54                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-29 19:28:54                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-29 20:31:44                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-29 20:31:44                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-29 21:09:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-29 21:09:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-09-29 22:27:14                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1376f      ,   .  ,  ,  .        .  
      Audit Success   103        2015-09-29 22:27:15                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-09-30 11:08:44                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-09-30 11:08:44                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-09-30 11:08:45                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x85e2  
      Audit Success   12544      2015-09-30 11:08:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-30 11:08:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-30 11:08:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-30 11:08:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-30 11:08:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-30 11:08:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-30 11:08:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-30 11:08:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-30 11:08:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-30 11:08:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-09-30 11:08:50                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-09-30 11:08:50                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x23c    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-09-30 11:08:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x14bfc   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x23c    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-30 11:08:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-30 11:08:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x14bfc    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-30 11:08:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-09-30 11:08:51                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-09-30 11:08:51                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-09-30 11:08:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1b0c6   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-30 11:09:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-30 11:09:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-30 11:10:53                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-30 11:10:53                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-30 11:57:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-30 11:57:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-09-30 12:04:21                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-09-30 12:04:21                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-09-30 12:04:21                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-09-30 12:04:21                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-09-30 15:13:17                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x14bfc      ,   .  ,  ,  .        .  
      Audit Success   103        2015-09-30 15:13:18                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-01 23:14:00                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-01 23:14:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-10-01 23:14:00                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x8a7a  
      Audit Success   12544      2015-10-01 23:14:01                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-01 23:14:01                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-01 23:14:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-01 23:14:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-01 23:14:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-01 23:14:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-01 23:14:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-01 23:14:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-01 23:14:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-01 23:14:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-01 23:14:03                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-01 23:14:03                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x254    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-01 23:14:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x146a9   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x254    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-01 23:14:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x146a9    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-01 23:14:04                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-01 23:14:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-01 23:14:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-01 23:14:05                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-01 23:14:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1acfb   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-01 23:14:13                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-01 23:14:13                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-01 23:16:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-01 23:16:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-01 23:41:13                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-01 23:41:13                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-01 23:46:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-01 23:46:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-01 23:47:57                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-01 23:47:57                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-01 23:47:58                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-01 23:47:58                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-01 23:48:17                                  Microsoft-Windows-Security-Auditing  4904:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0x9f0    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0xb341b  
      Audit Success   13568      2015-10-01 23:48:17                                  Microsoft-Windows-Security-Auditing  4905:       .    Subject    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0x9f0    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0xb341b  
      Audit Success   12544      2015-10-02 00:08:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-02 00:08:15                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-02 00:08:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-02 00:08:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-02 00:08:24                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-02 00:08:24                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-02 00:08:37                                  Microsoft-Windows-Security-Auditing  4904:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0x368    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0x102320  
      Audit Success   13568      2015-10-02 00:08:37                                  Microsoft-Windows-Security-Auditing  4905:       .    Subject    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0x368    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0x102320  
      Audit Success   12544      2015-10-02 00:08:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-02 00:08:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-02 00:09:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-02 00:09:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-02 00:21:20                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-02 00:21:20                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-02 00:25:58                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-02 00:25:58                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-02 00:29:40                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x146a9      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-02 00:29:42                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-03 22:30:08                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-03 22:30:08                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-10-03 22:30:08                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x8eb9  
      Audit Success   12544      2015-10-03 22:30:12                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-03 22:30:12                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-03 22:30:12                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-03 22:30:12                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-03 22:30:12                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-03 22:30:12                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-03 22:30:12                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-03 22:30:12                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-03 22:30:13                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12292      2015-10-03 22:30:13                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-03 22:30:13                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-03 22:30:13                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-03 22:30:13                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-03 22:30:13                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-03 22:30:14                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-03 22:30:14                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x238    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-03 22:30:14                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x16aa8   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x238    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-03 22:30:14                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1996d   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-03 22:30:14                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x16aa8    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-03 22:30:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-03 22:30:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-03 22:32:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-03 22:32:15                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-03 22:52:11                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-03 22:52:11                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-03 23:02:09                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-03 23:02:09                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-03 23:02:09                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-03 23:02:09                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-03 23:02:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-03 23:02:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-03 23:18:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-03 23:18:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12288      2015-10-04 00:00:03                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x450   :  C:\Windows\System32\svchost.exe     :  2015-10-03T15:00:17.081054600Z   :  2015-10-03T15:00:03.232311000Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-10-04 00:00:03                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x450   :  C:\Windows\System32\svchost.exe     :  2015-10-03T15:00:03.248912500Z   :  2015-10-03T15:00:03.248000000Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-10-04 00:00:03                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x450   :  C:\Windows\System32\svchost.exe     :  2015-10-03T15:00:03.248000000Z   :  2015-10-03T15:00:03.248000000Z          .    Windows,    ,    .           .  
      Audit Success   12544      2015-10-04 01:08:55                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-04 01:08:55                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-04 01:10:21                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-04 01:10:21                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-04 02:01:27                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x16aa8      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-04 02:01:28                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-04 13:34:14                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-04 13:34:14                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-10-04 13:34:14                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x93d1  
      Audit Success   12544      2015-10-04 13:34:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-04 13:34:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-04 13:34:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-04 13:34:15                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-04 13:34:15                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-04 13:34:15                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-04 13:34:16                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-04 13:34:16                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-04 13:34:16                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-04 13:34:16                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-04 13:34:17                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-04 13:34:17                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x264    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-04 13:34:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x146f4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x264    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-04 13:34:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x146f4    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-04 13:34:18                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-04 13:34:18                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-04 13:34:18                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-04 13:34:19                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-04 13:34:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x197b7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-04 13:34:27                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-04 13:34:27                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-04 13:36:21                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-04 13:36:21                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-04 14:10:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-04 14:10:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-04 14:10:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-04 14:10:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-04 23:00:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-04 23:00:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-04 23:00:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-04 23:00:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12288      2015-10-04 23:36:35                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x454   :  C:\Windows\System32\svchost.exe     :  2015-10-04T14:36:35.796875000Z   :  2015-10-04T14:36:35.796000000Z          .    Windows,    ,    .           .  
      Audit Success   12290      2015-10-04 23:49:26                                  Microsoft-Windows-Security-Auditing  5061:  .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir      :  0x146f4     :    : Microsoft Software Key Storage Provider    : RSA    : lp-ed919552-825f-4490-8a35-5b628caeda78    : %%2500     :   : %%2480    : 0x0  
      Audit Success   12292      2015-10-04 23:49:26                                  Microsoft-Windows-Security-Auditing  5058:    .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir      :  0x146f4     :    : Microsoft Software Key Storage Provider    : %%2432    : lp-ed919552-825f-4490-8a35-5b628caeda78    : %%2500         :     : C:\Users\sima\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1499224401-2478604990-2095306355-1000\ee539417034139c4c4a9391b2008de47_f952cf71-67f6-4072-b534-bf35f443671e   : %%2458    : 0x0  
      Audit Success   12545      2015-10-05 01:07:27                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x146f4      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-05 01:07:28                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-05 01:07:28                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x454   :  C:\Windows\System32\svchost.exe     :  2015-10-04T16:07:28.669141300Z   :  2015-10-04T16:07:28.669000000Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-10-05 08:16:24                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-05 08:16:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-10-05 08:16:24                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9c73  
      Audit Success   12290      2015-10-05 08:16:27                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-05 08:16:27                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-05 08:16:27                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-05 08:16:27                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-05 08:16:27                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-05 08:16:27                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-05 08:16:27                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-05 08:16:27                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-05 08:16:27                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-05 08:16:27                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-05 08:16:27                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-05 08:16:28                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x284    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-05 08:16:28                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b451   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x284    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-05 08:16:28                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b451    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-05 08:16:29                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-10-05 08:16:29                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-05 08:16:29                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-05 08:16:29                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x21a48   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-05 08:16:29                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-05 08:16:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-05 08:16:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-05 08:18:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-05 08:18:31                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-05 08:41:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-05 08:41:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-05 08:41:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-05 08:41:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-05 08:46:30                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-05 08:46:30                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12288      2015-10-05 08:53:51                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x474   :  C:\Windows\System32\svchost.exe     :  2015-10-04T23:53:51.226562500Z   :  2015-10-04T23:53:51.226000000Z          .    Windows,    ,    .           .  
      Audit Success   12545      2015-10-05 17:36:23                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b451      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-05 17:36:24                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-07 07:26:16                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-07 07:26:16                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-07 07:26:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-07 07:26:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-07 07:26:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-07 07:26:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-07 07:26:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-07 07:26:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-07 07:26:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-07 07:26:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-07 07:26:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-07 07:26:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-07 07:26:17                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa534  
      Audit Success   12544      2015-10-07 07:26:19                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x2a4    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-07 07:26:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1af27   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x2a4    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-07 07:26:19                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1af27    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-07 07:26:20                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-07 07:26:20                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-07 07:26:20                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-07 07:26:21                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-10-07 07:26:21                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-07 07:26:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x218a3   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-07 07:26:30                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-07 07:26:30                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-07 07:28:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-07 07:28:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-07 07:49:17                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1af27      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-07 07:49:18                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-07 10:25:47                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-07 10:25:47                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-07 10:25:47                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-07 10:25:47                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-07 10:25:47                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-07 10:25:47                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-07 10:25:47                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-07 10:25:47                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-07 10:25:47                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-07 10:25:47                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-07 10:25:47                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-07 10:25:47                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-07 10:25:47                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa577  
      Audit Success   12290      2015-10-07 10:25:50                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-07 10:25:50                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x294    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-07 10:25:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b887   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x294    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-07 10:25:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b887    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-07 10:25:51                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-07 10:25:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-07 10:25:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-07 10:25:52                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-07 10:25:53                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x22048   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-07 10:26:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-07 10:26:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-07 10:27:54                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-07 10:27:54                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-07 11:09:08                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-07 11:09:08                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-07 11:19:08                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-07 11:19:08                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-07 11:19:08                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-07 11:19:08                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-07 12:59:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-07 12:59:15                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-07 13:46:11                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b887      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-07 13:46:12                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-08 07:34:49                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-08 07:34:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-08 07:34:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-08 07:34:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-08 07:34:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-08 07:34:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-08 07:34:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-08 07:34:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-08 07:34:49                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa570  
      Audit Success   12544      2015-10-08 07:34:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-08 07:34:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-08 07:34:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-08 07:34:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-08 07:34:51                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-08 07:34:51                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x2a4    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-08 07:34:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b695   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x2a4    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-08 07:34:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b695    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-08 07:34:52                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-08 07:34:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-08 07:34:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-08 07:34:53                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-08 07:34:54                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x21497   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-08 07:35:01                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-08 07:35:01                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-08 07:36:56                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-08 07:36:56                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-08 08:59:13                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-08 08:59:13                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-08 09:27:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-08 09:27:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-08 09:34:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-08 09:34:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-08 09:34:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-08 09:34:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-08 10:05:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-08 10:05:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   103        2015-10-08 23:15:53                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12545      2015-10-08 23:15:53                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b695      ,   .  ,  ,  .        .  
      Audit Success   12288      2015-10-09 07:44:22                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-09 07:44:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-09 07:44:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-09 07:44:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-09 07:44:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-09 07:44:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-09 07:44:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-09 07:44:22                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-09 07:44:22                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-09 07:44:22                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-09 07:44:22                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-09 07:44:22                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-09 07:44:22                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa8ac  
      Audit Success   12290      2015-10-09 07:44:24                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-09 07:44:24                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x270    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-09 07:44:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b393   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x270    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-09 07:44:24                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b393    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-09 07:44:25                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-10-09 07:44:25                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-09 07:44:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-09 07:44:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-09 07:44:26                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x21550   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-09 07:44:34                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-09 07:44:34                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-09 07:46:28                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-09 07:46:28                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-09 09:01:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-09 09:01:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-09 09:01:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-09 09:01:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-09 09:02:03                                  Microsoft-Windows-Security-Auditing  4904:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0x420    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0xd16d4  
      Audit Success   13568      2015-10-09 09:02:03                                  Microsoft-Windows-Security-Auditing  4905:       .    Subject    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0x420    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0xd16d4  
      Audit Success   12544      2015-10-09 09:02:34                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-09 09:02:34                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-10 00:40:16                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b393      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-10 00:40:17                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-10 09:16:37                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-10 09:16:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-10 09:16:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-10 09:16:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-10 09:16:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-10 09:16:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-10 09:16:37                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xafc7  
      Audit Success   12290      2015-10-10 09:16:38                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-10 09:16:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-10 09:16:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-10 09:16:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-10 09:16:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-10 09:16:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-10 09:16:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-10 09:16:39                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-10 09:16:39                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x270    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-10 09:16:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b6af   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x270    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-10 09:16:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-10 09:16:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b6af    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-10 09:16:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-10 09:16:40                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-10 09:16:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x2aac5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-10 09:16:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-10 09:16:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-10 09:18:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-10 09:18:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-10 09:21:44                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b6af      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-10 09:21:46                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-11 08:57:05                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-11 08:57:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-10-11 08:57:05                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa54c  
      Audit Success   12544      2015-10-11 08:57:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-11 08:57:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-11 08:57:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-11 08:57:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-11 08:57:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-11 08:57:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-11 08:57:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-11 08:57:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-11 08:57:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-11 08:57:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-11 08:57:08                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-11 08:57:08                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x268    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-11 08:57:08                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b352   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x268    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-11 08:57:08                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b352    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-11 08:57:09                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-11 08:57:09                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-11 08:57:09                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-11 08:57:10                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-11 08:57:11                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x210ef   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-11 08:57:18                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-11 08:57:18                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-11 08:59:14                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-11 08:59:14                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12288      2015-10-11 09:03:20                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x46c   :  C:\Windows\System32\svchost.exe     :  2015-10-11T00:03:33.555664000Z   :  2015-10-11T00:03:20.973036100Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-10-11 09:03:20                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x46c   :  C:\Windows\System32\svchost.exe     :  2015-10-11T00:03:20.989636600Z   :  2015-10-11T00:03:20.989000000Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-10-11 09:03:20                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x46c   :  C:\Windows\System32\svchost.exe     :  2015-10-11T00:03:20.989976500Z   :  2015-10-11T00:03:20.989000000Z          .    Windows,    ,    .           .  
      Audit Success   12544      2015-10-11 09:22:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-11 09:22:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-11 09:41:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-11 09:41:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-11 09:51:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-11 09:51:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-11 09:51:08                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-11 09:51:08                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-11 12:27:13                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b352      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-11 12:27:14                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-12 13:29:41                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-12 13:29:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-12 13:29:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-12 13:29:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-12 13:29:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-12 13:29:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-12 13:29:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-12 13:29:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-12 13:29:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-12 13:29:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-12 13:29:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-12 13:29:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-12 13:29:41                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa5b5  
      Audit Success   12544      2015-10-12 13:29:42                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x268    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-12 13:29:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1acc7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x268    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-12 13:29:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1acc7    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-12 13:29:43                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12292      2015-10-12 13:29:43                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-12 13:29:43                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-12 13:29:43                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-12 13:29:45                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-12 13:29:46                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x21fed   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-12 13:29:53                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-12 13:29:53                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-12 13:31:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-12 13:31:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12288      2015-10-12 13:37:00                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x47c   :  C:\Windows\System32\svchost.exe     :  2015-10-12T04:37:00.240234100Z   :  2015-10-12T04:37:00.240000000Z          .    Windows,    ,    .           .  
      Audit Success   12544      2015-10-12 14:14:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-12 14:14:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-12 14:14:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-12 14:14:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-12 22:01:21                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-12 22:01:21                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-12 23:48:38                                  Microsoft-Windows-Security-Auditing  5061:  .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir      :  0x1acc7     :    : Microsoft Software Key Storage Provider    : RSA    : lp-ed919552-825f-4490-8a35-5b628caeda78    : %%2500     :   : %%2480    : 0x0  
      Audit Success   12292      2015-10-12 23:48:38                                  Microsoft-Windows-Security-Auditing  5058:    .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir      :  0x1acc7     :    : Microsoft Software Key Storage Provider    : %%2432    : lp-ed919552-825f-4490-8a35-5b628caeda78    : %%2500         :     : C:\Users\sima\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1499224401-2478604990-2095306355-1000\ee539417034139c4c4a9391b2008de47_f952cf71-67f6-4072-b534-bf35f443671e   : %%2458    : 0x0  
      Audit Success   12545      2015-10-13 00:32:58                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1acc7      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-13 00:32:59                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-13 18:51:37                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-13 18:51:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-13 18:51:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-13 18:51:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-13 18:51:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-13 18:51:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-13 18:51:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-13 18:51:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-13 18:51:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-13 18:51:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-13 18:51:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-13 18:51:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-13 18:51:37                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa4d5  
      Audit Success   12290      2015-10-13 18:51:39                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-13 18:51:39                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x294    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-13 18:51:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b82e   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x294    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-13 18:51:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b82e    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-13 18:51:40                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-13 18:51:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-13 18:51:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-13 18:51:42                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-13 18:51:43                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x228d6   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-13 18:51:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-13 18:51:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-13 18:53:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-13 18:53:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-13 19:21:57                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-13 19:21:57                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-13 19:21:57                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-13 19:21:57                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-13 22:57:55                                  Microsoft-Windows-Security-Auditing  5061:  .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir      :  0x1b82e     :    : Microsoft Software Key Storage Provider    : RSA    : lp-ed919552-825f-4490-8a35-5b628caeda78    : %%2500     :   : %%2480    : 0x0  
      Audit Success   12292      2015-10-13 22:57:55                                  Microsoft-Windows-Security-Auditing  5058:    .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir      :  0x1b82e     :    : Microsoft Software Key Storage Provider    : %%2432    : lp-ed919552-825f-4490-8a35-5b628caeda78    : %%2500         :     : C:\Users\sima\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1499224401-2478604990-2095306355-1000\ee539417034139c4c4a9391b2008de47_f952cf71-67f6-4072-b534-bf35f443671e   : %%2458    : 0x0  
      Audit Success   103        2015-10-14 00:33:13                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12545      2015-10-14 00:33:13                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b82e      ,   .  ,  ,  .        .  
      Audit Success   12288      2015-10-14 10:18:44                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-14 10:18:44                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-14 10:18:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-14 10:18:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-14 10:18:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-14 10:18:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-14 10:18:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-14 10:18:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-14 10:18:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-14 10:18:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-14 10:18:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-14 10:18:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-14 10:18:45                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa5f5  
      Audit Success   12290      2015-10-14 10:18:47                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-14 10:18:47                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x268    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-14 10:18:47                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b152   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x268    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-14 10:18:47                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b152    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-14 10:18:48                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-14 10:18:48                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-14 10:18:48                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-14 10:18:50                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-14 10:18:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x22ad8   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-14 10:18:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-14 10:18:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-14 10:19:31                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b152      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-14 10:19:32                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-14 10:20:44                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-14 10:20:44                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-14 10:20:44                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-14 10:20:44                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-14 10:20:44                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa43f  
      Audit Success   12544      2015-10-14 10:20:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-14 10:20:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-14 10:20:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-14 10:20:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-14 10:20:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-14 10:20:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-14 10:20:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-14 10:20:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-14 10:20:47                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-14 10:20:47                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x26c    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-14 10:20:47                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b094   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x26c    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-14 10:20:47                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b094    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-14 10:20:48                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-14 10:20:48                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-14 10:20:48                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-14 10:20:50                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-14 10:20:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x22abd   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-14 10:20:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-14 10:20:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-14 10:22:53                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-14 10:22:53                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-14 11:57:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-14 11:57:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-14 13:10:58                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-14 13:10:58                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-14 13:20:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-14 13:20:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-14 13:20:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-14 13:20:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-14 17:14:12                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-14 17:14:12                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-14 18:34:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-14 18:34:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-15 01:34:16                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b094      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-15 01:34:17                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-15 07:32:20                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-15 07:32:20                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-15 07:32:20                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-15 07:32:20                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-15 07:32:20                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa2cf  
      Audit Success   12544      2015-10-15 07:32:21                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-15 07:32:21                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-15 07:32:21                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-15 07:32:21                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-15 07:32:21                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-15 07:32:21                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-15 07:32:21                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-15 07:32:21                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-15 07:32:22                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-15 07:32:22                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x280    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-15 07:32:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b777   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x280    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-15 07:32:22                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b777    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-15 07:32:23                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-15 07:32:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-15 07:32:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-15 07:32:24                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-15 07:32:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x22829   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-15 07:32:33                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-15 07:32:33                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-15 07:34:27                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-15 07:34:27                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-15 07:55:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-15 07:55:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-15 08:02:18                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-15 08:02:18                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-15 08:02:18                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-15 08:02:18                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   103        2015-10-15 10:05:59                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12545      2015-10-15 10:05:59                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b777      ,   .  ,  ,  .        .  
      Audit Success   12288      2015-10-18 21:41:30                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-18 21:41:30                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-18 21:41:30                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-18 21:41:30                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-18 21:41:30                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-18 21:41:30                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-18 21:41:30                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-18 21:41:30                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-18 21:41:30                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-18 21:41:30                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-18 21:41:30                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa33f  
      Audit Success   12544      2015-10-18 21:41:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-18 21:41:31                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-18 21:41:32                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x274    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-18 21:41:32                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a327   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x274    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-18 21:41:32                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a327    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-18 21:41:38                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-18 21:41:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-18 21:41:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-18 21:41:39                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-10-18 21:41:39                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-18 21:41:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x263c9   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-18 21:41:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-18 21:41:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-18 21:43:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-18 21:43:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-18 22:01:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-18 22:01:22                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-18 22:11:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-18 22:11:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-18 22:11:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-18 22:11:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-18 22:11:42                                  Microsoft-Windows-Security-Auditing  4904:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0xb88    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0x1bb4f1  
      Audit Success   13568      2015-10-18 22:11:42                                  Microsoft-Windows-Security-Auditing  4905:       .    Subject    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0xb88    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0x1bb4f1  
      Audit Success   12544      2015-10-18 22:12:18                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x204    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-18 22:12:18                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-18 23:31:08                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a327      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-18 23:31:09                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-19 17:23:02                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-19 17:23:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-10-19 17:23:02                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xada3  
      Audit Success   12544      2015-10-19 17:23:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-19 17:23:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-19 17:23:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-19 17:23:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-19 17:23:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-19 17:23:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-19 17:23:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-19 17:23:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-19 17:23:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-19 17:23:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-19 17:23:04                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-19 17:23:04                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x270    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-19 17:23:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1bc84   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x270    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-19 17:23:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1bc84    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-19 17:23:05                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-10-19 17:23:05                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-19 17:23:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-19 17:23:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x23f9d   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-19 17:23:05                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-19 17:23:12                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-19 17:23:12                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-19 17:25:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-19 17:25:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-19 17:49:57                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-19 17:49:57                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-19 17:49:58                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-19 17:49:58                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-19 17:53:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-19 17:53:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-19 23:16:18                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1bc84      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-19 23:16:19                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-20 07:00:25                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-20 07:00:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-20 07:00:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-20 07:00:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-20 07:00:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-20 07:00:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-20 07:00:25                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa4ad  
      Audit Success   12544      2015-10-20 07:00:26                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-20 07:00:26                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-20 07:00:26                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-20 07:00:26                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-20 07:00:26                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-20 07:00:26                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-20 07:00:28                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-20 07:00:28                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x288    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-20 07:00:28                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1afe1   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x288    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-20 07:00:28                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1afe1    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-20 07:00:29                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-20 07:00:29                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-20 07:00:29                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-20 07:00:30                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-20 07:00:32                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x233f4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-20 07:00:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-20 07:00:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-20 07:02:35                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-20 07:02:35                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12288      2015-10-20 07:17:37                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x45c   :  C:\Windows\System32\svchost.exe     :  2015-10-19T22:17:54.456054600Z   :  2015-10-19T22:17:37.564948100Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-10-20 07:17:37                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x45c   :  C:\Windows\System32\svchost.exe     :  2015-10-19T22:17:37.564948100Z   :  2015-10-19T22:17:37.564000000Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-10-20 07:17:37                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x45c   :  C:\Windows\System32\svchost.exe     :  2015-10-19T22:17:37.564000000Z   :  2015-10-19T22:17:37.564000000Z          .    Windows,    ,    .           .  
      Audit Success   12544      2015-10-20 07:59:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-20 07:59:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-20 07:59:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-20 07:59:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-20 22:31:12                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1afe1      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-20 22:31:13                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-21 07:42:55                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-21 07:42:55                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 07:42:56                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 07:42:56                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 07:42:56                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 07:42:56                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 07:42:56                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 07:42:56                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-21 07:42:56                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-21 07:42:56                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-21 07:42:56                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-21 07:42:56                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-21 07:42:56                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa4e3  
      Audit Success   12290      2015-10-21 07:42:57                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-21 07:42:57                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x288    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-21 07:42:57                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1aaf3   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x288    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 07:42:57                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1aaf3    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-21 07:42:58                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-21 07:42:58                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 07:42:58                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-21 07:42:59                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-21 07:42:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x29fbf   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 07:43:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 07:43:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-21 07:45:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 07:45:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-21 09:12:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 09:12:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-21 09:47:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 09:47:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-21 09:54:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 09:54:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 09:54:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-21 09:54:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-21 10:16:30                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1aaf3      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-21 10:16:31                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-21 12:10:17                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-21 12:10:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 12:10:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 12:10:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 12:10:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 12:10:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 12:10:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 12:10:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-21 12:10:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-21 12:10:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-21 12:10:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-21 12:10:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-21 12:10:17                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa67f  
      Audit Success   12290      2015-10-21 12:10:19                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12292      2015-10-21 12:10:19                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-21 12:10:19                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x270    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-21 12:10:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1ac89   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x270    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 12:10:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 12:10:19                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1ac89    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-21 12:10:19                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-21 12:10:20                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-21 12:10:20                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x2953d   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 12:10:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 12:10:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-21 12:12:21                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 12:12:21                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-21 13:23:33                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1ac89      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-21 13:23:34                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-21 15:41:15                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-21 15:41:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 15:41:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 15:41:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 15:41:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 15:41:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 15:41:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 15:41:15                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-21 15:41:15                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-21 15:41:15                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-21 15:41:15                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-21 15:41:15                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-21 15:41:15                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa57e  
      Audit Success   12544      2015-10-21 15:41:16                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x270    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-21 15:41:16                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a2bf   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x270    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 15:41:16                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a2bf    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-21 15:41:17                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12292      2015-10-21 15:41:18                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-10-21 15:41:18                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-21 15:41:18                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 15:41:18                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x2705c   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 15:41:18                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-21 15:41:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 15:41:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-21 15:43:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 15:43:19                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-21 15:58:48                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 15:58:48                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-21 16:11:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 16:11:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 16:11:19                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-21 16:11:19                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-21 17:49:04                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a2bf      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-21 17:49:05                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-21 22:47:15                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-21 22:47:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 22:47:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 22:47:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 22:47:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 22:47:15                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-21 22:47:15                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-21 22:47:15                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-21 22:47:15                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa3c9  
      Audit Success   12544      2015-10-21 22:47:16                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 22:47:16                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 22:47:16                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-21 22:47:16                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-21 22:47:17                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-21 22:47:17                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x2ac    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-21 22:47:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a1eb   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x2ac    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 22:47:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a1eb    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-21 22:47:18                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-10-21 22:47:18                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-21 22:47:18                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-21 22:47:18                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x26178   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 22:47:18                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-21 22:47:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 22:47:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-21 22:49:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 22:49:19                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-21 23:02:34                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-21 23:02:34                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-22 00:02:41                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x2ac    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-22 00:02:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x16caca   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x2ac    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12545      2015-10-22 00:02:41                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x16caca     :   7          .           " ".      ,       .  
      Audit Success   12548      2015-10-22 00:02:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x16caca    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-22 00:02:50                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a1eb      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-22 00:02:51                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-22 06:49:25                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-22 06:49:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-22 06:49:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-22 06:49:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-22 06:49:25                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa2eb  
      Audit Success   12544      2015-10-22 06:49:26                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-22 06:49:26                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-22 06:49:26                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-22 06:49:26                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-22 06:49:26                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-22 06:49:26                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-22 06:49:26                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-22 06:49:26                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-22 06:49:27                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-22 06:49:27                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x2a0    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-22 06:49:27                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a922   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x2a0    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-22 06:49:27                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a922    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-22 06:49:28                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-22 06:49:28                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-22 06:49:28                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-22 06:49:29                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-22 06:49:29                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x29ad1   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-22 06:49:34                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-22 06:49:34                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-22 06:51:29                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x218    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-22 06:51:29                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-22 06:52:09                                  Microsoft-Windows-Security-Auditing  5061:  .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir      :  0x1a922     :    : Microsoft Software Key Storage Provider    : RSA    : lp-ed919552-825f-4490-8a35-5b628caeda78    : %%2500     :   : %%2480    : 0x0  
      Audit Success   12292      2015-10-22 06:52:09                                  Microsoft-Windows-Security-Auditing  5058:    .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir      :  0x1a922     :    : Microsoft Software Key Storage Provider    : %%2432    : lp-ed919552-825f-4490-8a35-5b628caeda78    : %%2500         :     : C:\Users\sima\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1499224401-2478604990-2095306355-1000\ee539417034139c4c4a9391b2008de47_f952cf71-67f6-4072-b534-bf35f443671e   : %%2458    : 0x0  
      Audit Success   12544      2015-10-22 07:37:17                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x2a0    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-22 07:37:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xeae31   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x2a0    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12545      2015-10-22 07:37:17                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xeae31     :   7          .           " ".      ,       .  
      Audit Success   12548      2015-10-22 07:37:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xeae31    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-22 08:40:34                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x2a0    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-22 08:40:34                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x115496   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x2a0    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12545      2015-10-22 08:40:34                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x115496     :   7          .           " ".      ,       .  
      Audit Success   12548      2015-10-22 08:40:34                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x115496    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-22 08:40:47                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a922      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-22 08:40:48                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-22 12:49:02                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-22 12:49:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-22 12:49:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-22 12:49:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-22 12:49:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-22 12:49:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-22 12:49:02                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa8ec  
      Audit Success   12544      2015-10-22 12:49:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-22 12:49:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-22 12:49:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-22 12:49:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-22 12:49:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-22 12:49:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-22 12:49:04                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-22 12:49:04                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x270    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-22 12:49:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1ba70   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x270    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-22 12:49:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-22 12:49:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1ba70    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-22 12:49:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-22 12:49:05                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-10-22 12:49:05                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-22 12:49:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x22df8   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-22 12:49:14                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-22 12:49:14                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-22 12:51:09                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-22 12:51:09                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-22 13:47:06                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1ba70      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-22 13:47:07                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-22 20:31:41                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-22 20:31:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-22 20:31:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-22 20:31:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-22 20:31:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-22 20:31:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-22 20:31:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-22 20:31:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-22 20:31:41                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa48a  
      Audit Success   12544      2015-10-22 20:31:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-22 20:31:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-22 20:31:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-22 20:31:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-22 20:31:43                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-22 20:31:43                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x294    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-22 20:31:43                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a335   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x294    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-22 20:31:43                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-22 20:31:43                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a335    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-22 20:31:43                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-22 20:31:44                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-10-22 20:31:44                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-22 20:31:44                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x25ae8   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-22 20:31:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-22 20:31:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-22 20:33:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-22 20:33:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-22 23:19:29                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x294    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-22 23:19:29                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x94899   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x294    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-22 23:19:29                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x94899    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-22 23:19:30                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x94899     :   7          .           " ".      ,       .  
      Audit Success   12545      2015-10-22 23:19:36                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a335      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-22 23:19:37                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-24 00:12:24                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-24 00:12:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-24 00:12:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-24 00:12:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-24 00:12:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-24 00:12:24                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-24 00:12:24                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-24 00:12:24                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-24 00:12:24                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa24b  
      Audit Success   12544      2015-10-24 00:12:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-24 00:12:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-24 00:12:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-24 00:12:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-24 00:12:26                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-24 00:12:26                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x26c    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-24 00:12:26                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b9b3   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x26c    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-24 00:12:26                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-24 00:12:26                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b9b3    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-24 00:12:26                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-24 00:12:27                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-10-24 00:12:27                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-24 00:12:28                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x203d1   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-24 00:12:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-24 00:12:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-24 00:14:29                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-24 00:14:29                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-24 01:08:56                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b9b3      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-24 01:08:57                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-24 10:20:31                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-24 10:20:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-24 10:20:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x208    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-24 10:20:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x208    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-24 10:20:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x208    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-24 10:20:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x208    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-24 10:20:31                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-24 10:20:31                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-24 10:20:31                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-24 10:20:31                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-24 10:20:31                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xaccf  
      Audit Success   12544      2015-10-24 10:20:32                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x208    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-24 10:20:32                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-24 10:20:33                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-24 10:20:33                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x26c    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-24 10:20:33                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1aee3   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x26c    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-24 10:20:33                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1aee3    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-24 10:20:34                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-24 10:20:34                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x208    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-24 10:20:34                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-24 10:20:36                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-24 10:20:36                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x20bbf   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-24 10:20:47                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x208    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-24 10:20:47                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-24 10:22:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x208    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-24 10:22:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-24 10:27:56                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1aee3      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-24 10:27:57                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-25 09:03:51                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-25 09:03:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:03:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:03:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:03:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:03:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:03:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:03:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-25 09:03:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-25 09:03:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-25 09:03:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-25 09:03:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-25 09:03:51                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa601  
      Audit Success   12544      2015-10-25 09:03:52                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x28c    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-25 09:03:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a33c   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x28c    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:03:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a33c    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-25 09:03:53                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12292      2015-10-25 09:03:53                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-25 09:03:53                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:03:53                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-25 09:03:56                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-25 09:03:57                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x21f44   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:04:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:04:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-25 09:05:58                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x210    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:05:58                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-25 09:12:24                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a33c      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-25 09:14:56                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-25 09:15:39                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-25 09:15:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:15:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:15:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:15:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:15:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:15:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:15:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-25 09:15:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-25 09:15:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-25 09:15:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-25 09:15:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-25 09:15:39                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa215  
      Audit Success   12290      2015-10-25 09:15:41                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-25 09:15:41                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x298    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-25 09:15:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1ae54   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x298    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:15:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1ae54    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-25 09:15:42                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-25 09:15:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:15:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-25 09:15:43                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-25 09:15:44                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x210f3   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:15:55                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:15:55                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-25 09:17:46                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:17:46                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-25 09:21:28                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1ae54      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-25 09:21:29                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-25 09:23:40                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-25 09:23:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-10-25 09:23:41                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x7f92  
      Audit Success   12544      2015-10-25 09:23:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:23:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:23:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-25 09:23:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-25 09:23:43                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:23:43                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:23:43                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:23:43                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-25 09:23:43                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-25 09:23:43                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-25 09:23:44                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x258    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-25 09:23:44                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x11ddc   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x258    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:23:44                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x11ddc    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-25 09:23:46                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12292      2015-10-25 09:23:47                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-10-25 09:23:47                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-25 09:23:47                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:23:47                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1f013   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:23:47                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-25 09:23:54                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:23:54                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-25 09:24:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:24:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:24:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-25 09:24:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Failure   12290      2015-10-25 09:24:45                                  Microsoft-Windows-Security-Auditing  5038:     ,     .         ,          .     : \Device\HarddiskVolume3\Windows\System32\drivers\cmudaxp.sys   
      Audit Success   13568      2015-10-25 09:24:45                                  Microsoft-Windows-Security-Auditing  4904:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0xd38    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0x592a5  
      Audit Success   13568      2015-10-25 09:24:45                                  Microsoft-Windows-Security-Auditing  4905:       .    Subject    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0xd38    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0x592a5  
      Audit Success   12544      2015-10-25 09:25:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:25:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-25 09:28:37                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x11ddc      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-25 09:28:38                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-25 09:29:33                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-25 09:29:33                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-10-25 09:29:33                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x919a  
      Audit Success   12544      2015-10-25 09:29:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:29:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:29:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:29:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:29:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:29:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-25 09:29:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-25 09:29:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-25 09:29:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-25 09:29:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-25 09:29:43                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x268    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-25 09:29:43                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x183de   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x268    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:29:43                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x183de    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-25 09:29:48                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12292      2015-10-25 09:29:49                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-10-25 09:29:49                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-25 09:29:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:29:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-25 09:29:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x25133   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 09:30:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:30:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-25 09:32:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 09:32:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-25 10:47:32                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x268    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-25 10:47:32                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xfda42   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x268    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12545      2015-10-25 10:47:32                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xfda42     :   7          .           " ".      ,       .  
      Audit Success   12548      2015-10-25 10:47:32                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xfda42    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-25 11:08:06                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x268    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-25 11:08:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x114803   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x268    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12545      2015-10-25 11:08:06                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x114803     :   7          .           " ".      ,       .  
      Audit Success   12548      2015-10-25 11:08:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x114803    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   103        2015-10-25 11:10:50                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12545      2015-10-25 11:10:50                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x183de      ,   .  ,  ,  .        .  
      Audit Success   12288      2015-10-25 19:56:59                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-25 19:56:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 19:56:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 19:56:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-25 19:56:59                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x933a  
      Audit Success   12544      2015-10-25 19:57:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 19:57:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 19:57:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 19:57:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 19:57:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-25 19:57:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-25 19:57:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-25 19:57:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-25 19:57:01                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x23c    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-25 19:57:01                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18081   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x23c    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 19:57:01                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18081    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-25 19:57:09                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12292      2015-10-25 19:57:09                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-25 19:57:09                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 19:57:09                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-25 19:57:10                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-25 19:57:10                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x26b2e   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-25 19:57:16                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 19:57:16                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-25 19:59:12                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 19:59:12                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-25 22:50:06                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x23c    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-25 22:50:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x824e8   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x23c    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-25 22:50:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x824e8    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-25 22:50:08                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x824e8     :   7          .           " ".      ,       .  
      Audit Success   12288      2015-10-25 22:51:52                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x458   :  C:\Windows\System32\svchost.exe     :  2015-10-25T13:52:02.802734400Z   :  2015-10-25T13:51:52.358424500Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-10-25 22:51:52                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x458   :  C:\Windows\System32\svchost.exe     :  2015-10-25T13:51:52.358424500Z   :  2015-10-25T13:51:52.358000000Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-10-25 22:51:52                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x458   :  C:\Windows\System32\svchost.exe     :  2015-10-25T13:51:52.363859300Z   :  2015-10-25T13:51:52.363000000Z          .    Windows,    ,    .           .  
      Audit Success   12545      2015-10-26 00:14:02                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18081      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-26 00:14:04                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-26 08:29:41                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-26 08:29:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-26 08:29:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-26 08:29:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-26 08:29:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-26 08:29:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-26 08:29:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-26 08:29:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-26 08:29:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-26 08:29:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-26 08:29:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-26 08:29:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-26 08:29:42                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x958a  
      Audit Success   12290      2015-10-26 08:29:43                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12292      2015-10-26 08:29:43                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-26 08:29:43                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-26 08:29:43                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-26 08:29:44                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-26 08:29:44                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x250    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-26 08:29:44                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b6ad   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x250    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-26 08:29:44                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1dd7f   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-26 08:29:44                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b6ad    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-26 08:29:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-26 08:29:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-26 08:31:46                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-26 08:31:46                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12288      2015-10-26 08:39:00                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x450   :  C:\Windows\System32\svchost.exe     :  2015-10-25T23:39:00.859375000Z   :  2015-10-25T23:39:00.859000000Z          .    Windows,    ,    .           .  
      Audit Success   12545      2015-10-26 09:06:37                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b6ad      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-26 09:06:38                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-26 14:22:40                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-26 14:22:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-26 14:22:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-26 14:22:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-26 14:22:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-26 14:22:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-26 14:22:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-26 14:22:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-26 14:22:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-26 14:22:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-26 14:22:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-26 14:22:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-26 14:22:40                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x95dc  
      Audit Success   12290      2015-10-26 14:22:41                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-10-26 14:22:41                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x248    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-26 14:22:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x17d00   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x248    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-26 14:22:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-26 14:22:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x17d00    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-26 14:22:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-26 14:22:42                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-10-26 14:22:42                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-26 14:22:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1efae   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-26 14:22:48                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-26 14:22:48                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-26 14:24:43                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-26 14:24:43                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-26 14:27:14                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x17d00      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-26 14:27:15                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-27 06:52:48                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-27 06:52:48                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-10-27 06:52:48                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9495  
      Audit Success   12544      2015-10-27 06:52:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-27 06:52:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-27 06:52:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-27 06:52:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-27 06:52:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-27 06:52:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-27 06:52:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-27 06:52:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-27 06:52:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-27 06:52:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-27 06:52:50                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12292      2015-10-27 06:52:50                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-27 06:52:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-27 06:52:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-27 06:52:51                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-27 06:52:51                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x250    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-27 06:52:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1c562   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x250    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-27 06:52:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1ce61   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-27 06:52:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1c562    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-27 06:52:58                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-27 06:52:58                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-27 06:54:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-27 06:54:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-27 06:57:53                                  Microsoft-Windows-Security-Auditing  5061:  .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir      :  0x1c562     :    : Microsoft Software Key Storage Provider    : RSA    : lp-ed919552-825f-4490-8a35-5b628caeda78    : %%2500     :   : %%2480    : 0x0  
      Audit Success   12292      2015-10-27 06:57:53                                  Microsoft-Windows-Security-Auditing  5058:    .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir      :  0x1c562     :    : Microsoft Software Key Storage Provider    : %%2432    : lp-ed919552-825f-4490-8a35-5b628caeda78    : %%2500         :     : C:\Users\sima\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1499224401-2478604990-2095306355-1000\ee539417034139c4c4a9391b2008de47_f952cf71-67f6-4072-b534-bf35f443671e   : %%2458    : 0x0  
      Audit Success   12545      2015-10-27 07:07:51                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1c562      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-27 07:07:52                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-29 13:06:37                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-29 13:06:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-29 13:06:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-29 13:06:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-29 13:06:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-29 13:06:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-29 13:06:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-29 13:06:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-29 13:06:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-29 13:06:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-29 13:06:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-29 13:06:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-29 13:06:38                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x959b  
      Audit Success   12290      2015-10-29 13:06:39                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12292      2015-10-29 13:06:39                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-29 13:06:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-29 13:06:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-29 13:06:40                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-29 13:06:40                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x24c    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-29 13:06:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b747   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x24c    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-29 13:06:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1e043   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-29 13:06:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b747    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-29 13:06:47                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-29 13:06:47                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-29 13:08:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-29 13:08:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-29 16:32:45                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x24c    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-29 16:32:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x94a8b   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x24c    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-29 16:32:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x94a8b    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-29 16:32:47                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x94a8b     :   7          .           " ".      ,       .  
      Audit Success   12545      2015-10-29 16:33:24                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b747      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-29 16:33:25                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-31 19:16:30                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-31 19:16:30                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-31 19:16:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-31 19:16:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-31 19:16:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-31 19:16:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-31 19:16:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-31 19:16:31                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-31 19:16:31                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-31 19:16:31                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-31 19:16:31                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-31 19:16:31                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-31 19:16:31                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9384  
      Audit Success   12290      2015-10-31 19:16:32                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12292      2015-10-31 19:16:32                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-10-31 19:16:32                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-31 19:16:32                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-10-31 19:16:33                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-31 19:16:33                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x2bc    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-31 19:16:33                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1c98d   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x2bc    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-31 19:16:33                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1d685   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-31 19:16:33                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1c98d    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-31 19:16:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-31 19:16:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-31 19:17:32                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1c98d      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-31 19:17:33                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-10-31 19:19:37                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-10-31 19:19:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-31 19:19:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-31 19:19:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-31 19:19:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-31 19:19:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-10-31 19:19:37                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x94de  
      Audit Success   12544      2015-10-31 19:19:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-31 19:19:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-31 19:19:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-31 19:19:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-31 19:19:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-31 19:19:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-10-31 19:19:39                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12292      2015-10-31 19:19:39                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-10-31 19:19:39                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-10-31 19:19:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-31 19:19:39                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x2b8    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-31 19:19:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1ca3f   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x2b8    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-31 19:19:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-10-31 19:19:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1ca3f    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-31 19:19:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1d7fb   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-10-31 19:19:46                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-31 19:19:46                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-31 19:21:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-10-31 19:21:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-31 19:34:16                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x2b8    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-31 19:34:16                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xa7b7f9   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x2b8    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12545      2015-10-31 19:34:16                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xa7b7f9     :   7          .           " ".      ,       .  
      Audit Success   12548      2015-10-31 19:34:16                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xa7b7f9    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-10-31 20:07:10                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x2b8    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-10-31 20:07:10                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xca3f85   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x2b8    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12545      2015-10-31 20:07:10                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xca3f85     :   7          .           " ".      ,       .  
      Audit Success   12548      2015-10-31 20:07:10                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xca3f85    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-10-31 20:08:45                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1ca3f      ,   .  ,  ,  .        .  
      Audit Success   103        2015-10-31 20:08:46                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-01 07:19:36                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-01 07:19:36                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 07:19:36                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 07:19:36                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-01 07:19:36                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-01 07:19:36                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-01 07:19:36                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x928b  
      Audit Success   12544      2015-11-01 07:19:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 07:19:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 07:19:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-01 07:19:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-01 07:19:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-01 07:19:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-01 07:19:38                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12292      2015-11-01 07:19:38                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-01 07:19:38                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-01 07:19:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 07:19:38                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x2bc    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-01 07:19:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1c75f   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x2bc    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-01 07:19:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-01 07:19:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1c75f    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-01 07:19:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1d4ff   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 07:19:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-01 07:19:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-01 07:21:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-01 07:21:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12288      2015-11-01 07:28:39                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x444   :  C:\Windows\System32\svchost.exe     :  2015-10-31T22:28:55.019531200Z   :  2015-10-31T22:28:39.996848700Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-11-01 07:28:40                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x444   :  C:\Windows\System32\svchost.exe     :  2015-10-31T22:28:40.013449200Z   :  2015-10-31T22:28:40.013000000Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-11-01 07:28:40                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x444   :  C:\Windows\System32\svchost.exe     :  2015-10-31T22:28:40.017882800Z   :  2015-10-31T22:28:40.017000000Z          .    Windows,    ,    .           .  
      Audit Success   12544      2015-11-01 08:35:25                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x2bc    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-01 08:35:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x10c428   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x2bc    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-01 08:35:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x10c428    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-01 08:35:28                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x10c428     :   7          .           " ".      ,       .  
      Audit Success   12545      2015-11-01 09:22:34                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1c75f      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-01 09:22:35                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-01 09:24:07                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-01 09:24:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 09:24:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-01 09:24:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-01 09:24:07                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9a01  
      Audit Success   12544      2015-11-01 09:24:08                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 09:24:08                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 09:24:08                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 09:24:08                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-01 09:24:08                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-01 09:24:08                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-01 09:24:08                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-01 09:24:08                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-01 09:24:10                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12292      2015-11-01 09:24:10                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-11-01 09:24:10                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-01 09:24:10                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-01 09:24:11                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-01 09:24:11                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1bafe   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 09:24:11                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x28c    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-01 09:24:11                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1eb05   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x28c    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-01 09:24:11                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1eb05    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-01 09:24:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-01 09:24:19                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-01 09:24:30                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1eb05      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-01 09:24:32                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-01 09:26:09                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-01 09:26:09                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 09:26:09                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 09:26:09                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-01 09:26:09                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-01 09:26:09                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-01 09:26:09                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9396  
      Audit Success   12544      2015-11-01 09:26:10                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 09:26:10                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 09:26:10                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-01 09:26:10                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-01 09:26:10                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-01 09:26:10                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-01 09:26:11                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12292      2015-11-01 09:26:11                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-01 09:26:11                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-01 09:26:11                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 09:26:11                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x2a0    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-01 09:26:11                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1bd4f   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x2a0    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 09:26:11                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1cf43   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-01 09:26:11                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-01 09:26:11                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1bd4f    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-01 09:26:18                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-01 09:26:18                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-01 09:28:12                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-01 09:28:12                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-01 09:34:07                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1bd4f      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-01 09:34:08                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-01 16:14:42                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-01 16:14:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-11-01 16:14:42                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9b95  
      Audit Success   12290      2015-11-01 16:14:43                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-01 16:14:43                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 16:14:43                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 16:14:43                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 16:14:43                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 16:14:43                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-01 16:14:43                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-01 16:14:43                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-01 16:14:43                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-01 16:14:43                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-01 16:14:43                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-01 16:14:44                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-11-01 16:14:44                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x324    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-01 16:14:44                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18896   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x324    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 16:14:44                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-01 16:14:44                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18896    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-01 16:14:44                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-01 16:14:45                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-01 16:14:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x228ab   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-01 16:14:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-01 16:14:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-01 16:16:46                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-01 16:16:46                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12288      2015-11-01 16:23:00                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x450   :  C:\Windows\System32\svchost.exe     :  2015-11-01T07:23:00.731445300Z   :  2015-11-01T07:23:00.731000000Z          .    Windows,    ,    .           .  
      Audit Success   12544      2015-11-01 20:09:38                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x324    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-01 20:09:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x103e83   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x324    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12545      2015-11-01 20:09:38                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x103e83     :   7          .           " ".      ,       .  
      Audit Success   12548      2015-11-01 20:09:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x103e83    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-01 20:12:07                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18896      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-01 20:12:08                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-03 06:59:05                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-03 06:59:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-03 06:59:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-03 06:59:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-03 06:59:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-03 06:59:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-03 06:59:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-03 06:59:05                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-03 06:59:05                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-03 06:59:05                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-03 06:59:05                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-03 06:59:05                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-03 06:59:05                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9d27  
      Audit Success   12290      2015-11-03 06:59:06                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-03 06:59:07                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x27c    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-03 06:59:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18966   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x27c    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-03 06:59:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18966    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-03 06:59:10                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-11-03 06:59:10                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-03 06:59:10                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-03 06:59:11                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-03 06:59:11                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x20461   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-03 06:59:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-03 06:59:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-03 07:00:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-03 07:00:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-03 07:01:12                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-03 07:01:12                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12288      2015-11-03 07:02:23                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x44c   :  C:\Windows\System32\svchost.exe     :  2015-11-02T22:02:27.758789000Z   :  2015-11-02T22:02:23.315753900Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-11-03 07:02:23                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x44c   :  C:\Windows\System32\svchost.exe     :  2015-11-02T22:02:23.352862700Z   :  2015-11-02T22:02:23.352000000Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-11-03 07:02:23                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x44c   :  C:\Windows\System32\svchost.exe     :  2015-11-02T22:02:23.363718700Z   :  2015-11-02T22:02:23.363000000Z          .    Windows,    ,    .           .  
      Audit Success   12545      2015-11-03 07:13:07                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18966      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-03 07:13:08                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-03 22:21:25                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-03 22:21:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-03 22:21:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-03 22:21:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-03 22:21:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-03 22:21:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-03 22:21:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-03 22:21:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-03 22:21:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-03 22:21:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-03 22:21:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-03 22:21:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-03 22:21:25                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9c5c  
      Audit Success   12290      2015-11-03 22:21:26                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-03 22:21:26                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x248    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-03 22:21:26                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1879f   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x248    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-03 22:21:26                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1879f    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-03 22:21:27                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-03 22:21:27                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-03 22:21:29                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-03 22:21:31                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-03 22:21:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x20ca7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-03 22:21:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-03 22:21:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-03 22:23:33                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-03 22:23:33                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-03 22:34:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-03 22:34:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-04 00:07:59                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x248    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-04 00:07:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1e19e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x248    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-04 00:07:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1e19e7    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-04 00:08:02                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1e19e7     :   7          .           " ".      ,       .  
      Audit Success   12544      2015-11-04 01:05:36                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x248    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-04 01:05:36                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x463593   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x248    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-04 01:05:36                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x463593    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-04 01:05:38                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x463593     :   7          .           " ".      ,       .  
      Audit Success   12545      2015-11-04 02:46:58                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1879f      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-04 02:46:59                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-04 02:47:56                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-04 02:47:56                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-04 02:47:56                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-04 02:47:56                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-04 02:47:56                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa088  
      Audit Success   12544      2015-11-04 02:47:57                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-04 02:47:57                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-04 02:47:57                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-04 02:47:57                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-04 02:47:57                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-04 02:47:57                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-04 02:47:57                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-04 02:47:57                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-04 02:47:58                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x20c    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-04 02:47:58                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x17f58   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x20c    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-04 02:47:58                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x17f58    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-04 02:48:02                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-04 02:48:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-04 02:48:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-04 02:48:03                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-04 02:48:03                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-04 02:48:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x21d7a   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-04 02:48:11                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-04 02:48:11                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-04 02:50:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-04 02:50:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-04 02:55:51                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x17f58      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-04 02:55:52                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-04 21:10:36                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-04 21:10:36                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-04 21:10:36                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-04 21:10:36                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-04 21:10:36                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-04 21:10:36                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-04 21:10:36                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x97c1  
      Audit Success   12290      2015-11-04 21:10:37                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-04 21:10:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-04 21:10:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-04 21:10:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-04 21:10:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-04 21:10:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-04 21:10:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-04 21:10:38                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-04 21:10:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1869e   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-04 21:10:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-04 21:10:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1869e    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-04 21:10:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-04 21:10:39                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-04 21:10:42                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-04 21:10:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x211dc   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-04 21:10:48                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-04 21:10:48                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-04 21:12:43                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-04 21:12:43                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-04 21:32:43                                  Microsoft-Windows-Security-Auditing  5061:  .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir      :  0x1869e     :    : Microsoft Software Key Storage Provider    : RSA    : lp-ed919552-825f-4490-8a35-5b628caeda78    : %%2500     :   : %%2480    : 0x0  
      Audit Success   12292      2015-11-04 21:32:43                                  Microsoft-Windows-Security-Auditing  5058:    .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir      :  0x1869e     :    : Microsoft Software Key Storage Provider    : %%2432    : lp-ed919552-825f-4490-8a35-5b628caeda78    : %%2500         :     : C:\Users\sima\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1499224401-2478604990-2095306355-1000\ee539417034139c4c4a9391b2008de47_f952cf71-67f6-4072-b534-bf35f443671e   : %%2458    : 0x0  
      Audit Success   12544      2015-11-04 22:43:46                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-04 22:43:46                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x180434   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-04 22:43:46                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x180434    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-04 22:43:49                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x180434     :   7          .           " ".      ,       .  
      Audit Success   12545      2015-11-04 22:44:43                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1869e      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-04 22:44:44                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-05 07:25:32                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-05 07:25:32                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 07:25:32                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 07:25:32                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 07:25:32                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-05 07:25:32                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-05 07:25:32                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x909c  
      Audit Success   12290      2015-11-05 07:25:33                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-05 07:25:33                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 07:25:33                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 07:25:33                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 07:25:33                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-05 07:25:33                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-05 07:25:33                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-05 07:25:34                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x24c    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-05 07:25:34                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18daa   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x24c    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 07:25:34                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18daa    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-05 07:25:35                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-11-05 07:25:35                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 07:25:35                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-05 07:25:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1ddbd   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12292      2015-11-05 07:25:40                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-05 07:25:46                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 07:25:46                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-05 07:27:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 07:27:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-05 07:36:35                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x24c    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-05 07:36:35                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x50df3   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x24c    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 07:36:35                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x50df3    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-05 07:36:39                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x50df3     :   7          .           " ".      ,       .  
      Audit Success   12545      2015-11-05 07:36:45                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18daa      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-05 07:36:46                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-05 09:20:01                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-05 09:20:01                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 09:20:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 09:20:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 09:20:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 09:20:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 09:20:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 09:20:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-05 09:20:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-05 09:20:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-05 09:20:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-05 09:20:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-05 09:20:02                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9dad  
      Audit Success   12290      2015-11-05 09:20:03                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12292      2015-11-05 09:20:03                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-11-05 09:20:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 09:20:03                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x248    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-05 09:20:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18fed   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x248    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 09:20:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-05 09:20:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18fed    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-05 09:20:06                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-05 09:20:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x215e2   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 09:20:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 09:20:15                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-05 09:22:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 09:22:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-05 11:03:22                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18fed      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-05 11:03:23                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-05 12:51:05                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-05 12:51:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 12:51:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 12:51:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 12:51:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 12:51:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 12:51:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 12:51:05                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-05 12:51:05                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-05 12:51:05                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-05 12:51:05                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-05 12:51:05                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-05 12:51:05                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9c9d  
      Audit Success   12290      2015-11-05 12:51:06                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-05 12:51:06                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x248    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-05 12:51:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18ac9   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x248    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 12:51:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18ac9    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-05 12:51:07                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-11-05 12:51:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 12:51:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-05 12:51:10                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-05 12:51:10                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x21234   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 12:51:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 12:51:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-05 12:53:11                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 12:53:11                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-05 13:56:41                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x248    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-05 13:56:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xfc059   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x248    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12545      2015-11-05 13:56:41                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xfc059     :   7          .           " ".      ,       .  
      Audit Success   12548      2015-11-05 13:56:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xfc059    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-05 13:56:48                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 13:56:48                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-05 14:05:35                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18ac9      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-05 14:05:36                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-05 14:08:00                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-05 14:08:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 14:08:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 14:08:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 14:08:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-05 14:08:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-05 14:08:00                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9515  
      Audit Success   12544      2015-11-05 14:08:01                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 14:08:01                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 14:08:01                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 14:08:01                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-05 14:08:01                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-05 14:08:01                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-05 14:08:02                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-05 14:08:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 14:08:02                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-05 14:08:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1939b   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 14:08:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-05 14:08:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1939b    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-05 14:08:03                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-05 14:08:06                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-05 14:08:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x20782   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 14:08:14                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 14:08:14                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-05 14:10:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 14:10:15                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-05 14:15:51                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1939b      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-05 14:15:52                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-05 21:48:49                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-05 21:48:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 21:48:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 21:48:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 21:48:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-05 21:48:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-05 21:48:49                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9576  
      Audit Success   12544      2015-11-05 21:48:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 21:48:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 21:48:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 21:48:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-05 21:48:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-05 21:48:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-05 21:48:51                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-05 21:48:51                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-05 21:48:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18d5e   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 21:48:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18d5e    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-05 21:48:52                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-11-05 21:48:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 21:48:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-05 21:48:56                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-05 21:48:56                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x20482   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-05 21:49:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 21:49:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-05 21:50:57                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 21:50:57                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-05 23:15:17                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-05 23:15:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xf7026   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-05 23:15:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xf7026    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-05 23:15:18                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xf7026     :   7          .           " ".      ,       .  
      Audit Success   12544      2015-11-06 02:28:29                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-06 02:28:29                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x2a5f80   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12545      2015-11-06 02:28:29                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x2a5f80     :   7          .           " ".      ,       .  
      Audit Success   12548      2015-11-06 02:28:29                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x2a5f80    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-06 04:58:24                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-06 04:58:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x456919   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-06 04:58:24                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x456919    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-06 04:58:25                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x456919     :   7          .           " ".      ,       .  
      Audit Success   12545      2015-11-06 05:00:38                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18d5e      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-06 05:00:39                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-07 11:48:39                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-07 11:48:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-07 11:48:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-07 11:48:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-07 11:48:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-07 11:48:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-07 11:48:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-07 11:48:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-07 11:48:39                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9566  
      Audit Success   12290      2015-11-07 11:48:40                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-07 11:48:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-07 11:48:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-07 11:48:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-07 11:48:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-07 11:48:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-07 11:48:41                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-07 11:48:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x190f2   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-07 11:48:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-07 11:48:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x190f2    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-07 11:48:43                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-07 11:48:45                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-07 11:48:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x20999   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-07 11:48:53                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-07 11:48:53                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-07 11:50:47                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-07 11:50:47                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-07 12:25:23                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-07 12:25:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x53ff2   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-07 12:25:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x53ff2    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-07 12:25:26                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x53ff2     :   7          .           " ".      ,       .  
      Audit Success   12544      2015-11-07 14:09:14                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-07 14:09:14                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x788df   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-07 14:09:14                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x788df    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-07 14:09:15                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x788df     :   7          .           " ".      ,       .  
      Audit Success   12545      2015-11-07 14:09:27                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x190f2      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-07 14:09:29                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-07 17:00:59                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-07 17:00:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-07 17:01:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-07 17:01:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-07 17:01:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-07 17:01:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-07 17:01:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-07 17:01:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-07 17:01:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-07 17:01:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-07 17:01:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-07 17:01:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-07 17:01:00                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x95e6  
      Audit Success   12290      2015-11-07 17:01:01                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-07 17:01:01                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-07 17:01:01                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-07 17:01:02                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-11-07 17:01:02                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-07 17:01:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x199d5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-07 17:01:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x199d5    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-07 17:01:06                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-07 17:01:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x21a91   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-07 17:01:16                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-07 17:01:16                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-07 17:03:08                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-07 17:03:08                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-07 18:02:29                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-07 18:02:29                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x2fd3d3   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12545      2015-11-07 18:02:29                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x2fd3d3     :   7          .           " ".      ,       .  
      Audit Success   12548      2015-11-07 18:02:29                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x2fd3d3    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-07 18:02:37                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x199d5      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-07 18:02:38                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-09 06:31:25                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-09 06:31:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-09 06:31:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-09 06:31:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-09 06:31:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-09 06:31:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-09 06:31:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-09 06:31:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-09 06:31:25                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9624  
      Audit Success   12290      2015-11-09 06:31:26                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-09 06:31:26                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-09 06:31:26                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-09 06:31:26                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-09 06:31:26                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-09 06:31:27                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-09 06:31:27                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-09 06:31:27                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x195a5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-09 06:31:27                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-09 06:31:27                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x195a5    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-09 06:31:28                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-09 06:31:32                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-09 06:31:32                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x21fb9   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-09 06:31:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-09 06:31:42                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-09 06:33:34                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-09 06:33:34                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12288      2015-11-09 06:34:06                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x450   :  C:\Windows\System32\svchost.exe     :  2015-11-08T21:34:19.527343700Z   :  2015-11-08T21:34:06.167824100Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-11-09 06:34:06                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x450   :  C:\Windows\System32\svchost.exe     :  2015-11-08T21:34:06.168800700Z   :  2015-11-08T21:34:06.168000000Z          .    Windows,    ,    .           .  
      Audit Success   12544      2015-11-09 06:34:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-09 06:34:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-09 07:10:30                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x195a5      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-09 07:10:31                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-09 07:10:31                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x450   :  C:\Windows\System32\svchost.exe     :  2015-11-08T22:10:31.570343700Z   :  2015-11-08T22:10:31.570000000Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-11-10 01:26:52                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-10 01:26:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-10 01:26:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-10 01:26:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-10 01:26:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-10 01:26:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-10 01:26:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-10 01:26:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-10 01:26:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-10 01:26:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-10 01:26:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-10 01:26:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-10 01:26:52                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x94a1  
      Audit Success   12290      2015-11-10 01:26:54                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-10 01:26:54                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-10 01:26:54                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-10 01:26:55                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x240    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-10 01:26:55                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19921   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x240    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-10 01:26:55                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19921    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-10 01:26:56                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-10 01:26:59                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-10 01:27:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x21a0b   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-10 01:27:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-10 01:27:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-10 01:29:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-10 01:29:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-10 02:11:10                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x240    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-10 02:11:10                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   7     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xe744b   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x240    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12545      2015-11-10 02:11:10                                  Microsoft-Windows-Security-Auditing  4634:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xe744b     :   7          .           " ".      ,       .  
      Audit Success   12548      2015-11-10 02:11:10                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0xe744b    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-10 05:09:03                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19921      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-10 05:09:04                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-11 01:24:51                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-11 01:24:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-11-11 01:24:51                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x937e  
      Audit Success   12544      2015-11-11 01:24:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-11 01:24:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-11 01:24:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-11 01:24:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-11 01:24:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-11 01:24:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-11 01:24:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-11 01:24:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-11 01:24:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-11 01:24:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-11 01:24:53                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-11 01:24:54                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-11 01:24:54                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x240    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-11 01:24:54                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x198a9   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x240    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-11 01:24:54                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-11 01:24:54                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x198a9    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-11 01:24:55                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-11 01:24:58                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-11 01:24:58                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x2149d   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-11 01:25:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-11 01:25:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-11 01:27:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-11 01:27:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-11 04:39:52                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x198a9      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-11 04:39:53                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-13 13:52:21                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-13 13:52:21                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-11-13 13:52:21                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9019  
      Audit Success   12544      2015-11-13 13:52:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-13 13:52:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-13 13:52:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-13 13:52:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-13 13:52:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-13 13:52:22                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-13 13:52:22                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-13 13:52:22                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-13 13:52:22                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-13 13:52:22                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-13 13:52:23                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-13 13:52:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-13 13:52:24                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-13 13:52:25                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-11-13 13:52:25                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x250    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-13 13:52:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1969d   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x250    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-13 13:52:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1969d    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-13 13:52:28                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-13 13:52:29                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x21207   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-13 13:52:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-13 13:52:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-13 13:54:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-13 13:54:31                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-13 14:42:05                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1969d      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-13 14:42:06                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-14 03:20:50                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-14 03:20:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-14 03:20:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-14 03:20:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-14 03:20:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-14 03:20:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-14 03:20:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-14 03:20:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-14 03:20:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-14 03:20:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-14 03:20:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-14 03:20:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-14 03:20:50                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x92c4  
      Audit Success   12290      2015-11-14 03:20:51                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-14 03:20:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-14 03:20:52                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-14 03:20:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x197e9   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-14 03:20:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-14 03:20:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x197e9    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-14 03:20:54                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-14 03:20:55                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-14 03:20:56                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x20fc3   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-14 03:21:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-14 03:21:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-14 03:22:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-14 03:22:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-14 04:11:29                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x197e9      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-14 04:11:30                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-15 01:53:23                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-15 01:53:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 01:53:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 01:53:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 01:53:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 01:53:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 01:53:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 01:53:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-15 01:53:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-15 01:53:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-15 01:53:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-15 01:53:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-15 01:53:23                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x92d3  
      Audit Success   12290      2015-11-15 01:53:25                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-15 01:53:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 01:53:25                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x240    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-15 01:53:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1930a   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x240    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 01:53:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-15 01:53:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1930a    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-15 01:53:26                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-15 01:53:27                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-15 01:53:29                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x2165d   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 01:53:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 01:53:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-15 01:55:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 01:55:31                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12288      2015-11-15 01:56:30                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x440   :  C:\Windows\System32\svchost.exe     :  2015-11-14T16:56:42.631835900Z   :  2015-11-14T16:56:30.764142700Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-11-15 01:56:30                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x440   :  C:\Windows\System32\svchost.exe     :  2015-11-14T16:56:30.773907700Z   :  2015-11-14T16:56:30.773000000Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-11-15 01:56:30                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x440   :  C:\Windows\System32\svchost.exe     :  2015-11-14T16:56:30.776906300Z   :  2015-11-14T16:56:30.776000000Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-11-15 09:48:22                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-15 09:48:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-11-15 09:48:22                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xabc4  
      Audit Success   101        2015-11-15 09:48:23                                  Microsoft-Windows-Eventlog      1101:     .  0  
      Audit Success   12290      2015-11-15 09:48:23                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-15 09:48:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 09:48:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 09:48:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 09:48:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 09:48:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 09:48:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-15 09:48:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-15 09:48:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-15 09:48:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-15 09:48:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-15 09:48:24                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x278    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-15 09:48:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19a96   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x278    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 09:48:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 09:48:24                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19a96    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-15 09:48:24                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-15 09:48:25                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-15 09:48:26                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-15 09:48:28                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x21c31   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 09:48:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 09:48:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-15 09:50:35                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 09:50:35                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-15 10:59:35                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 10:59:35                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-15 11:09:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 11:09:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 11:09:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-15 11:09:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-15 11:09:57                                  Microsoft-Windows-Security-Auditing  4904:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0x610    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0x30f3cd  
      Audit Success   13568      2015-11-15 11:09:57                                  Microsoft-Windows-Security-Auditing  4905:       .    Subject    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0x610    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0x30f3cd  
      Audit Success   12544      2015-11-15 11:10:44                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 11:10:44                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-15 11:31:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 11:31:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12288      2015-11-15 11:34:36                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-15 11:34:36                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-11-15 11:34:36                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x95e6  
      Audit Success   12544      2015-11-15 11:34:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 11:34:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-15 11:34:40                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-15 11:34:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 11:34:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 11:34:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 11:34:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 11:34:40                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x250    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-15 11:34:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18926   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x250    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 11:34:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-15 11:34:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-15 11:34:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-15 11:34:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-15 11:34:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18926    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-15 11:34:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 11:34:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-15 11:34:42                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-15 11:34:42                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-15 11:34:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x2158f   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 11:34:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 11:34:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-15 11:36:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 11:36:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-15 11:38:54                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18926      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-15 11:38:55                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-15 20:05:06                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-15 20:05:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 20:05:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 20:05:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-15 20:05:06                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9406  
      Audit Success   12544      2015-11-15 20:05:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 20:05:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 20:05:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 20:05:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 20:05:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-15 20:05:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-15 20:05:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-15 20:05:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-15 20:05:09                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-15 20:05:09                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 20:05:09                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-15 20:05:10                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-11-15 20:05:10                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x240    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-15 20:05:10                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x199d2   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x240    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 20:05:10                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x199d2    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-15 20:05:12                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-15 20:05:14                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1f1ba   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-15 20:05:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 20:05:22                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-15 20:07:16                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 20:07:16                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-15 21:45:43                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 21:45:43                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-15 21:45:44                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-15 21:45:44                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-15 23:58:08                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x199d2      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-15 23:58:09                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-16 11:09:58                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-16 11:09:58                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-16 11:09:58                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-16 11:09:58                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-16 11:09:58                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-16 11:09:58                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-16 11:09:58                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-16 11:09:58                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-16 11:09:58                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-16 11:09:58                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-16 11:09:58                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-16 11:09:58                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-16 11:09:58                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9417  
      Audit Success   12290      2015-11-16 11:10:00                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-16 11:10:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-16 11:10:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-16 11:10:01                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-11-16 11:10:01                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x258    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-16 11:10:01                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a1ee   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x258    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-16 11:10:01                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a1ee    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-16 11:10:03                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-16 11:10:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x2115c   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-16 11:10:13                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-16 11:10:13                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-16 11:12:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-16 11:12:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-16 12:16:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-16 12:16:31                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-16 12:16:32                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-16 12:16:32                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-16 15:09:28                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a1ee      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-16 15:09:29                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-16 15:48:03                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-16 15:48:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-16 15:48:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-16 15:48:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-16 15:48:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-16 15:48:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-16 15:48:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-16 15:48:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-16 15:48:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-16 15:48:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-16 15:48:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-16 15:48:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-16 15:48:03                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x94ce  
      Audit Success   12290      2015-11-16 15:48:05                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-16 15:48:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-16 15:48:05                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-16 15:48:06                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-11-16 15:48:06                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-16 15:48:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1aca6   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-16 15:48:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1aca6    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-16 15:48:09                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-16 15:48:11                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x21942   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-16 15:48:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-16 15:48:19                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-16 15:50:13                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-16 15:50:13                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-16 16:39:43                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-16 16:39:43                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-16 16:39:44                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-16 16:39:44                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-16 17:03:38                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1aca6      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-16 17:03:39                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-16 18:57:24                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-16 18:57:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-16 18:57:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-16 18:57:24                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-16 18:57:24                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9abb  
      Audit Success   12544      2015-11-16 18:57:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-16 18:57:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-16 18:57:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-16 18:57:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-16 18:57:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-16 18:57:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-16 18:57:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-16 18:57:25                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-16 18:57:26                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-16 18:57:26                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-16 18:57:26                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x248    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-16 18:57:26                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x198bb   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x248    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-16 18:57:26                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-16 18:57:26                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x198bb    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-16 18:57:27                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-16 18:57:29                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-16 18:57:30                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x211dd   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-16 18:57:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-16 18:57:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-16 18:59:32                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-16 18:59:32                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-16 19:11:05                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x198bb      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-16 19:11:06                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-17 06:37:58                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-17 06:37:58                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-17 06:37:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-17 06:37:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-17 06:37:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-17 06:37:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-17 06:37:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-17 06:37:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-17 06:37:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-17 06:37:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-17 06:37:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-17 06:37:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-17 06:37:59                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x93d4  
      Audit Success   12290      2015-11-17 06:38:00                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12292      2015-11-17 06:38:01                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-11-17 06:38:01                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-17 06:38:01                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-17 06:38:02                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x240    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-17 06:38:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b21f   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x240    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-17 06:38:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b21f    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-17 06:38:03                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-17 06:38:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1f6a8   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-17 06:38:12                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-17 06:38:12                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-17 06:40:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-17 06:40:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-17 07:07:37                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1b21f      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-17 07:07:38                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-17 17:40:19                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-17 17:40:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-17 17:40:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-17 17:40:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-17 17:40:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-17 17:40:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-17 17:40:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-17 17:40:19                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-17 17:40:19                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-17 17:40:19                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-17 17:40:19                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-17 17:40:19                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-17 17:40:19                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x8f35  
      Audit Success   12290      2015-11-17 17:40:21                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-17 17:40:21                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-17 17:40:21                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x250    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-17 17:40:21                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a011   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x250    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-17 17:40:21                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-17 17:40:21                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a011    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-17 17:40:23                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-17 17:40:24                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-17 17:40:27                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x20712   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-17 17:40:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-17 17:40:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-17 17:42:32                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-17 17:42:32                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-17 18:51:47                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-17 18:51:47                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-17 18:51:53                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-17 18:51:53                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-17 19:09:03                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a011      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-17 19:09:04                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-17 23:44:05                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-17 23:44:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-11-17 23:44:05                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9399  
      Audit Success   12544      2015-11-17 23:44:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-17 23:44:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-17 23:44:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-17 23:44:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-17 23:44:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-17 23:44:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-17 23:44:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-17 23:44:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-17 23:44:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-17 23:44:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-17 23:44:07                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-17 23:44:07                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-17 23:44:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18fd3   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-17 23:44:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18fd3    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-17 23:44:08                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-11-17 23:44:08                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-17 23:44:08                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-17 23:44:09                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-17 23:44:11                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x215bb   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-17 23:44:18                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-17 23:44:18                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-17 23:46:12                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-17 23:46:12                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-18 00:53:26                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18fd3      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-18 00:53:28                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-18 18:53:25                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-18 18:53:25                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-11-18 18:53:25                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x8917  
      Audit Success   12544      2015-11-18 18:53:35                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-18 18:53:35                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-18 18:53:35                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-18 18:53:35                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-18 18:53:35                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-18 18:53:35                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-18 18:53:35                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-18 18:53:35                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-18 18:53:35                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-18 18:53:35                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-18 18:53:36                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-18 18:53:36                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x25c    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-18 18:53:36                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19045   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x25c    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-18 18:53:36                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-18 18:53:36                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19045    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-18 18:53:36                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-18 18:53:37                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-18 18:53:37                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-18 18:53:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x20bc4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-18 18:53:43                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-18 18:53:43                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-18 18:55:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-18 18:55:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-18 19:43:01                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-18 19:43:01                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-18 19:52:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-18 19:52:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-18 19:53:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-18 19:53:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-18 21:15:54                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-18 21:15:54                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-19 00:10:48                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19045      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-19 00:10:50                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-21 05:21:45                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-21 05:21:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-21 05:21:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-21 05:21:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-21 05:21:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-21 05:21:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-21 05:21:45                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-21 05:21:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-21 05:21:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-21 05:21:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-21 05:21:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-21 05:21:45                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-21 05:21:45                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x936a  
      Audit Success   12290      2015-11-21 05:21:47                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12292      2015-11-21 05:21:48                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-11-21 05:21:48                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-21 05:21:48                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x258    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-21 05:21:48                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19633   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x258    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-21 05:21:48                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-21 05:21:48                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19633    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-21 05:21:51                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-21 05:21:53                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1ee0c   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-21 05:22:01                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-21 05:22:01                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-21 05:23:55                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-21 05:23:55                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-21 06:47:56                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-21 06:47:56                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-21 06:54:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-21 06:54:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-21 06:54:53                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-21 06:54:53                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-21 08:47:25                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19633      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-21 08:47:27                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-21 13:19:51                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-21 13:19:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-21 13:19:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-21 13:19:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-21 13:19:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-21 13:19:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-21 13:19:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-21 13:19:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-21 13:19:51                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9227  
      Audit Success   12544      2015-11-21 13:19:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-21 13:19:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-21 13:19:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-21 13:19:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-21 13:19:53                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-21 13:19:54                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x228    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-21 13:19:54                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18e3a   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x228    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-21 13:19:54                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-21 13:19:54                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18e3a    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-21 13:19:54                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-21 13:19:55                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-21 13:19:56                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-21 13:19:57                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1cff2   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-21 13:20:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-21 13:20:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-21 13:22:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-21 13:22:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-21 14:34:11                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-21 14:34:11                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-21 14:34:17                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-21 14:34:17                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-21 15:47:57                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-21 15:47:57                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-21 18:57:27                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x18e3a      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-21 18:57:29                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-21 21:01:53                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-21 21:01:53                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-21 21:01:53                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-21 21:01:53                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-21 21:01:53                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9ecf  
      Audit Success   12290      2015-11-21 21:01:54                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-21 21:01:54                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-21 21:01:54                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-21 21:01:54                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-21 21:01:54                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-21 21:01:54                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-21 21:01:54                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-21 21:01:54                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-21 21:01:54                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-21 21:01:55                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x278    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-21 21:01:55                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19311   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x278    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-21 21:01:55                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-21 21:01:55                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19311    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-21 21:01:55                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-21 21:01:56                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-21 21:01:56                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-21 21:01:57                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x20e8e   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-21 21:02:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-21 21:02:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-21 21:03:58                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-21 21:03:58                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-21 21:28:18                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19311      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-21 21:28:19                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-22 02:22:24                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-22 02:22:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-11-22 02:22:24                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x94b9  
      Audit Success   12544      2015-11-22 02:22:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 02:22:31                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-22 02:22:32                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-22 02:22:32                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 02:22:32                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 02:22:32                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 02:22:32                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 02:22:32                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 02:22:32                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 02:22:32                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 02:22:32                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 02:22:33                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x254    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-22 02:22:33                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19587   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x254    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 02:22:33                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 02:22:33                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19587    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 02:22:33                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-22 02:22:34                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-22 02:22:34                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-22 02:22:34                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x214d4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 02:22:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 02:22:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 02:24:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 02:24:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12288      2015-11-22 02:25:35                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x458   :  C:\Windows\System32\svchost.exe     :  2015-11-21T17:25:50.548828100Z   :  2015-11-21T17:25:35.482644300Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-11-22 02:25:35                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x458   :  C:\Windows\System32\svchost.exe     :  2015-11-21T17:25:35.501197800Z   :  2015-11-21T17:25:35.501000000Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-11-22 02:25:35                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x458   :  C:\Windows\System32\svchost.exe     :  2015-11-21T17:25:35.501976500Z   :  2015-11-21T17:25:35.501000000Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-11-22 08:13:48                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-22 08:13:48                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 08:13:48                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 08:13:48                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-22 08:13:48                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0xa7f0  
      Audit Success   12544      2015-11-22 08:13:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 08:13:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 08:13:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 08:13:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 08:13:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 08:13:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 08:13:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 08:13:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   101        2015-11-22 08:13:50                                  Microsoft-Windows-Eventlog      1101:     .  0  
      Audit Success   12290      2015-11-22 08:13:50                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-22 08:13:50                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-22 08:13:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x17fd9   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x244    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 08:13:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 08:13:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x17fd9    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 08:13:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-22 08:13:51                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-22 08:13:53                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-22 08:13:55                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x1f29f   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 08:14:13                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 08:14:13                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 08:16:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 08:16:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-22 08:22:48                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x17fd9      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-22 08:22:49                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-22 08:27:37                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-22 08:27:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-11-22 08:27:37                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9c9a  
      Audit Success   12544      2015-11-22 08:27:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 08:27:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 08:27:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 08:27:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 08:27:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 08:27:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 08:27:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 08:27:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 08:27:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 08:27:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-22 08:27:40                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-22 08:27:40                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x28c    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-22 08:27:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19d2f   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x28c    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 08:27:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19d2f    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-22 08:27:41                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-22 08:27:41                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-22 08:27:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 08:27:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 08:27:42                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x21b5b   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 08:27:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 08:27:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 08:29:46                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 08:29:46                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 08:54:14                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 08:54:14                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 09:04:14                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 09:04:14                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 09:04:14                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 09:04:14                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12288      2015-11-22 09:53:58                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-22 09:53:58                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 09:53:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 09:53:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 09:53:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 09:53:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-22 09:53:59                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9e83  
      Audit Success   12290      2015-11-22 09:54:00                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-22 09:54:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 09:54:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 09:54:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 09:54:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 09:54:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 09:54:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   101        2015-11-22 09:54:01                                  Microsoft-Windows-Eventlog      1101:     .  0  
      Audit Success   12544      2015-11-22 09:54:01                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x23c    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-22 09:54:01                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19786   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x23c    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 09:54:01                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19786    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-22 09:54:02                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-22 09:54:02                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-22 09:54:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 09:54:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 09:54:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x22286   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 09:54:13                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 09:54:13                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 09:56:10                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 09:56:10                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12288      2015-11-22 12:45:37                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-22 12:45:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 12:45:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 12:45:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-22 12:45:37                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9bfe  
      Audit Success   12544      2015-11-22 12:45:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 12:45:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 12:45:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 12:45:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 12:45:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 12:45:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 12:45:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 12:45:38                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   101        2015-11-22 12:45:39                                  Microsoft-Windows-Eventlog      1101:     .  0  
      Audit Success   12290      2015-11-22 12:45:39                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-22 12:45:40                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x2ac    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-22 12:45:40                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a12f   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x2ac    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 12:45:40                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a12f    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-22 12:45:41                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-11-22 12:45:41                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 12:45:41                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-22 12:45:42                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-22 12:45:44                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x21d7a   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 12:45:54                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 12:45:54                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 12:47:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 12:47:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12288      2015-11-22 13:30:46                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-22 13:30:46                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 13:30:46                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 13:30:46                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-22 13:30:46                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9501  
      Audit Success   12544      2015-11-22 13:30:47                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 13:30:47                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 13:30:47                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 13:30:47                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 13:30:47                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 13:30:47                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 13:30:47                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 13:30:47                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   101        2015-11-22 13:30:48                                  Microsoft-Windows-Eventlog      1101:     .  0  
      Audit Success   12290      2015-11-22 13:30:49                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-22 13:30:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 13:30:50                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x238    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-22 13:30:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19a46   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x238    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 13:30:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 13:30:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19a46    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-22 13:30:51                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-22 13:30:51                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-22 13:30:53                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x20e1f   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 13:31:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 13:31:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 13:32:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 13:32:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12288      2015-11-22 13:36:00                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x424   :  C:\Windows\System32\svchost.exe     :  2015-11-22T04:36:00.459959300Z   :  2015-11-22T04:36:00.459000000Z          .    Windows,    ,    .           .  
      Audit Success   12544      2015-11-22 13:36:24                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 13:36:24                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Failure   12290      2015-11-22 13:38:31                                  Microsoft-Windows-Security-Auditing  5038:     ,     .         ,          .     : \Device\HarddiskVolume2\Users\sima\AppData\Local\Temp\4f38e278-1720-49a7-9327-e7b801aae760   
      Audit Success   12544      2015-11-22 13:38:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 13:38:31                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 13:40:36                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 13:40:36                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 14:06:33                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 14:06:33                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 14:06:34                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 14:06:34                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 14:06:34                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 14:06:34                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-22 14:06:55                                  Microsoft-Windows-Security-Auditing  4904:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0xcbc    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0x128ec8  
      Audit Success   13568      2015-11-22 14:06:55                                  Microsoft-Windows-Security-Auditing  4905:       .    Subject    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0xcbc    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0x128ec8  
      Audit Success   12544      2015-11-22 14:09:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 14:09:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 14:13:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 14:13:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 14:14:21                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 14:14:21                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 14:14:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1dc    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 14:14:22                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-22 14:14:39                                  Microsoft-Windows-Security-Auditing  4904:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0xcbc    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0x24fa3b  
      Audit Success   13568      2015-11-22 14:14:39                                  Microsoft-Windows-Security-Auditing  4905:       .    Subject    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0xcbc    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0x24fa3b  
      Audit Success   12545      2015-11-22 14:20:34                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19a46      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-22 14:20:35                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-22 14:21:22                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-22 14:21:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-11-22 14:21:23                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9852  
      Audit Success   12544      2015-11-22 14:21:30                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 14:21:30                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 14:21:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 14:21:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 14:21:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 14:21:31                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 14:21:31                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 14:21:31                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 14:21:31                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 14:21:31                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-22 14:21:32                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-22 14:21:32                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x248    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-22 14:21:32                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a33e   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x248    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 14:21:32                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a33e    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-22 14:21:33                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-22 14:21:33                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-22 14:21:33                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 14:21:33                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 14:21:38                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x25a45   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 14:21:54                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 14:21:54                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 14:23:47                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 14:23:47                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 14:53:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 14:53:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 14:53:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 14:53:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 14:53:37                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 14:53:37                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-22 17:40:35                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a33e      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-22 17:40:37                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-22 19:50:48                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-22 19:50:48                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 19:50:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 19:50:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-22 19:50:49                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9706  
      Audit Success   12544      2015-11-22 19:50:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 19:50:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-22 19:50:52                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-22 19:50:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 19:50:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 19:50:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 19:50:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 19:50:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 19:50:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 19:50:53                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x230    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-22 19:50:53                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a977   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x230    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 19:50:53                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a977    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 19:50:54                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 19:50:54                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-22 19:50:56                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-22 19:50:57                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-22 19:51:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x2be53   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 19:51:14                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 19:51:14                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 19:53:09                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 19:53:09                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Failure   12290      2015-11-22 20:03:03                                  Microsoft-Windows-Security-Auditing  5038:     ,     .         ,          .     : \Device\HarddiskVolume2\Windows\System32\drivers\BazisPortableCDBus.sys   
      Audit Success   12544      2015-11-22 20:04:59                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 20:04:59                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 20:05:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 20:05:00                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-22 20:05:27                                  Microsoft-Windows-Security-Auditing  4904:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0x410    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0xd82d7  
      Audit Success   13568      2015-11-22 20:05:27                                  Microsoft-Windows-Security-Auditing  4905:       .    Subject    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0x410    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0xd82d7  
      Audit Success   12544      2015-11-22 20:06:16                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 20:06:16                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 20:06:44                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 20:06:44                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-22 20:06:52                                  Microsoft-Windows-Security-Auditing  4904:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0x410    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0x109878  
      Audit Success   13568      2015-11-22 20:06:52                                  Microsoft-Windows-Security-Auditing  4905:       .    Subject    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :    : 0x410    : C:\Windows\System32\VSSVC.exe     :    : VSSAudit     : 0x109878  
      Audit Success   12544      2015-11-22 20:43:57                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-22 20:43:57                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 20:43:57                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-22 20:43:57                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-22 20:44:33                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1f0    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-22 20:44:33                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-22 21:06:48                                  Microsoft-Windows-Security-Auditing  5061:  .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir      :  0x1a977     :    : Microsoft Software Key Storage Provider    : RSA    : lp-ed919552-825f-4490-8a35-5b628caeda78    : %%2500     :   : %%2480    : 0x0  
      Audit Success   12292      2015-11-22 21:06:48                                  Microsoft-Windows-Security-Auditing  5058:    .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir      :  0x1a977     :    : Microsoft Software Key Storage Provider    : %%2432    : lp-ed919552-825f-4490-8a35-5b628caeda78    : %%2500         :     : C:\Users\sima\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1499224401-2478604990-2095306355-1000\ee539417034139c4c4a9391b2008de47_f952cf71-67f6-4072-b534-bf35f443671e   : %%2458    : 0x0  
      Audit Success   12288      2015-11-22 21:20:53                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x478   :  C:\Windows\System32\svchost.exe     :  2015-11-22T12:20:53.220703100Z   :  2015-11-22T12:20:53.220000000Z          .    Windows,    ,    .           .  
      Audit Success   12545      2015-11-22 22:08:58                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a977      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-22 22:08:59                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-23 22:38:55                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-23 22:38:55                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   13568      2015-11-23 22:38:55                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9596  
      Audit Success   12544      2015-11-23 22:39:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-23 22:39:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-23 22:39:03                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-23 22:39:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-23 22:39:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-23 22:39:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-23 22:39:03                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-23 22:39:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-23 22:39:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-23 22:39:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-23 22:39:03                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-23 22:39:04                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x220    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-23 22:39:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19f15   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x220    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-23 22:39:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-23 22:39:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19f15    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-23 22:39:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-23 22:39:05                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-23 22:39:05                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-23 22:39:08                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x22dd8   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-23 22:39:22                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-23 22:39:22                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-23 22:41:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-23 22:41:15                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12288      2015-11-23 22:42:17                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x498   :  C:\Windows\System32\svchost.exe     :  2015-11-23T13:42:21.811523400Z   :  2015-11-23T13:42:17.446507900Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-11-23 22:42:17                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x498   :  C:\Windows\System32\svchost.exe     :  2015-11-23T13:42:17.464085800Z   :  2015-11-23T13:42:17.464000000Z          .    Windows,    ,    .           .  
      Audit Success   12288      2015-11-23 22:42:17                                  Microsoft-Windows-Security-Auditing  4616:   .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5      :    : 0x498   :  C:\Windows\System32\svchost.exe     :  2015-11-23T13:42:17.464000000Z   :  2015-11-23T13:42:17.464000000Z          .    Windows,    ,    .           .  
      Audit Success   12290      2015-11-23 22:42:18                                  Microsoft-Windows-Security-Auditing  5061:  .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir      :  0x19f15     :    : Microsoft Software Key Storage Provider    : RSA    : lp-ed919552-825f-4490-8a35-5b628caeda78    : %%2500     :   : %%2480    : 0x0  
      Audit Success   12292      2015-11-23 22:42:18                                  Microsoft-Windows-Security-Auditing  5058:    .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir      :  0x19f15     :    : Microsoft Software Key Storage Provider    : %%2432    : lp-ed919552-825f-4490-8a35-5b628caeda78    : %%2500         :     : C:\Users\sima\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1499224401-2478604990-2095306355-1000\ee539417034139c4c4a9391b2008de47_f952cf71-67f6-4072-b534-bf35f443671e   : %%2458    : 0x0  
      Audit Success   12544      2015-11-23 23:02:33                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-23 23:02:33                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-23 23:26:48                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x19f15      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-23 23:26:49                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-24 21:30:02                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-24 21:30:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-24 21:30:02                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-24 21:30:02                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-24 21:30:02                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9a49  
      Audit Success   12544      2015-11-24 21:30:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-24 21:30:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-24 21:30:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-24 21:30:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-24 21:30:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-24 21:30:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-24 21:30:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-24 21:30:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-24 21:30:05                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-24 21:30:05                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x21c    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-24 21:30:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a324   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x21c    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-24 21:30:05                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a324    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-24 21:30:07                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12544      2015-11-24 21:30:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-24 21:30:07                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-24 21:30:09                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-24 21:30:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x25cb9   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-24 21:30:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-24 21:30:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-24 21:32:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-24 21:32:19                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-24 21:38:43                                  Microsoft-Windows-Security-Auditing  5061:  .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir      :  0x1a324     :    : Microsoft Software Key Storage Provider    : RSA    : lp-ed919552-825f-4490-8a35-5b628caeda78    : %%2500     :   : %%2480    : 0x0  
      Audit Success   12292      2015-11-24 21:38:43                                  Microsoft-Windows-Security-Auditing  5058:    .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir      :  0x1a324     :    : Microsoft Software Key Storage Provider    : %%2432    : lp-ed919552-825f-4490-8a35-5b628caeda78    : %%2500         :     : C:\Users\sima\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1499224401-2478604990-2095306355-1000\ee539417034139c4c4a9391b2008de47_f952cf71-67f6-4072-b534-bf35f443671e   : %%2458    : 0x0  
      Audit Success   12544      2015-11-24 23:22:47                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e8    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-24 23:22:47                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   103        2015-11-24 23:47:32                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12545      2015-11-24 23:47:32                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a324      ,   .  ,  ,  .        .  
      Audit Success   12288      2015-11-25 09:22:04                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-25 09:22:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-25 09:22:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-25 09:22:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-25 09:22:04                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x99a8  
      Audit Success   12544      2015-11-25 09:22:05                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-25 09:22:05                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-25 09:22:06                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-25 09:22:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-25 09:22:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-25 09:22:06                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-25 09:22:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-25 09:22:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-25 09:22:06                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-25 09:22:08                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-25 09:22:08                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x220    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-25 09:22:08                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a83c   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x220    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-25 09:22:08                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-25 09:22:08                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a83c    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-25 09:22:09                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-25 09:22:12                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-25 09:22:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x25de6   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-25 09:22:27                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-25 09:22:27                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-25 09:24:28                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-25 09:24:28                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-25 09:40:48                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a83c      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-25 09:40:49                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-25 14:41:07                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-25 14:41:07                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-25 14:41:08                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-25 14:41:08                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-25 14:41:08                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-25 14:41:08                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-25 14:41:08                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x99d5  
      Audit Success   12290      2015-11-25 14:41:10                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-25 14:41:10                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-25 14:41:10                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-25 14:41:10                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-25 14:41:10                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-25 14:41:10                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-25 14:41:10                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-25 14:41:12                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-25 14:41:12                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x220    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-25 14:41:12                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a9ae   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x220    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-25 14:41:12                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-25 14:41:12                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a9ae    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-25 14:41:13                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-25 14:41:16                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-25 14:41:19                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x2520f   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-25 14:41:27                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-25 14:41:27                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-25 14:43:23                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-25 14:43:23                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12545      2015-11-25 15:03:41                                  Microsoft-Windows-Security-Auditing  4647: ,  :    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a9ae      ,   .  ,  ,  .        .  
      Audit Success   103        2015-11-25 15:03:42                                  Microsoft-Windows-Eventlog      1100:      .  
      Audit Success   12288      2015-11-25 23:28:49                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-25 23:28:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-25 23:28:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-25 23:28:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-25 23:28:50                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x9d71  
      Audit Success   12544      2015-11-25 23:28:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-25 23:28:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-25 23:28:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-25 23:28:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-25 23:28:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-25 23:28:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-25 23:28:52                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-25 23:28:52                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-25 23:28:52                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-25 23:28:53                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-25 23:28:53                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-25 23:28:54                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x220    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-25 23:28:54                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a4d6   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x220    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-25 23:28:54                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1a4d6    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-25 23:28:55                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-25 23:28:57                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-25 23:29:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x26d14   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-25 23:29:08                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-25 23:29:08                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-25 23:31:04                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1ec    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-25 23:31:04                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12290      2015-11-25 23:34:31                                  Microsoft-Windows-Security-Auditing  5061:  .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir      :  0x1a4d6     :    : Microsoft Software Key Storage Provider    : RSA    : lp-ed919552-825f-4490-8a35-5b628caeda78    : %%2500     :   : %%2480    : 0x0  
      Audit Success   12292      2015-11-25 23:34:31                                  Microsoft-Windows-Security-Auditing  5058:    .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir      :  0x1a4d6     :    : Microsoft Software Key Storage Provider    : %%2432    : lp-ed919552-825f-4490-8a35-5b628caeda78    : %%2500         :     : C:\Users\sima\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1499224401-2478604990-2095306355-1000\ee539417034139c4c4a9391b2008de47_f952cf71-67f6-4072-b534-bf35f443671e   : %%2458    : 0x0  
      Audit Success   12288      2015-11-26 07:15:49                                  Microsoft-Windows-Security-Auditing  4608:   Windows.           LSASS.EXE    .  
      Audit Success   12544      2015-11-26 07:15:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   0     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x4    :        :     : -     : -    :  -       :    :  -     : -    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-26 07:15:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-26 07:15:50                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-26 07:15:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-26 07:15:50                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-20     :  NETWORK SERVICE     :  NT AUTHORITY    :  0x3e4    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   13568      2015-11-26 07:15:50                                  Microsoft-Windows-Security-Auditing  4902:      .     : 0   : 0x966d  
      Audit Success   12544      2015-11-26 07:15:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-26 07:15:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-26 07:15:51                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-26 07:15:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-19     :  LOCAL SERVICE     :  NT AUTHORITY    :  0x3e5    :  SeAssignPrimaryTokenPrivilege     SeAuditPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-26 07:15:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12548      2015-11-26 07:15:51                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   101        2015-11-26 07:15:52                                  Microsoft-Windows-Eventlog      1101:     .  0  
      Audit Success   12290      2015-11-26 07:15:53                                  Microsoft-Windows-Security-Auditing  5056:   .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP      :  0x3e7    :  ncrypt.dll     : 0x0  
      Audit Success   12544      2015-11-26 07:15:54                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-26 07:15:54                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-26 07:15:55                                  Microsoft-Windows-Security-Auditing  4648:          .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}          :     :  sima     :  vladimir   GUID :  {00000000-0000-0000-0000-000000000000}     :     : localhost    : localhost      :    :  0x214    :  C:\Windows\System32\winlogon.exe      :    : 127.0.0.1   :   0      ,        ,     .         , ,  ,    RUNAS.  
      Audit Success   12544      2015-11-26 07:15:55                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   2     :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1863a   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x214    :  C:\Windows\System32\winlogon.exe      :     : VLADIMIR     : 127.0.0.1    :  0       :    :  User32      : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-26 07:15:55                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-21-1499224401-2478604990-2095306355-1000     :  sima     :  vladimir    :  0x1863a    :  SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12292      2015-11-26 07:15:56                                  Microsoft-Windows-Security-Auditing  5033:   Windows  .  
      Audit Success   12292      2015-11-26 07:15:57                                  Microsoft-Windows-Security-Auditing  5024:   Windows  .  
      Audit Success   12544      2015-11-26 07:16:00                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-0-0     :  -     :  -    :  0x0     :   3     :    :  S-1-5-7     :        :  NT AUTHORITY    :  0x22b80   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x0    :  -      :     :      : -    :  -       :    :  NtLmSsp      : NTLM    : -     ( NTLM): NTLM V1    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12544      2015-11-26 07:16:15                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-26 07:16:15                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-26 07:16:20                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-26 07:16:20                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-26 07:18:28                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-26 07:18:28                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Failure   12290      2015-11-26 07:29:29                                  Microsoft-Windows-Security-Auditing  5038:     ,     .         ,          .     : \Device\HarddiskVolume2\Users\sima\AppData\Local\Temp\d34add37-9146-4198-8537-8d8fb281b8bc   
      Audit Success   12544      2015-11-26 07:29:32                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-26 07:29:32                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-26 07:31:39                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-26 07:31:39                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
      Audit Success   12544      2015-11-26 07:34:49                                  Microsoft-Windows-Security-Auditing  4624:      .    :    :  S-1-5-18     :  VLADIMIR$     :  WORKGROUP    :  0x3e7     :   5     :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7   GUID :  {00000000-0000-0000-0000-000000000000}      :    :  0x1e4    :  C:\Windows\System32\services.exe      :     :      : -    :  -       :    :  Advapi       : Negotiate    : -     ( NTLM): -    :  0          .    ,    .     ""      ,  .   , ,  "",   ,   Winlogon.exe  Services.exe.      " "    .     2 ()  3 ().     " "    ,      ,     ,    .     ,    ,      .      ,         .                .   - GUID  -   ,        KDC.   -   " " ,         .   -  " "   ,    NTLM.   -  " "     .      "0",     .  
      Audit Success   12548      2015-11-26 07:34:49                                  Microsoft-Windows-Security-Auditing  4672:      .    :    :  S-1-5-18     :       :  NT AUTHORITY    :  0x3e7    :  SeAssignPrimaryTokenPrivilege     SeTcbPrivilege     SeSecurityPrivilege     SeTakeOwnershipPrivilege     SeLoadDriverPrivilege     SeBackupPrivilege     SeRestorePrivilege     SeDebugPrivilege     SeAuditPrivilege     SeSystemEnvironmentPrivilege     SeImpersonatePrivilege  
                        2010-11-21 06:57:42                                  Service Control Manager         7036:  "Volume Shadow Copy"    stopped.  
                        2010-11-21 06:57:42                                  Service Control Manager         7036:  "Windows Event Log"    stopped.  
                        2010-11-21 06:57:42                                  Service Control Manager         7036:  "Software Protection"    stopped.  
                        2010-11-21 06:57:42                                  Service Control Manager         7036:  "Plug and Play"    stopped.  
                        2010-11-21 06:57:42                                  Service Control Manager         7036:  "Windows Modules Installer"    stopped.  
                        2010-11-21 06:57:42                                  Service Control Manager         7036:  "Cryptographic Services"    stopped.  
                7010       2010-11-21 06:57:42                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                103        2010-11-21 06:57:43                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2010-11-21 06:57:46                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-09-28 01:22:17                           Microsoft-Windows-Kernel-General  1:  .  
                        2015-09-28 01:22:23                                  Service Control Manager         7036:  "Windows Search"    .  
                7005       2015-09-28 01:22:50                           Microsoft-Windows-UserPnp       20003:       AsyncMac      SW\{EEAB7790-C514-11D1-B42B-00805FC1270E}\ASYNCMAC   : 0.  
                7005       2015-09-28 01:22:51                           Microsoft-Windows-UserPnp       20001:             SW\{EEAB7790-C514-11D1-B42B-00805FC1270E}\ASYNCMAC   : 0x0.  
                        2015-09-28 01:22:59                           USER32                          1074:  C:\Windows\system32\shutdown.exe (WIN-N09L0AS3TIA)   ""   VLADIMIR    NT AUTHORITY\  :        : 0x800000ff     :     :   
                1101       2015-09-28 01:23:03                           Microsoft-Windows-Winlogon      7001:           
                        2015-09-28 01:23:04  sima                            Microsoft-Windows-GroupPolicy   1501:        .          .  
                        2015-09-28 01:23:06                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:23:10                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 01:23:28                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 01:24:04                                  Service Control Manager         7036:  "    (BITS)"    .  
                        2015-09-28 01:24:04                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-09-28 01:24:04                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v2.0.50727_X86"    .  
                        2015-09-28 01:24:05                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-09-28 01:24:06                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-28 01:24:06                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:24:07                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 01:24:40                                  EventLog                        6006:    .  
                        2015-09-28 01:24:40                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 01:24:40                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:24:40                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v2.0.50727_X86"    .  
                        2015-09-28 01:24:40                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:24:40                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 01:24:40                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-09-28 01:24:40                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-09-28 01:24:40                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:24:40                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 01:24:40                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-28 01:24:40                                  Service Control Manager         7036:  "DHCP-"    .  
                4          2015-09-28 01:24:40  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-09-28 01:24:40  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-09-28 01:24:40                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-09-28 01:24:41                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:24:41                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-09-28 01:24:41                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:24:41                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:24:41                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 01:24:41                                  Service Control Manager         7036:  "     "    .  
                        2015-09-28 01:24:41                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-09-28 01:24:41                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-09-28 01:24:41                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:24:41                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 01:24:41                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 01:24:41                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 01:24:41                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-09-28 01:24:41                                  Microsoft-Windows-Kernel-Power  109:      .  
                1102       2015-09-28 01:24:41                           Microsoft-Windows-Winlogon      7002:           
                        2015-09-28 01:24:44                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-09-28 01:27:08                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-09-28 01:27:11                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T09:21:51.000000000Z)       .  
                4          2015-09-28 01:27:16                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-09-28 01:27:16                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-09-28 01:27:19                                  nvlddmkm                        
                        2015-09-28 01:27:20                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-09-28 01:27:20                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 01:27:20                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-09-28 01:27:20                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-09-28 01:27:20                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-09-28 01:27:20                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T09:15:44.000000000Z)       .  
                7010       2015-09-28 01:27:20                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-09-28 01:27:21                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-09-28 01:27:21                                  EventLog                        6005:    .  
                        2015-09-28 01:27:21                                  EventLog                        6013:    13 .  
                        2015-09-28 01:27:21                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 01:27:21                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:27:22                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-09-28 01:27:22                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-09-28 01:27:22                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 01:27:22                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 01:27:22                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-09-28 01:27:22                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:27:22                                  Service Control Manager         7036:  "    "    .  
                        2015-09-28 01:27:22                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:27:22                                  Service Control Manager         7036:  "     "    .  
                        2015-09-28 01:27:22                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 01:27:23                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 01:27:23                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-09-28 01:27:23                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-09-28 01:27:23                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-09-28 01:27:23                                  Service Control Manager         7036:  "  "    .  
                4          2015-09-28 01:27:23  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-09-28 01:27:23  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-09-28 01:27:24                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 01:27:24                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 01:27:24                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:27:24                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-28 01:27:24                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 01:27:25                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 01:27:25                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-09-28 01:27:25                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:27:25                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 01:27:25                                  Service Control Manager         7036:  "    "    .  
                        2015-09-28 01:27:25                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 01:27:25                                  Service Control Manager         7036:  "  IP"    .  
                        2015-09-28 01:27:25                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 01:27:25                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:27:25                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:27:25                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-09-28 01:27:25                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:27:25                                  Service Control Manager         7036:  "   "    .  
                1101       2015-09-28 01:27:25                           Microsoft-Windows-Winlogon      7001:           
                        2015-09-28 01:27:26                                  Virtual Disk Service            3:  .  
                        2015-09-28 01:27:26                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 01:27:26                                  Service Control Manager         7036:  "   "    .  
                7005       2015-09-28 01:27:28                           Microsoft-Windows-UserPnp       20003:       disk      IDE\DISKSAMSUNG_SP0802N_________________________TK300-06\6&2334830&0&0.1.0   : 0.  
                7005       2015-09-28 01:27:29                           Microsoft-Windows-UserPnp       20001:       FileRepository\disk.inf_x86_neutral_b431b61a11f8df6c\disk.inf      IDE\DISKSAMSUNG_SP0802N_________________________TK300-06\6&2334830&0&0.1.0   : 0x0.  
                        2015-09-28 01:27:39                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 01:27:40                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-09-28 01:28:02                                  Virtual Disk Service            4:  .  
                        2015-09-28 01:28:02                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 01:29:25                                  Service Control Manager         7036:  "    (BITS)"    .  
                        2015-09-28 01:29:25                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-09-28 01:29:26                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v2.0.50727_X86"    .  
                        2015-09-28 01:29:27                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-09-28 01:29:27                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:29:28                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-28 01:29:28                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:29:29                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 01:29:29                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 01:30:50                                  Service Control Manager         7036:  "    "    .  
                        2015-09-28 01:30:50                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-09-28 01:31:53                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:32:00                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 01:32:54                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:32:56                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                7005       2015-09-28 01:33:14                           Microsoft-Windows-UserPnp       20001:       FileRepository\volsnap.inf_x86_neutral_42f862e05fcb0306\volsnap.inf      STORAGE\VOLUMESNAPSHOT\HARDDISKVOLUMESNAPSHOT1   : 0x0.  
                        2015-09-28 01:33:32                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-28 01:33:52                           Service Control Manager         7045:    .     :  Office  Source Engine    :  "C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"   :        :      :  LocalSystem  
                        2015-09-28 01:34:32                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:36:31                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:36:49                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:37:02                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:37:49                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:38:28                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 01:38:29                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-09-28 01:38:29                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-09-28 01:38:29                           Service Control Manager         7040:    "  IPsec        IP   "    ""  "".  
                        2015-09-28 01:40:03                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:40:34                           Service Control Manager         7045:    .     :  Office Software Protection Platform    :  "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"   :        :      :  NT AUTHORITY\NetworkService  
                        2015-09-28 01:40:35                           Service Control Manager         7045:    .     :  Microsoft SharePoint Workspace Audit Service    :  "C:\Program Files\Microsoft Office\Office14\GROOVE.EXE" /auditservice   :        :      :  NT AUTHORITY\LocalService  
                        2015-09-28 01:40:41                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-09-28 01:40:56                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 01:41:58                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-09-28 01:41:59                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-09-28 01:42:13                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 01:43:03                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-09-28 01:44:29                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-09-28 01:51:15                           Service Control Manager         7040:    "  Windows"    ""  "".  
                        2015-09-28 01:52:00                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-28 01:53:54                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 01:53:54                           Service Control Manager         7040:    "  Windows"    ""  "".  
                        2015-09-28 01:54:28                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 01:59:58                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 02:00:35                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-09-28 02:02:05                           Service Control Manager         7045:    .     :  Realtek Wireless LAN 802.11n USB 2.0 Network Adapter    :  system32\DRIVERS\rtwlanu.sys   :        :      :    
                7005       2015-09-28 02:02:05                           Microsoft-Windows-UserPnp       20003:       RtlWlanu      USB\VID_0B05&PID_17BA\00E04C000001   : 0.  
                        2015-09-28 02:02:08                           Service Control Manager         7040:    "  WLAN"    ""  "".  
                        2015-09-28 02:02:09                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-09-28 02:02:09                                  Service Control Manager         7036:  "    (EAP)"    .  
                7005       2015-09-28 02:02:09                           Microsoft-Windows-UserPnp       20001:       FileRepository\netrtwlanu.inf_x86_neutral_349ee8d87b8e598f\netrtwlanu.inf      USB\VID_0B05&PID_17BA\00E04C000001   : 0x0.  
                        2015-09-28 02:02:10                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-09-28 02:02:10                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                7005       2015-09-28 02:02:10                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0001   : 0.  
                        2015-09-28 02:05:05                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:05:05                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                7005       2015-09-28 02:05:14                           Microsoft-Windows-UserPnp       20001:       FileRepository\volsnap.inf_x86_neutral_42f862e05fcb0306\volsnap.inf      STORAGE\VOLUMESNAPSHOT\HARDDISKVOLUMESNAPSHOT2   : 0x0.  
                        2015-09-28 02:05:27                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 02:05:27                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-09-28 02:05:27                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 02:05:27                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-09-28 02:05:27                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 02:05:27  sima                            Service Control Manager         7040:    "      (ICS)"    ""  "".  
                        2015-09-28 02:05:28                                  Service Control Manager         7036:  "  PNP-"    .  
                            2015-09-28 02:05:39                                  Service Control Manager         7030:  "Realtek11nCU"   .         .     .  
                        2015-09-28 02:05:39  sima                            Service Control Manager         7045:    .     :  Realtek11nCU    :  C:\Program Files\REALTEK\11n USB Wireless LAN Utility\RtlService.exe   :        :      :  LocalSystem  
                        2015-09-28 02:05:40                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-28 02:05:55                                  Service Control Manager         7036:  "Realtek11nCU"    .  
                        2015-09-28 02:06:07                                  Virtual Disk Service            3:  .  
                        2015-09-28 02:06:07                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 02:07:25                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:08:22                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:09:59                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-09-28 02:11:22                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-09-28 02:15:47                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-28 02:15:49                           Service Control Manager         7040:    "Microsoft .NET Framework NGEN v2.0.50727_X86"    ""  "".  
                        2015-09-28 02:15:50                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v2.0.50727_X86"    .  
                7005       2015-09-28 02:19:09                           Microsoft-Windows-UserPnp       20003:       volsnap      STORAGE\VOLUME\{9A34E732-6534-11E5-976B-806E6F6E6963}#0000000000100000   : 0.  
                7005       2015-09-28 02:19:09                           Microsoft-Windows-UserPnp       20001:       FileRepository\volume.inf_x86_neutral_6dee0205881d1a1d\volume.inf      STORAGE\VOLUME\{9A34E732-6534-11E5-976B-806E6F6E6963}#0000000000100000   : 0x0.  
                        2015-09-28 02:19:28                                  Virtual Disk Service            4:  .  
                        2015-09-28 02:19:28                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 02:19:36  sima                            USER32                          1074:  Explorer.EXE   ""   VLADIMIR    vladimir\sima  :  ()     : 0x0     :     :   
                        2015-09-28 02:19:39  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   ""   VLADIMIR    vladimir\sima  :        : 0x500ff     :     :   
                1102       2015-09-28 02:19:39                           Microsoft-Windows-Winlogon      7002:           
                        2015-09-28 02:19:40                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 02:19:40                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:19:40                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-09-28 02:19:40                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-09-28 02:19:40                                  Service Control Manager         7036:  ""    .  
                4          2015-09-28 02:19:40  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-09-28 02:19:40  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                        2015-09-28 02:19:41                                  EventLog                        6006:    .  
                        2015-09-28 02:19:41                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:19:41                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:19:41                                  Service Control Manager         7036:  "     "    .  
                        2015-09-28 02:19:41                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 02:19:41                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-09-28 02:19:41                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-09-28 02:19:41                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:19:41                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-09-28 02:19:41                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-09-28 02:19:41                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-09-28 02:19:41                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-09-28 02:19:41                                  Service Control Manager         7036:  "Realtek11nCU"    .  
                        2015-09-28 02:19:41                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:19:41                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 02:19:41                                  Service Control Manager         7036:  "  WLAN"    .  
                7010       2015-09-28 02:19:41                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-09-28 02:19:41                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-09-28 02:19:42                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-09-28 02:19:42                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 02:19:42                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-09-28 02:19:42                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-09-28 02:19:42                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-28 02:19:43                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 02:19:43                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 02:19:43                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-09-28 02:19:44                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-09-28 02:19:44                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-09-28 02:19:47                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-09-28 02:20:17                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-09-28 02:20:20                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T09:21:51.000000000Z)       .  
                4          2015-09-28 02:20:23                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-09-28 02:20:23                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-09-28 02:20:33                                  nvlddmkm                        
                        2015-09-28 02:20:39                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-09-28 02:20:39                                  EventLog                        6005:    .  
                        2015-09-28 02:20:39                                  EventLog                        6013:    22 .  
                        2015-09-28 02:20:39                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-09-28 02:20:39                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 02:20:39                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-09-28 02:20:39                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-09-28 02:20:39                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-09-28 02:20:39                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 02:20:39                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T09:15:44.000000000Z)       .  
                7010       2015-09-28 02:20:39                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-09-28 02:20:40                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:20:41                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-09-28 02:20:41                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-09-28 02:20:41                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 02:20:41                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:20:41                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 02:20:41                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:20:41                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-09-28 02:20:41                                  Service Control Manager         7036:  "    "    .  
                        2015-09-28 02:20:41                                  Service Control Manager         7036:  "     "    .  
                        2015-09-28 02:20:41                                  Service Control Manager         7036:  "   "    .  
                1101       2015-09-28 02:20:44                           Microsoft-Windows-Winlogon      7001:           
                        2015-09-28 02:20:51                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-09-28 02:20:51                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-09-28 02:20:52                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-09-28 02:20:52                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 02:20:52                                  Service Control Manager         7036:  "DHCP-"    .  
                4          2015-09-28 02:20:52  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-09-28 02:20:52  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-09-28 02:20:53                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-09-28 02:20:53                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-09-28 02:20:53                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:20:53                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                        2015-09-28 02:20:55                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 02:20:55                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 02:20:55                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:20:55                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-28 02:20:55                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 02:20:55                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:20:55                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 02:20:56                                  Service Control Manager         7036:  "Realtek11nCU"    .  
                        2015-09-28 02:20:56                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-09-28 02:20:56                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 02:20:56                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-09-28 02:20:57                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 02:20:57                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-09-28 02:20:57                                  Service Control Manager         7036:  "  IP"    .  
                        2015-09-28 02:20:58                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 02:20:58                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 02:20:58                                  Service Control Manager         7036:  "    "    .  
                        2015-09-28 02:20:58                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 02:21:01                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 02:21:04                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-09-28 02:21:04                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-09-28 02:21:04                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:21:04                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:21:04                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 02:21:05                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:21:06                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 02:21:06                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 02:21:06                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 02:21:06                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-09-28 02:21:08                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-09-28 02:21:08                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-09-28 02:21:13                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-09-28 02:23:04                                  Service Control Manager         7036:  "    (BITS)"    .  
                        2015-09-28 02:23:05                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-09-28 02:23:05                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:23:05                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-28 02:23:06                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:23:06                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 02:23:07                                  Service Control Manager         7036:  "  Windows"    .  
                12         2015-09-28 02:24:01  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:     :            :     . . . . . . . . . . : ASUS USB-N10 150Mbps 11n Wireless USB dongle     . . . . . . . : ASUSTeK Computer Inc.     . . . . . . . . . . : Realtek Semiconductor Corp.     . . . . . . . . . . : 1021.3.912.2012     INF- . . . . . . . . . : C:\Windows\INF\oem2.inf     INF- . . . . . . . . . : 19  2013 .  14:56:04        . . . . . . . . . : RTL8192cu.ndi      . . . . . . . . . : usb\vid_0b05&pid_17ba       . . . . . : 0x180600a        . . : 0     If  . . . . . . . . . . . . : 71       . . . . . . : 9   
                12         2015-09-28 02:24:01  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:        :          GUID : 211835d6-e914-4a4d-824e-a3809356f2d8   : ASUS USB-N10 150Mbps 11n Wireless USB dongle   :  WiFi         : 1      :  : 1,  : 1         BSSID  BSS  PHY () /    SSID ------------------------------------------------------------------------- 48-50-73-ED-A0-BE   < > -57  11  Windows Phone8415          1      :   - 1;   - 1   BSS  PHY  (RSSI)  SSID   ------------------------------------------------------------------------------     < >   76   Windows Phone8415      :   - 0    
                12         2015-09-28 02:24:01  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:        :            .     .    :    :        GUID : 211835d6-e914-4a4d-824e-a3809356f2d8   : ASUS USB-N10 150Mbps 11n Wireless USB dongle   :  WiFi   :     : <DiagnosticsText><Title><![CDATA[   ]]></Title><Description><![CDATA[        Windows       .]]></Description><Parameters><Parameter><Name><![CDATA[SSID]]></Name><Value><![CDATA[]]></Value></Parameter></Parameters><Extensions><Extension><Name><![CDATA[Keyword]]></Name><Value><![CDATA[ ]]></Value></Extension><Extension><Name><![CDATA[Keyword]]></Name><Value><![CDATA[     ():       ( )   :               .    
                4          2015-09-28 02:24:01  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  4000:      .    :        : AutoConfig Helper Class     :             Windows       .     Guid  : {8CE4EB9A-49D5-4806-A204-DF5DF4D8A41F}      :               .     Guid : {6AEFFF5C-B33E-4A07-9989-B2532A3DCB6A}      (),   : 300      ,   : 0    :    ({211835D6-E914-4A4D-824E-A3809356F2D8})  
                        2015-09-28 02:24:18                                  Service Control Manager         7036:  "  Windows -  "    .  
                            2015-09-28 02:24:48                                  ipnathlp                        
                        2015-09-28 02:24:48                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 02:24:49                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-09-28 02:24:51  LOCAL SERVICE                   Microsoft-Windows-Time-Service  37: NTP-         time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->191.233.81.105:123).  
                        2015-09-28 02:24:58                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 02:24:58  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-09-28 02:24:58  LOCAL SERVICE                   Microsoft-Windows-Time-Service  35:          time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->191.233.81.105:123).  
                        2015-09-28 02:24:58  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-09-28 02:24:58  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-09-28 02:25:32                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:26:55                                  Service Control Manager         7036:  "    "    .  
                        2015-09-28 02:26:55                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-09-28 02:28:09                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:28:14                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-09-28 02:28:42                                  Service Control Manager         7036:  "Realtek11nCU"    .  
                        2015-09-28 02:29:21                                  Service Control Manager         7036:  " Windows"    .  
                          2015-09-28 02:30:05  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     aus3.mozilla.org        DNS.  
                            2015-09-28 02:34:20                           Schannel                        36888:    : 10.   : 10.  
                            2015-09-28 02:34:20                           Schannel                        36888:    : 10.   : 10.  
                            2015-09-28 02:34:20                           Schannel                        36888:    : 10.   : 10.  
                            2015-09-28 02:34:20                           Schannel                        36888:    : 10.   : 10.  
                        2015-09-28 02:34:32                                  Service Control Manager         7036:  "   Windows"    .  
                            2015-09-28 02:34:33                           Schannel                        36888:    : 10.   : 10.  
                            2015-09-28 02:34:33                           Schannel                        36888:    : 10.   : 10.  
                            2015-09-28 02:34:33                           Schannel                        36888:    : 10.   : 10.  
                            2015-09-28 02:34:33                           Schannel                        36888:    : 10.   : 10.  
                        2015-09-28 02:36:32                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-09-28 02:38:11                                  Service Control Manager         7036:  "  "    .  
                          2015-09-28 02:39:43  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     addons.mozilla.org        DNS.  
                          2015-09-28 02:39:56  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-09-28 02:40:14                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-28 02:42:42                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:42:42                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                7005       2015-09-28 02:42:50                           Microsoft-Windows-UserPnp       20001:       FileRepository\volsnap.inf_x86_neutral_42f862e05fcb0306\volsnap.inf      STORAGE\VOLUMESNAPSHOT\HARDDISKVOLUMESNAPSHOT3   : 0x0.  
                1          2015-09-28 02:43:11                           Microsoft-Windows-WindowsUpdateClient  19:  :     : Definition Update for Windows Defender - KB915597 (Definition 1.207.973.0)  
                        2015-09-28 02:43:12                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:46:05                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 02:49:05                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-09-28 02:52:58                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 02:53:12                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-09-28 03:00:48                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 03:10:50                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 03:30:48                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 03:42:41                           Service Control Manager         7040:    "    (BITS)"    ""  "".  
                        2015-09-28 04:57:35                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 04:58:49                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 04:58:50                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 05:03:20                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 05:05:53                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 05:05:53                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-09-28 05:05:56                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 05:06:05                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 05:06:25                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 05:08:56                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 05:11:56                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-09-28 05:15:56                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 05:17:32                           Service Control Manager         7040:    "  Windows"    ""  "".  
                        2015-09-28 05:17:33                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 05:17:33                           Service Control Manager         7040:    "  Windows"    ""  "".  
                        2015-09-28 05:43:37                                  Service Control Manager         7036:  " "    .  
                          2015-09-28 05:51:39  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-09-28 05:55:48                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 06:02:53                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 06:35:35                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-09-28 06:37:35                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-09-28 06:38:33                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 06:40:40                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 06:45:40                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 06:49:29  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-09-28 06:49:31  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-09-28 06:49:31                           Microsoft-Windows-Winlogon      7002:           
                        2015-09-28 06:49:32                                  EventLog                        6006:    .  
                        2015-09-28 06:49:32                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 06:49:32                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 06:49:32                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-09-28 06:49:32                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-09-28 06:49:32                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 06:49:32                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 06:49:32                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 06:49:32                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                4          2015-09-28 06:49:32  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-09-28 06:49:32  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-09-28 06:49:32                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-09-28 06:49:33                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 06:49:33                                  Service Control Manager         7036:  "     "    .  
                        2015-09-28 06:49:33                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-09-28 06:49:33                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 06:49:33                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-09-28 06:49:33                                  Service Control Manager         7036:  "  Windows -  "    .  
                        2015-09-28 06:49:33                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-09-28 06:49:33                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-09-28 06:49:33                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-09-28 06:49:33                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 06:49:34                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 06:49:34                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-09-28 06:49:34                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-09-28 06:49:34                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 06:49:34                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-09-28 06:49:34                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 06:49:34                                  Service Control Manager         7036:  "  WLAN"    .  
                          2015-09-28 06:49:34                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-09-28 06:49:35                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 06:49:35                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-28 06:49:36                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-09-28 06:49:36                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-09-28 06:49:39                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-09-28 07:16:10                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-09-28 07:16:24                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T03:21:51.000000000Z)       .  
                4          2015-09-28 07:16:31                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-09-28 07:16:31                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                        2015-09-28 07:17:03                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                7010       2015-09-28 07:17:03                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-09-28 07:17:04                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 07:17:04                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-09-28 07:17:04                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-09-28 07:17:04                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-09-28 07:17:10                           Service Control Manager         7040:    "storvsc"    "  "  "".  
                        2015-09-28 07:17:10                           Service Control Manager         7040:    "msdsm"    "  "  "".  
                        2015-09-28 07:17:10                           Service Control Manager         7040:    "mpio"    "  "  "".  
                        2015-09-28 07:17:10                           Service Control Manager         7040:    "adpu320"    "  "  "".  
                        2015-09-28 07:17:10                           Service Control Manager         7040:    "adp94xx"    "  "  "".  
                        2015-09-28 07:17:11                           Service Control Manager         7040:    "arcsas"    "  "  "".  
                        2015-09-28 07:17:11                           Service Control Manager         7040:    "arc"    "  "  "".  
                        2015-09-28 07:17:11                           Service Control Manager         7040:    "aic78xx"    "  "  "".  
                        2015-09-28 07:17:11                           Service Control Manager         7040:    "adpahci"    "  "  "".  
                        2015-09-28 07:17:11                           Service Control Manager         7040:    "iaStorV"    "  "  "".  
                        2015-09-28 07:17:11                           Service Control Manager         7040:    "iirsp"    "  "  "".  
                        2015-09-28 07:17:12                           Service Control Manager         7040:    "vsmraid"    "  "  "".  
                        2015-09-28 07:17:12                           Service Control Manager         7040:    "viaide"    "  "  "".  
                        2015-09-28 07:17:12                           Service Control Manager         7040:    "elxstor"    "  "  "".  
                        2015-09-28 07:17:12                           Service Control Manager         7040:    "nvstor"    "  "  "".  
                        2015-09-28 07:17:12                           Service Control Manager         7040:    "aliide"    "  "  "".  
                        2015-09-28 07:17:12                           Service Control Manager         7040:    "cmdide"    "  "  "".  
                        2015-09-28 07:17:12                           Service Control Manager         7040:    "ql40xx"    "  "  "".  
                        2015-09-28 07:17:13                           Service Control Manager         7040:    "ql2300"    "  "  "".  
                        2015-09-28 07:17:13                           Service Control Manager         7040:    "stexstor"    "  "  "".  
                        2015-09-28 07:17:13                           Service Control Manager         7040:    "SiSRaid4"    "  "  "".  
                        2015-09-28 07:17:13                           Service Control Manager         7040:    "SiSRaid2"    "  "  "".  
                        2015-09-28 07:17:13                           Service Control Manager         7040:    "amdide"    "  "  "".  
                        2015-09-28 07:17:14                           Service Control Manager         7040:    "nfrd960"    "  "  "".  
                        2015-09-28 07:17:14                           Service Control Manager         7040:    "amdsata"    "  "  "".  
                        2015-09-28 07:17:14                           Service Control Manager         7040:    "amdsbs"    "  "  "".  
                        2015-09-28 07:17:14                           Service Control Manager         7040:    "LSI_FC"    "  "  "".  
                        2015-09-28 07:17:14                           Service Control Manager         7040:    "LSI_SAS2"    "  "  "".  
                        2015-09-28 07:17:14                           Service Control Manager         7040:    "megasas"    "  "  "".  
                        2015-09-28 07:17:15                           Service Control Manager         7040:    "MegaSR"    "  "  "".  
                        2015-09-28 07:17:15                           Service Control Manager         7040:    "LSI_SAS"    "  "  "".  
                        2015-09-28 07:17:15                           Service Control Manager         7040:    "LSI_SCSI"    "  "  "".  
                        2015-09-28 07:17:15                           Service Control Manager         7040:    "HpSAMD"    "  "  "".  
                        2015-09-28 07:17:15                           Service Control Manager         7040:    "msahci"    "  "  "".  
                        2015-09-28 07:17:15                           Service Control Manager         7040:    "Compbatt"    "  "  "".  
                        2015-09-28 07:17:16                           Service Control Manager         7040:    "vmbus"    "  "  "".  
                        2015-09-28 07:17:16                           Service Control Manager         7040:    "sbp2port"    "  "  "".  
                        2015-09-28 07:17:16                           Service Control Manager         7040:    "Wd"    "  "  "".  
                        2015-09-28 07:17:16                           Service Control Manager         7040:    "nvraid"    "  "  "".  
                        2015-09-28 07:17:16                           Service Control Manager         7040:    "isapnp"    "  "  "".  
                        2015-09-28 07:17:16                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T03:15:44.000000000Z)       .  
                        2015-09-28 07:17:17                                  EventLog                        6011: NetBIOS-   DNS-      37L4247F27-08  WIN-N09L0AS3TIA.  
                        2015-09-28 07:17:17                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-09-28 07:17:17                                  EventLog                        6005:    .  
                        2015-09-28 07:17:17                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 07:17:17                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:17:17                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-09-28 07:17:17                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-09-28 07:17:17                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 07:17:17                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:17:17                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:17:18                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-09-28 07:17:18                                  Service Control Manager         7036:  "    "    .  
                        2015-09-28 07:17:18                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 07:17:18                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 07:17:18                                  Service Control Manager         7036:  "     "    .  
                        2015-09-28 07:17:18                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 07:17:18                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 07:17:18                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-09-28 07:17:18                                  Service Control Manager         7036:  "DHCP-"    .  
                4          2015-09-28 07:17:18  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-09-28 07:17:18  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-09-28 07:17:19                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-09-28 07:17:19                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:17:19                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:17:19                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 07:17:19                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 07:17:19                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:17:19                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-28 07:17:20                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 07:17:20                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:17:20                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 07:17:20                                  Service Control Manager         7036:  "    "    .  
                        2015-09-28 07:17:20                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-09-28 07:17:20                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 07:17:20                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 07:17:21                                  Service Control Manager         7036:  "  IP"    .  
                        2015-09-28 07:17:22                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:17:22                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 07:17:22                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 07:17:22                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:17:22                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 07:17:22                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:17:22                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-09-28 07:17:24                           Service Control Manager         7040:    "  "    ""  "".  
                7005       2015-09-28 07:17:25                           Microsoft-Windows-UserPnp       20003:       Serial      ACPI\PNP0501\1   : 0.  
                7005       2015-09-28 07:17:25                           Microsoft-Windows-UserPnp       20003:       Serenum      ACPI\PNP0501\1   : 0.  
                7005       2015-09-28 07:17:25                           Microsoft-Windows-UserPnp       20001:       FileRepository\msports.inf_x86_neutral_c1a802e06677f73f\msports.inf      ACPI\PNP0501\1   : 0x0.  
                7005       2015-09-28 07:17:26                           Microsoft-Windows-UserPnp       20003:       umbus      ROOT\UMBUS\0000   : 0.  
                7005       2015-09-28 07:17:26                           Microsoft-Windows-UserPnp       20001:       FileRepository\umbus.inf_x86_neutral_79120b2cb6857971\umbus.inf      ROOT\UMBUS\0000   : 0x0.  
                7005       2015-09-28 07:17:26                           Microsoft-Windows-UserPnp       20003:       atapi      PCIIDE\IDECHANNEL\5&2262BA5&0&1   : 0.  
                7005       2015-09-28 07:17:29                           Microsoft-Windows-UserPnp       20001:       FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\mshdc.inf      PCIIDE\IDECHANNEL\5&2262BA5&0&1   : 0x0.  
                        2015-09-28 07:17:31                           Service Control Manager         7045:    .     :  nvlddmkm    :  system32\DRIVERS\nvlddmkm.sys   :        :      :    
                7005       2015-09-28 07:17:31                           Microsoft-Windows-UserPnp       20003:       nvlddmkm      PCI\VEN_10DE&DEV_0613&SUBSYS_00000000&REV_A2\4&1591CBDA&0&0008   : 0.  
                7005       2015-09-28 07:17:32                           Microsoft-Windows-UserPnp       20001:       FileRepository\nv_lh.inf_x86_neutral_bbe628dbdd6fce25\nv_lh.inf      PCI\VEN_10DE&DEV_0613&SUBSYS_00000000&REV_A2\4&1591CBDA&0&0008   : 0x0.  
                7005       2015-09-28 07:17:32                           Microsoft-Windows-UserPnp       20003:       vdrvroot      ROOT\VDRVROOT\0000   : 0.  
                            2015-09-28 07:17:33                                  nvlddmkm                        
                7005       2015-09-28 07:17:33                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ROOT\VDRVROOT\0000   : 0x0.  
                7005       2015-09-28 07:17:33                           Microsoft-Windows-UserPnp       20001:       FileRepository\hal.inf_x86_neutral_bf3422256b0b201d\hal.inf      ROOT\ACPI_HAL\0000   : 0x0.  
                7005       2015-09-28 07:17:34                           Microsoft-Windows-UserPnp       20003:       volmgr      ROOT\VOLMGR\0000   : 0.  
                7005       2015-09-28 07:17:34                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ROOT\VOLMGR\0000   : 0x0.  
                7005       2015-09-28 07:17:34                           Microsoft-Windows-UserPnp       20003:       blbdrive      ROOT\BLBDRIVE\0000   : 0.  
                7005       2015-09-28 07:17:34                           Microsoft-Windows-UserPnp       20001:       FileRepository\blbdrive.inf_x86_neutral_1aa816fe7dc98c3f\blbdrive.inf      ROOT\BLBDRIVE\0000   : 0x0.  
                7005       2015-09-28 07:17:35                           Microsoft-Windows-UserPnp       20003:       CompositeBus      ROOT\COMPOSITEBUS\0000   : 0.  
                7005       2015-09-28 07:17:35                           Microsoft-Windows-UserPnp       20001:       FileRepository\compositebus.inf_x86_neutral_a53ef080c39c3218\compositebus.inf      ROOT\COMPOSITEBUS\0000   : 0x0.  
                7005       2015-09-28 07:17:36                           Microsoft-Windows-UserPnp       20003:       mssmbios      ROOT\MSSMBIOS\0000   : 0.  
                7005       2015-09-28 07:17:36                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ROOT\MSSMBIOS\0000   : 0x0.  
                7005       2015-09-28 07:17:58                           Microsoft-Windows-UserPnp       20003:       NdisWan      ROOT\MS_NDISWANIP\0000   : 0.  
                7005       2015-09-28 07:17:58                           Microsoft-Windows-UserPnp       20003:       NdisTapi      ROOT\MS_NDISWANIP\0000   : 0.  
                7005       2015-09-28 07:17:59                           Microsoft-Windows-UserPnp       20001:             ROOT\MS_NDISWANIP\0000   : 0x0.  
                7005       2015-09-28 07:17:59                           Microsoft-Windows-UserPnp       20003:       Rasl2tp      ROOT\MS_L2TPMINIPORT\0000   : 0.  
                7005       2015-09-28 07:18:00                           Microsoft-Windows-UserPnp       20001:             ROOT\MS_L2TPMINIPORT\0000   : 0x0.  
                7005       2015-09-28 07:18:00                           Microsoft-Windows-UserPnp       20003:       NdisWan      ROOT\MS_NDISWANBH\0000   : 0.  
                7005       2015-09-28 07:18:00                           Microsoft-Windows-UserPnp       20003:       NdisTapi      ROOT\MS_NDISWANBH\0000   : 0.  
                7005       2015-09-28 07:18:01                           Microsoft-Windows-UserPnp       20001:             ROOT\MS_NDISWANBH\0000   : 0x0.  
                7005       2015-09-28 07:18:01                           Microsoft-Windows-UserPnp       20003:       RasAgileVpn      ROOT\MS_AGILEVPNMINIPORT\0000   : 0.  
                7005       2015-09-28 07:18:02                           Microsoft-Windows-UserPnp       20001:             ROOT\MS_AGILEVPNMINIPORT\0000   : 0x0.  
                7005       2015-09-28 07:18:02                           Microsoft-Windows-UserPnp       20003:       NdisWan      ROOT\MS_NDISWANIPV6\0000   : 0.  
                7005       2015-09-28 07:18:02                           Microsoft-Windows-UserPnp       20003:       NdisTapi      ROOT\MS_NDISWANIPV6\0000   : 0.  
                7005       2015-09-28 07:18:02                           Microsoft-Windows-UserPnp       20001:             ROOT\MS_NDISWANIPV6\0000   : 0x0.  
                7005       2015-09-28 07:18:03                           Microsoft-Windows-UserPnp       20003:       RasPppoe      ROOT\MS_PPPOEMINIPORT\0000   : 0.  
                7005       2015-09-28 07:18:03                           Microsoft-Windows-UserPnp       20001:             ROOT\MS_PPPOEMINIPORT\0000   : 0x0.  
                7005       2015-09-28 07:18:04                           Microsoft-Windows-UserPnp       20003:       PptpMiniport      ROOT\MS_PPTPMINIPORT\0000   : 0.  
                7005       2015-09-28 07:18:04                           Microsoft-Windows-UserPnp       20001:             ROOT\MS_PPTPMINIPORT\0000   : 0x0.  
                7005       2015-09-28 07:18:04                           Microsoft-Windows-UserPnp       20003:       RasSstp      ROOT\MS_SSTPMINIPORT\0000   : 0.  
                7005       2015-09-28 07:18:05                           Microsoft-Windows-UserPnp       20001:             ROOT\MS_SSTPMINIPORT\0000   : 0x0.  
                7005       2015-09-28 07:18:05                           Microsoft-Windows-UserPnp       20003:       TermDD      ROOT\RDP_KBD\0000   : 0.  
                7005       2015-09-28 07:18:05                           Microsoft-Windows-UserPnp       20003:       kbdclass      ROOT\RDP_KBD\0000   : 0.  
                7005       2015-09-28 07:18:05                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ROOT\RDP_KBD\0000   : 0x0.  
                7005       2015-09-28 07:18:06                           Microsoft-Windows-UserPnp       20003:       TermDD      ROOT\RDP_MOU\0000   : 0.  
                7005       2015-09-28 07:18:06                           Microsoft-Windows-UserPnp       20003:       mouclass      ROOT\RDP_MOU\0000   : 0.  
                7005       2015-09-28 07:18:06                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ROOT\RDP_MOU\0000   : 0x0.  
                7005       2015-09-28 07:18:07                           Microsoft-Windows-UserPnp       20003:       swenum      ROOT\SYSTEM\0000   : 0.  
                7005       2015-09-28 07:18:07                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ROOT\SYSTEM\0000   : 0x0.  
                7005       2015-09-28 07:18:07                           Microsoft-Windows-UserPnp       20003:       volsnap      STORAGE\VOLUME\{63CA6920-6565-11E5-8631-806E6F6E6963}#0000000000100000   : 0.  
                7005       2015-09-28 07:18:07                           Microsoft-Windows-UserPnp       20001:       FileRepository\volume.inf_x86_neutral_6dee0205881d1a1d\volume.inf      STORAGE\VOLUME\{63CA6920-6565-11E5-8631-806E6F6E6963}#0000000000100000   : 0x0.  
                7005       2015-09-28 07:18:08                           Microsoft-Windows-UserPnp       20003:       volsnap      STORAGE\VOLUME\{63CA6920-6565-11E5-8631-806E6F6E6963}#0000000006500000   : 0.  
                7005       2015-09-28 07:18:08                           Microsoft-Windows-UserPnp       20001:       FileRepository\volume.inf_x86_neutral_6dee0205881d1a1d\volume.inf      STORAGE\VOLUME\{63CA6920-6565-11E5-8631-806E6F6E6963}#0000000006500000   : 0x0.  
                7005       2015-09-28 07:18:08                           Microsoft-Windows-UserPnp       20003:       volsnap      STORAGE\VOLUME\{63CA6921-6565-11E5-8631-806E6F6E6963}#0000000000100000   : 0.  
                7005       2015-09-28 07:18:08                           Microsoft-Windows-UserPnp       20001:       FileRepository\volume.inf_x86_neutral_6dee0205881d1a1d\volume.inf      STORAGE\VOLUME\{63CA6921-6565-11E5-8631-806E6F6E6963}#0000000000100000   : 0x0.  
                7005       2015-09-28 07:18:08                           Microsoft-Windows-UserPnp       20003:       volsnap      STORAGE\VOLUME\{63CA6921-6565-11E5-8631-806E6F6E6963}#000000B80CC00000   : 0.  
                7005       2015-09-28 07:18:08                           Microsoft-Windows-UserPnp       20001:       FileRepository\volume.inf_x86_neutral_6dee0205881d1a1d\volume.inf      STORAGE\VOLUME\{63CA6921-6565-11E5-8631-806E6F6E6963}#000000B80CC00000   : 0x0.  
                7005       2015-09-28 07:18:09                           Microsoft-Windows-UserPnp       20003:       ACPI      ACPI_HAL\PNP0C08\0   : 0.  
                7005       2015-09-28 07:18:09                           Microsoft-Windows-UserPnp       20001:       FileRepository\acpi.inf_x86_neutral_a1f4891fe0de4401\acpi.inf      ACPI_HAL\PNP0C08\0   : 0x0.  
                7005       2015-09-28 07:18:09                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ACPI\FIXEDBUTTON\2&DABA3FF&2   : 0x0.  
                7005       2015-09-28 07:18:10                           Microsoft-Windows-UserPnp       20003:       pci      ACPI\PNP0A08\0   : 0.  
                7005       2015-09-28 07:18:11                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ACPI\PNP0A08\0   : 0x0.  
                7005       2015-09-28 07:18:11                           Microsoft-Windows-UserPnp       20003:       intelppm      ACPI\GENUINEINTEL_-_X86_FAMILY_6_MODEL_15_-_INTEL(R)_CORE(TM)2_DUO_CPU_____E6550__@_2.33GHZ\_1   : 0.  
                7005       2015-09-28 07:18:11                           Microsoft-Windows-UserPnp       20001:       FileRepository\cpu.inf_x86_neutral_729b871528391032\cpu.inf      ACPI\GENUINEINTEL_-_X86_FAMILY_6_MODEL_15_-_INTEL(R)_CORE(TM)2_DUO_CPU_____E6550__@_2.33GHZ\_1   : 0x0.  
                7005       2015-09-28 07:18:11                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ACPI\PNP0C01\1   : 0x0.  
                7005       2015-09-28 07:18:12                           Microsoft-Windows-UserPnp       20003:       intelppm      ACPI\GENUINEINTEL_-_X86_FAMILY_6_MODEL_15_-_INTEL(R)_CORE(TM)2_DUO_CPU_____E6550__@_2.33GHZ\_2   : 0.  
                7005       2015-09-28 07:18:12                           Microsoft-Windows-UserPnp       20001:       FileRepository\cpu.inf_x86_neutral_729b871528391032\cpu.inf      ACPI\GENUINEINTEL_-_X86_FAMILY_6_MODEL_15_-_INTEL(R)_CORE(TM)2_DUO_CPU_____E6550__@_2.33GHZ\_2   : 0x0.  
                7005       2015-09-28 07:18:12                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ACPI\PNP0C0C\AA   : 0x0.  
                7005       2015-09-28 07:18:13                           Microsoft-Windows-UserPnp       20003:       usbuhci      PCI\VEN_8086&DEV_2830&SUBSYS_72351462&REV_02\3&11583659&0&E8   : 0.  
                7005       2015-09-28 07:18:13                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbport.inf_x86_neutral_f9abf85fd00186bd\usbport.inf      PCI\VEN_8086&DEV_2830&SUBSYS_72351462&REV_02\3&11583659&0&E8   : 0x0.  
                7005       2015-09-28 07:18:14                           Microsoft-Windows-UserPnp       20003:       pci      PCI\VEN_8086&DEV_283F&SUBSYS_72351462&REV_02\3&11583659&0&E0   : 0.  
                7005       2015-09-28 07:18:14                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      PCI\VEN_8086&DEV_283F&SUBSYS_72351462&REV_02\3&11583659&0&E0   : 0x0.  
                7005       2015-09-28 07:18:14                           Microsoft-Windows-UserPnp       20003:       usbuhci      PCI\VEN_8086&DEV_2831&SUBSYS_72351462&REV_02\3&11583659&0&E9   : 0.  
                7005       2015-09-28 07:18:16                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbport.inf_x86_neutral_f9abf85fd00186bd\usbport.inf      PCI\VEN_8086&DEV_2831&SUBSYS_72351462&REV_02\3&11583659&0&E9   : 0x0.  
                7005       2015-09-28 07:18:17                           Microsoft-Windows-UserPnp       20003:       pci      PCI\VEN_8086&DEV_2849&SUBSYS_72351462&REV_02\3&11583659&0&E5   : 0.  
                7005       2015-09-28 07:18:17                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      PCI\VEN_8086&DEV_2849&SUBSYS_72351462&REV_02\3&11583659&0&E5   : 0x0.  
                7005       2015-09-28 07:18:20                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ACPI\PNP0C01\A   : 0x0.  
                7005       2015-09-28 07:18:20                           Microsoft-Windows-UserPnp       20003:       usbuhci      PCI\VEN_8086&DEV_2832&SUBSYS_72351462&REV_02\3&11583659&0&EA   : 0.  
                7005       2015-09-28 07:18:20                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbport.inf_x86_neutral_f9abf85fd00186bd\usbport.inf      PCI\VEN_8086&DEV_2832&SUBSYS_72351462&REV_02\3&11583659&0&EA   : 0x0.  
                7005       2015-09-28 07:18:21                           Microsoft-Windows-UserPnp       20003:       HDAudBus      PCI\VEN_8086&DEV_284B&SUBSYS_72351462&REV_02\3&11583659&0&D8   : 0.  
                7005       2015-09-28 07:18:21                           Microsoft-Windows-UserPnp       20001:       FileRepository\hdaudbus.inf_x86_neutral_77479a4820fb8643\hdaudbus.inf      PCI\VEN_8086&DEV_284B&SUBSYS_72351462&REV_02\3&11583659&0&D8   : 0x0.  
                7005       2015-09-28 07:18:21                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ACPI\PNP0C02\11   : 0x0.  
                7005       2015-09-28 07:18:22                           Microsoft-Windows-UserPnp       20003:       usbuhci      PCI\VEN_8086&DEV_2834&SUBSYS_72351462&REV_02\3&11583659&0&D0   : 0.  
                7005       2015-09-28 07:18:22                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbport.inf_x86_neutral_f9abf85fd00186bd\usbport.inf      PCI\VEN_8086&DEV_2834&SUBSYS_72351462&REV_02\3&11583659&0&D0   : 0x0.  
                7005       2015-09-28 07:18:23                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      PCI\VEN_8086&DEV_29A0&SUBSYS_72351462&REV_02\3&11583659&0&00   : 0x0.  
                7005       2015-09-28 07:18:23                           Microsoft-Windows-UserPnp       20003:       pci      PCI\VEN_8086&DEV_244E&SUBSYS_72351462&REV_F2\3&11583659&0&F0   : 0.  
                7005       2015-09-28 07:18:23                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      PCI\VEN_8086&DEV_244E&SUBSYS_72351462&REV_F2\3&11583659&0&F0   : 0x0.  
                7005       2015-09-28 07:18:24                           Microsoft-Windows-UserPnp       20003:       usbuhci      PCI\VEN_8086&DEV_2835&SUBSYS_72351462&REV_02\3&11583659&0&D1   : 0.  
                7005       2015-09-28 07:18:24                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbport.inf_x86_neutral_f9abf85fd00186bd\usbport.inf      PCI\VEN_8086&DEV_2835&SUBSYS_72351462&REV_02\3&11583659&0&D1   : 0x0.  
                7005       2015-09-28 07:18:25                           Microsoft-Windows-UserPnp       20003:       pci      PCI\VEN_8086&DEV_29A1&SUBSYS_00008086&REV_02\3&11583659&0&08   : 0.  
                7005       2015-09-28 07:18:25                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      PCI\VEN_8086&DEV_29A1&SUBSYS_00008086&REV_02\3&11583659&0&08   : 0x0.  
                7005       2015-09-28 07:18:25                           Microsoft-Windows-UserPnp       20003:       msisadrv      PCI\VEN_8086&DEV_2810&SUBSYS_72351462&REV_02\3&11583659&0&F8   : 0.  
                7005       2015-09-28 07:18:25                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      PCI\VEN_8086&DEV_2810&SUBSYS_72351462&REV_02\3&11583659&0&F8   : 0x0.  
                7005       2015-09-28 07:18:26                           Microsoft-Windows-UserPnp       20003:       usbehci      PCI\VEN_8086&DEV_2836&SUBSYS_72351462&REV_02\3&11583659&0&EF   : 0.  
                7005       2015-09-28 07:18:26                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbport.inf_x86_neutral_f9abf85fd00186bd\usbport.inf      PCI\VEN_8086&DEV_2836&SUBSYS_72351462&REV_02\3&11583659&0&EF   : 0x0.  
                7005       2015-09-28 07:18:26                           Microsoft-Windows-UserPnp       20003:       intelide      PCI\VEN_8086&DEV_2820&SUBSYS_72351462&REV_02\3&11583659&0&FA   : 0.  
                7005       2015-09-28 07:18:26                           Microsoft-Windows-UserPnp       20001:       FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\mshdc.inf      PCI\VEN_8086&DEV_2820&SUBSYS_72351462&REV_02\3&11583659&0&FA   : 0x0.  
                7005       2015-09-28 07:18:27                           Microsoft-Windows-UserPnp       20003:       usbehci      PCI\VEN_8086&DEV_283A&SUBSYS_72351462&REV_02\3&11583659&0&D7   : 0.  
                7005       2015-09-28 07:18:34                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbport.inf_x86_neutral_f9abf85fd00186bd\usbport.inf      PCI\VEN_8086&DEV_283A&SUBSYS_72351462&REV_02\3&11583659&0&D7   : 0x0.  
                7005       2015-09-28 07:18:34                           Microsoft-Windows-UserPnp       20003:       intelide      PCI\VEN_8086&DEV_2825&SUBSYS_72351462&REV_02\3&11583659&0&FD   : 0.  
                7005       2015-09-28 07:18:36                           Microsoft-Windows-UserPnp       20001:       FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\mshdc.inf      PCI\VEN_8086&DEV_2825&SUBSYS_72351462&REV_02\3&11583659&0&FD   : 0x0.  
                7005       2015-09-28 07:18:36                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      PCI\VEN_8086&DEV_283E&SUBSYS_72351462&REV_02\3&11583659&0&FB   : 0x0.  
                7005       2015-09-28 07:18:37                           Microsoft-Windows-UserPnp       20003:       usbhub      USB\ROOT_HUB\4&5F6992B&0   : 0.  
                7005       2015-09-28 07:18:37                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbport.inf_x86_neutral_f9abf85fd00186bd\usbport.inf      USB\ROOT_HUB\4&5F6992B&0   : 0x0.  
                7005       2015-09-28 07:18:37                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ACPI\PNP0800\4&2D411207&0   : 0x0.  
                7005       2015-09-28 07:18:38                           Microsoft-Windows-UserPnp       20003:       usbhub      USB\ROOT_HUB20\4&3765326E&0   : 0.  
                7005       2015-09-28 07:18:38                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbport.inf_x86_neutral_f9abf85fd00186bd\usbport.inf      USB\ROOT_HUB20\4&3765326E&0   : 0x0.  
                        2015-09-28 07:18:39                           Service Control Manager         7045:    .     :   Realtek 8167 NT    :  system32\DRIVERS\Rt86win7.sys   :        :      :    
                7005       2015-09-28 07:18:39                           Microsoft-Windows-UserPnp       20003:       RTL8167      PCI\VEN_10EC&DEV_8167&SUBSYS_235C1462&REV_10\4&3829F325&0&10F0   : 0.  
                7005       2015-09-28 07:18:47                           Microsoft-Windows-UserPnp       20001:       FileRepository\netrtx32.inf_x86_neutral_aa92429bfa083dca\netrtx32.inf      PCI\VEN_10EC&DEV_8167&SUBSYS_235C1462&REV_10\4&3829F325&0&10F0   : 0x0.  
                7005       2015-09-28 07:18:47                           Microsoft-Windows-UserPnp       20003:       usbhub      USB\ROOT_HUB20\4&3A43F5AB&0   : 0.  
                7005       2015-09-28 07:18:47                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                7005       2015-09-28 07:18:48                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbport.inf_x86_neutral_f9abf85fd00186bd\usbport.inf      USB\ROOT_HUB20\4&3A43F5AB&0   : 0x0.  
                7005       2015-09-28 07:18:48                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ACPI\PNP0B00\4&2D411207&0   : 0x0.  
                7005       2015-09-28 07:18:48                           Microsoft-Windows-UserPnp       20003:       1394ohci      PCI\VEN_1106&DEV_3044&SUBSYS_235D1462&REV_C0\4&3829F325&0&18F0   : 0.  
                7005       2015-09-28 07:18:49                           Microsoft-Windows-UserPnp       20001:       FileRepository\1394.inf_x86_neutral_832ec31f25d91fee\1394.inf      PCI\VEN_1106&DEV_3044&SUBSYS_235D1462&REV_C0\4&3829F325&0&18F0   : 0x0.  
                7005       2015-09-28 07:18:49                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ACPI\PNP0C02\0   : 0x0.  
                7005       2015-09-28 07:18:49                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ACPI\PNP0C02\10   : 0x0.  
                7005       2015-09-28 07:18:49                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ACPI\PNP0C02\3   : 0x0.  
                7005       2015-09-28 07:18:50                           Microsoft-Windows-UserPnp       20003:       pciide      PCI\VEN_11AB&DEV_6121&SUBSYS_612111AB&REV_B1\4&C506A3B&0&00E5   : 0.  
                7005       2015-09-28 07:18:53                           Microsoft-Windows-UserPnp       20001:       FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\mshdc.inf      PCI\VEN_11AB&DEV_6121&SUBSYS_612111AB&REV_B1\4&C506A3B&0&00E5   : 0x0.  
                7005       2015-09-28 07:18:53                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ACPI\PNP0C04\4&2D411207&0   : 0x0.  
                7005       2015-09-28 07:18:53                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ACPI\PNP0C02\4E   : 0x0.  
                7005       2015-09-28 07:18:54                           Microsoft-Windows-UserPnp       20003:       i8042prt      ACPI\PNP0F03\4&2D411207&0   : 0.  
                7005       2015-09-28 07:18:54                           Microsoft-Windows-UserPnp       20003:       mouclass      ACPI\PNP0F03\4&2D411207&0   : 0.  
                7005       2015-09-28 07:18:54                           Microsoft-Windows-UserPnp       20001:       FileRepository\msmouse.inf_x86_neutral_7a9084e0177406eb\msmouse.inf      ACPI\PNP0F03\4&2D411207&0   : 0x0.  
                        2015-09-28 07:18:55                           Service Control Manager         7045:    .     :    UAA   High Definition Audio (Microsoft),  1.1    :  system32\drivers\HdAudio.sys   :        :      :    
                7005       2015-09-28 07:18:56                           Microsoft-Windows-UserPnp       20003:       HdAudAddService      HDAUDIO\FUNC_01&VEN_10EC&DEV_0888&SUBSYS_14627235&REV_1000\4&ADBBC3C&0&0001   : 0.  
                7005       2015-09-28 07:18:56                           Microsoft-Windows-UserPnp       20001:       FileRepository\hdaudio.inf_x86_neutral_5a5e688ecb9e273f\hdaudio.inf      HDAUDIO\FUNC_01&VEN_10EC&DEV_0888&SUBSYS_14627235&REV_1000\4&ADBBC3C&0&0001   : 0x0.  
                7005       2015-09-28 07:18:57                           Microsoft-Windows-UserPnp       20003:       atapi      PCIIDE\IDECHANNEL\4&148DDF4C&0&0   : 0.  
                7005       2015-09-28 07:18:58                           Microsoft-Windows-UserPnp       20001:       FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\mshdc.inf      PCIIDE\IDECHANNEL\4&148DDF4C&0&0   : 0x0.  
                7005       2015-09-28 07:18:58                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ACPI\INT0800\4&2D411207&0   : 0x0.  
                7005       2015-09-28 07:18:59                           Microsoft-Windows-UserPnp       20003:       atapi      PCIIDE\IDECHANNEL\4&148DDF4C&0&1   : 0.  
                        2015-09-28 07:19:00                           Service Control Manager         7045:    .     :     Microsoft    :  system32\drivers\MSPCLOCK.sys   :        :      :    
                7005       2015-09-28 07:19:00                           Microsoft-Windows-UserPnp       20001:       FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\mshdc.inf      PCIIDE\IDECHANNEL\4&148DDF4C&0&1   : 0x0.  
                        2015-09-28 07:19:01                           Service Control Manager         7045:    .     :      Microsoft    :  system32\drivers\MSPQM.sys   :        :      :    
                        2015-09-28 07:19:01                           Service Control Manager         7045:    .     :     Microsoft    :  system32\drivers\MSKSSRV.sys   :        :      :    
                7005       2015-09-28 07:19:01                           Microsoft-Windows-UserPnp       20003:       MSPCLOCK      SW\{97EBAACC-95BD-11D0-A3EA-00A0C9223196}\{53172480-4791-11D0-A5D6-28DB04C10000}   : 0.  
                7005       2015-09-28 07:19:01                           Microsoft-Windows-UserPnp       20001:       FileRepository\ksfilter.inf_x86_neutral_92aac3fbbef4a5e4\ksfilter.inf      SW\{97EBAACC-95BD-11D0-A3EA-00A0C9223196}\{53172480-4791-11D0-A5D6-28DB04C10000}   : 0x0.  
                7005       2015-09-28 07:19:01                           Microsoft-Windows-UserPnp       20003:       MSPQM      SW\{DDF4358E-BB2C-11D0-A42F-00A0C9223196}\{97EBAACB-95BD-11D0-A3EA-00A0C9223196}   : 0.  
                7005       2015-09-28 07:19:01                           Microsoft-Windows-UserPnp       20001:       FileRepository\ksfilter.inf_x86_neutral_92aac3fbbef4a5e4\ksfilter.inf      SW\{DDF4358E-BB2C-11D0-A42F-00A0C9223196}\{97EBAACB-95BD-11D0-A3EA-00A0C9223196}   : 0x0.  
                7005       2015-09-28 07:19:01                           Microsoft-Windows-UserPnp       20003:       MSKSSRV      SW\{96E080C7-143C-11D1-B40F-00A0C9223196}\{3C0D501A-140B-11D1-B40F-00A0C9223196}   : 0.  
                        2015-09-28 07:19:02                           Service Control Manager         7045:    .     :    Tee/Sink-to-Sink Microsoft    :  system32\drivers\MSTEE.sys   :        :      :    
                7005       2015-09-28 07:19:02                           Microsoft-Windows-UserPnp       20001:       FileRepository\ksfilter.inf_x86_neutral_92aac3fbbef4a5e4\ksfilter.inf      SW\{96E080C7-143C-11D1-B40F-00A0C9223196}\{3C0D501A-140B-11D1-B40F-00A0C9223196}   : 0x0.  
                7005       2015-09-28 07:19:02                           Microsoft-Windows-UserPnp       20003:       MSTEE      SW\{CFD669F1-9BC2-11D0-8299-0000F822FE8A}\{CF1DDA2C-9743-11D0-A3EE-00A0C9223196}   : 0.  
                7005       2015-09-28 07:19:02                           Microsoft-Windows-UserPnp       20001:       FileRepository\ksfilter.inf_x86_neutral_92aac3fbbef4a5e4\ksfilter.inf      SW\{CFD669F1-9BC2-11D0-8299-0000F822FE8A}\{CF1DDA2C-9743-11D0-A3EE-00A0C9223196}   : 0x0.  
                        2015-09-28 07:19:03                           Service Control Manager         7045:    .     :        :  system32\drivers\drmkaud.sys   :        :      :    
                7005       2015-09-28 07:19:03                           Microsoft-Windows-UserPnp       20003:       MSTEE      SW\{CFD669F1-9BC2-11D0-8299-0000F822FE8A}\{0A4252A0-7E70-11D0-A5D6-28DB04C10000}   : 0.  
                7005       2015-09-28 07:19:03                           Microsoft-Windows-UserPnp       20001:       FileRepository\ksfilter.inf_x86_neutral_92aac3fbbef4a5e4\ksfilter.inf      SW\{CFD669F1-9BC2-11D0-8299-0000F822FE8A}\{0A4252A0-7E70-11D0-A5D6-28DB04C10000}   : 0x0.  
                7005       2015-09-28 07:19:03                           Microsoft-Windows-UserPnp       20003:       drmkaud      SW\{EEC12DB6-AD9C-4168-8658-B03DAEF417FE}\{ABD61E00-9350-47E2-A632-4438B90C6641}   : 0.  
                7005       2015-09-28 07:19:03                           Microsoft-Windows-UserPnp       20001:       FileRepository\wdmaudio.inf_x86_neutral_aed2a4456700dfde\wdmaudio.inf      SW\{EEC12DB6-AD9C-4168-8658-B03DAEF417FE}\{ABD61E00-9350-47E2-A632-4438B90C6641}   : 0x0.  
                7005       2015-09-28 07:19:04                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ACPI\PNP0000\4&2D411207&0   : 0x0.  
                7005       2015-09-28 07:19:04                           Microsoft-Windows-UserPnp       20003:       atapi      PCIIDE\IDECHANNEL\4&1E4D5799&0&0   : 0.  
                7005       2015-09-28 07:19:07                           Microsoft-Windows-UserPnp       20001:       FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\mshdc.inf      PCIIDE\IDECHANNEL\4&1E4D5799&0&0   : 0x0.  
                7005       2015-09-28 07:19:07                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ACPI\PNP0100\4&2D411207&0   : 0x0.  
                7005       2015-09-28 07:19:07                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      ACPI\PNP0200\4&2D411207&0   : 0x0.  
                7005       2015-09-28 07:19:08                           Microsoft-Windows-UserPnp       20003:       usbhub      USB\ROOT_HUB\4&11B374B1&0   : 0.  
                7005       2015-09-28 07:19:08                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbport.inf_x86_neutral_f9abf85fd00186bd\usbport.inf      USB\ROOT_HUB\4&11B374B1&0   : 0x0.  
                7005       2015-09-28 07:19:08                           Microsoft-Windows-UserPnp       20003:       usbhub      USB\ROOT_HUB\4&229112C1&0   : 0.  
                7005       2015-09-28 07:19:08                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbport.inf_x86_neutral_f9abf85fd00186bd\usbport.inf      USB\ROOT_HUB\4&229112C1&0   : 0x0.  
                7005       2015-09-28 07:19:09                           Microsoft-Windows-UserPnp       20003:       atapi      PCIIDE\IDECHANNEL\4&1E4D5799&0&1   : 0.  
                7005       2015-09-28 07:19:09                           Microsoft-Windows-UserPnp       20001:       FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\mshdc.inf      PCIIDE\IDECHANNEL\4&1E4D5799&0&1   : 0x0.  
                7005       2015-09-28 07:19:09                           Microsoft-Windows-UserPnp       20003:       i8042prt      ACPI\PNP0303\4&2D411207&0   : 0.  
                7005       2015-09-28 07:19:09                           Microsoft-Windows-UserPnp       20003:       kbdclass      ACPI\PNP0303\4&2D411207&0   : 0.  
                7005       2015-09-28 07:19:09                           Microsoft-Windows-UserPnp       20001:       FileRepository\keyboard.inf_x86_neutral_50ad659974198591\keyboard.inf      ACPI\PNP0303\4&2D411207&0   : 0x0.  
                7005       2015-09-28 07:19:10                           Microsoft-Windows-UserPnp       20003:       usbhub      USB\ROOT_HUB\4&38005B34&0   : 0.  
                7005       2015-09-28 07:19:12                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbport.inf_x86_neutral_f9abf85fd00186bd\usbport.inf      USB\ROOT_HUB\4&38005B34&0   : 0x0.  
                7005       2015-09-28 07:19:12                           Microsoft-Windows-UserPnp       20003:       Parport      ACPI\PNP0400\4&2D411207&0   : 0.  
                7005       2015-09-28 07:19:12                           Microsoft-Windows-UserPnp       20003:       Parvdm      ACPI\PNP0400\4&2D411207&0   : 0.  
                7005       2015-09-28 07:19:13                           Microsoft-Windows-UserPnp       20001:       FileRepository\msports.inf_x86_neutral_c1a802e06677f73f\msports.inf      ACPI\PNP0400\4&2D411207&0   : 0x0.  
                7005       2015-09-28 07:19:13                           Microsoft-Windows-UserPnp       20003:       usbhub      USB\ROOT_HUB\4&3BBD3C2&0   : 0.  
                7005       2015-09-28 07:19:13                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbport.inf_x86_neutral_f9abf85fd00186bd\usbport.inf      USB\ROOT_HUB\4&3BBD3C2&0   : 0x0.  
                7005       2015-09-28 07:19:14                           Microsoft-Windows-UserPnp       20001:       NULL Driver      USB\VID_0B05&PID_17BA\00E04C000001   : 0x0.  
                7005       2015-09-28 07:19:14                           Microsoft-Windows-UserPnp       20003:       cdrom      IDE\CDROMOPTIARC_DVD+-RW_AD-7200S________________102A____\5&4248B16&0&1.0.0   : 0.  
                7005       2015-09-28 07:19:15                           Microsoft-Windows-UserPnp       20001:       FileRepository\cdrom.inf_x86_neutral_6381e09675524225\cdrom.inf      IDE\CDROMOPTIARC_DVD+-RW_AD-7200S________________102A____\5&4248B16&0&1.0.0   : 0x0.  
                7005       2015-09-28 07:19:15                           Microsoft-Windows-UserPnp       20003:       usbccgp      USB\VID_1E4E&PID_0109\5&9965632&0&3   : 0.  
                7005       2015-09-28 07:19:16                           Microsoft-Windows-UserPnp       20001:       FileRepository\usb.inf_x86_neutral_2620fd493cad7d41\usb.inf      USB\VID_1E4E&PID_0109\5&9965632&0&3   : 0x0.  
                7005       2015-09-28 07:19:16                           Microsoft-Windows-UserPnp       20003:       disk      IDE\DISKST31000528AS____________________________CC38____\5&16DE3BBB&0&0.0.0   : 0.  
                7005       2015-09-28 07:19:17                           Microsoft-Windows-UserPnp       20001:       FileRepository\disk.inf_x86_neutral_b431b61a11f8df6c\disk.inf      IDE\DISKST31000528AS____________________________CC38____\5&16DE3BBB&0&0.0.0   : 0x0.  
                7005       2015-09-28 07:19:17                           Microsoft-Windows-UserPnp       20003:       disk      IDE\DISKST3320418AS_____________________________CC38____\5&2B5A1D44&0&1.0.0   : 0.  
                7005       2015-09-28 07:19:17                           Microsoft-Windows-UserPnp       20001:       FileRepository\disk.inf_x86_neutral_b431b61a11f8df6c\disk.inf      IDE\DISKST3320418AS_____________________________CC38____\5&2B5A1D44&0&1.0.0   : 0x0.  
                7005       2015-09-28 07:19:18                           Microsoft-Windows-UserPnp       20003:       atapi      PCIIDE\IDECHANNEL\5&2262BA5&0&0   : 0.  
                7005       2015-09-28 07:19:20                           Microsoft-Windows-UserPnp       20001:       FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\mshdc.inf      PCIIDE\IDECHANNEL\5&2262BA5&0&0   : 0x0.  
                7005       2015-09-28 07:19:21                           Microsoft-Windows-UserPnp       20003:       usbccgp      USB\VID_045E&PID_0745\5&5A81B0C&0&2   : 0.  
                        2015-09-28 07:19:22                                  Service Control Manager         7036:  "    (BITS)"    .  
                        2015-09-28 07:19:22                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-09-28 07:19:22                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-09-28 07:19:22                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:19:23                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-28 07:19:23                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:19:23                                  Service Control Manager         7036:  "Windows Search"    .  
                7005       2015-09-28 07:19:23                           Microsoft-Windows-UserPnp       20001:       FileRepository\usb.inf_x86_neutral_2620fd493cad7d41\usb.inf      USB\VID_045E&PID_0745\5&5A81B0C&0&2   : 0x0.  
                7005       2015-09-28 07:19:24                           Microsoft-Windows-UserPnp       20001:       FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\machine.inf      LPTENUM\MICROSOFTRAWPORT\5&30A50EA1&0&LPT1   : 0x0.  
                7005       2015-09-28 07:19:25                           Microsoft-Windows-UserPnp       20003:       monitor      DISPLAY\ACR0053\5&7C7907&0&UID16777473   : 0.  
                7005       2015-09-28 07:19:26                           Microsoft-Windows-UserPnp       20001:       FileRepository\monitor.inf_x86_neutral_f7168ca1d7f8ec24\monitor.inf      DISPLAY\ACR0053\5&7C7907&0&UID16777473   : 0x0.  
                7005       2015-09-28 07:19:26                           Microsoft-Windows-UserPnp       20003:       umbus      UMB\UMB\1&841921D&0&PRINTERBUSENUMERATOR   : 0.  
                7005       2015-09-28 07:19:26                           Microsoft-Windows-UserPnp       20001:       FileRepository\umbus.inf_x86_neutral_79120b2cb6857971\umbus.inf      UMB\UMB\1&841921D&0&PRINTERBUSENUMERATOR   : 0x0.  
                        2015-09-28 07:19:27                                  Service Control Manager         7036:  "  Windows"    .  
                7005       2015-09-28 07:19:27                           Microsoft-Windows-UserPnp       20003:       HidUsb      USB\VID_045E&PID_0745&MI_00\6&88D595&0&0000   : 0.  
                7005       2015-09-28 07:19:29                           Microsoft-Windows-UserPnp       20001:       FileRepository\input.inf_x86_neutral_9e1eba5724be176f\input.inf      USB\VID_045E&PID_0745&MI_00\6&88D595&0&0000   : 0x0.  
                7005       2015-09-28 07:19:29                           Microsoft-Windows-UserPnp       20003:       HidUsb      USB\VID_045E&PID_0745&MI_01\6&88D595&0&0001   : 0.  
                        2015-09-28 07:19:30                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:19:30                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                7005       2015-09-28 07:19:30                           Microsoft-Windows-UserPnp       20001:       FileRepository\input.inf_x86_neutral_9e1eba5724be176f\input.inf      USB\VID_045E&PID_0745&MI_01\6&88D595&0&0001   : 0x0.  
                7005       2015-09-28 07:19:30                           Microsoft-Windows-UserPnp       20003:       HidUsb      USB\VID_045E&PID_0745&MI_02\6&88D595&0&0002   : 0.  
                7005       2015-09-28 07:19:30                           Microsoft-Windows-UserPnp       20001:       FileRepository\input.inf_x86_neutral_9e1eba5724be176f\input.inf      USB\VID_045E&PID_0745&MI_02\6&88D595&0&0002   : 0x0.  
                        2015-09-28 07:19:32                           Service Control Manager         7045:    .     :  USB- (WDM)    :  System32\Drivers\usbvideo.sys   :        :      :    
                        2015-09-28 07:19:32                           Service Control Manager         7045:    .     :    USB (WDM)    :  system32\drivers\usbaudio.sys   :        :      :    
                7005       2015-09-28 07:19:32                           Microsoft-Windows-UserPnp       20003:       usbvideo      USB\VID_1E4E&PID_0109&MI_00\6&3B08C855&0&0000   : 0.  
                7005       2015-09-28 07:19:32                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbvideo.inf_x86_neutral_8fe3504355514e0c\usbvideo.inf      USB\VID_1E4E&PID_0109&MI_00\6&3B08C855&0&0000   : 0x0.  
                7005       2015-09-28 07:19:32                           Microsoft-Windows-UserPnp       20003:       usbaudio      USB\VID_1E4E&PID_0109&MI_02\6&3B08C855&0&0002   : 0.  
                7005       2015-09-28 07:19:33                           Microsoft-Windows-UserPnp       20001:       FileRepository\wdma_usb.inf_x86_neutral_a721e4f3907a2769\wdma_usb.inf      USB\VID_1E4E&PID_0109&MI_02\6&3B08C855&0&0002   : 0x0.  
                7005       2015-09-28 07:19:33                           Microsoft-Windows-UserPnp       20003:       kbdhid      HID\VID_045E&PID_0745&MI_00\7&131AF297&0&0000   : 0.  
                7005       2015-09-28 07:19:33                           Microsoft-Windows-UserPnp       20003:       kbdclass      HID\VID_045E&PID_0745&MI_00\7&131AF297&0&0000   : 0.  
                7005       2015-09-28 07:19:35                           Microsoft-Windows-UserPnp       20001:       FileRepository\keyboard.inf_x86_neutral_50ad659974198591\keyboard.inf      HID\VID_045E&PID_0745&MI_00\7&131AF297&0&0000   : 0x0.  
                7005       2015-09-28 07:19:36                           Microsoft-Windows-UserPnp       20001:       FileRepository\hidserv.inf_x86_neutral_32c4c73e5497e483\hidserv.inf      HID\VID_045E&PID_0745&MI_02&COL01\7&1E0FDE83&0&0000   : 0x0.  
                7005       2015-09-28 07:19:36                           Microsoft-Windows-UserPnp       20001:       FileRepository\hidserv.inf_x86_neutral_32c4c73e5497e483\hidserv.inf      HID\VID_045E&PID_0745&MI_02&COL02\7&1E0FDE83&0&0001   : 0x0.  
                7005       2015-09-28 07:19:37                           Microsoft-Windows-UserPnp       20001:       FileRepository\input.inf_x86_neutral_9e1eba5724be176f\input.inf      HID\VID_045E&PID_0745&MI_02&COL03\7&1E0FDE83&0&0002   : 0x0.  
                7005       2015-09-28 07:19:37                           Microsoft-Windows-UserPnp       20001:       FileRepository\input.inf_x86_neutral_9e1eba5724be176f\input.inf      HID\VID_045E&PID_0745&MI_02&COL04\7&1E0FDE83&0&0003   : 0x0.  
                7005       2015-09-28 07:19:37                           Microsoft-Windows-UserPnp       20001:       FileRepository\hidserv.inf_x86_neutral_32c4c73e5497e483\hidserv.inf      HID\VID_045E&PID_0745&MI_01&COL02\7&2BCFCD6C&0&0001   : 0x0.  
                7005       2015-09-28 07:19:38                           Microsoft-Windows-UserPnp       20003:       mouhid      HID\VID_045E&PID_0745&MI_01&COL01\7&2BCFCD6C&0&0000   : 0.  
                7005       2015-09-28 07:19:38                           Microsoft-Windows-UserPnp       20003:       mouclass      HID\VID_045E&PID_0745&MI_01&COL01\7&2BCFCD6C&0&0000   : 0.  
                7005       2015-09-28 07:19:38                           Microsoft-Windows-UserPnp       20001:       FileRepository\msmouse.inf_x86_neutral_7a9084e0177406eb\msmouse.inf      HID\VID_045E&PID_0745&MI_01&COL01\7&2BCFCD6C&0&0000   : 0x0.  
                7005       2015-09-28 07:19:49                           Microsoft-Windows-UserPnp       20003:       rdpbus      ROOT\RDPBUS\0000   : 0.  
                7005       2015-09-28 07:19:49                           Microsoft-Windows-UserPnp       20001:       FileRepository\rdpbus.inf_x86_neutral_27637529205407be\rdpbus.inf      ROOT\RDPBUS\0000   : 0x0.  
                        2015-09-28 07:19:58                                  HTTP                            
                        2015-09-28 07:19:59                                  HTTP                            
                        2015-09-28 07:20:01                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-09-28 07:20:03                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v2.0.50727_X86"    .  
                        2015-09-28 07:20:03                           Service Control Manager         7040:    "Microsoft .NET Framework NGEN v2.0.50727_X86"    ""  "".  
                7010       2015-09-28 07:20:03                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-09-28 07:20:08                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:20:08                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                3000       2015-09-28 07:20:08                           Microsoft-Windows-Setup         2003:         
                4000       2015-09-28 07:20:08                           Microsoft-Windows-Setup         2004:        
                        2015-09-28 07:20:10                           USER32                          1074:  C:\Windows\system32\winlogon.exe (37L4247F27-08)   ""   WIN-N09L0AS3TIA    NT AUTHORITY\  :  :  ()     : 0x80020003     :     :   
                        2015-09-28 07:20:11                                  EventLog                        6006:    .  
                        2015-09-28 07:20:11                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 07:20:11                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:20:11                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:20:11                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-09-28 07:20:11                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 07:20:11                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-09-28 07:20:11                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:20:11                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:20:11                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:20:11                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 07:20:11                                  Service Control Manager         7036:  "     "    .  
                        2015-09-28 07:20:11                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 07:20:11                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-09-28 07:20:11                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 07:20:11                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-09-28 07:20:11                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-09-28 07:20:11                                  Service Control Manager         7036:  "  "    .  
                4          2015-09-28 07:20:11  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-09-28 07:20:11  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                        2015-09-28 07:20:12                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-28 07:20:12                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:20:12                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-09-28 07:20:12                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:20:12                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 07:20:12                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v2.0.50727_X86"    .  
                        2015-09-28 07:20:12                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-09-28 07:20:12                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-09-28 07:20:12                                  Service Control Manager         7036:  " "    .  
                7010       2015-09-28 07:20:12                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                103        2015-09-28 07:20:13                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-09-28 07:20:14                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-09-28 07:20:50                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-09-28 07:20:53                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T03:21:51.000000000Z)       .  
                4          2015-09-28 07:21:00                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-09-28 07:21:00                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-09-28 07:21:08                                  nvlddmkm                        
                        2015-09-28 07:21:11                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-09-28 07:21:11                                  Service Control Manager         7036:  ""    .  
                7010       2015-09-28 07:21:11                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-09-28 07:21:12                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-09-28 07:21:12                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-09-28 07:21:12                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-09-28 07:21:31                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:21:33                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:21:33                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-09-28 07:21:33                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-09-28 07:21:34                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 07:21:35                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 07:21:35                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 07:21:58                                  EventLog                        6011: NetBIOS-   DNS-      WIN-N09L0AS3TIA  VLADIMIR.  
                        2015-09-28 07:21:58                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-09-28 07:21:58                                  EventLog                        6005:    .  
                        2015-09-28 07:21:58                                  EventLog                        6013:    68 .  
                        2015-09-28 07:21:58                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 07:21:58                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 07:21:59                                  Service Control Manager         7036:  "    "    .  
                        2015-09-28 07:21:59                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 07:21:59                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:22:00                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 07:22:00                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:22:00                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:22:00                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-09-28 07:22:00                                  Service Control Manager         7036:  "    "    .  
                        2015-09-28 07:22:00                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T03:15:44.000000000Z)       .  
                        2015-09-28 07:22:02                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 07:22:02                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 07:22:02                                  Service Control Manager         7036:  "     "    .  
                        2015-09-28 07:22:02                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 07:22:02                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-09-28 07:22:02                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-09-28 07:22:02                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-09-28 07:22:02                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:22:02                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 07:22:02                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:22:02                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-28 07:22:02                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 07:22:02                                  Service Control Manager         7036:  "  "    .  
                4          2015-09-28 07:22:02  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-09-28 07:22:02  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-09-28 07:22:03                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-09-28 07:22:03                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 07:22:03                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 07:22:04                                  Service Control Manager         7036:  "  IP"    .  
                        2015-09-28 07:22:04                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 07:22:04                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:22:04                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 07:22:04                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-09-28 07:22:04                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 07:22:04                           Service Control Manager         7040:    "  Windows"    ""  "".  
                        2015-09-28 07:22:05                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 07:22:17                           Microsoft-Windows-Kernel-General  1:  .  
                        2015-09-28 23:26:36                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-09-28 23:26:39                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T09:21:51.000000000Z)       .  
                4          2015-09-28 23:26:46                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-09-28 23:26:46                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-09-28 23:26:51                                  nvlddmkm                        
                        2015-09-28 23:26:59                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-09-28 23:26:59                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 23:26:59                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-09-28 23:26:59                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-09-28 23:26:59                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-09-28 23:26:59                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T09:15:44.000000000Z)       .  
                7010       2015-09-28 23:26:59                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-09-28 23:27:00                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-09-28 23:27:00                                  EventLog                        6005:    .  
                        2015-09-28 23:27:00                                  EventLog                        6013:    23 .  
                        2015-09-28 23:27:00                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 23:27:00                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 23:27:01                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-09-28 23:27:01                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-09-28 23:27:01                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 23:27:01                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 23:27:01                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 23:27:01                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 23:27:01                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-09-28 23:27:01                                  Service Control Manager         7036:  "    "    .  
                        2015-09-28 23:27:01                                  Service Control Manager         7036:  "     "    .  
                        2015-09-28 23:27:01                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 23:27:01                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 23:27:01                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-09-28 23:27:01                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-09-28 23:27:01                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-09-28 23:27:01                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-09-28 23:27:01                                  Service Control Manager         7036:  "    (EAP)"    .  
                4          2015-09-28 23:27:01  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-09-28 23:27:01  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                1101       2015-09-28 23:27:02                           Microsoft-Windows-Winlogon      7001:           
                        2015-09-28 23:27:04                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-09-28 23:27:04                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 23:27:04                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 23:27:04                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 23:27:04                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 23:27:04                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-28 23:27:04                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                        2015-09-28 23:27:05                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 23:27:05                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 23:27:05                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 23:27:05                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-09-28 23:27:05                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 23:27:05                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-09-28 23:27:05                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 23:27:05                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-09-28 23:27:05                                  Service Control Manager         7036:  "    "    .  
                        2015-09-28 23:27:05                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 23:27:05                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 23:27:06                                  Service Control Manager         7036:  "  IP"    .  
                        2015-09-28 23:27:06                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 23:27:06                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 23:27:07                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-09-28 23:27:07                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 23:27:07                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-09-28 23:27:07                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 23:27:07                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 23:27:07                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 23:27:07                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 23:27:07                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 23:27:07                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 23:27:07                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-09-28 23:27:08                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-09-28 23:27:08                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-09-28 23:27:09                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-09-28 23:27:11                           Microsoft-Windows-UserPnp       20003:       cdrom      IDE\CDROMHL-DT-ST_DVD+-RW_GH50N__________________B102____\5&4248B16&0&1.0.0   : 0.  
                7005       2015-09-28 23:27:13                           Microsoft-Windows-UserPnp       20001:       FileRepository\cdrom.inf_x86_neutral_6381e09675524225\cdrom.inf      IDE\CDROMHL-DT-ST_DVD+-RW_GH50N__________________B102____\5&4248B16&0&1.0.0   : 0x0.  
                7005       2015-09-28 23:27:14                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-09-28 23:27:19                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-09-28 23:29:07                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-09-28 23:29:07                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 23:29:08                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-28 23:29:08                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 23:29:10                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 23:29:13                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 23:32:00                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 23:34:09                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 23:40:05                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 23:40:35  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 23:40:37                                  EventLog                        6006:    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  ""    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  "     "    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  "   "    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  "  "    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-28 23:40:37                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-09-28 23:40:37  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-09-28 23:40:37                           Microsoft-Windows-Winlogon      7002:           
                4          2015-09-28 23:40:37  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-09-28 23:40:37  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-09-28 23:40:37                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-09-28 23:40:38                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-09-28 23:40:38                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-09-28 23:40:38                                  Service Control Manager         7036:  " "    .  
                        2015-09-28 23:40:38                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-09-28 23:40:38                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-09-28 23:40:38                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-09-28 23:40:38                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-09-28 23:40:40                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-09-29 18:58:30                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-09-29 18:58:33                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T09:21:51.000000000Z)       .  
                4          2015-09-29 18:58:39                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-09-29 18:58:39                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-09-29 18:58:44                                  nvlddmkm                        
                        2015-09-29 18:58:45                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-09-29 18:58:45                                  EventLog                        6005:    .  
                        2015-09-29 18:58:45                                  EventLog                        6013:    15 .  
                        2015-09-29 18:58:45                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-09-29 18:58:45                                  Service Control Manager         7036:  ""    .  
                        2015-09-29 18:58:45                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-09-29 18:58:45                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-09-29 18:58:45                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-09-29 18:58:45                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-29 18:58:45                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 18:58:45                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T09:15:44.000000000Z)       .  
                7010       2015-09-29 18:58:45                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-09-29 18:58:48                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-09-29 18:58:48                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-09-29 18:58:48                                  Service Control Manager         7036:  ""    .  
                        2015-09-29 18:58:48                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 18:58:48                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 18:58:48                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-09-29 18:58:48                                  Service Control Manager         7036:  "    "    .  
                        2015-09-29 18:58:49                                  Service Control Manager         7036:  " "    .  
                        2015-09-29 18:58:49                                  Service Control Manager         7036:  "     "    .  
                        2015-09-29 18:58:50                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-09-29 18:58:50                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 18:58:50                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                1101       2015-09-29 18:58:50                           Microsoft-Windows-Winlogon      7001:           
                        2015-09-29 18:58:51                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 18:58:51                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-09-29 18:58:51                                  Service Control Manager         7036:  "DNS-"    .  
                4          2015-09-29 18:58:51  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-09-29 18:58:51  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-09-29 18:58:52                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-09-29 18:58:53                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-09-29 18:58:53                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 18:58:53                                  Service Control Manager         7036:  " "    .  
                        2015-09-29 18:58:53                                  Service Control Manager         7036:  " "    .  
                        2015-09-29 18:58:53                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 18:58:53                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-29 18:58:53                                  Service Control Manager         7036:  " "    .  
                        2015-09-29 18:58:53                                  Service Control Manager         7036:  " "    .  
                        2015-09-29 18:58:53                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 18:58:53                                  Service Control Manager         7036:  " "    .  
                        2015-09-29 18:58:53                                  Service Control Manager         7036:  "    "    .  
                        2015-09-29 18:58:53                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-09-29 18:58:53                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-09-29 18:58:53                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-09-29 18:58:53                                  Service Control Manager         7036:  ""    .  
                        2015-09-29 18:58:53                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 18:58:53                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                        2015-09-29 18:58:54                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-29 18:58:54                                  Service Control Manager         7036:  "  IP"    .  
                        2015-09-29 18:58:54                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 18:58:54                                  Service Control Manager         7036:  ""    .  
                        2015-09-29 18:58:54                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-09-29 18:58:54                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-09-29 18:58:54                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 18:58:54                                  Service Control Manager         7036:  " "    .  
                        2015-09-29 18:58:54                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 18:58:54                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 18:58:54                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 18:58:54                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 18:58:54                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 18:58:54                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-09-29 18:58:55                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-09-29 18:58:55                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-09-29 18:59:02                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-09-29 19:00:54                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 19:00:54                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-09-29 19:00:55                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 19:00:55                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-29 19:00:56                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 19:00:57                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-29 19:03:45                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 19:05:57                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 19:08:54                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 19:18:24                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 19:23:23                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 19:23:24                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-09-29 19:26:25                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 19:28:24                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 19:28:54                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 19:31:54                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 19:34:54                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                7005       2015-09-29 19:35:27                           Microsoft-Windows-UserPnp       20003:       USBSTOR      USB\VID_1058&PID_1010\57442D57584E314536314159504A57   : 0.  
                7005       2015-09-29 19:35:28                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbstor.inf_x86_neutral_c77d41a490bdc63d\usbstor.inf      USB\VID_1058&PID_1010\57442D57584E314536314159504A57   : 0x0.  
                7005       2015-09-29 19:35:28                           Microsoft-Windows-UserPnp       20003:       disk      USBSTOR\DISK&VEN_WD&PROD_3200BPV_EXTERNAL&REV_1.75\57442D57584E314536314159504A57&0   : 0.  
                        2015-09-29 19:35:29                                  Service Control Manager         7036:  "   "    .  
                7005       2015-09-29 19:35:29                           Microsoft-Windows-UserPnp       20001:       FileRepository\disk.inf_x86_neutral_b431b61a11f8df6c\disk.inf      USBSTOR\DISK&VEN_WD&PROD_3200BPV_EXTERNAL&REV_1.75\57442D57584E314536314159504A57&0   : 0x0.  
                7005       2015-09-29 19:35:29                           Microsoft-Windows-UserPnp       20003:       volsnap      STORAGE\VOLUME\{A477E433-6690-11E5-89AA-0019DB4D6DEE}#0000000000100000   : 0.  
                7005       2015-09-29 19:35:29                           Microsoft-Windows-UserPnp       20001:       FileRepository\volume.inf_x86_neutral_6dee0205881d1a1d\volume.inf      STORAGE\VOLUME\{A477E433-6690-11E5-89AA-0019DB4D6DEE}#0000000000100000   : 0x0.  
                        2015-09-29 19:35:44                                  Service Control Manager         7036:  "    "    .  
                        2015-09-29 19:35:44                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-09-29 19:35:45                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 19:37:29                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 19:38:53                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 19:48:35                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 19:55:08                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 19:58:03                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 20:23:29                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-09-29 20:23:34                                  Service Control Manager         7036:  "   "    .  
                            2015-09-29 20:23:41                                  ipnathlp                        
                        2015-09-29 20:23:42                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-09-29 20:23:45                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-09-29 20:31:44                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-09-29 20:33:44                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-09-29 20:35:34  sima                            Service Control Manager         7045:    .     :  Mozilla Maintenance Service    :  "C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe"   :        :      :  LocalSystem  
                        2015-09-29 20:46:18                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-09-29 20:46:18                                  Service Control Manager         7036:  " "    .  
                        2015-09-29 20:47:42                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-09-29 20:56:11                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 20:56:58                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 21:09:40                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-09-29 21:11:40                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-09-29 21:14:54                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 21:16:54                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 21:25:54                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 22:27:13  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-09-29 22:27:15                                  EventLog                        6006:    .  
                        2015-09-29 22:27:15                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-29 22:27:15                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 22:27:15                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-09-29 22:27:15                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-09-29 22:27:15                                  Service Control Manager         7036:  ""    .  
                        2015-09-29 22:27:15                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-09-29 22:27:15                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-09-29 22:27:15                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 22:27:15                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 22:27:15                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 22:27:15                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-09-29 22:27:15                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-09-29 22:27:15                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-09-29 22:27:15                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-09-29 22:27:15                                  Service Control Manager         7036:  "     "    .  
                        2015-09-29 22:27:15  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-09-29 22:27:15                           Microsoft-Windows-Winlogon      7002:           
                4          2015-09-29 22:27:15  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-09-29 22:27:15  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-09-29 22:27:15                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-09-29 22:27:16                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 22:27:16                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-09-29 22:27:16                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-09-29 22:27:16                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-09-29 22:27:16                                  Service Control Manager         7036:  "   "    .  
                        2015-09-29 22:27:16                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-09-29 22:27:16                                  Service Control Manager         7036:  "  "    .  
                        2015-09-29 22:27:16                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-29 22:27:16                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-29 22:27:16                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-09-29 22:27:16                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-29 22:27:16                                  Service Control Manager         7036:  " "    .  
                          2015-09-29 22:27:16                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-09-29 22:27:17                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-09-29 22:27:18                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-09-29 22:27:32                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-09-30 11:08:33                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-09-30 11:08:36                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T09:21:51.000000000Z)       .  
                4          2015-09-30 11:08:41                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-09-30 11:08:41                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-09-30 11:08:44                                  nvlddmkm                        
                        2015-09-30 11:08:49                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-09-30 11:08:49                                  EventLog                        6005:    .  
                        2015-09-30 11:08:49                                  EventLog                        6013:    16 .  
                        2015-09-30 11:08:49                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-09-30 11:08:49                                  Service Control Manager         7036:  ""    .  
                        2015-09-30 11:08:49                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-09-30 11:08:49                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-09-30 11:08:49                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-09-30 11:08:49                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-30 11:08:49                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 11:08:49                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-09-30 11:08:49                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-09-30 11:08:49                                  Service Control Manager         7036:  ""    .  
                        2015-09-30 11:08:49                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 11:08:49                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 11:08:49                                  Service Control Manager         7036:  " "    .  
                        2015-09-30 11:08:49                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-09-30 11:08:49                                  Service Control Manager         7036:  "    "    .  
                        2015-09-30 11:08:49                                  Service Control Manager         7036:  "     "    .  
                        2015-09-30 11:08:49                                  Service Control Manager         7036:  "   "    .  
                        2015-09-30 11:08:49                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T09:15:44.000000000Z)       .  
                7010       2015-09-30 11:08:49                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-09-30 11:08:50                                  Service Control Manager         7036:  "   "    .  
                        2015-09-30 11:08:50                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-09-30 11:08:50                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-09-30 11:08:50                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-09-30 11:08:50                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-09-30 11:08:50                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-09-30 11:08:50                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-09-30 11:08:50                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 11:08:50                                  Service Control Manager         7036:  " "    .  
                        2015-09-30 11:08:50                                  Service Control Manager         7036:  " "    .  
                        2015-09-30 11:08:50                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-09-30 11:08:50                           Microsoft-Windows-Winlogon      7001:           
                4          2015-09-30 11:08:50  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-09-30 11:08:50  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-09-30 11:08:51                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 11:08:51                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-30 11:08:51                                  Service Control Manager         7036:  " "    .  
                        2015-09-30 11:08:51                                  Service Control Manager         7036:  " "    .  
                        2015-09-30 11:08:51                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 11:08:51                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-09-30 11:08:51                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-09-30 11:08:51                                  Service Control Manager         7036:  "   "    .  
                        2015-09-30 11:08:51                                  Service Control Manager         7036:  ""    .  
                        2015-09-30 11:08:51                                  Service Control Manager         7036:  "    "    .  
                        2015-09-30 11:08:51                                  Service Control Manager         7036:  " "    .  
                        2015-09-30 11:08:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-30 11:08:52                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-09-30 11:08:52                                  Service Control Manager         7036:  "  IP"    .  
                        2015-09-30 11:08:52                                  Service Control Manager         7036:  "   "    .  
                        2015-09-30 11:08:52                                  Service Control Manager         7036:  ""    .  
                        2015-09-30 11:08:52                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-09-30 11:08:52                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 11:08:53                                  Service Control Manager         7036:  " "    .  
                        2015-09-30 11:08:53                                  Service Control Manager         7036:  "   "    .  
                        2015-09-30 11:08:53                                  Service Control Manager         7036:  "   "    .  
                        2015-09-30 11:08:53                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-09-30 11:08:53                                  Service Control Manager         7036:  "   "    .  
                        2015-09-30 11:08:53                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 11:08:53                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 11:08:53                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-09-30 11:08:53                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-09-30 11:08:53                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-09-30 11:09:01                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-09-30 11:09:36                                  Service Control Manager         7036:  "    "    .  
                        2015-09-30 11:09:36                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-09-30 11:09:36                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-09-30 11:09:37                                  Service Control Manager         7036:  "   Windows"    .  
                            2015-09-30 11:09:55                                  ipnathlp                        
                        2015-09-30 11:09:56                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-09-30 11:09:56                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-09-30 11:10:53                                  Service Control Manager         7036:  "   "    .  
                        2015-09-30 11:10:53                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 11:10:53                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-30 11:10:53                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 11:10:55                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-30 11:13:49                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 11:15:55                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 11:18:54                                  Service Control Manager         7036:  "   "    .  
                        2015-09-30 11:26:26                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-09-30 11:48:51                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 11:57:23                                  Service Control Manager         7036:  " "    .  
                        2015-09-30 12:04:21                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 12:04:21                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-09-30 12:07:22                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 12:10:22                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-09-30 12:50:49                                  Service Control Manager         7036:  " "    .  
                          2015-09-30 13:37:09  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     ibbe.group-ib.ru        DNS.  
                        2015-09-30 13:59:21                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-09-30 13:59:22                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-09-30 13:59:22                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                            2015-09-30 14:02:27                                  ipnathlp                        
                        2015-09-30 14:02:30                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-09-30 14:32:36  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                          2015-09-30 14:39:54  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     safebrowsing.google.com        DNS.  
                          2015-09-30 14:44:05  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     ibbe.group-ib.ru        DNS.  
                          2015-09-30 15:02:03  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-09-30 15:13:15  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 15:13:18                                  EventLog                        6006:    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  ""    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  "   "    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  "     "    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  "   "    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  "  "    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  " Windows"    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  " "    .  
                        2015-09-30 15:13:18                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-09-30 15:13:18  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-09-30 15:13:18                           Microsoft-Windows-Winlogon      7002:           
                4          2015-09-30 15:13:18  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-09-30 15:13:18  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-09-30 15:13:18                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-09-30 15:13:19                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-09-30 15:13:19                                  Service Control Manager         7036:  "  WLAN"    .  
                103        2015-09-30 15:13:19                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-09-30 15:13:19                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-09-30 15:13:30                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-01 23:13:49                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-01 23:13:52                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T09:21:51.000000000Z)       .  
                4          2015-10-01 23:13:57                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-01 23:13:57                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-01 23:14:00                                  nvlddmkm                        
                        2015-10-01 23:14:01                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                7010       2015-10-01 23:14:01                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-01 23:14:02                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-01 23:14:02                                  EventLog                        6005:    .  
                        2015-10-01 23:14:02                                  EventLog                        6013:    13 .  
                        2015-10-01 23:14:02                                  Service Control Manager         7036:  ""    .  
                        2015-10-01 23:14:02                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-01 23:14:02                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-01 23:14:02                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-01 23:14:02                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-01 23:14:02                                  Service Control Manager         7036:  "  "    .  
                        2015-10-01 23:14:02                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-01 23:14:02                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-01 23:14:02                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T09:15:44.000000000Z)       .  
                        2015-10-01 23:14:03                                  Service Control Manager         7036:  ""    .  
                        2015-10-01 23:14:03                                  Service Control Manager         7036:  " "    .  
                        2015-10-01 23:14:03                                  Service Control Manager         7036:  "  "    .  
                        2015-10-01 23:14:03                                  Service Control Manager         7036:  "  "    .  
                        2015-10-01 23:14:03                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-01 23:14:03                                  Service Control Manager         7036:  "    "    .  
                        2015-10-01 23:14:03                                  Service Control Manager         7036:  "     "    .  
                        2015-10-01 23:14:03                                  Service Control Manager         7036:  "   "    .  
                        2015-10-01 23:14:03                                  Service Control Manager         7036:  "   "    .  
                        2015-10-01 23:14:03                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-01 23:14:03                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-01 23:14:03                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-01 23:14:03                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-01 23:14:03                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-01 23:14:03                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-01 23:14:03                                  Service Control Manager         7036:  "  "    .  
                        2015-10-01 23:14:03                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-10-01 23:14:03  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-01 23:14:03  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-01 23:14:04                                  Service Control Manager         7036:  " "    .  
                        2015-10-01 23:14:04                                  Service Control Manager         7036:  " "    .  
                        2015-10-01 23:14:04                                  Service Control Manager         7036:  "  "    .  
                        2015-10-01 23:14:04                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-01 23:14:04                                  Service Control Manager         7036:  " "    .  
                1101       2015-10-01 23:14:04                           Microsoft-Windows-Winlogon      7001:           
                        2015-10-01 23:14:05                                  Service Control Manager         7036:  " "    .  
                        2015-10-01 23:14:05                                  Service Control Manager         7036:  "  "    .  
                        2015-10-01 23:14:05                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-01 23:14:05                                  Service Control Manager         7036:  " "    .  
                        2015-10-01 23:14:05                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-01 23:14:05                                  Service Control Manager         7036:  ""    .  
                        2015-10-01 23:14:05                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-01 23:14:05                                  Service Control Manager         7036:  "   "    .  
                        2015-10-01 23:14:05                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-01 23:14:05                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-01 23:14:06                                  Service Control Manager         7036:  "    "    .  
                        2015-10-01 23:14:06                                  Service Control Manager         7036:  "   "    .  
                        2015-10-01 23:14:06                                  Service Control Manager         7036:  ""    .  
                        2015-10-01 23:14:06                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-01 23:14:06                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-01 23:14:06                                  Service Control Manager         7036:  " "    .  
                        2015-10-01 23:14:06                                  Service Control Manager         7036:  "  "    .  
                        2015-10-01 23:14:06                                  Service Control Manager         7036:  "   "    .  
                        2015-10-01 23:14:06                                  Service Control Manager         7036:  "   "    .  
                        2015-10-01 23:14:06                                  Service Control Manager         7036:  "  "    .  
                        2015-10-01 23:14:06                                  Service Control Manager         7036:  "  "    .  
                        2015-10-01 23:14:06                                  Service Control Manager         7036:  "   "    .  
                        2015-10-01 23:14:06                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-01 23:14:07                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-01 23:14:07                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-01 23:14:14                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-01 23:16:06                                  Service Control Manager         7036:  "   "    .  
                        2015-10-01 23:16:06                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-01 23:16:07                                  Service Control Manager         7036:  "  "    .  
                        2015-10-01 23:16:07                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-01 23:16:07                                  Service Control Manager         7036:  "  "    .  
                        2015-10-01 23:16:09                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-01 23:19:02                                  Service Control Manager         7036:  "  "    .  
                        2015-10-01 23:21:09                                  Service Control Manager         7036:  "  "    .  
                        2015-10-01 23:21:16                                  Service Control Manager         7036:  "   "    .  
                        2015-10-01 23:23:16                                  Service Control Manager         7036:  "   "    .  
                        2015-10-01 23:24:08                                  Service Control Manager         7036:  "   "    .  
                        2015-10-01 23:36:53                                  Service Control Manager         7036:  "    "    .  
                        2015-10-01 23:36:53                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-01 23:36:54                                  Service Control Manager         7036:  "   "    .  
                        2015-10-01 23:38:22                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-01 23:41:13                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-01 23:42:13                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-01 23:42:14                                  Service Control Manager         7036:  " "    .  
                            2015-10-01 23:43:07                                  ipnathlp                        
                7005       2015-10-01 23:43:09                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-10-01 23:43:10                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-01 23:43:13                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-01 23:46:50                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-01 23:47:58                                  Service Control Manager         7036:  "  "    .  
                        2015-10-01 23:47:58                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                7005       2015-10-01 23:48:08                           Microsoft-Windows-UserPnp       20001:       FileRepository\volsnap.inf_x86_neutral_42f862e05fcb0306\volsnap.inf      STORAGE\VOLUMESNAPSHOT\HARDDISKVOLUMESNAPSHOT4   : 0x0.  
                          2015-10-01 23:48:46  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     addons.cdn.mozilla.net        DNS.  
                        2015-10-01 23:51:17                                  Service Control Manager         7036:  "  "    .  
                        2015-10-01 23:54:05                                  Service Control Manager         7036:  "  "    .  
                        2015-10-01 23:54:17                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                          2015-10-01 23:54:22  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     tr001.skype-edf.akadns.net        DNS.  
                        2015-10-01 23:58:30                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-01 23:59:40                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-01 23:59:52                                  Service Control Manager         7036:  "   "    .  
                            2015-10-02 00:00:53                           Schannel                        36888:    : 10.   : 10.  
                            2015-10-02 00:00:53                           Schannel                        36888:    : 10.   : 10.  
                            2015-10-02 00:00:53                           Schannel                        36888:    : 10.   : 10.  
                            2015-10-02 00:00:53                           Schannel                        36888:    : 10.   : 10.  
                            2015-10-02 00:01:00                           Schannel                        36888:    : 10.   : 10.  
                            2015-10-02 00:01:00                           Schannel                        36888:    : 10.   : 10.  
                            2015-10-02 00:01:00                           Schannel                        36888:    : 10.   : 10.  
                            2015-10-02 00:01:01                           Schannel                        36888:    : 10.   : 10.  
                        2015-10-02 00:02:47                                  Service Control Manager         7036:  "   "    .  
                            2015-10-02 00:05:13                           Schannel                        36888:    : 10.   : 10.  
                            2015-10-02 00:05:13                           Schannel                        36888:    : 10.   : 10.  
                            2015-10-02 00:05:14                           Schannel                        36888:    : 10.   : 10.  
                            2015-10-02 00:05:14                           Schannel                        36888:    : 10.   : 10.  
                            2015-10-02 00:05:22                           Schannel                        36888:    : 10.   : 10.  
                            2015-10-02 00:05:22                           Schannel                        36888:    : 10.   : 10.  
                            2015-10-02 00:05:22                           Schannel                        36888:    : 10.   : 10.  
                            2015-10-02 00:05:23                           Schannel                        36888:    : 10.   : 10.  
                        2015-10-02 00:08:15                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-02 00:08:24                                  Service Control Manager         7036:  "  "    .  
                        2015-10-02 00:08:24                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                7005       2015-10-02 00:08:28                           Microsoft-Windows-UserPnp       20001:       FileRepository\volsnap.inf_x86_neutral_42f862e05fcb0306\volsnap.inf      STORAGE\VOLUMESNAPSHOT\HARDDISKVOLUMESNAPSHOT5   : 0x0.  
                        2015-10-02 00:08:40                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-02 00:08:42                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-02 00:09:45                                  Service Control Manager         7036:  "   Windows"    .  
                          2015-10-02 00:10:14  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     support.microsoft.com        DNS.  
                        2015-10-02 00:11:37                                  Service Control Manager         7036:  "  "    .  
                        2015-10-02 00:11:45                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-02 00:14:37                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-02 00:19:08                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-02 00:21:20                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-02 00:23:20                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-02 00:25:58                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-02 00:27:58                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-02 00:29:39  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-02 00:29:41                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-02 00:29:41                                  Service Control Manager         7036:  "  "    .  
                        2015-10-02 00:29:41                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-02 00:29:41  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-02 00:29:41                           Microsoft-Windows-Winlogon      7002:           
                4          2015-10-02 00:29:41  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                        2015-10-02 00:29:42                                  EventLog                        6006:    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  ""    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  "     "    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  "   "    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  "   "    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-02 00:29:42                                  Service Control Manager         7036:  "Superfetch"    .  
                4          2015-10-02 00:29:42  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-02 00:29:42                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-10-02 00:29:43                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-02 00:29:43                                  Service Control Manager         7036:  " "    .  
                          2015-10-02 00:29:43                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-02 00:29:44                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-02 00:29:44                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-02 00:29:44                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-02 00:29:49                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-03 22:29:58                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-03 22:30:01                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T09:21:51.000000000Z)       .  
                4          2015-10-03 22:30:05                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-03 22:30:05                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-03 22:30:08                                  nvlddmkm                        
                        2015-10-03 22:30:12                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-03 22:30:12                                  EventLog                        6005:    .  
                        2015-10-03 22:30:12                                  EventLog                        6013:    14 .  
                        2015-10-03 22:30:12                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-03 22:30:12                                  Service Control Manager         7036:  ""    .  
                        2015-10-03 22:30:12                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-03 22:30:12                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-03 22:30:12                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-03 22:30:12                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-03 22:30:12                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T09:15:44.000000000Z)       .  
                7010       2015-10-03 22:30:12                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  "  "    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  ""    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  "  "    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  "  "    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  " "    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  "    "    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  "     "    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  "   "    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  "   "    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  "  "    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  " "    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  " "    .  
                        2015-10-03 22:30:13                                  Service Control Manager         7036:  "  "    .  
                        2015-10-03 22:30:13                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-10-03 22:30:13  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-03 22:30:13  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-03 22:30:14                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-03 22:30:14                                  Service Control Manager         7036:  " "    .  
                        2015-10-03 22:30:14                                  Service Control Manager         7036:  " "    .  
                        2015-10-03 22:30:14                                  Service Control Manager         7036:  " "    .  
                        2015-10-03 22:30:14                                  Service Control Manager         7036:  "  "    .  
                        2015-10-03 22:30:14                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-03 22:30:14                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-03 22:30:14                                  Service Control Manager         7036:  ""    .  
                        2015-10-03 22:30:14                                  Service Control Manager         7036:  "   "    .  
                        2015-10-03 22:30:14                                  Service Control Manager         7036:  "    "    .  
                        2015-10-03 22:30:14                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-03 22:30:14                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-03 22:30:14                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-03 22:30:14                                  Service Control Manager         7036:  "   "    .  
                        2015-10-03 22:30:14                                  Service Control Manager         7036:  ""    .  
                1101       2015-10-03 22:30:14                           Microsoft-Windows-Winlogon      7001:           
                        2015-10-03 22:30:15                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-03 22:30:15                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-03 22:30:15                                  Service Control Manager         7036:  " "    .  
                        2015-10-03 22:30:15                                  Service Control Manager         7036:  "   "    .  
                        2015-10-03 22:30:15                                  Service Control Manager         7036:  "   "    .  
                        2015-10-03 22:30:15                                  Service Control Manager         7036:  "  "    .  
                        2015-10-03 22:30:15                                  Service Control Manager         7036:  "   "    .  
                        2015-10-03 22:30:15                                  Service Control Manager         7036:  "  "    .  
                        2015-10-03 22:30:15                                  Service Control Manager         7036:  "  "    .  
                        2015-10-03 22:30:16                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-03 22:30:16                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-03 22:30:16                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-03 22:30:16                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-10-03 22:30:21                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-10-03 22:30:25                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-03 22:30:33                                  Service Control Manager         7036:  "    "    .  
                        2015-10-03 22:30:33                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-03 22:30:35                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-03 22:31:13                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-03 22:32:15                                  Service Control Manager         7036:  "  "    .  
                        2015-10-03 22:32:15                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-03 22:32:15                                  Service Control Manager         7036:  "  "    .  
                        2015-10-03 22:32:17                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-03 22:33:15                                  Service Control Manager         7036:  "   "    .  
                        2015-10-03 22:35:13                                  Service Control Manager         7036:  "  "    .  
                        2015-10-03 22:37:17                                  Service Control Manager         7036:  "  "    .  
                        2015-10-03 22:41:13                                  Service Control Manager         7036:  "   "    .  
                        2015-10-03 22:46:46                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-03 22:52:11                                  Service Control Manager         7036:  " "    .  
                        2015-10-03 23:02:09                                  Service Control Manager         7036:  "  "    .  
                        2015-10-03 23:02:09                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-03 23:02:43                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-03 23:05:10                                  Service Control Manager         7036:  "  "    .  
                        2015-10-03 23:08:10                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-03 23:10:14                                  Service Control Manager         7036:  "  "    .  
                        2015-10-03 23:11:43                                  Service Control Manager         7036:  " "    .  
                        2015-10-03 23:13:23                           Service Control Manager         7040:    "  Windows"    ""  "".  
                        2015-10-03 23:13:24                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-03 23:13:24                           Service Control Manager         7040:    "  Windows"    ""  "".  
                        2015-10-03 23:13:58                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-03 23:13:58                                  Service Control Manager         7036:  " "    .  
                        2015-10-03 23:17:07                                  Service Control Manager         7036:  "   "    .  
                        2015-10-03 23:18:49                                  Service Control Manager         7036:  "   Windows"    .  
                          2015-10-03 23:20:48  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     fonts.googleapis.com        DNS.  
                        2015-10-03 23:20:49                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-03 23:28:36                                  Service Control Manager         7036:  "   "    .  
                          2015-10-03 23:28:43  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     cp.sweb.ru        DNS.  
                          2015-10-03 23:30:18  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     cdn.jivosite.com        DNS.  
                        2015-10-03 23:34:04                                  Service Control Manager         7036:  "   "    .  
                          2015-10-03 23:42:18  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     ssl.google-analytics.com        DNS.  
                        2015-10-03 23:44:04                                  Service Control Manager         7036:  "   "    .  
                        2015-10-04 00:00:01                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-04 00:00:02  LOCAL SERVICE                   Microsoft-Windows-Time-Service  37: NTP-         time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->23.99.222.162:123).  
                        2015-10-04 00:00:03                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-04 00:00:03  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-04 00:00:03  LOCAL SERVICE                   Microsoft-Windows-Time-Service  35:          time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->23.99.222.162:123).  
                        2015-10-04 00:00:03  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-04 00:00:03  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-04 00:16:05                                  Service Control Manager         7036:  "   "    .  
                          2015-10-04 00:19:51  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     cp.sweb.ru        DNS.  
                        2015-10-04 00:27:53                                  Service Control Manager         7036:  "   "    .  
                        2015-10-04 00:33:08                                  Service Control Manager         7036:  "   "    .  
                        2015-10-04 00:43:08                                  Service Control Manager         7036:  "   "    .  
                        2015-10-04 01:08:55                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-04 01:09:01                                  Service Control Manager         7036:  "   "    .  
                        2015-10-04 01:10:21                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-04 01:10:55                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-04 01:14:10                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-04 01:14:50                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-04 01:24:33                                  Service Control Manager         7036:  "   "    .  
                          2015-10-04 01:49:44  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     ocsp.entrust.net        DNS.  
                        2015-10-04 01:55:46                                  Service Control Manager         7036:  "   "    .  
                        2015-10-04 02:01:25  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-04 02:01:27                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-04 02:01:27  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-04 02:01:27                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-04 02:01:28                                  EventLog                        6006:    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  ""    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  "   "    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  "     "    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  "   "    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-04 02:01:28                                  Service Control Manager         7036:  " "    .  
                4          2015-10-04 02:01:28  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-04 02:01:28  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-04 02:01:28                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-10-04 02:01:29                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-04 02:01:29                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-04 02:01:29                                  Service Control Manager         7036:  "Windows Search"    .  
                          2015-10-04 02:01:29                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                103        2015-10-04 02:01:30                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-04 02:01:44                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-04 13:34:04                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-04 13:34:07                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T09:21:51.000000000Z)       .  
                4          2015-10-04 13:34:12                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-04 13:34:12                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-04 13:34:14                                  nvlddmkm                        
                        2015-10-04 13:34:15                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-04 13:34:15                                  EventLog                        6005:    .  
                        2015-10-04 13:34:15                                  EventLog                        6013:    11 .  
                        2015-10-04 13:34:15                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-04 13:34:15                                  Service Control Manager         7036:  ""    .  
                        2015-10-04 13:34:15                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-04 13:34:15                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-04 13:34:15                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-04 13:34:15                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T09:15:44.000000000Z)       .  
                7010       2015-10-04 13:34:15                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-04 13:34:16                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-04 13:34:16                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 13:34:16                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-04 13:34:16                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-04 13:34:16                                  Service Control Manager         7036:  ""    .  
                        2015-10-04 13:34:16                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 13:34:16                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 13:34:17                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-04 13:34:17                                  Service Control Manager         7036:  "    "    .  
                        2015-10-04 13:34:17                                  Service Control Manager         7036:  " "    .  
                        2015-10-04 13:34:17                                  Service Control Manager         7036:  "     "    .  
                        2015-10-04 13:34:17                                  Service Control Manager         7036:  "   "    .  
                        2015-10-04 13:34:17                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-04 13:34:17                                  Service Control Manager         7036:  "   "    .  
                        2015-10-04 13:34:17                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-04 13:34:17                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-04 13:34:17                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-04 13:34:17                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-04 13:34:17                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-04 13:34:17                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 13:34:17                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-10-04 13:34:17  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-04 13:34:17  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-04 13:34:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-04 13:34:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-04 13:34:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 13:34:18                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-04 13:34:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-04 13:34:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-04 13:34:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-04 13:34:18                                  Service Control Manager         7036:  "  "    .  
                1101       2015-10-04 13:34:18                           Microsoft-Windows-Winlogon      7001:           
                        2015-10-04 13:34:19                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-04 13:34:19                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-04 13:34:19                                  Service Control Manager         7036:  ""    .  
                        2015-10-04 13:34:19                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-04 13:34:19                                  Service Control Manager         7036:  "   "    .  
                        2015-10-04 13:34:19                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-04 13:34:19                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-04 13:34:19                                  Service Control Manager         7036:  "   "    .  
                        2015-10-04 13:34:19                                  Service Control Manager         7036:  ""    .  
                        2015-10-04 13:34:19                                  Service Control Manager         7036:  "    "    .  
                        2015-10-04 13:34:20                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-04 13:34:20                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 13:34:20                                  Service Control Manager         7036:  " "    .  
                        2015-10-04 13:34:20                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-04 13:34:20                                  Service Control Manager         7036:  "   "    .  
                        2015-10-04 13:34:20                                  Service Control Manager         7036:  "   "    .  
                        2015-10-04 13:34:20                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 13:34:20                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 13:34:20                                  Service Control Manager         7036:  "   "    .  
                        2015-10-04 13:34:20                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-04 13:34:21                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-04 13:34:21                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-04 13:34:29                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-04 13:36:20                                  Service Control Manager         7036:  "   "    .  
                        2015-10-04 13:36:20                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-04 13:36:21                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 13:36:21                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-04 13:36:21                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 13:36:23                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-04 13:37:41                                  Service Control Manager         7036:  "    "    .  
                        2015-10-04 13:37:41                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-04 13:37:44                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-04 13:37:45                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-04 13:38:14                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-04 13:39:16                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 13:41:23                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 13:44:20                                  Service Control Manager         7036:  "   "    .  
                        2015-10-04 14:10:02                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 14:10:02                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-04 14:10:12                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-04 14:10:12                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-04 14:13:03                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 14:14:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 14:16:03                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-04 23:00:06                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 23:00:06                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-04 23:03:06                                  Service Control Manager         7036:  "  "    .  
                        2015-10-04 23:06:06                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-04 23:36:19                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-04 23:36:19                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-10-04 23:36:19                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-10-04 23:36:22  LOCAL SERVICE                   Microsoft-Windows-Time-Service  37: NTP-         time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->104.41.150.68:123).  
                        2015-10-04 23:36:35                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-04 23:36:35  LOCAL SERVICE                   Microsoft-Windows-Time-Service  35:          time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->104.41.150.68:123).  
                        2015-10-04 23:36:35  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-04 23:39:47                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-04 23:39:50                                  Service Control Manager         7036:  " "    .  
                        2015-10-04 23:40:16                                  Service Control Manager         7036:  "   "    .  
                        2015-10-04 23:52:49                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-04 23:59:07                                  Service Control Manager         7036:  "   "    .  
                        2015-10-05 00:24:05                                  Service Control Manager         7036:  "   "    .  
                        2015-10-05 00:24:10                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-05 00:24:12  LOCAL SERVICE                   Microsoft-Windows-Time-Service  37: NTP-         time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->23.101.187.68:123).  
                        2015-10-05 00:24:12  LOCAL SERVICE                   Microsoft-Windows-Time-Service  35:          time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->23.101.187.68:123).  
                        2015-10-05 00:24:35  sima                            Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-05 00:26:26                           Service Control Manager         7045:    .     :  Service for Realtek HD Audio (WDM)    :  system32\drivers\RTKVHDA.sys   :        :      :    
                7005       2015-10-05 00:26:27                           Microsoft-Windows-UserPnp       20003:       IntcAzAudAddService      HDAUDIO\FUNC_01&VEN_10EC&DEV_0888&SUBSYS_14627235&REV_1000\4&ADBBC3C&0&0001   : 0.  
                7005       2015-10-05 00:26:27                           Microsoft-Windows-UserPnp       20001:       FileRepository\hdart.inf_x86_neutral_b95248914b096303\hdart.inf      HDAUDIO\FUNC_01&VEN_10EC&DEV_0888&SUBSYS_14627235&REV_1000\4&ADBBC3C&0&0001   : 0x0.  
                        2015-10-05 00:26:47                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 00:35:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 00:41:17                                  Service Control Manager         7036:  "   "    .  
                        2015-10-05 00:53:05                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 00:58:06                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 01:07:09  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-05 01:07:16                                  Service Control Manager         7036:  "  "    .  
                          2015-10-05 01:07:17  sima                            USER32                          1073:   vladimir\sima      VLADIMIR    
                        2015-10-05 01:07:25  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-05 01:07:28                                  EventLog                        6006:    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  ""    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "     "    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "   "    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "   "    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-05 01:07:28                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-05 01:07:28  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-05 01:07:28  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-05 01:07:28                           Microsoft-Windows-Winlogon      7002:           
                4          2015-10-05 01:07:28  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-05 01:07:28  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-05 01:07:28                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-10-05 01:07:29                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-05 01:07:29                                  Service Control Manager         7036:  " "    .  
                        2015-10-05 01:07:29                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-05 01:07:29                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-05 01:07:29                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-10-05 01:07:29                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-05 01:07:41                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-05 08:16:13                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-05 08:16:16                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-05 08:16:21                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-05 08:16:21                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-05 08:16:23                                  nvlddmkm                        
                        2015-10-05 08:16:27                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-05 08:16:27                                  EventLog                        6005:    .  
                        2015-10-05 08:16:27                                  EventLog                        6013:    13 .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  ""    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  ""    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  " "    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  "    "    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  "     "    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  "   "    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  "   "    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-05 08:16:27                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-05 08:16:27                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                4          2015-10-05 08:16:27  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-05 08:16:27  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                7010       2015-10-05 08:16:27                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-05 08:16:28                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-05 08:16:28                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-05 08:16:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 08:16:28                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-10-05 08:16:28                           Microsoft-Windows-Winlogon      7001:           
                        2015-10-05 08:16:29                                  Service Control Manager         7036:  " "    .  
                        2015-10-05 08:16:29                                  Service Control Manager         7036:  " "    .  
                        2015-10-05 08:16:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 08:16:29                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-05 08:16:29                                  Service Control Manager         7036:  " "    .  
                        2015-10-05 08:16:29                                  Service Control Manager         7036:  " "    .  
                        2015-10-05 08:16:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 08:16:29                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-05 08:16:29                                  Service Control Manager         7036:  "    "    .  
                        2015-10-05 08:16:29                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-05 08:16:29                                  Service Control Manager         7036:  ""    .  
                        2015-10-05 08:16:29                                  Service Control Manager         7036:  "   "    .  
                        2015-10-05 08:16:29                                  Service Control Manager         7036:  " "    .  
                        2015-10-05 08:16:29                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-05 08:16:29                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-05 08:16:29                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-05 08:16:29                                  Service Control Manager         7036:  "   "    .  
                        2015-10-05 08:16:29                                  Service Control Manager         7036:  ""    .  
                        2015-10-05 08:16:31                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-05 08:16:31                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 08:16:31                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 08:16:31                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-05 08:16:31                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 08:16:31                                  Service Control Manager         7036:  "   "    .  
                        2015-10-05 08:16:31                                  Service Control Manager         7036:  "   "    .  
                        2015-10-05 08:16:31                                  Service Control Manager         7036:  "   "    .  
                        2015-10-05 08:16:31                                  Service Control Manager         7036:  " "    .  
                        2015-10-05 08:16:31                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-05 08:16:31                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-05 08:16:31                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-05 08:16:41                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-05 08:18:31                                  Service Control Manager         7036:  "   "    .  
                        2015-10-05 08:18:31                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-05 08:18:31                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 08:18:31                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-05 08:18:32                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 08:18:33                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-05 08:21:43                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 08:23:33                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 08:26:31                                  Service Control Manager         7036:  "   "    .  
                        2015-10-05 08:41:04                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 08:41:04                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-05 08:41:05                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-05 08:41:05                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-05 08:44:06                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 08:46:30                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 08:49:30                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 08:52:30                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-05 08:52:59                                  Service Control Manager         7036:  "  "    .  
                7005       2015-10-05 08:52:59                           Microsoft-Windows-UserPnp       20003:       USBSTOR      USB\VID_0951&PID_1665\50E549C6942EFD60793F2ACE   : 0.  
                7005       2015-10-05 08:52:59                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbstor.inf_x86_neutral_c77d41a490bdc63d\usbstor.inf      USB\VID_0951&PID_1665\50E549C6942EFD60793F2ACE   : 0x0.  
                7005       2015-10-05 08:53:01                           Microsoft-Windows-UserPnp       20003:       disk      USBSTOR\DISK&VEN_KINGSTON&PROD_DATATRAVELER_2.0&REV_1.00\50E549C6942EFD60793F2ACE&0   : 0.  
                7005       2015-10-05 08:53:01                           Microsoft-Windows-UserPnp       20001:       FileRepository\disk.inf_x86_neutral_b431b61a11f8df6c\disk.inf      USBSTOR\DISK&VEN_KINGSTON&PROD_DATATRAVELER_2.0&REV_1.00\50E549C6942EFD60793F2ACE&0   : 0x0.  
                        2015-10-05 08:53:02                                  Service Control Manager         7036:  "   "    .  
                7005       2015-10-05 08:53:02                           Microsoft-Windows-UserPnp       20003:       volsnap      STORAGE\VOLUME\_??_USBSTOR#DISK&VEN_KINGSTON&PROD_DATATRAVELER_2.0&REV_1.00#50E549C6942EFD60793F2ACE&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}   : 0.  
                7005       2015-10-05 08:53:02                           Microsoft-Windows-UserPnp       20001:       FileRepository\volume.inf_x86_neutral_6dee0205881d1a1d\volume.inf      STORAGE\VOLUME\_??_USBSTOR#DISK&VEN_KINGSTON&PROD_DATATRAVELER_2.0&REV_1.00#50E549C6942EFD60793F2ACE&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}   : 0x0.  
                        2015-10-05 08:53:13                                  Service Control Manager         7036:  "    "    .  
                        2015-10-05 08:53:13                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-05 08:53:19                                  Service Control Manager         7036:  "   "    .  
                7005       2015-10-05 08:53:20                           Microsoft-Windows-UserPnp       20003:       umbus      UMB\UMB\1&841921D&0&WPDBUSENUMROOT   : 0.  
                7005       2015-10-05 08:53:20                           Microsoft-Windows-UserPnp       20001:       FileRepository\umbus.inf_x86_neutral_79120b2cb6857971\umbus.inf      UMB\UMB\1&841921D&0&WPDBUSENUMROOT   : 0x0.  
                        2015-10-05 08:53:21                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-05 08:53:21                           Service Control Manager         7040:    "Windows Driver Foundation - User-mode Driver Framework"    ""  "".  
                        2015-10-05 08:53:21                           Service Control Manager         7045:    .     :  WUDFRd    :  system32\DRIVERS\WUDFRd.sys   :        :      :    
                48         2015-10-05 08:53:21                           Microsoft-Windows-DriverFrameworks-UserMode  10000:  ,       1.9.0,    WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_KINGSTON&PROD_DATATRAVELER_2.0&REV_1.00#50E549C6942EFD60793F2ACE&0#.  
                48         2015-10-05 08:53:21                           Microsoft-Windows-DriverFrameworks-UserMode  10001:      WpdFs (CLSID {112DE495-AC4C-46F8-B663-6A4266C53313}) .      1.9.0    .  
                48         2015-10-05 08:53:21                           Microsoft-Windows-DriverFrameworks-UserMode  10100:     .  
                7005       2015-10-05 08:53:21                           Microsoft-Windows-UserPnp       20003:       WUDFRd      WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_KINGSTON&PROD_DATATRAVELER_2.0&REV_1.00#50E549C6942EFD60793F2ACE&0#   : 0.  
                16         2015-10-05 08:53:22                                  WPDClassInstaller               
                32         2015-10-05 08:53:22                                  WPDClassInstaller               
                32         2015-10-05 08:53:22                                  WPDClassInstaller               
                7005       2015-10-05 08:53:22                           Microsoft-Windows-UserPnp       20001:       FileRepository\wpdfs.inf_x86_neutral_fc4ebadff3a40ae4\wpdfs.inf      WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_KINGSTON&PROD_DATATRAVELER_2.0&REV_1.00#50E549C6942EFD60793F2ACE&0#   : 0x0.  
                        2015-10-05 08:53:34                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-05 08:53:34                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-10-05 08:53:34                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-10-05 08:53:37  LOCAL SERVICE                   Microsoft-Windows-Time-Service  37: NTP-         time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->104.209.134.106:123).  
                        2015-10-05 08:53:51                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-05 08:53:51  LOCAL SERVICE                   Microsoft-Windows-Time-Service  35:          time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->104.209.134.106:123).  
                        2015-10-05 08:53:51  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-05 08:56:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 08:59:29                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-05 08:59:43                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 09:03:33                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 09:08:34                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 09:10:04                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-05 09:12:08                                  Service Control Manager         7036:  "   "    .  
                        2015-10-05 09:13:06                                  Service Control Manager         7036:  "  "    .  
                          2015-10-05 09:15:00  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     gstaticadssl.l.google.com        DNS.  
                        2015-10-05 09:18:06                                  Service Control Manager         7036:  "  "    .  
                          2015-10-05 09:19:37  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     top-fwz1.mail.ru        DNS.  
                        2015-10-05 10:02:00                                  Service Control Manager         7036:  "   "    .  
                        2015-10-05 10:12:00                                  Service Control Manager         7036:  "   "    .  
                          2015-10-05 10:44:03  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 10:49:17  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 10:53:55  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 10:58:58  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 11:03:38  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     safebrowsing.google.com        DNS.  
                          2015-10-05 11:08:48  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-05 11:09:18                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-05 11:09:19                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-05 11:09:19                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-05 12:00:18                                  EventLog                        6013:    13445 .  
                12         2015-10-05 12:02:45  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:     :            :     . . . . . . . . . . : ASUS USB-N10 150Mbps 11n Wireless USB dongle     . . . . . . . : ASUSTeK Computer Inc.     . . . . . . . . . . : Realtek Semiconductor Corp.     . . . . . . . . . . : 1021.3.912.2012     INF- . . . . . . . . . : C:\Windows\INF\oem2.inf     INF- . . . . . . . . . : 19  2013 .  14:56:04        . . . . . . . . . : RTL8192cu.ndi      . . . . . . . . . : usb\vid_0b05&pid_17ba       . . . . . : 0x180600a        . . : 0     If  . . . . . . . . . . . . : 71       . . . . . . : 9   
                12         2015-10-05 12:02:45  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:     :             :     . . . . . . . . . . :   Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC (NDIS 6.20)     . . . . . . . : Realtek     . . . . . . . . . . : Microsoft     . . . . . . . . . . : 7.2.1127.2008     INF- . . . . . . . . . : C:\Windows\INF\netrtx32.inf     INF- . . . . . . . . . : 13  2009 .  20:46:34        . . . . . . . . . : RTL8169.ndi      . . . . . . . . . : pci\ven_10ec&dev_8167       . . . . . : 0x180200a        . . : 0     If  . . . . . . . . . . . . : 6       . . . . . . : 14   
                12         2015-10-05 12:02:45  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:        :          GUID : 211835d6-e914-4a4d-824e-a3809356f2d8   : ASUS USB-N10 150Mbps 11n Wireless USB dongle   :  WiFi         : 3      :  : 0,  : 0          3      :   - 0;   - 0      :   - 1    : Windows Phone8415     SSID: Windows Phone8415      SSID: 17      :      :        :            :      :       : 0x00028002       2      :   - 0;   - 0      :   - 1    : Windows Phone8415     SSID: Windows Phone8415      SSID: 17      :      :        :            :      :       : 0x00028002       2   : 2015-10-05 11:09:20-559     : 2   : Windows Phone8415   SSID: Windows Phone8415    SSID: 17    :    :                 (IHV):      ,     (IHV):        :      :      :  0x00038002      : 0x00000002       1      :   - 1;   - 1   BSS  PHY  (RSSI)  SSID   ------------------------------------------------------------------------------     b   100   Windows Phone8415      :   - 1    : Windows Phone8415     SSID: Windows Phone8415      SSID: 17      :      :        :            :      :        1   : 2015-10-05 08:53:33-070     : 1   : Windows Phone8415   SSID: Windows Phone8415    SSID: 17    :    :                 (IHV):      ,     (IHV):        :      :      :        :  48-50-73-ed-a0-be            : WPA2-PSK      : CCMP(AES)     802.1X:       :        :        :        : 0       : 0        :             Ndis Rx: 0     Ndis Tx: 0       : 3       : 0       : 0       : 0      : 591      : 0      : 10      : 0      : 0      : 0         : 0        ACK: 0     : : 1      : 2015-10-05 11:09:08-383       BSSID:  48-50-73-ed-a0-be      : 0x00000007    BSSID:  00-00-00-00-00-00   : 0x00000205    
                12         2015-10-05 12:02:45  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:      :            .     .    :  WiFi MSM   :        GUID : 211835d6-e914-4a4d-824e-a3809356f2d8   : ASUS USB-N10 150Mbps 11n Wireless USB dongle   :  WiFi  :     SSID: (  )   SSID: 0   : < >  :         :    :         
                12         2015-10-05 12:02:45  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:        :            .     .    :    :        GUID : 211835d6-e914-4a4d-824e-a3809356f2d8   : ASUS USB-N10 150Mbps 11n Wireless USB dongle   :  WiFi   :     : RNWF MSM Helper Class   : <DiagnosticsText><Title><![CDATA[Windows        ]]></Title><Description><![CDATA[   ,       .]]></Description><Parameters><Parameter><Name><![CDATA[SSID]]></Name><Value><![CDATA[]]></Value></Parameter></Parameters><Extensions><Extension><Name><![CDATA[Keyword]]></Name><Value><![CDATA[  ]]></Value></Extension><Extension><Name><![CDATA[Keyword]]></Name><Value><![CDATA[]]></Va    ():  Windows             :           -   .             Windows.    
                4          2015-10-05 12:02:45  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  4000:      .    :        : Dot3HelperClass     :           Guid  : {4DA030B8-86E5-4B6A-A879-2FFF8443B527}      :  Ethernet-    Ethernet-    ,       .         . ,        .    ,   .     Guid : {1296DFF0-D04E-4BE1-A512-90F04DDFA3E6}      (),   : 0      ,   : 0    :     ({B788672F-6878-4DCD-8605-75D838605432})  
                4          2015-10-05 12:02:45  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  4000:      .    :        : AutoConfig Helper Class     : Windows            ,       .     Guid  : {7452F6E5-11BC-4B8B-877B-8BC9EEE51DBF}      :           -   .             Windows.     Guid : {A7D9DC2B-A0E0-4DFA-A723-E16891A4FAD4}      (),   : 300      ,   : 0    :    ({211835D6-E914-4A4D-824E-A3809356F2D8})  
                4          2015-10-05 12:02:45  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  4000:      .    :        : AutoConfig Helper Class     : Windows            ,       .     Guid  : {7452F6E5-11BC-4B8B-877B-8BC9EEE51DBF}      :     .     "  "        .     Guid : {07D37F7B-FA5E-4443-BDA7-AB107B29AFB9}      (),   : 300      ,   : 80    :    ({211835D6-E914-4A4D-824E-A3809356F2D8})  
                        2015-10-05 12:02:46                                  Service Control Manager         7036:  "  "    .  
                12         2015-10-05 12:03:06  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:     :            :     . . . . . . . . . . : ASUS USB-N10 150Mbps 11n Wireless USB dongle     . . . . . . . : ASUSTeK Computer Inc.     . . . . . . . . . . : Realtek Semiconductor Corp.     . . . . . . . . . . : 1021.3.912.2012     INF- . . . . . . . . . : C:\Windows\INF\oem2.inf     INF- . . . . . . . . . : 19  2013 .  14:56:04        . . . . . . . . . : RTL8192cu.ndi      . . . . . . . . . : usb\vid_0b05&pid_17ba       . . . . . : 0x180600a        . . : 0     If  . . . . . . . . . . . . : 71       . . . . . . : 9   
                12         2015-10-05 12:03:06  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:     :             :     . . . . . . . . . . :   Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC (NDIS 6.20)     . . . . . . . : Realtek     . . . . . . . . . . : Microsoft     . . . . . . . . . . : 7.2.1127.2008     INF- . . . . . . . . . : C:\Windows\INF\netrtx32.inf     INF- . . . . . . . . . : 13  2009 .  20:46:34        . . . . . . . . . : RTL8169.ndi      . . . . . . . . . : pci\ven_10ec&dev_8167       . . . . . : 0x180200a        . . : 0     If  . . . . . . . . . . . . : 6       . . . . . . : 14   
                12         2015-10-05 12:03:06  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:        :          GUID : 211835d6-e914-4a4d-824e-a3809356f2d8   : ASUS USB-N10 150Mbps 11n Wireless USB dongle   :  WiFi         : 1      :  : 0,  : 0          1      :   - 0;   - 0      :   - 1    : Windows Phone8415     SSID: Windows Phone8415      SSID: 17      :      :        :            :      :       : 0x00028002    
                12         2015-10-05 12:03:06  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:      :            .     .    :  WiFi MSM   :        GUID : 211835d6-e914-4a4d-824e-a3809356f2d8   : ASUS USB-N10 150Mbps 11n Wireless USB dongle   :  WiFi  :     SSID: (  )   SSID: 0   : < >  :         :    :         
                12         2015-10-05 12:03:06  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:        :            .     .    :    :        GUID : 211835d6-e914-4a4d-824e-a3809356f2d8   : ASUS USB-N10 150Mbps 11n Wireless USB dongle   :  WiFi   :     : RNWF MSM Helper Class   : <DiagnosticsText><Title><![CDATA[Windows        ]]></Title><Description><![CDATA[   ,       .]]></Description><Parameters><Parameter><Name><![CDATA[SSID]]></Name><Value><![CDATA[]]></Value></Parameter></Parameters><Extensions><Extension><Name><![CDATA[Keyword]]></Name><Value><![CDATA[  ]]></Value></Extension><Extension><Name><![CDATA[Keyword]]></Name><Value><![CDATA[]]></Va    ():  Windows             :           -   .             Windows.    
                4          2015-10-05 12:03:06  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  4000:      .    :        : Dot3HelperClass     :           Guid  : {4DA030B8-86E5-4B6A-A879-2FFF8443B527}      :  Ethernet-    Ethernet-    ,       .         . ,        .    ,   .     Guid : {1296DFF0-D04E-4BE1-A512-90F04DDFA3E6}      (),   : 0      ,   : 0    :     ({B788672F-6878-4DCD-8605-75D838605432})  
                4          2015-10-05 12:03:06  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  4000:      .    :        : AutoConfig Helper Class     : Windows            ,       .     Guid  : {7452F6E5-11BC-4B8B-877B-8BC9EEE51DBF}      :           -   .             Windows.     Guid : {A7D9DC2B-A0E0-4DFA-A723-E16891A4FAD4}      (),   : 300      ,   : 0    :    ({211835D6-E914-4A4D-824E-A3809356F2D8})  
                4          2015-10-05 12:03:06  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  4000:      .    :        : AutoConfig Helper Class     : Windows            ,       .     Guid  : {7452F6E5-11BC-4B8B-877B-8BC9EEE51DBF}      :     .     "  "        .     Guid : {07D37F7B-FA5E-4443-BDA7-AB107B29AFB9}      (),   : 300      ,   : 80    :    ({211835D6-E914-4A4D-824E-A3809356F2D8})  
                7          2015-10-05 12:03:06  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  5100:         .     :        : AutoConfig Helper Class      :     .     "  "        .     Guid : {07D37F7B-FA5E-4443-BDA7-AB107B29AFB9}     n,    ,   .   NDF     .        NDF .  
                        2015-10-05 12:07:47                                  Service Control Manager         7036:  "  "    .  
                            2015-10-05 12:14:52                                  ipnathlp                        
                        2015-10-05 12:14:52                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-05 12:14:58                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                          2015-10-05 12:15:03  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 12:19:53  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     js-agent.newrelic.com        DNS.  
                          2015-10-05 12:23:03  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 12:27:51  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 12:28:04  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                          2015-10-05 12:33:45  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 12:38:41  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 12:43:45  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 12:49:50  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                          2015-10-05 13:03:27  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 13:08:24  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 14:03:43  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 14:08:49  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 14:13:46  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 14:23:30  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 14:28:32  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 14:33:50  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 14:38:07  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 14:43:55  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 14:48:03  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 14:53:42  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 14:58:32  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 15:03:26  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 15:08:11  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-05 15:13:53  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-05 15:50:42                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-05 15:50:43                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-05 15:50:43                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-05 16:09:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 16:14:36                                  Service Control Manager         7036:  "  "    .  
                            2015-10-05 17:11:52                                  ipnathlp                        
                        2015-10-05 17:11:52                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-05 17:16:58                                  Service Control Manager         7036:  "   "    .  
                        2015-10-05 17:26:58                                  Service Control Manager         7036:  "   "    .  
                        2015-10-05 17:36:21                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 17:36:21  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-05 17:36:23                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-05 17:36:23                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 17:36:23  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-05 17:36:23                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-05 17:36:24                                  EventLog                        6006:    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  ""    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "     "    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "   "    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "   "    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "  "    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  " "    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-05 17:36:24                                  Service Control Manager         7036:  "  WLAN"    .  
                4          2015-10-05 17:36:24  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-05 17:36:24  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-05 17:36:24                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-10-05 17:36:24                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                103        2015-10-05 17:36:25                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-05 17:36:36                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-07 07:26:06                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-07 07:26:09                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-07 07:26:14                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-07 07:26:14                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-07 07:26:16                                  nvlddmkm                        
                        2015-10-07 07:26:17                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-07 07:26:17                                  EventLog                        6005:    .  
                        2015-10-07 07:26:17                                  EventLog                        6013:    11 .  
                        2015-10-07 07:26:17                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-07 07:26:17                                  Service Control Manager         7036:  ""    .  
                        2015-10-07 07:26:17                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-07 07:26:17                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-07 07:26:17                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-07 07:26:17                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-07 07:26:17                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:26:17                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-07 07:26:17                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-07 07:26:18                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-07 07:26:18                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-07 07:26:18                                  Service Control Manager         7036:  ""    .  
                        2015-10-07 07:26:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:26:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:26:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-07 07:26:19                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-07 07:26:19                                  Service Control Manager         7036:  "    "    .  
                        2015-10-07 07:26:19                                  Service Control Manager         7036:  "     "    .  
                        2015-10-07 07:26:19                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 07:26:20                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-07 07:26:20                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 07:26:20                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-07 07:26:20                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-07 07:26:20                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-07 07:26:20                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-07 07:26:20                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-07 07:26:20                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-07 07:26:20                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:26:20                                  Service Control Manager         7036:  " "    .  
                        2015-10-07 07:26:20                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-10-07 07:26:20                           Microsoft-Windows-Winlogon      7001:           
                4          2015-10-07 07:26:20  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-07 07:26:20  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-07 07:26:21                                  Service Control Manager         7036:  " "    .  
                        2015-10-07 07:26:21                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:26:21                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-07 07:26:21                                  Service Control Manager         7036:  " "    .  
                        2015-10-07 07:26:21                                  Service Control Manager         7036:  " "    .  
                        2015-10-07 07:26:21                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:26:21                                  Service Control Manager         7036:  " "    .  
                        2015-10-07 07:26:21                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-07 07:26:21                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-07 07:26:21                                  Service Control Manager         7036:  ""    .  
                        2015-10-07 07:26:21                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-07 07:26:21                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 07:26:22                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-07 07:26:22                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-07 07:26:22                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 07:26:22                                  Service Control Manager         7036:  ""    .  
                        2015-10-07 07:26:22                                  Service Control Manager         7036:  "    "    .  
                        2015-10-07 07:26:23                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-07 07:26:23                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:26:23                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:26:23                                  Service Control Manager         7036:  " "    .  
                        2015-10-07 07:26:23                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:26:23                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 07:26:23                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-07 07:26:23                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 07:26:23                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 07:26:23                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-07 07:26:24                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-07 07:26:24                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-07 07:26:25                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-10-07 07:26:28                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-10-07 07:26:31                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-07 07:26:44                                  Service Control Manager         7036:  "    "    .  
                        2015-10-07 07:26:44                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-07 07:26:46                                  Service Control Manager         7036:  "   Windows"    .  
                7005       2015-10-07 07:27:17                           Microsoft-Windows-UserPnp       20003:       usbccgp      USB\VID_0421&PID_0661\004A009000C9005F0000000000000000   : 0.  
                7005       2015-10-07 07:27:18                           Microsoft-Windows-UserPnp       20001:       FileRepository\usb.inf_x86_neutral_2620fd493cad7d41\usb.inf      USB\VID_0421&PID_0661\004A009000C9005F0000000000000000   : 0x0.  
                7005       2015-10-07 07:27:18                           Microsoft-Windows-UserPnp       20001:       NULL Driver      USB\VID_0421&PID_0661&MI_01\6&2B3DC919&0&0001   : 0xe0000203.  
                48         2015-10-07 07:27:19                           Microsoft-Windows-DriverFrameworks-UserMode  10000:  ,       1.9.0,    USB\VID_0421&PID_0661&MI_00\6&2B3DC919&0&0000.  
                48         2015-10-07 07:27:19                           Microsoft-Windows-DriverFrameworks-UserMode  10001:      WpdMtpDriver (CLSID {AAAE762B-A6A2-4C45-B5D8-9A83AFB6BB70}) .      1.9.0    .  
                7005       2015-10-07 07:27:19                           Microsoft-Windows-UserPnp       20001:       NULL Driver      USB\VID_0421&PID_0661&MI_02\6&2B3DC919&0&0002   : 0xe0000203.  
                7005       2015-10-07 07:27:19                           Microsoft-Windows-UserPnp       20001:       NULL Driver      USB\VID_0421&PID_0661&MI_03\6&2B3DC919&0&0003   : 0xe0000203.  
                48         2015-10-07 07:27:20                           Microsoft-Windows-DriverFrameworks-UserMode  10100:     .  
                        2015-10-07 07:27:21                           Service Control Manager         7045:    .     :  WinUsb    :  system32\DRIVERS\WinUsb.sys   :        :      :    
                7005       2015-10-07 07:27:21                           Microsoft-Windows-UserPnp       20003:       WUDFRd      USB\VID_0421&PID_0661&MI_00\6&2B3DC919&0&0000   : 0.  
                7005       2015-10-07 07:27:21                           Microsoft-Windows-UserPnp       20003:       WinUsb      USB\VID_0421&PID_0661&MI_00\6&2B3DC919&0&0000   : 0.  
                16         2015-10-07 07:27:28                                  WPDClassInstaller               
                32         2015-10-07 07:27:28                                  WPDClassInstaller               
                32         2015-10-07 07:27:28                                  WPDClassInstaller               
                        2015-10-07 07:27:29                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-07 07:27:29                           Service Control Manager         7040:    "   Windows (WIA)"    ""  "".  
                7005       2015-10-07 07:27:30                           Microsoft-Windows-UserPnp       20001:       FileRepository\wpdmtp.inf_x86_neutral_28f06ca2e38e8979\wpdmtp.inf      USB\VID_0421&PID_0661&MI_00\6&2B3DC919&0&0000   : 0x0.  
                        2015-10-07 07:28:23                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 07:28:23                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:28:24                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-07 07:28:24                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:28:25                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-07 07:32:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:33:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:35:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:36:32                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-07 07:36:33                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-07 07:42:55                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-07 07:43:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:46:34                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 07:47:56                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:48:05                                  Service Control Manager         7036:  " "    .  
                        2015-10-07 07:49:15  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-07 07:49:18                                  EventLog                        6006:    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  ""    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  "     "    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 07:49:18                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-07 07:49:18  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-07 07:49:18                           Microsoft-Windows-Winlogon      7002:           
                4          2015-10-07 07:49:18  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-07 07:49:18  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-07 07:49:18                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-10-07 07:49:19                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-07 07:49:19                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-07 07:49:19                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-07 07:49:19                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-07 07:49:19                                  Service Control Manager         7036:  " "    .  
                        2015-10-07 07:49:19                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-07 07:49:19                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-07 07:49:19                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-07 07:49:19                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-10-07 07:49:19                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-07 07:49:21                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-07 10:25:36                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-07 10:25:39                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-07 10:25:44                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-07 10:25:44                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-07 10:25:47                                  nvlddmkm                        
                        2015-10-07 10:25:47                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-07 10:25:47                                  EventLog                        6005:    .  
                        2015-10-07 10:25:47                                  EventLog                        6013:    11 .  
                        2015-10-07 10:25:47                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-07 10:25:47                                  Service Control Manager         7036:  ""    .  
                        2015-10-07 10:25:47                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-07 10:25:47                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-07 10:25:47                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-07 10:25:47                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-07 10:25:47                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 10:25:47                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-07 10:25:47                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-07 10:25:48                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-07 10:25:48                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-07 10:25:49                                  Service Control Manager         7036:  ""    .  
                        2015-10-07 10:25:49                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 10:25:49                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 10:25:49                                  Service Control Manager         7036:  " "    .  
                        2015-10-07 10:25:49                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-07 10:25:49                                  Service Control Manager         7036:  "    "    .  
                        2015-10-07 10:25:49                                  Service Control Manager         7036:  "     "    .  
                        2015-10-07 10:25:49                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 10:25:49                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-07 10:25:50                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 10:25:50                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-07 10:25:50                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-07 10:25:50                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-07 10:25:50                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-07 10:25:50                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-07 10:25:50                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-07 10:25:50                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 10:25:50                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-10-07 10:25:50                           Microsoft-Windows-Winlogon      7001:           
                4          2015-10-07 10:25:50  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-07 10:25:50  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-07 10:25:51                                  Service Control Manager         7036:  " "    .  
                        2015-10-07 10:25:51                                  Service Control Manager         7036:  " "    .  
                        2015-10-07 10:25:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 10:25:51                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-07 10:25:51                                  Service Control Manager         7036:  " "    .  
                        2015-10-07 10:25:51                                  Service Control Manager         7036:  " "    .  
                        2015-10-07 10:25:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 10:25:51                                  Service Control Manager         7036:  " "    .  
                        2015-10-07 10:25:51                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-07 10:25:52                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-07 10:25:52                                  Service Control Manager         7036:  ""    .  
                        2015-10-07 10:25:52                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-07 10:25:52                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 10:25:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-07 10:25:52                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-07 10:25:52                                  Service Control Manager         7036:  "    "    .  
                        2015-10-07 10:25:52                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-07 10:25:53                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 10:25:53                                  Service Control Manager         7036:  ""    .  
                        2015-10-07 10:25:54                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-07 10:25:54                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 10:25:54                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 10:25:54                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 10:25:54                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 10:25:54                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-07 10:25:54                                  Service Control Manager         7036:  " "    .  
                        2015-10-07 10:25:54                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 10:25:54                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 10:25:54                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-07 10:25:56                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-07 10:25:56                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-07 10:26:02                                  Service Control Manager         7036:  "Windows Search"    .  
                            2015-10-07 10:26:55                                  ipnathlp                        
                        2015-10-07 10:26:56                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-10-07 10:26:56                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-10-07 10:27:12                                  Service Control Manager         7036:  "    "    .  
                        2015-10-07 10:27:12                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-07 10:27:13                                  Service Control Manager         7036:  "   Windows"    .  
                          2015-10-07 10:27:41  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     safebrowsing.google.com        DNS.  
                        2015-10-07 10:27:54                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 10:27:54                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 10:27:54                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-07 10:27:55                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 10:27:56                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-07 10:28:33                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-07 10:31:02                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 10:32:56                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 10:35:54                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 10:42:34                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 10:43:26                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-07 10:47:35                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 11:05:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 11:09:08                                  Service Control Manager         7036:  " "    .  
                        2015-10-07 11:19:08                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 11:19:08                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-07 11:22:10                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 11:25:10                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                          2015-10-07 11:27:24  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-07 11:34:30                                  Service Control Manager         7036:  " "    .  
                          2015-10-07 11:41:23  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     tao.ru        DNS.  
                          2015-10-07 11:42:08  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-07 11:47:01  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     img.alicdn.com        DNS.  
                          2015-10-07 11:52:14  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.google.ru        DNS.  
                        2015-10-07 12:00:27                                  EventLog                        6013:    5690 .  
                        2015-10-07 12:03:17                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 12:13:17                                  Service Control Manager         7036:  "   "    .  
                          2015-10-07 12:13:18  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.wildberries.ru        DNS.  
                        2015-10-07 12:59:15                                  Service Control Manager         7036:  " "    .  
                          2015-10-07 13:37:26  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-07 13:40:31                                  Service Control Manager         7036:  " "    .  
                        2015-10-07 13:46:09  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-07 13:46:10                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 13:46:12                                  EventLog                        6006:    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  ""    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  "     "    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  "   "    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  "  "    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-07 13:46:12                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-07 13:46:12  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-07 13:46:12                           Microsoft-Windows-Winlogon      7002:           
                4          2015-10-07 13:46:12  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-07 13:46:12  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-07 13:46:12                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-10-07 13:46:13                                  Service Control Manager         7036:  " "    .  
                        2015-10-07 13:46:13                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-07 13:46:13                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-07 13:46:13                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-07 13:46:13                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-10-07 13:46:13                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-07 13:46:25                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-08 07:34:36                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-08 07:34:39                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-08 07:34:46                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-08 07:34:46                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-08 07:34:49                                  nvlddmkm                        
                        2015-10-08 07:34:49                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-08 07:34:49                                  Service Control Manager         7036:  ""    .  
                        2015-10-08 07:34:49                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-08 07:34:49                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-08 07:34:49                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-08 07:34:49                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-08 07:34:49                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-08 07:34:50                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-08 07:34:50                                  EventLog                        6005:    .  
                        2015-10-08 07:34:50                                  EventLog                        6013:    13 .  
                        2015-10-08 07:34:50                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-08 07:34:50                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 07:34:50                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-08 07:34:50                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-08 07:34:50                                  Service Control Manager         7036:  ""    .  
                        2015-10-08 07:34:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 07:34:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 07:34:51                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-08 07:34:51                                  Service Control Manager         7036:  " "    .  
                        2015-10-08 07:34:51                                  Service Control Manager         7036:  "    "    .  
                        2015-10-08 07:34:51                                  Service Control Manager         7036:  "     "    .  
                        2015-10-08 07:34:51                                  Service Control Manager         7036:  "   "    .  
                        2015-10-08 07:34:51                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-08 07:34:51                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-08 07:34:51                                  Service Control Manager         7036:  "   "    .  
                        2015-10-08 07:34:51                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-08 07:34:51                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-08 07:34:51                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-08 07:34:51                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-08 07:34:51                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-08 07:34:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 07:34:51                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-10-08 07:34:51  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-08 07:34:51  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-08 07:34:52                                  Service Control Manager         7036:  " "    .  
                        2015-10-08 07:34:52                                  Service Control Manager         7036:  " "    .  
                        2015-10-08 07:34:52                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 07:34:52                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-08 07:34:52                                  Service Control Manager         7036:  " "    .  
                        2015-10-08 07:34:52                                  Service Control Manager         7036:  " "    .  
                        2015-10-08 07:34:52                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 07:34:52                                  Service Control Manager         7036:  " "    .  
                1101       2015-10-08 07:34:52                           Microsoft-Windows-Winlogon      7001:           
                        2015-10-08 07:34:53                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-08 07:34:53                                  Service Control Manager         7036:  "    "    .  
                        2015-10-08 07:34:53                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-08 07:34:53                                  Service Control Manager         7036:  ""    .  
                        2015-10-08 07:34:53                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-08 07:34:53                                  Service Control Manager         7036:  "   "    .  
                        2015-10-08 07:34:53                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-08 07:34:53                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-08 07:34:53                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-08 07:34:54                                  Service Control Manager         7036:  ""    .  
                        2015-10-08 07:34:54                                  Service Control Manager         7036:  "   "    .  
                        2015-10-08 07:34:55                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-08 07:34:55                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 07:34:55                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 07:34:55                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 07:34:55                                  Service Control Manager         7036:  " "    .  
                        2015-10-08 07:34:55                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-08 07:34:55                                  Service Control Manager         7036:  "   "    .  
                        2015-10-08 07:34:55                                  Service Control Manager         7036:  "   "    .  
                        2015-10-08 07:34:55                                  Service Control Manager         7036:  "   "    .  
                        2015-10-08 07:34:55                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-08 07:34:57                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-08 07:34:57                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-08 07:35:02                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-08 07:36:55                                  Service Control Manager         7036:  "   "    .  
                        2015-10-08 07:36:55                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-08 07:36:56                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 07:36:56                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-08 07:36:56                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 07:36:58                                  Service Control Manager         7036:  "  Windows"    .  
                7005       2015-10-08 07:38:58                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-10-08 07:39:00                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-08 07:40:02                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 07:40:18                                  Service Control Manager         7036:  "    "    .  
                        2015-10-08 07:40:18                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-08 07:40:18                           Microsoft-Windows-Application-Experience  206:          .  
                          2015-10-08 07:41:37  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     world.taobao.com.danuoyi.tbcache.com        DNS.  
                        2015-10-08 07:41:57                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 07:44:55                                  Service Control Manager         7036:  "   "    .  
                          2015-10-08 07:50:00  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     gdetoedet.ru        DNS.  
                        2015-10-08 07:55:30                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-10-08 07:58:02  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-08 07:59:53                                  Service Control Manager         7036:  " "    .  
                        2015-10-08 07:59:53                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-08 08:00:48                                  Service Control Manager         7036:  "   "    .  
                        2015-10-08 08:04:15                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 08:10:48                                  Service Control Manager         7036:  "   "    .  
                        2015-10-08 08:11:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 08:14:52                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 08:59:13                                  Service Control Manager         7036:  " "    .  
                        2015-10-08 09:01:45                                  Service Control Manager         7036:  " "    .  
                        2015-10-08 09:27:42                                  Service Control Manager         7036:  " "    .  
                        2015-10-08 09:34:41                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 09:34:42                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-08 09:37:43                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 09:40:43                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-08 09:48:01                                  Service Control Manager         7036:  " "    .  
                          2015-10-08 09:53:16  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     people.directory.live.com        DNS.  
                          2015-10-08 09:54:04  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     people.directory.live.com        DNS.  
                          2015-10-08 09:59:24  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                          2015-10-08 10:04:09  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     safebrowsing.google.com        DNS.  
                        2015-10-08 10:05:52                                  Service Control Manager         7036:  " "    .  
                          2015-10-08 10:09:22  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-08 10:30:53                                  Service Control Manager         7036:  " "    .  
                          2015-10-08 11:12:05  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-08 11:13:11                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-08 11:13:11                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-08 11:13:11                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-08 11:13:16                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-08 11:13:28  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-08 11:30:28  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     x.cnt.my        DNS.  
                        2015-10-08 12:00:29                                  EventLog                        6013:    15953 .  
                          2015-10-08 12:05:20  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.taobao.com        DNS.  
                          2015-10-08 12:11:46  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     vip.tmall.com        DNS.  
                          2015-10-08 12:43:31  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                          2015-10-08 12:49:43  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                          2015-10-08 13:48:49  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     item.taobao.com.danuoyi.tbcache.com        DNS.  
                          2015-10-08 13:53:23  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     profile.madnet.ru        DNS.  
                          2015-10-08 14:21:15  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www-google-analytics.l.google.com        DNS.  
                          2015-10-08 14:23:25  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                          2015-10-08 14:28:37  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-08 14:33:34  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-08 14:38:28  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-08 14:43:30  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-08 15:00:02                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-08 15:00:03                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-08 15:00:03                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-08 15:02:09                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                            2015-10-08 15:02:10                                  ipnathlp                        
                          2015-10-08 15:54:55  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     img1.labirint.ru        DNS.  
                          2015-10-08 16:10:47  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     1234.my6cduffll8cavbt70amyfxw.15684432.cmos.greencompute.org        DNS.  
                          2015-10-08 16:29:56  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                          2015-10-08 16:57:14  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     adhands.ru        DNS.  
                          2015-10-08 17:24:29  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                          2015-10-08 19:17:33  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-08 22:05:21                                  Service Control Manager         7036:  "   "    .  
                        2015-10-08 22:05:22                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 22:05:28                                  Service Control Manager         7036:  "   "    .  
                        2015-10-08 22:07:21                                  Service Control Manager         7036:  "   "    .  
                        2015-10-08 22:11:48                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 22:15:28                                  Service Control Manager         7036:  "   "    .  
                        2015-10-08 23:03:49                                  Service Control Manager         7036:  "  "    .  
                          2015-10-08 23:04:00  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     addons.cdn.mozilla.net        DNS.  
                          2015-10-08 23:07:33  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-08 23:08:49                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 23:13:26                                  Service Control Manager         7036:  "   "    .  
                        2015-10-08 23:15:50  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-08 23:15:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 23:15:53                                  EventLog                        6006:    .  
                        2015-10-08 23:15:53                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-08 23:15:53                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 23:15:53                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-08 23:15:53                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 23:15:53                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-08 23:15:53                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-08 23:15:53                                  Service Control Manager         7036:  ""    .  
                        2015-10-08 23:15:53                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 23:15:53                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-08 23:15:53                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-08 23:15:53                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 23:15:53                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-08 23:15:53                                  Service Control Manager         7036:  "     "    .  
                        2015-10-08 23:15:53                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-08 23:15:53                                  Service Control Manager         7036:  "   "    .  
                        2015-10-08 23:15:53                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-08 23:15:53                                  Service Control Manager         7036:  "   "    .  
                        2015-10-08 23:15:53                                  Service Control Manager         7036:  "  "    .  
                        2015-10-08 23:15:53                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-08 23:15:53                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-08 23:15:53  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-08 23:15:53                           Microsoft-Windows-Winlogon      7002:           
                4          2015-10-08 23:15:53  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-08 23:15:53  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-08 23:15:53                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-10-08 23:15:54                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-08 23:15:54                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-08 23:15:54                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-08 23:15:54                                  Service Control Manager         7036:  " "    .  
                        2015-10-08 23:15:54                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-08 23:15:54                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-08 23:15:54                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-08 23:15:54                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-08 23:15:54                                  Service Control Manager         7036:  "  WLAN"    .  
                103        2015-10-08 23:15:54                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-10-08 23:15:54                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-08 23:16:06                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-09 07:44:09                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-09 07:44:12                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-09 07:44:19                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-09 07:44:19                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-09 07:44:22                                  nvlddmkm                        
                        2015-10-09 07:44:22                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-09 07:44:22                                  EventLog                        6005:    .  
                        2015-10-09 07:44:22                                  EventLog                        6013:    13 .  
                        2015-10-09 07:44:22                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-09 07:44:22                                  Service Control Manager         7036:  ""    .  
                        2015-10-09 07:44:22                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-09 07:44:22                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-09 07:44:22                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-09 07:44:22                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-09 07:44:22                                  Service Control Manager         7036:  "  "    .  
                        2015-10-09 07:44:22                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-09 07:44:22                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-09 07:44:23                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-09 07:44:23                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-09 07:44:23                                  Service Control Manager         7036:  ""    .  
                        2015-10-09 07:44:23                                  Service Control Manager         7036:  "  "    .  
                        2015-10-09 07:44:23                                  Service Control Manager         7036:  "  "    .  
                        2015-10-09 07:44:23                                  Service Control Manager         7036:  " "    .  
                        2015-10-09 07:44:24                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-09 07:44:24                                  Service Control Manager         7036:  "    "    .  
                        2015-10-09 07:44:24                                  Service Control Manager         7036:  "     "    .  
                        2015-10-09 07:44:24                                  Service Control Manager         7036:  "   "    .  
                        2015-10-09 07:44:24                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-09 07:44:24                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 07:44:24                                  Service Control Manager         7036:  "   "    .  
                        2015-10-09 07:44:24                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-09 07:44:24                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-09 07:44:24                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-09 07:44:24                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-09 07:44:24                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-09 07:44:24                                  Service Control Manager         7036:  "  "    .  
                        2015-10-09 07:44:24                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-10-09 07:44:24                           Microsoft-Windows-Winlogon      7001:           
                4          2015-10-09 07:44:24  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-09 07:44:24  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-09 07:44:25                                  Service Control Manager         7036:  " "    .  
                        2015-10-09 07:44:25                                  Service Control Manager         7036:  " "    .  
                        2015-10-09 07:44:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-09 07:44:25                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-09 07:44:25                                  Service Control Manager         7036:  " "    .  
                        2015-10-09 07:44:25                                  Service Control Manager         7036:  " "    .  
                        2015-10-09 07:44:25                                  Service Control Manager         7036:  " "    .  
                        2015-10-09 07:44:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-09 07:44:25                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-09 07:44:25                                  Service Control Manager         7036:  "    "    .  
                        2015-10-09 07:44:26                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-09 07:44:26                                  Service Control Manager         7036:  ""    .  
                        2015-10-09 07:44:26                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-09 07:44:26                                  Service Control Manager         7036:  "   "    .  
                        2015-10-09 07:44:26                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-09 07:44:26                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-09 07:44:26                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-09 07:44:26                                  Service Control Manager         7036:  "   "    .  
                        2015-10-09 07:44:26                                  Service Control Manager         7036:  ""    .  
                        2015-10-09 07:44:28                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-09 07:44:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-09 07:44:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-09 07:44:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-09 07:44:28                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-09 07:44:28                                  Service Control Manager         7036:  "   "    .  
                        2015-10-09 07:44:28                                  Service Control Manager         7036:  " "    .  
                        2015-10-09 07:44:28                                  Service Control Manager         7036:  "   "    .  
                        2015-10-09 07:44:28                                  Service Control Manager         7036:  "   "    .  
                        2015-10-09 07:44:28                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-09 07:44:30                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-09 07:44:30                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-09 07:44:30                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-10-09 07:44:31                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-10-09 07:44:35                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-09 07:45:57                                  Service Control Manager         7036:  "    "    .  
                        2015-10-09 07:45:57                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-09 07:46:00                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-09 07:46:28                                  Service Control Manager         7036:  "   "    .  
                        2015-10-09 07:46:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-09 07:46:28                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-09 07:46:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-09 07:46:30                                  Service Control Manager         7036:  "  Windows"    .  
                          2015-10-09 07:48:24  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     bn3sch020022334.gateway.messenger.live.com        DNS.  
                          2015-10-09 07:49:34  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     top-fwz1.mail.ru        DNS.  
                        2015-10-09 07:49:36                                  Service Control Manager         7036:  "  "    .  
                        2015-10-09 07:51:30                                  Service Control Manager         7036:  "  "    .  
                        2015-10-09 07:54:28                                  Service Control Manager         7036:  "   "    .  
                        2015-10-09 08:01:00                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-09 08:24:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-09 08:42:13                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 08:42:14                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 08:42:14                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                            2015-10-09 08:44:18                                  ipnathlp                        
                        2015-10-09 08:44:20                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                            2015-10-09 08:44:21                                  ipnathlp                        
                        2015-10-09 09:01:40                                  Service Control Manager         7036:  "  "    .  
                        2015-10-09 09:01:40                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                7005       2015-10-09 09:01:57                           Microsoft-Windows-UserPnp       20001:       FileRepository\volsnap.inf_x86_neutral_42f862e05fcb0306\volsnap.inf      STORAGE\VOLUMESNAPSHOT\HARDDISKVOLUMESNAPSHOT6   : 0x0.  
                        2015-10-09 09:01:59                                  volsnap                         33:      C:      ,     C:,  ,  .  
                        2015-10-09 09:01:59                                  volsnap                         33:      C:      ,     C:,  ,  .  
                        2015-10-09 09:01:59                                  volsnap                         33:      C:      ,     C:,  ,  .  
                        2015-10-09 09:01:59                                  volsnap                         33:      C:      ,     C:,  ,  .  
                        2015-10-09 09:01:59                                  volsnap                         33:      C:      ,     C:,  ,  .  
                        2015-10-09 09:02:34                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-09 09:05:03                                  Service Control Manager         7036:  "  "    .  
                        2015-10-09 09:08:03                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-09 09:12:37                           Service Control Manager         7040:    "  Windows"    ""  "".  
                        2015-10-09 09:12:38                           Service Control Manager         7040:    "  Windows"    ""  "".  
                        2015-10-09 09:12:39                                  Service Control Manager         7036:  "  Windows"    .  
                          2015-10-09 11:20:46  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 11:52:58  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-09 12:00:17                                  EventLog                        6013:    15368 .  
                          2015-10-09 13:46:23  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 14:11:22  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 14:16:35  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 14:20:50  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 14:26:02  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 14:31:08  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 14:36:15  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 14:41:06  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 14:45:51  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     token.services.mozilla.com        DNS.  
                          2015-10-09 14:50:56  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 14:56:05  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 15:00:57  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 15:05:49  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-09 15:07:27                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                            2015-10-09 15:07:28                                  ipnathlp                        
                        2015-10-09 15:07:28                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 15:07:28                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 15:07:30                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                            2015-10-09 15:07:31                                  ipnathlp                        
                          2015-10-09 15:07:40  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 15:12:29  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 15:17:37  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 15:22:45  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 15:27:40  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 15:32:53  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 15:37:46  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 15:42:43  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 15:48:18  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 15:52:56  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 15:57:52  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 16:02:55  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 16:07:40  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     token.services.mozilla.com        DNS.  
                          2015-10-09 16:12:42  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 16:17:48  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 16:22:39  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 16:27:30  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-09 16:31:58                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 16:31:59                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 16:31:59                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 16:34:37                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 16:34:51  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 16:35:56  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-09 16:36:33                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 16:36:33                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 16:36:33                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                            2015-10-09 16:36:34                                  ipnathlp                        
                        2015-10-09 16:36:35                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                            2015-10-09 16:36:37                                  ipnathlp                        
                          2015-10-09 16:36:38  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-09 16:37:46                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 16:37:47                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 16:37:47                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                            2015-10-09 20:46:51                                  ipnathlp                        
                        2015-10-09 20:46:53                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 20:47:06  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 20:47:17                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-09 20:47:19                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                            2015-10-09 20:47:20                                  ipnathlp                        
                        2015-10-09 20:47:20                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 20:47:20                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 20:47:21                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 20:47:21  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-09 21:03:47                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-10-09 21:25:21  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-09 21:34:55                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 21:34:56                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 21:34:56                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 21:34:57                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 21:35:08  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-09 21:35:27                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 21:35:28                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 21:35:28                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                            2015-10-09 21:39:14                                  ipnathlp                        
                        2015-10-09 21:39:16                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 21:57:27                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 21:57:28                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 21:57:28                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                            2015-10-09 21:57:37                                  ipnathlp                        
                        2015-10-09 21:57:39                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:00:36  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:00:48                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                            2015-10-09 22:00:49                                  ipnathlp                        
                        2015-10-09 22:00:49                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:00:49                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:00:49  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-09 22:00:50                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:02:22  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                          2015-10-09 22:02:29  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-09 22:02:30                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-10-09 22:05:02  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-09 22:05:43                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:05:44                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:05:44                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                            2015-10-09 22:05:45                                  ipnathlp                        
                        2015-10-09 22:05:46                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:05:59  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:06:25                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:06:26                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:06:26                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                            2015-10-09 22:06:32                                  ipnathlp                        
                        2015-10-09 22:06:34                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:06:47  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:06:59                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:07:00                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:07:00                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:07:00  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-09 22:08:27                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:08:41  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:08:53                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:08:54                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:08:54                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 22:09:01                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:09:15  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-09 22:09:27                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:09:28                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:09:28                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:09:29  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:09:32                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:09:42  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-09 22:09:52                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:09:52                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 22:09:53                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                          2015-10-09 22:09:54  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-09 22:11:24                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:11:38  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:11:52                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:11:52                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:11:52                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:11:54  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:12:07                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:12:18  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     _ldap._tcp.dc._msdcs.mshome.net        DNS.  
                        2015-10-09 22:12:33                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:12:34                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:12:34                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:12:35  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-09 22:12:36                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:12:58  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     wpad.mshome.net        DNS.  
                        2015-10-09 22:13:07                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:13:08                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:13:08                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:13:11  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-09 22:13:13                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:13:13  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.msftncsi.com        DNS.  
                          2015-10-09 22:13:26  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-09 22:13:37                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                            2015-10-09 22:13:38                                  ipnathlp                        
                        2015-10-09 22:13:38                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:13:38                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:13:39  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                          2015-10-09 22:13:39  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:13:40                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:13:53  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                            2015-10-09 22:13:57                                  ipnathlp                        
                        2015-10-09 22:14:07                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:14:08                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:14:08                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 22:14:10                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:14:20  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-09 22:14:48                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                            2015-10-09 22:14:49                                  ipnathlp                        
                        2015-10-09 22:14:49                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:14:49                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:14:49  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     wpad.mshome.net        DNS.  
                        2015-10-09 22:14:51                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:15:19                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                            2015-10-09 22:15:20                                  ipnathlp                        
                        2015-10-09 22:15:20                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:15:20                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 22:15:22                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:15:23  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                          2015-10-09 22:15:35  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-09 22:15:49                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:15:50                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:15:50                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:15:50  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     wpad.mshome.net        DNS.  
                          2015-10-09 22:15:51  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-09 22:15:52                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:16:06  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:16:23                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:16:24                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:16:24                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:16:25  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                            2015-10-09 22:16:42                                  ipnathlp                        
                        2015-10-09 22:16:43                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:16:56  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:17:09                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:17:10                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:17:10                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 22:17:11                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:17:22  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-09 22:17:43                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:17:43                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:17:43                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:17:45  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:17:46                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:17:54  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.msftncsi.com        DNS.  
                        2015-10-09 22:18:17                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:18:17                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:18:17                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:18:19  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     _ldap._tcp.dc._msdcs.mshome.net        DNS.  
                            2015-10-09 22:22:06                                  ipnathlp                        
                        2015-10-09 22:22:06                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:22:20  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:22:33                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:22:34                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:22:34                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:22:35  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:22:36                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:22:48  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-09 22:23:03                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:23:04                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:23:04                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 22:23:05                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:23:05  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     wpad.mshome.net        DNS.  
                          2015-10-09 22:23:19  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:23:33                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:23:34                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:23:34                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:23:35  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:23:36                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:23:49  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-09 22:24:11                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:24:11                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:24:11                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                            2015-10-09 22:24:12                                  ipnathlp                        
                        2015-10-09 22:24:14                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:24:28  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:24:41                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:24:42                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:24:42                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:24:43  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-09 22:24:43  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:24:44                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:24:55  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-09 22:25:11                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:25:12                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:25:12                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 22:25:16                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:25:26  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     _ldap._tcp.dc._msdcs.mshome.net        DNS.  
                        2015-10-09 22:25:41                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                            2015-10-09 22:25:42                                  ipnathlp                        
                        2015-10-09 22:25:42                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:25:42                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:25:43  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:25:44                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:25:57  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:26:17                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:26:18                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:26:18                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 22:26:20                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:26:29  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.msftncsi.com        DNS.  
                        2015-10-09 22:26:47                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:26:48                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:26:48                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:26:49  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                            2015-10-09 22:26:58                                  ipnathlp                        
                        2015-10-09 22:26:59                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:27:15  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-09 22:27:25                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:27:26                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:27:26                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:27:26  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     wpad.mshome.net        DNS.  
                        2015-10-09 22:27:29                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:27:45  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-09 22:27:59                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:28:00                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:28:00                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 22:28:02                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:28:15  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-09 22:28:45                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:28:46                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:28:46                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 22:28:48                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:28:57  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.msftncsi.com        DNS.  
                          2015-10-09 22:29:15  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:29:59                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                            2015-10-09 22:30:00                                  ipnathlp                        
                        2015-10-09 22:30:00                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:30:00                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 22:30:02                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:30:15  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-09 22:32:43                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:32:44                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:32:44                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 22:32:45                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:32:59  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:33:15                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:33:16                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:33:16                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 22:33:17                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:33:17  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:34:07                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                            2015-10-09 22:34:08                                  ipnathlp                        
                        2015-10-09 22:34:08                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:34:08                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 22:34:10                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:35:43  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-09 22:35:45                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                            2015-10-09 22:35:46                                  ipnathlp                        
                        2015-10-09 22:35:46                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:35:46                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 22:35:47                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:36:00  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     wpad.mshome.net        DNS.  
                        2015-10-09 22:36:15                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:36:16                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:36:16                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:36:17  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:36:18                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:36:20  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.msftncsi.com        DNS.  
                        2015-10-09 22:36:44                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:36:44                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:36:44                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 22:36:46                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:37:00  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:37:13                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:37:14                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:37:14                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:37:15  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     wpad.mshome.net        DNS.  
                          2015-10-09 22:37:15  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:37:16                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:37:29  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:37:43                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:37:44                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:37:44                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:37:44  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-09 22:37:46                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:37:55  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.msftncsi.com        DNS.  
                        2015-10-09 22:38:13                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:38:14                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:38:14                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 22:38:15                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:38:15  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:39:07                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:39:08                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:39:08                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                            2015-10-09 22:39:13                                  ipnathlp                        
                        2015-10-09 22:39:13                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:39:27  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:39:39                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:39:40                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:39:40                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 22:39:42                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:39:55  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:40:09                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                            2015-10-09 22:40:10                                  ipnathlp                        
                        2015-10-09 22:40:10                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:40:10                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:40:11  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-09 22:40:12                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:40:25  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-09 22:40:39                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:40:40                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:40:40                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-09 22:40:41  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:40:43                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-09 22:40:56  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 22:41:09                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 22:41:10                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 22:41:10                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 22:43:42                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                            2015-10-09 22:43:43                                  ipnathlp                        
                        2015-10-09 22:56:30                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-09 23:11:32                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 23:11:32                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 23:11:32                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 23:11:38                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 23:11:47                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-10-09 23:11:52  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     isatap.mshome.net        DNS.  
                        2015-10-09 23:16:55                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-09 23:16:56                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-09 23:16:56                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-09 23:28:17                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-09 23:58:46                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-09 23:59:59                                  Service Control Manager         7036:  "   "    .  
                        2015-10-10 00:01:20                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 00:10:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 00:16:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 00:17:27                                  Service Control Manager         7036:  "   "    .  
                        2015-10-10 00:25:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 00:29:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 00:34:26                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 00:40:13  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-10 00:40:14                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 00:40:17                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-10 00:40:17                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 00:40:17                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-10 00:40:17                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-10 00:40:17                                  Service Control Manager         7036:  ""    .  
                        2015-10-10 00:40:17                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-10 00:40:17                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 00:40:17  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-10 00:40:17                           Microsoft-Windows-Winlogon      7002:           
                4          2015-10-10 00:40:17  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-10 00:40:17  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-10 00:40:17                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-10-10 00:40:18                                  EventLog                        6006:    .  
                        2015-10-10 00:40:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 00:40:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 00:40:18                                  Service Control Manager         7036:  "     "    .  
                        2015-10-10 00:40:18                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-10 00:40:18                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-10 00:40:18                                  Service Control Manager         7036:  "   "    .  
                        2015-10-10 00:40:18                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-10 00:40:18                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-10 00:40:18                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-10 00:40:18                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-10 00:40:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 00:40:18                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-10 00:40:18                                  Service Control Manager         7036:  "   "    .  
                        2015-10-10 00:40:18                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-10 00:40:18                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-10 00:40:18                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-10 00:40:18                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-10 00:40:18                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-10 00:40:18                                  Service Control Manager         7036:  " "    .  
                          2015-10-10 00:40:18                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-10 00:40:19                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-10 00:40:20                                  Service Control Manager         7036:  " Windows"    .  
                103        2015-10-10 00:40:20                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-10 00:40:26                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-10 09:16:23                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-10 09:16:26                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-10 09:16:30                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-10 09:16:30                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-10 09:16:37                                  nvlddmkm                        
                        2015-10-10 09:16:37                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-10 09:16:37                                  Service Control Manager         7036:  ""    .  
                        2015-10-10 09:16:37                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-10 09:16:37                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-10 09:16:37                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-10 09:16:38                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-10 09:16:38                                  EventLog                        6005:    .  
                        2015-10-10 09:16:38                                  EventLog                        6013:    14 .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  ""    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  " "    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  "    "    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  "     "    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  "   "    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  "   "    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-10 09:16:38                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-10 09:16:38                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-10-10 09:16:38  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-10 09:16:38  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-10 09:16:39                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 09:16:39                                  Service Control Manager         7036:  " "    .  
                        2015-10-10 09:16:39                                  Service Control Manager         7036:  " "    .  
                        2015-10-10 09:16:39                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 09:16:39                                  Service Control Manager         7036:  " Windows"    .  
                1101       2015-10-10 09:16:39                           Microsoft-Windows-Winlogon      7001:           
                        2015-10-10 09:16:40                                  Service Control Manager         7036:  " "    .  
                        2015-10-10 09:16:40                                  Service Control Manager         7036:  " "    .  
                        2015-10-10 09:16:40                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-10 09:16:40                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 09:16:40                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-10 09:16:40                                  Service Control Manager         7036:  ""    .  
                        2015-10-10 09:16:40                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-10 09:16:40                                  Service Control Manager         7036:  "   "    .  
                        2015-10-10 09:16:40                                  Service Control Manager         7036:  " "    .  
                        2015-10-10 09:16:40                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-10 09:16:40                                  Service Control Manager         7036:  "    "    .  
                        2015-10-10 09:16:40                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-10 09:16:40                                  Service Control Manager         7036:  "   "    .  
                        2015-10-10 09:16:40                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-10 09:16:40                                  Service Control Manager         7036:  ""    .  
                        2015-10-10 09:16:42                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-10 09:16:42                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-10 09:16:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 09:16:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 09:16:42                                  Service Control Manager         7036:  "   "    .  
                        2015-10-10 09:16:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 09:16:42                                  Service Control Manager         7036:  "   "    .  
                        2015-10-10 09:16:42                                  Service Control Manager         7036:  "   "    .  
                        2015-10-10 09:16:42                                  Service Control Manager         7036:  " "    .  
                        2015-10-10 09:16:42                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-10 09:16:43                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-10 09:16:43                                  Service Control Manager         7036:  "  PNP-"    .  
                7005       2015-10-10 09:16:44                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0001   : 0.  
                        2015-10-10 09:16:46                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-10 09:18:42                                  Service Control Manager         7036:  "   "    .  
                        2015-10-10 09:18:42                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-10 09:18:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 09:18:42                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-10 09:18:43                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 09:18:44                                  Service Control Manager         7036:  "  Windows"    .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-10 09:19:14                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                        2015-10-10 09:19:27                                  Service Control Manager         7036:  "   "    .  
                        2015-10-10 09:21:27                                  Service Control Manager         7036:  "   "    .  
                        2015-10-10 09:21:42  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-10 09:21:45                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-10 09:21:45                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 09:21:45  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-10 09:21:45                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-10 09:21:46                                  EventLog                        6006:    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  ""    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "     "    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "   "    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "   "    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  " "    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-10 09:21:46                                  Service Control Manager         7036:  "Superfetch"    .  
                103        2015-10-10 09:21:46                                  Microsoft-Windows-Kernel-Power  109:      .  
                4          2015-10-10 09:21:46  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-10 09:21:46  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-10 09:21:46                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-10-10 09:21:46                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-10 09:21:52                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-11 08:56:55                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-11 08:56:58                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-11 08:57:03                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-11 08:57:03                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-11 08:57:05                                  nvlddmkm                        
                        2015-10-11 08:57:06                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-11 08:57:06                                  EventLog                        6005:    .  
                        2015-10-11 08:57:06                                  EventLog                        6013:    10 .  
                        2015-10-11 08:57:06                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-11 08:57:06                                  Service Control Manager         7036:  ""    .  
                        2015-10-11 08:57:06                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-11 08:57:06                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-11 08:57:06                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-11 08:57:06                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-11 08:57:06                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 08:57:06                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-11 08:57:06                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-11 08:57:06                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-11 08:57:07                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-11 08:57:07                                  Service Control Manager         7036:  ""    .  
                        2015-10-11 08:57:07                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 08:57:07                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 08:57:07                                  Service Control Manager         7036:  " "    .  
                        2015-10-11 08:57:07                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-11 08:57:07                                  Service Control Manager         7036:  "    "    .  
                        2015-10-11 08:57:07                                  Service Control Manager         7036:  "     "    .  
                        2015-10-11 08:57:07                                  Service Control Manager         7036:  "   "    .  
                        2015-10-11 08:57:08                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-11 08:57:08                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-11 08:57:08                                  Service Control Manager         7036:  "   "    .  
                        2015-10-11 08:57:08                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-11 08:57:08                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-11 08:57:08                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-11 08:57:08                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-11 08:57:08                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-11 08:57:08                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 08:57:08                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-10-11 08:57:08                           Microsoft-Windows-Winlogon      7001:           
                4          2015-10-11 08:57:08  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-11 08:57:08  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-11 08:57:09                                  Service Control Manager         7036:  " "    .  
                        2015-10-11 08:57:09                                  Service Control Manager         7036:  " "    .  
                        2015-10-11 08:57:09                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 08:57:09                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-11 08:57:09                                  Service Control Manager         7036:  " "    .  
                        2015-10-11 08:57:09                                  Service Control Manager         7036:  " "    .  
                        2015-10-11 08:57:09                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 08:57:09                                  Service Control Manager         7036:  " "    .  
                        2015-10-11 08:57:10                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-11 08:57:10                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-11 08:57:10                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-11 08:57:10                                  Service Control Manager         7036:  ""    .  
                        2015-10-11 08:57:10                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-11 08:57:10                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-11 08:57:10                                  Service Control Manager         7036:  "   "    .  
                        2015-10-11 08:57:11                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-11 08:57:11                                  Service Control Manager         7036:  ""    .  
                        2015-10-11 08:57:11                                  Service Control Manager         7036:  "   "    .  
                        2015-10-11 08:57:11                                  Service Control Manager         7036:  "    "    .  
                        2015-10-11 08:57:14                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-11 08:57:14                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 08:57:14                                  Service Control Manager         7036:  "   "    .  
                        2015-10-11 08:57:14                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 08:57:14                                  Service Control Manager         7036:  "   "    .  
                        2015-10-11 08:57:14                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 08:57:15                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-11 08:57:15                                  Service Control Manager         7036:  " "    .  
                        2015-10-11 08:57:15                                  Service Control Manager         7036:  "   "    .  
                        2015-10-11 08:57:15                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-11 08:57:17                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-11 08:57:17                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-11 08:57:18                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-11 08:57:58                                  Service Control Manager         7036:  "    "    .  
                        2015-10-11 08:57:58                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-11 08:58:00                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-11 08:59:14                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 08:59:14                                  Service Control Manager         7036:  "   "    .  
                        2015-10-11 08:59:14                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-11 08:59:15                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 08:59:17                                  Service Control Manager         7036:  "  Windows"    .  
                12         2015-10-11 09:01:26  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:     :            :     . . . . . . . . . . : ASUS USB-N10 150Mbps 11n Wireless USB dongle     . . . . . . . : ASUSTeK Computer Inc.     . . . . . . . . . . : Realtek Semiconductor Corp.     . . . . . . . . . . : 1021.3.912.2012     INF- . . . . . . . . . : C:\Windows\INF\oem2.inf     INF- . . . . . . . . . : 19  2013 .  14:56:04        . . . . . . . . . : RTL8192cu.ndi      . . . . . . . . . : usb\vid_0b05&pid_17ba       . . . . . : 0x180600a        . . : 0     If  . . . . . . . . . . . . : 71       . . . . . . : 9   
                12         2015-10-11 09:01:27  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:     :             :     . . . . . . . . . . :   Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC (NDIS 6.20)     . . . . . . . : Realtek     . . . . . . . . . . : Microsoft     . . . . . . . . . . : 7.2.1127.2008     INF- . . . . . . . . . : C:\Windows\INF\netrtx32.inf     INF- . . . . . . . . . : 13  2009 .  20:46:34        . . . . . . . . . : RTL8169.ndi      . . . . . . . . . : pci\ven_10ec&dev_8167       . . . . . : 0x180200a        . . : 0     If  . . . . . . . . . . . . : 6       . . . . . . : 14   
                12         2015-10-11 09:01:27  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:        :          GUID : 211835d6-e914-4a4d-824e-a3809356f2d8   : ASUS USB-N10 150Mbps 11n Wireless USB dongle   :  WiFi         : 1      :  : 0,  : 0          1      :   - 0;   - 0      :   - 1    : Windows Phone8415     SSID: Windows Phone8415      SSID: 17      :      :        :            :      :       : 0x00028002    
                12         2015-10-11 09:01:27  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:      :            .     .    :  WiFi MSM   :        GUID : 211835d6-e914-4a4d-824e-a3809356f2d8   : ASUS USB-N10 150Mbps 11n Wireless USB dongle   :  WiFi  :     SSID: (  )   SSID: 0   : < >  :         :    :         
                12         2015-10-11 09:01:27  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:        :            .     .    :    :        GUID : 211835d6-e914-4a4d-824e-a3809356f2d8   : ASUS USB-N10 150Mbps 11n Wireless USB dongle   :  WiFi   :     : RNWF MSM Helper Class   : <DiagnosticsText><Title><![CDATA[Windows        ]]></Title><Description><![CDATA[   ,       .]]></Description><Parameters><Parameter><Name><![CDATA[SSID]]></Name><Value><![CDATA[]]></Value></Parameter></Parameters><Extensions><Extension><Name><![CDATA[Keyword]]></Name><Value><![CDATA[  ]]></Value></Extension><Extension><Name><![CDATA[Keyword]]></Name><Value><![CDATA[]]></Va    ():  Windows             :           -   .             Windows.    
                4          2015-10-11 09:01:27  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  4000:      .    :        : Dot3HelperClass     :           Guid  : {4DA030B8-86E5-4B6A-A879-2FFF8443B527}      :  Ethernet-    Ethernet-    ,       .         . ,        .    ,   .     Guid : {1296DFF0-D04E-4BE1-A512-90F04DDFA3E6}      (),   : 0      ,   : 0    :     ({B788672F-6878-4DCD-8605-75D838605432})  
                4          2015-10-11 09:01:27  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  4000:      .    :        : AutoConfig Helper Class     : Windows            ,       .     Guid  : {7452F6E5-11BC-4B8B-877B-8BC9EEE51DBF}      :           -   .             Windows.     Guid : {A7D9DC2B-A0E0-4DFA-A723-E16891A4FAD4}      (),   : 300      ,   : 0    :    ({211835D6-E914-4A4D-824E-A3809356F2D8})  
                4          2015-10-11 09:01:27  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  4000:      .    :        : AutoConfig Helper Class     : Windows            ,       .     Guid  : {7452F6E5-11BC-4B8B-877B-8BC9EEE51DBF}      :     .     "  "        .     Guid : {07D37F7B-FA5E-4443-BDA7-AB107B29AFB9}      (),   : 300      ,   : 80    :    ({211835D6-E914-4A4D-824E-A3809356F2D8})  
                12         2015-10-11 09:01:48  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:     :            :     . . . . . . . . . . : ASUS USB-N10 150Mbps 11n Wireless USB dongle     . . . . . . . : ASUSTeK Computer Inc.     . . . . . . . . . . : Realtek Semiconductor Corp.     . . . . . . . . . . : 1021.3.912.2012     INF- . . . . . . . . . : C:\Windows\INF\oem2.inf     INF- . . . . . . . . . : 19  2013 .  14:56:04        . . . . . . . . . : RTL8192cu.ndi      . . . . . . . . . : usb\vid_0b05&pid_17ba       . . . . . : 0x180600a        . . : 0     If  . . . . . . . . . . . . : 71       . . . . . . : 9   
                7          2015-10-11 09:01:48  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  5100:         .     :        : AutoConfig Helper Class      :     .     "  "        .     Guid : {07D37F7B-FA5E-4443-BDA7-AB107B29AFB9}     n,    ,   .   NDF     .        NDF .  
                12         2015-10-11 09:01:49  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:     :             :     . . . . . . . . . . :   Realtek RTL8169/8110 Family PCI Gigabit Ethernet NIC (NDIS 6.20)     . . . . . . . : Realtek     . . . . . . . . . . : Microsoft     . . . . . . . . . . : 7.2.1127.2008     INF- . . . . . . . . . : C:\Windows\INF\netrtx32.inf     INF- . . . . . . . . . : 13  2009 .  20:46:34        . . . . . . . . . : RTL8169.ndi      . . . . . . . . . : pci\ven_10ec&dev_8167       . . . . . : 0x180200a        . . : 0     If  . . . . . . . . . . . . : 6       . . . . . . : 14   
                12         2015-10-11 09:01:49  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:        :          GUID : 211835d6-e914-4a4d-824e-a3809356f2d8   : ASUS USB-N10 150Mbps 11n Wireless USB dongle   :  WiFi         : 1      :  : 0,  : 0          1      :   - 0;   - 0      :   - 1    : Windows Phone8415     SSID: Windows Phone8415      SSID: 17      :      :        :            :      :       : 0x00028002    
                12         2015-10-11 09:01:49  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:      :            .     .    :  WiFi MSM   :        GUID : 211835d6-e914-4a4d-824e-a3809356f2d8   : ASUS USB-N10 150Mbps 11n Wireless USB dongle   :  WiFi  :     SSID: (  )   SSID: 0   : < >  :         :    :         
                12         2015-10-11 09:01:49  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:        :            .     .    :    :        GUID : 211835d6-e914-4a4d-824e-a3809356f2d8   : ASUS USB-N10 150Mbps 11n Wireless USB dongle   :  WiFi   :     : RNWF MSM Helper Class   : <DiagnosticsText><Title><![CDATA[Windows        ]]></Title><Description><![CDATA[   ,       .]]></Description><Parameters><Parameter><Name><![CDATA[SSID]]></Name><Value><![CDATA[]]></Value></Parameter></Parameters><Extensions><Extension><Name><![CDATA[Keyword]]></Name><Value><![CDATA[  ]]></Value></Extension><Extension><Name><![CDATA[Keyword]]></Name><Value><![CDATA[]]></Va    ():  Windows             :           -   .             Windows.    
                4          2015-10-11 09:01:49  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  4000:      .    :        : Dot3HelperClass     :           Guid  : {4DA030B8-86E5-4B6A-A879-2FFF8443B527}      :  Ethernet-    Ethernet-    ,       .         . ,        .    ,   .     Guid : {1296DFF0-D04E-4BE1-A512-90F04DDFA3E6}      (),   : 0      ,   : 0    :     ({B788672F-6878-4DCD-8605-75D838605432})  
                4          2015-10-11 09:01:49  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  4000:      .    :        : AutoConfig Helper Class     : Windows            ,       .     Guid  : {7452F6E5-11BC-4B8B-877B-8BC9EEE51DBF}      :           -   .             Windows.     Guid : {A7D9DC2B-A0E0-4DFA-A723-E16891A4FAD4}      (),   : 300      ,   : 0    :    ({211835D6-E914-4A4D-824E-A3809356F2D8})  
                4          2015-10-11 09:01:49  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  4000:      .    :        : AutoConfig Helper Class     : Windows            ,       .     Guid  : {7452F6E5-11BC-4B8B-877B-8BC9EEE51DBF}      :     .     "  "        .     Guid : {07D37F7B-FA5E-4443-BDA7-AB107B29AFB9}      (),   : 300      ,   : 80    :    ({211835D6-E914-4A4D-824E-A3809356F2D8})  
                        2015-10-11 09:02:24                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-11 09:03:09                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-11 09:03:20                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-11 09:03:20  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-11 09:03:20  LOCAL SERVICE                   Microsoft-Windows-Time-Service  35:          time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->23.101.187.68:123).  
                        2015-10-11 09:03:20  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-11 09:03:20  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-11 09:03:21  LOCAL SERVICE                   Microsoft-Windows-Time-Service  37: NTP-         time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->23.101.187.68:123).  
                        2015-10-11 09:04:04                                  Service Control Manager         7036:  "  "    .  
                          2015-10-11 09:04:19  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                        2015-10-11 09:06:16                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 09:07:02                                  Service Control Manager         7036:  "   "    .  
                          2015-10-11 09:08:46  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     stats.g.doubleclick.net        DNS.  
                        2015-10-11 09:22:04                                  Service Control Manager         7036:  " "    .  
                        2015-10-11 09:26:11                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-11 09:28:12                                  Service Control Manager         7036:  " "    .  
                        2015-10-11 09:36:57                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 09:41:06                                  Service Control Manager         7036:  " "    .  
                        2015-10-11 09:45:35                                  Service Control Manager         7036:  " "    .  
                        2015-10-11 09:51:07                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 09:51:08                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-11 09:51:09                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-11 09:51:22                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-11 09:54:09                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 09:57:09                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-11 10:08:11                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-11 10:08:12                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-11 10:08:12                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-11 10:08:14  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                            2015-10-11 10:12:20                                  ipnathlp                        
                        2015-10-11 10:12:20                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-11 10:12:43  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     top-fwz1.mail.ru        DNS.  
                        2015-10-11 10:22:39                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 10:25:20                                  Service Control Manager         7036:  "   "    .  
                        2015-10-11 10:28:11                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 10:35:20                                  Service Control Manager         7036:  "   "    .  
                    10         2015-10-11 10:45:12  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  5300:  .           .     Windows. [2147942487]  
                        2015-10-11 10:49:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 10:54:19                                  Service Control Manager         7036:  "  "    .  
                          2015-10-11 10:57:58  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     g.alicdn.com        DNS.  
                          2015-10-11 11:06:48  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     assets.alicdn.com        DNS.  
                        2015-10-11 11:17:05                                  Service Control Manager         7036:  "  "    .  
                          2015-10-11 11:17:31  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     translate.google.com        DNS.  
                        2015-10-11 11:22:11                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 12:00:02                                  EventLog                        6013:    11000 .  
                          2015-10-11 12:11:35  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     bn3sch020022324.gateway.messenger.live.com        DNS.  
                        2015-10-11 12:24:49                                  Service Control Manager         7036:  "  "    .  
                7005       2015-10-11 12:24:50                           Microsoft-Windows-UserPnp       20003:       usbccgp      USB\VID_0BDA&PID_0161\20070818000000000   : 0.  
                7005       2015-10-11 12:24:50                           Microsoft-Windows-UserPnp       20001:       FileRepository\usb.inf_x86_neutral_2620fd493cad7d41\usb.inf      USB\VID_0BDA&PID_0161\20070818000000000   : 0x0.  
                        2015-10-11 12:24:51                                  Service Control Manager         7036:  "-"    .  
                48         2015-10-11 12:24:51                           Microsoft-Windows-DriverFrameworks-UserMode  10000:  ,       1.9.0,    USB\VID_0BDA&PID_0161&MI_00\6&1E43E1E2&0&0000.  
                48         2015-10-11 12:24:51                           Microsoft-Windows-DriverFrameworks-UserMode  10001:      WUDFUsbccidDriver (CLSID {5EB949F2-78C6-443B-9964-07588EB151C6}) .      1.9.0    .  
                48         2015-10-11 12:24:51                           Microsoft-Windows-DriverFrameworks-UserMode  10100:     .  
                        2015-10-11 12:24:52                                  Service Control Manager         7036:  " "    .  
                7005       2015-10-11 12:24:53                           Microsoft-Windows-UserPnp       20003:       WUDFRd      USB\VID_0BDA&PID_0161&MI_00\6&1E43E1E2&0&0000   : 0.  
                7005       2015-10-11 12:24:54                           Microsoft-Windows-UserPnp       20003:       WinUsb      USB\VID_0BDA&PID_0161&MI_00\6&1E43E1E2&0&0000   : 0.  
                7005       2015-10-11 12:24:54                           Microsoft-Windows-UserPnp       20001:       FileRepository\wudfusbcciddriver.inf_x86_neutral_b961cfda3f3ba863\wudfusbcciddriver.inf      USB\VID_0BDA&PID_0161&MI_00\6&1E43E1E2&0&0000   : 0x0.  
                            2015-10-11 12:24:55                                  SCardSvr                        
                7005       2015-10-11 12:24:55                           Microsoft-Windows-UserPnp       20003:       USBSTOR      USB\VID_0BDA&PID_0161&MI_01\6&1E43E1E2&0&0001   : 0.  
                        2015-10-11 12:24:56                           Microsoft-Windows-Application-Experience  206:          .  
                7005       2015-10-11 12:24:56                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbstor.inf_x86_neutral_c77d41a490bdc63d\usbstor.inf      USB\VID_0BDA&PID_0161&MI_01\6&1E43E1E2&0&0001   : 0x0.  
                            2015-10-11 12:24:57                                  SCardSvr                        
                            2015-10-11 12:24:57                                  SCardSvr                        
                7005       2015-10-11 12:24:57                           Microsoft-Windows-UserPnp       20001:       FileRepository\scrawpdo.inf_x86_neutral_18f3d1cd9736f87d\scrawpdo.inf      {892EDE5E-BE49-443C-A0B3-005D74F2D69C}\SCFILTER\7&49D6CEF&0&01   : 0x0.  
                7005       2015-10-11 12:24:57                           Microsoft-Windows-UserPnp       20003:       disk      USBSTOR\DISK&VEN_GENERIC-&PROD_SM/XD-PICTURE&REV_1.00\7&1C60F934&0&20070818000000000&1   : 0.  
                7005       2015-10-11 12:24:57                           Microsoft-Windows-UserPnp       20001:       FileRepository\disk.inf_x86_neutral_b431b61a11f8df6c\disk.inf      USBSTOR\DISK&VEN_GENERIC-&PROD_SM/XD-PICTURE&REV_1.00\7&1C60F934&0&20070818000000000&1   : 0x0.  
                        2015-10-11 12:24:58                                  Service Control Manager         7036:  "   "    .  
                7005       2015-10-11 12:24:58                           Microsoft-Windows-UserPnp       20003:       disk      USBSTOR\DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.00\7&1C60F934&0&20070818000000000&0   : 0.  
                7005       2015-10-11 12:24:58                           Microsoft-Windows-UserPnp       20001:       FileRepository\disk.inf_x86_neutral_b431b61a11f8df6c\disk.inf      USBSTOR\DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.00\7&1C60F934&0&20070818000000000&0   : 0x0.  
                7005       2015-10-11 12:24:58                           Microsoft-Windows-UserPnp       20003:       disk      USBSTOR\DISK&VEN_GENERIC-&PROD_SD/MMC&REV_1.00\7&1C60F934&0&20070818000000000&2   : 0.  
                7005       2015-10-11 12:24:59                           Microsoft-Windows-UserPnp       20001:       FileRepository\disk.inf_x86_neutral_b431b61a11f8df6c\disk.inf      USBSTOR\DISK&VEN_GENERIC-&PROD_SD/MMC&REV_1.00\7&1C60F934&0&20070818000000000&2   : 0x0.  
                7005       2015-10-11 12:24:59                           Microsoft-Windows-UserPnp       20003:       disk      USBSTOR\DISK&VEN_GENERIC-&PROD_MS/MS-PRO&REV_1.00\7&1C60F934&0&20070818000000000&3   : 0.  
                7005       2015-10-11 12:24:59                           Microsoft-Windows-UserPnp       20001:       FileRepository\disk.inf_x86_neutral_b431b61a11f8df6c\disk.inf      USBSTOR\DISK&VEN_GENERIC-&PROD_MS/MS-PRO&REV_1.00\7&1C60F934&0&20070818000000000&3   : 0x0.  
                7005       2015-10-11 12:25:00                           Microsoft-Windows-UserPnp       20003:       volsnap      STORAGE\VOLUME\_??_USBSTOR#DISK&VEN_GENERIC-&PROD_SM#XD-PICTURE&REV_1.00#7&1C60F934&0&20070818000000000&1#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}   : 0.  
                7005       2015-10-11 12:25:00                           Microsoft-Windows-UserPnp       20001:       FileRepository\volume.inf_x86_neutral_6dee0205881d1a1d\volume.inf      STORAGE\VOLUME\_??_USBSTOR#DISK&VEN_GENERIC-&PROD_SM#XD-PICTURE&REV_1.00#7&1C60F934&0&20070818000000000&1#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}   : 0x0.  
                7005       2015-10-11 12:25:00                           Microsoft-Windows-UserPnp       20003:       volsnap      STORAGE\VOLUME\_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.00#7&1C60F934&0&20070818000000000&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}   : 0.  
                7005       2015-10-11 12:25:01                           Microsoft-Windows-UserPnp       20001:       FileRepository\volume.inf_x86_neutral_6dee0205881d1a1d\volume.inf      STORAGE\VOLUME\_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.00#7&1C60F934&0&20070818000000000&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}   : 0x0.  
                7005       2015-10-11 12:25:01                           Microsoft-Windows-UserPnp       20003:       volsnap      STORAGE\VOLUME\_??_USBSTOR#DISK&VEN_GENERIC-&PROD_SD#MMC&REV_1.00#7&1C60F934&0&20070818000000000&2#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}   : 0.  
                7005       2015-10-11 12:25:01                           Microsoft-Windows-UserPnp       20001:       FileRepository\volume.inf_x86_neutral_6dee0205881d1a1d\volume.inf      STORAGE\VOLUME\_??_USBSTOR#DISK&VEN_GENERIC-&PROD_SD#MMC&REV_1.00#7&1C60F934&0&20070818000000000&2#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}   : 0x0.  
                48         2015-10-11 12:25:02                           Microsoft-Windows-DriverFrameworks-UserMode  10000:  ,       1.9.0,    WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_SM#XD-PICTURE&REV_1.00#7&1C60F934&0&20070818000000000&1#.  
                48         2015-10-11 12:25:02                           Microsoft-Windows-DriverFrameworks-UserMode  10002:      WpdFs (CLSID {112DE495-AC4C-46F8-B663-6A4266C53313}) .      1.9.0    .  
                48         2015-10-11 12:25:02                           Microsoft-Windows-DriverFrameworks-UserMode  10100:     .  
                7005       2015-10-11 12:25:02                           Microsoft-Windows-UserPnp       20003:       volsnap      STORAGE\VOLUME\_??_USBSTOR#DISK&VEN_GENERIC-&PROD_MS#MS-PRO&REV_1.00#7&1C60F934&0&20070818000000000&3#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}   : 0.  
                7005       2015-10-11 12:25:02                           Microsoft-Windows-UserPnp       20001:       FileRepository\volume.inf_x86_neutral_6dee0205881d1a1d\volume.inf      STORAGE\VOLUME\_??_USBSTOR#DISK&VEN_GENERIC-&PROD_MS#MS-PRO&REV_1.00#7&1C60F934&0&20070818000000000&3#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}   : 0x0.  
                7005       2015-10-11 12:25:02                           Microsoft-Windows-UserPnp       20003:       WUDFRd      WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_SM#XD-PICTURE&REV_1.00#7&1C60F934&0&20070818000000000&1#   : 0.  
                16         2015-10-11 12:25:03                                  WPDClassInstaller               
                32         2015-10-11 12:25:03                                  WPDClassInstaller               
                32         2015-10-11 12:25:03                                  WPDClassInstaller               
                48         2015-10-11 12:25:03                           Microsoft-Windows-DriverFrameworks-UserMode  10000:  ,       1.9.0,    WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.00#7&1C60F934&0&20070818000000000&0#.  
                48         2015-10-11 12:25:03                           Microsoft-Windows-DriverFrameworks-UserMode  10002:      WpdFs (CLSID {112DE495-AC4C-46F8-B663-6A4266C53313}) .      1.9.0    .  
                7005       2015-10-11 12:25:03                           Microsoft-Windows-UserPnp       20001:       FileRepository\wpdfs.inf_x86_neutral_fc4ebadff3a40ae4\wpdfs.inf      WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_SM#XD-PICTURE&REV_1.00#7&1C60F934&0&20070818000000000&1#   : 0x0.  
                          2015-10-11 12:25:03  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                        2015-10-11 12:25:04                                  Service Control Manager         7036:  "   "    .  
                16         2015-10-11 12:25:04                                  WPDClassInstaller               
                32         2015-10-11 12:25:04                                  WPDClassInstaller               
                32         2015-10-11 12:25:04                                  WPDClassInstaller               
                48         2015-10-11 12:25:04                           Microsoft-Windows-DriverFrameworks-UserMode  10100:     .  
                7005       2015-10-11 12:25:04                           Microsoft-Windows-UserPnp       20003:       WUDFRd      WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.00#7&1C60F934&0&20070818000000000&0#   : 0.  
                7005       2015-10-11 12:25:04                           Microsoft-Windows-UserPnp       20001:       FileRepository\wpdfs.inf_x86_neutral_fc4ebadff3a40ae4\wpdfs.inf      WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_COMPACT_FLASH&REV_1.00#7&1C60F934&0&20070818000000000&0#   : 0x0.  
                16         2015-10-11 12:25:05                                  WPDClassInstaller               
                48         2015-10-11 12:25:05                           Microsoft-Windows-DriverFrameworks-UserMode  10000:  ,       1.9.0,    WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_SD#MMC&REV_1.00#7&1C60F934&0&20070818000000000&2#.  
                48         2015-10-11 12:25:05                           Microsoft-Windows-DriverFrameworks-UserMode  10002:      WpdFs (CLSID {112DE495-AC4C-46F8-B663-6A4266C53313}) .      1.9.0    .  
                48         2015-10-11 12:25:05                           Microsoft-Windows-DriverFrameworks-UserMode  10100:     .  
                7005       2015-10-11 12:25:05                           Microsoft-Windows-UserPnp       20003:       WUDFRd      WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_SD#MMC&REV_1.00#7&1C60F934&0&20070818000000000&2#   : 0.  
                32         2015-10-11 12:25:06                                  WPDClassInstaller               
                32         2015-10-11 12:25:06                                  WPDClassInstaller               
                48         2015-10-11 12:25:06                           Microsoft-Windows-DriverFrameworks-UserMode  10000:  ,       1.9.0,    WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_MS#MS-PRO&REV_1.00#7&1C60F934&0&20070818000000000&3#.  
                48         2015-10-11 12:25:06                           Microsoft-Windows-DriverFrameworks-UserMode  10002:      WpdFs (CLSID {112DE495-AC4C-46F8-B663-6A4266C53313}) .      1.9.0    .  
                48         2015-10-11 12:25:06                           Microsoft-Windows-DriverFrameworks-UserMode  10100:     .  
                7005       2015-10-11 12:25:06                           Microsoft-Windows-UserPnp       20001:       FileRepository\wpdfs.inf_x86_neutral_fc4ebadff3a40ae4\wpdfs.inf      WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_SD#MMC&REV_1.00#7&1C60F934&0&20070818000000000&2#   : 0x0.  
                16         2015-10-11 12:25:07                                  WPDClassInstaller               
                32         2015-10-11 12:25:07                                  WPDClassInstaller               
                32         2015-10-11 12:25:07                                  WPDClassInstaller               
                7005       2015-10-11 12:25:07                           Microsoft-Windows-UserPnp       20003:       WUDFRd      WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_MS#MS-PRO&REV_1.00#7&1C60F934&0&20070818000000000&3#   : 0.  
                7005       2015-10-11 12:25:07                           Microsoft-Windows-UserPnp       20001:       FileRepository\wpdfs.inf_x86_neutral_fc4ebadff3a40ae4\wpdfs.inf      WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_GENERIC-&PROD_MS#MS-PRO&REV_1.00#7&1C60F934&0&20070818000000000&3#   : 0x0.  
                        2015-10-11 12:26:41                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-11 12:26:42                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-11 12:26:42                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-11 12:27:11  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-11 12:27:14                                  EventLog                        6006:    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  " "    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  ""    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "-"    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "     "    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "   "    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "   "    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "  "    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  " "    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-11 12:27:14                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-11 12:27:14  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-11 12:27:14                           Microsoft-Windows-Winlogon      7002:           
                4          2015-10-11 12:27:14  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-11 12:27:14  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-11 12:27:14                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-10-11 12:27:14                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-11 12:27:15                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-11 12:27:15                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-11 12:27:18                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-12 13:29:30                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-12 13:29:33                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-12 13:29:38                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-12 13:29:38                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-12 13:29:40                                  nvlddmkm                        
                        2015-10-12 13:29:41                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-12 13:29:41                                  EventLog                        6005:    .  
                        2015-10-12 13:29:41                                  EventLog                        6013:    10 .  
                        2015-10-12 13:29:41                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-12 13:29:41                                  Service Control Manager         7036:  ""    .  
                        2015-10-12 13:29:41                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-12 13:29:41                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-12 13:29:41                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-12 13:29:41                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-12 13:29:41                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 13:29:41                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-12 13:29:41                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-12 13:29:41                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-12 13:29:42                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-12 13:29:42                                  Service Control Manager         7036:  " "    .  
                        2015-10-12 13:29:42                                  Service Control Manager         7036:  ""    .  
                        2015-10-12 13:29:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 13:29:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 13:29:42                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-12 13:29:42                                  Service Control Manager         7036:  "    "    .  
                        2015-10-12 13:29:42                                  Service Control Manager         7036:  "     "    .  
                        2015-10-12 13:29:42                                  Service Control Manager         7036:  "   "    .  
                        2015-10-12 13:29:42                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-12 13:29:43                                  Service Control Manager         7036:  "   "    .  
                        2015-10-12 13:29:43                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-12 13:29:43                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-12 13:29:43                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-12 13:29:43                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-12 13:29:43                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-12 13:29:43                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-12 13:29:43                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 13:29:43                                  Service Control Manager         7036:  " "    .  
                        2015-10-12 13:29:43                                  Service Control Manager         7036:  " "    .  
                        2015-10-12 13:29:43                                  Service Control Manager         7036:  "-"    .  
                        2015-10-12 13:29:43                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 13:29:43                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-10-12 13:29:43                           Microsoft-Windows-Winlogon      7001:           
                4          2015-10-12 13:29:43  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-12 13:29:43  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-12 13:29:44                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-12 13:29:44                                  Service Control Manager         7036:  " "    .  
                        2015-10-12 13:29:44                                  Service Control Manager         7036:  " "    .  
                        2015-10-12 13:29:44                                  Service Control Manager         7036:  " "    .  
                        2015-10-12 13:29:44                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 13:29:44                                  Service Control Manager         7036:  " "    .  
                        2015-10-12 13:29:44                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-12 13:29:45                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-12 13:29:45                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-12 13:29:45                                  Service Control Manager         7036:  ""    .  
                        2015-10-12 13:29:45                                  Service Control Manager         7036:  "    "    .  
                        2015-10-12 13:29:45                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-12 13:29:45                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-12 13:29:45                                  Service Control Manager         7036:  "   "    .  
                        2015-10-12 13:29:45                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-12 13:29:46                                  Service Control Manager         7036:  ""    .  
                        2015-10-12 13:29:46                                  Service Control Manager         7036:  "   "    .  
                        2015-10-12 13:29:51                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-12 13:29:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 13:29:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 13:29:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 13:29:51                                  Service Control Manager         7036:  "   "    .  
                        2015-10-12 13:29:51                                  Service Control Manager         7036:  " "    .  
                        2015-10-12 13:29:51                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-12 13:29:51                                  Service Control Manager         7036:  "   "    .  
                        2015-10-12 13:29:51                                  Service Control Manager         7036:  "   "    .  
                        2015-10-12 13:29:51                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-12 13:29:51                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-12 13:29:51                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-12 13:29:53                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-12 13:30:15                                  Service Control Manager         7036:  "    "    .  
                        2015-10-12 13:30:15                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-12 13:30:17                                  Service Control Manager         7036:  "   Windows"    .  
                            2015-10-12 13:31:48                                  ipnathlp                        
                        2015-10-12 13:31:49                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-12 13:31:51                                  Service Control Manager         7036:  "   "    .  
                        2015-10-12 13:31:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 13:31:52                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-12 13:31:52                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 13:31:54                                  Service Control Manager         7036:  "  Windows"    .  
                          2015-10-12 13:34:13  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     yoursmileys.ru        DNS.  
                        2015-10-12 13:34:53                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 13:36:43                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-12 13:36:46  LOCAL SERVICE                   Microsoft-Windows-Time-Service  37: NTP-         time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->104.209.134.106:123).  
                        2015-10-12 13:36:54                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 13:37:00                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-12 13:37:00  LOCAL SERVICE                   Microsoft-Windows-Time-Service  35:          time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->104.209.134.106:123).  
                        2015-10-12 13:37:00  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-12 13:40:16                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 13:45:16                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 13:45:23                                  Service Control Manager         7036:  "   "    .  
                          2015-10-12 13:48:17  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.ikea.com        DNS.  
                        2015-10-12 13:48:19                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-12 14:09:44                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 14:14:37                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 14:14:37                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-12 14:14:39                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-12 14:14:48                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-12 14:17:39                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 14:20:39                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-12 14:20:50                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-12 14:20:50                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-12 14:20:50                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-12 14:20:57  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-12 22:00:40                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 22:01:07                                  Service Control Manager         7036:  "   "    .  
                        2015-10-12 22:01:21                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-12 22:01:44                                  Service Control Manager         7036:  "   "    .  
                        2015-10-12 22:03:07                                  Service Control Manager         7036:  "   "    .  
                        2015-10-12 22:03:21                                  Service Control Manager         7036:  "   Windows"    .  
                            2015-10-12 22:04:42                                  ipnathlp                        
                        2015-10-12 22:04:43                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-12 22:06:13  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     pay.mts.ru        DNS.  
                          2015-10-12 22:09:56  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     connect.facebook.net        DNS.  
                        2015-10-12 22:11:48                                  Service Control Manager         7036:  "   "    .  
                        2015-10-12 22:14:24                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-12 22:14:26                                  Service Control Manager         7036:  " "    .  
                        2015-10-12 22:14:26                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                          2015-10-12 22:14:43  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.windowsphone.com        DNS.  
                        2015-10-12 22:15:47                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-12 22:15:48                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-12 22:15:48                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-12 22:19:22                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 23:28:53                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-12 23:29:45                                  Service Control Manager         7036:  "  "    .  
                7005       2015-10-12 23:32:28                           Microsoft-Windows-UserPnp       20001:       NULL Driver      USB\VID_0421&PID_066E\5&9965632&0&1   : 0xe0000203.  
                        2015-10-12 23:38:03                                  Service Control Manager         7036:  "  "    .  
                          2015-10-12 23:42:56  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     d18kwxxua7ik1y.cloudfront.net        DNS.  
                        2015-10-12 23:48:03                                  Service Control Manager         7036:  "   "    .  
                        2015-10-12 23:48:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 23:53:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-12 23:58:06                                  Service Control Manager         7036:  "   "    .  
                        2015-10-13 00:32:56                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 00:32:56  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-13 00:32:58  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-13 00:32:58                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-13 00:32:59                                  EventLog                        6006:    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  " "    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  ""    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "-"    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "   "    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "     "    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "   "    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-13 00:32:59                                  Service Control Manager         7036:  " "    .  
                4          2015-10-13 00:32:59  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-13 00:32:59  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-13 00:32:59                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-10-13 00:33:00                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-13 00:33:00                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-13 00:33:00                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-10-13 00:33:00                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-13 00:33:06                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-13 18:51:21                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-13 18:51:24                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-13 18:51:34                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-13 18:51:34                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-13 18:51:37                                  nvlddmkm                        
                        2015-10-13 18:51:37                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-13 18:51:37                                  EventLog                        6005:    .  
                        2015-10-13 18:51:37                                  EventLog                        6013:    16 .  
                        2015-10-13 18:51:37                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-13 18:51:37                                  Service Control Manager         7036:  ""    .  
                        2015-10-13 18:51:37                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-13 18:51:37                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-13 18:51:37                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-13 18:51:37                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-13 18:51:37                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 18:51:37                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-13 18:51:37                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-13 18:51:38                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-13 18:51:38                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-13 18:51:38                                  Service Control Manager         7036:  " "    .  
                        2015-10-13 18:51:38                                  Service Control Manager         7036:  ""    .  
                        2015-10-13 18:51:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 18:51:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 18:51:38                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-13 18:51:38                                  Service Control Manager         7036:  "    "    .  
                        2015-10-13 18:51:38                                  Service Control Manager         7036:  "     "    .  
                        2015-10-13 18:51:38                                  Service Control Manager         7036:  "   "    .  
                        2015-10-13 18:51:38                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-13 18:51:39                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-13 18:51:39                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-13 18:51:39                                  Service Control Manager         7036:  "   "    .  
                        2015-10-13 18:51:39                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-13 18:51:39                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-13 18:51:39                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-13 18:51:39                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-13 18:51:39                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 18:51:39                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-10-13 18:51:39                           Microsoft-Windows-Winlogon      7001:           
                4          2015-10-13 18:51:39  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-13 18:51:39  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-13 18:51:40                                  Service Control Manager         7036:  " "    .  
                        2015-10-13 18:51:40                                  Service Control Manager         7036:  " "    .  
                        2015-10-13 18:51:40                                  Service Control Manager         7036:  "-"    .  
                        2015-10-13 18:51:40                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 18:51:40                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-13 18:51:40                                  Service Control Manager         7036:  " "    .  
                        2015-10-13 18:51:40                                  Service Control Manager         7036:  " "    .  
                        2015-10-13 18:51:40                                  Service Control Manager         7036:  " "    .  
                        2015-10-13 18:51:40                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 18:51:41                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-13 18:51:41                                  Service Control Manager         7036:  " "    .  
                        2015-10-13 18:51:41                                  Service Control Manager         7036:  "    "    .  
                        2015-10-13 18:51:41                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-13 18:51:42                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-13 18:51:42                                  Service Control Manager         7036:  ""    .  
                        2015-10-13 18:51:42                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-13 18:51:42                                  Service Control Manager         7036:  "   "    .  
                        2015-10-13 18:51:42                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-13 18:51:42                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-13 18:51:43                                  Service Control Manager         7036:  ""    .  
                        2015-10-13 18:51:43                                  Service Control Manager         7036:  "   "    .  
                        2015-10-13 18:51:45                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-13 18:51:45                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 18:51:45                                  Service Control Manager         7036:  "   "    .  
                        2015-10-13 18:51:45                                  Service Control Manager         7036:  "   "    .  
                        2015-10-13 18:51:45                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 18:51:45                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 18:51:45                                  Service Control Manager         7036:  " "    .  
                        2015-10-13 18:51:45                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-13 18:51:45                                  Service Control Manager         7036:  "   "    .  
                        2015-10-13 18:51:45                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-13 18:51:46                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-13 18:51:46                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-13 18:51:53                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-13 18:53:45                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-13 18:53:45                                  Service Control Manager         7036:  "   "    .  
                        2015-10-13 18:53:45                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 18:53:45                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-13 18:53:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 18:53:47                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-13 18:56:48                                  Service Control Manager         7036:  "   "    .  
                        2015-10-13 18:58:47                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 18:58:48                                  Service Control Manager         7036:  "   "    .  
                        2015-10-13 19:02:15                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 19:03:53                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 19:06:55                                  Service Control Manager         7036:  "   "    .  
                        2015-10-13 19:08:54                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 19:21:57                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 19:21:57                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-13 19:24:59                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 19:27:59                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-13 19:31:40                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 19:35:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 19:40:52                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 22:13:21                                  Service Control Manager         7036:  "  Windows -  "    .  
                            2015-10-13 22:13:33                                  ipnathlp                        
                            2015-10-13 22:13:38                                  ipnathlp                        
                        2015-10-13 22:13:41                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-13 22:13:41                                  Service Control Manager         7036:  "    "    .  
                        2015-10-13 22:13:41                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-13 22:13:44                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-13 22:13:44                                  Service Control Manager         7036:  " "    .  
                        2015-10-13 22:13:45                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-13 22:14:00                                  Service Control Manager         7036:  "  "    .  
                          2015-10-13 22:14:05  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     tiles.r53-2.services.mozilla.com        DNS.  
                        2015-10-13 22:14:16                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-13 22:14:16                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-13 22:14:16                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-13 22:14:18  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dostavkin.su        DNS.  
                        2015-10-13 22:14:23                                  Service Control Manager         7036:  "   "    .  
                            2015-10-13 22:17:22                                  ipnathlp                        
                        2015-10-13 22:17:24                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-13 22:18:31  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     rainbow-ru.mythings.com        DNS.  
                        2015-10-13 22:19:02                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 22:22:56                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 22:24:23                                  Service Control Manager         7036:  "   "    .  
                          2015-10-13 22:25:01  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     ttisuccessinsights.com.ua        DNS.  
                        2015-10-13 22:25:28                                  Service Control Manager         7036:  "   "    .  
                        2015-10-13 22:31:00                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 22:33:11                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-13 22:38:16                                  Service Control Manager         7036:  "   "    .  
                        2015-10-13 22:38:55                                  Service Control Manager         7036:  "   "    .  
                        2015-10-13 22:44:39                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 22:46:28                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-13 23:02:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 23:02:58                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-13 23:06:40                                  Service Control Manager         7036:  "   "    .  
                        2015-10-13 23:06:57                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 23:12:36                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 23:15:31                                  Service Control Manager         7036:  "  "    .  
                          2015-10-13 23:18:44  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.chel.mts.ru        DNS.  
                        2015-10-13 23:32:37                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 23:34:56                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 23:38:27                                  Service Control Manager         7036:  "   "    .  
                        2015-10-13 23:38:29                                  Service Control Manager         7036:  " "    .  
                        2015-10-13 23:48:32                                  Service Control Manager         7036:  "   "    .  
                        2015-10-13 23:50:02                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 23:52:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-13 23:57:46                                  Service Control Manager         7036:  "  "    .  
                          2015-10-14 00:21:41  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     seal.geotrust.com        DNS.  
                          2015-10-14 00:31:31  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     ssl.google-analytics.com        DNS.  
                        2015-10-14 00:33:10  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-14 00:33:11                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 00:33:13                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-14 00:33:13                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 00:33:13                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 00:33:13                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 00:33:13                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-14 00:33:13                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-14 00:33:13                                  Service Control Manager         7036:  ""    .  
                        2015-10-14 00:33:13                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-14 00:33:13                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 00:33:13                                  Service Control Manager         7036:  "-"    .  
                        2015-10-14 00:33:13                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-14 00:33:13                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-14 00:33:13                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-14 00:33:13  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-14 00:33:13                           Microsoft-Windows-Winlogon      7002:           
                4          2015-10-14 00:33:13  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-14 00:33:13  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-14 00:33:13                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-10-14 00:33:14                                  EventLog                        6006:    .  
                        2015-10-14 00:33:14                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 00:33:14                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-14 00:33:14                                  Service Control Manager         7036:  "     "    .  
                        2015-10-14 00:33:14                                  Service Control Manager         7036:  "  Windows -  "    .  
                        2015-10-14 00:33:14                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 00:33:14                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-14 00:33:14                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 00:33:14                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-14 00:33:14                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 00:33:14                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-14 00:33:14                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-14 00:33:14                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-14 00:33:14                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-14 00:33:14                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-14 00:33:14                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-14 00:33:14                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-14 00:33:14                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 00:33:14                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-14 00:33:14                                  Service Control Manager         7036:  "  WLAN"    .  
                          2015-10-14 00:33:14                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                103        2015-10-14 00:33:15                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-14 00:33:26                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-14 10:18:34                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-14 10:18:37                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-14 10:18:42                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-14 10:18:42                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-14 10:18:44                                  nvlddmkm                        
                        2015-10-14 10:18:45                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-14 10:18:45                                  EventLog                        6005:    .  
                        2015-10-14 10:18:45                                  EventLog                        6013:    10 .  
                        2015-10-14 10:18:45                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-14 10:18:45                                  Service Control Manager         7036:  ""    .  
                        2015-10-14 10:18:45                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-14 10:18:45                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-14 10:18:45                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-14 10:18:45                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-14 10:18:45                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:18:45                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-14 10:18:45                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-14 10:18:46                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-14 10:18:46                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-14 10:18:46                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 10:18:46                                  Service Control Manager         7036:  ""    .  
                        2015-10-14 10:18:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:18:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:18:46                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-14 10:18:46                                  Service Control Manager         7036:  "    "    .  
                        2015-10-14 10:18:46                                  Service Control Manager         7036:  "     "    .  
                        2015-10-14 10:18:46                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 10:18:46                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-14 10:18:47                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-14 10:18:47                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-14 10:18:47                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 10:18:47                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-14 10:18:47                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-14 10:18:47                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-14 10:18:47                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-14 10:18:47                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:18:47                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-10-14 10:18:47                           Microsoft-Windows-Winlogon      7001:           
                4          2015-10-14 10:18:47  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-14 10:18:47  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-14 10:18:48                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 10:18:48                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 10:18:48                                  Service Control Manager         7036:  "-"    .  
                        2015-10-14 10:18:48                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:18:48                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-14 10:18:48                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 10:18:48                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 10:18:48                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:18:49                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 10:18:49                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-14 10:18:50                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 10:18:50                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-14 10:18:50                                  Service Control Manager         7036:  "    "    .  
                        2015-10-14 10:18:50                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-14 10:18:50                                  Service Control Manager         7036:  ""    .  
                        2015-10-14 10:18:50                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-14 10:18:50                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 10:18:51                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-14 10:18:51                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-14 10:18:51                                  Service Control Manager         7036:  ""    .  
                        2015-10-14 10:18:51                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 10:18:53                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-14 10:18:53                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:18:53                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:18:53                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:18:53                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 10:18:53                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 10:18:53                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 10:18:53                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-14 10:18:54                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 10:18:54                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-14 10:18:55                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-14 10:18:55                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-14 10:18:55                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-10-14 10:18:57                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-10-14 10:19:02                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-14 10:19:11                                  Service Control Manager         7036:  "    "    .  
                        2015-10-14 10:19:11                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-14 10:19:13                                  Service Control Manager         7036:  "   Windows"    .  
                          2015-10-14 10:19:21  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     nginx-frontend-ha2.redhelper.ru        DNS.  
                        2015-10-14 10:19:31  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-14 10:19:31                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-14 10:19:32                                  EventLog                        6006:    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  ""    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "-"    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "     "    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-14 10:19:32                                  Service Control Manager         7036:  "Windows Search"    .  
                4          2015-10-14 10:19:32  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-14 10:19:32  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-14 10:19:32                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-10-14 10:19:33                                  Service Control Manager         7036:  "  WLAN"    .  
                103        2015-10-14 10:19:33                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-10-14 10:19:33                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-14 10:19:37                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-14 10:20:34                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-14 10:20:37                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-14 10:20:41                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-14 10:20:41                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-14 10:20:44                                  nvlddmkm                        
                        2015-10-14 10:20:45                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-14 10:20:45                                  EventLog                        6005:    .  
                        2015-10-14 10:20:45                                  EventLog                        6013:    10 .  
                        2015-10-14 10:20:45                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-14 10:20:45                                  Service Control Manager         7036:  ""    .  
                        2015-10-14 10:20:45                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-14 10:20:45                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-14 10:20:45                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-14 10:20:45                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-14 10:20:45                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:20:45                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-14 10:20:45                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-14 10:20:46                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-14 10:20:46                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-14 10:20:46                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 10:20:46                                  Service Control Manager         7036:  ""    .  
                        2015-10-14 10:20:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:20:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:20:46                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-14 10:20:46                                  Service Control Manager         7036:  "    "    .  
                        2015-10-14 10:20:46                                  Service Control Manager         7036:  "     "    .  
                        2015-10-14 10:20:46                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 10:20:46                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-14 10:20:47                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-14 10:20:47                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-14 10:20:47                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 10:20:47                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-14 10:20:47                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-14 10:20:47                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-14 10:20:47                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-14 10:20:47                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:20:47                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-10-14 10:20:47                           Microsoft-Windows-Winlogon      7001:           
                4          2015-10-14 10:20:47  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-14 10:20:47  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-14 10:20:48                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 10:20:48                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 10:20:48                                  Service Control Manager         7036:  "-"    .  
                        2015-10-14 10:20:48                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:20:48                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-14 10:20:48                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 10:20:48                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:20:48                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 10:20:49                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 10:20:49                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-14 10:20:50                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 10:20:50                                  Service Control Manager         7036:  "    "    .  
                        2015-10-14 10:20:50                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-14 10:20:50                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-14 10:20:50                                  Service Control Manager         7036:  ""    .  
                        2015-10-14 10:20:50                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-14 10:20:50                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 10:20:50                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-14 10:20:51                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-14 10:20:51                                  Service Control Manager         7036:  ""    .  
                        2015-10-14 10:20:51                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 10:20:53                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-14 10:20:53                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:20:53                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:20:53                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 10:20:53                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:20:53                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 10:20:53                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-14 10:20:53                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 10:20:53                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 10:20:54                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-14 10:20:54                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-14 10:20:54                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-14 10:20:55                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-14 10:20:57                                  Service Control Manager         7036:  "    "    .  
                        2015-10-14 10:20:57                           Microsoft-Windows-Application-Experience  201:       .  
                7005       2015-10-14 10:20:57                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-10-14 10:21:00                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-14 10:21:00                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-14 10:21:04                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-14 10:21:19                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-14 10:22:53                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 10:22:53                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:22:54                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-14 10:22:54                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:22:56                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-14 10:25:59                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 10:27:55                                  Service Control Manager         7036:  "  "    .  
                          2015-10-14 10:29:08  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     cs623927.vk.me        DNS.  
                        2015-10-14 10:30:53                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 10:37:25                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-14 11:00:48                                  Service Control Manager         7036:  "  "    .  
                          2015-10-14 11:07:21  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     ok.ru        DNS.  
                        2015-10-14 11:18:22                                  Service Control Manager         7036:  "   "    .  
                          2015-10-14 11:19:37  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.php.net        DNS.  
                        2015-10-14 11:28:22                                  Service Control Manager         7036:  "   "    .  
                          2015-10-14 11:43:51  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-14 11:44:44                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-14 11:44:44                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-14 11:44:44                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-14 11:44:47                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-14 11:44:51  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-14 11:57:42                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 12:00:39                                  EventLog                        6013:    6005 .  
                        2015-10-14 12:02:32                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 12:02:44                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 12:09:17                                  Service Control Manager         7036:  "  "    .  
                          2015-10-14 12:33:26  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.fotovshkole.ru        DNS.  
                        2015-10-14 13:10:58                                  Service Control Manager         7036:  " "    .  
                        2015-10-14 13:20:59                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 13:20:59                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-14 13:24:01                                  Service Control Manager         7036:  "  "    .  
                          2015-10-14 13:25:34  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-14 13:27:01                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                          2015-10-14 13:29:56  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-14 13:34:47  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-14 13:35:00  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                          2015-10-14 13:40:36  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-10-14 13:45:04  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     token.services.mozilla.com        DNS.  
                        2015-10-14 13:58:21                                  Service Control Manager         7036:  " "    .  
                          2015-10-14 14:09:51  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                          2015-10-14 14:10:04  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                          2015-10-14 15:19:11  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                          2015-10-14 15:20:47  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-14 17:14:12                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-14 17:14:25                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 17:16:12                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-14 17:17:50                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 17:20:00                                  Service Control Manager         7036:  "   "    .  
                          2015-10-14 17:20:00                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-10-14 17:20:01                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-14 17:20:02                                  Disk                            51:     \Device\Harddisk3\DR5      .  
                          2015-10-14 17:20:02                                  Disk                            51:     \Device\Harddisk3\DR6      .  
                          2015-10-14 17:20:03                                  Disk                            51:     \Device\Harddisk3\DR7      .  
                          2015-10-14 17:20:05                                  Disk                            51:     \Device\Harddisk3\DR8      .  
                          2015-10-14 17:20:06                                  Disk                            51:     \Device\Harddisk3\DR9      .  
                          2015-10-14 17:20:07                                  Disk                            51:     \Device\Harddisk3\DR10      .  
                          2015-10-14 17:20:07                                  Disk                            51:     \Device\Harddisk3\DR11      .  
                          2015-10-14 17:20:08                                  Disk                            51:     \Device\Harddisk3\DR12      .  
                          2015-10-14 17:20:09                                  Disk                            51:     \Device\Harddisk3\DR13      .  
                          2015-10-14 17:20:10                                  Disk                            51:     \Device\Harddisk3\DR14      .  
                          2015-10-14 17:20:10                                  Disk                            51:     \Device\Harddisk3\DR15      .  
                          2015-10-14 17:20:11                                  Disk                            51:     \Device\Harddisk3\DR16      .  
                        2015-10-14 17:24:25                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 17:25:17                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 17:28:59                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-14 17:28:59                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-14 17:28:59                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-14 17:30:08                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 17:35:26                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 18:21:05                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 18:23:05                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 18:26:06                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 18:34:32                                  Service Control Manager         7036:  "  "    .  
                        2015-10-14 18:34:33                                  Service Control Manager         7036:  "   "    .  
                          2015-10-14 18:34:33                                  Disk                            51:     \Device\Harddisk3\DR18      .  
                          2015-10-14 18:34:34                                  Disk                            51:     \Device\Harddisk3\DR19      .  
                          2015-10-14 18:34:35                                  Disk                            51:     \Device\Harddisk3\DR20      .  
                        2015-10-14 18:34:52                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-14 18:36:04                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-14 18:36:52                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-14 18:39:01                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 18:40:04                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 18:42:45                                  Service Control Manager         7036:  "   "    .  
                        2015-10-14 18:45:46                                  Service Control Manager         7036:  "  "    .  
                          2015-10-14 21:16:22  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-14 23:08:00                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-14 23:08:00                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-14 23:08:00                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                            2015-10-14 23:50:04                                  ipnathlp                        
                        2015-10-14 23:50:06                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-14 23:50:33  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     tao.ru        DNS.  
                          2015-10-15 00:23:51  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.theclimategroup.org.cn        DNS.  
                          2015-10-15 00:44:45  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.yunos.com        DNS.  
                          2015-10-15 00:45:06  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     gatc.tao.ru        DNS.  
                          2015-10-15 00:50:14  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     zcainfo.miitbeian.gov.cn        DNS.  
                          2015-10-15 01:06:59  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     login.tmall.com        DNS.  
                          2015-10-15 01:18:47  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     ai.taobao.com        DNS.  
                        2015-10-15 01:31:11                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-15 01:31:13                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-15 01:31:13                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-15 01:34:12  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-15 01:34:14                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 01:34:16  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-15 01:34:16                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-15 01:34:17                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-15 01:34:17                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 01:34:17                                  EventLog                        6006:    .  
                        2015-10-15 01:34:17                                  Service Control Manager         7036:  " "    .  
                        2015-10-15 01:34:17                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-15 01:34:17                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-15 01:34:17                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 01:34:17                                  Service Control Manager         7036:  ""    .  
                        2015-10-15 01:34:17                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-15 01:34:17                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-15 01:34:17                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 01:34:17                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 01:34:17                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-15 01:34:17                                  Service Control Manager         7036:  "     "    .  
                        2015-10-15 01:34:17                                  Service Control Manager         7036:  "-"    .  
                        2015-10-15 01:34:17                                  Service Control Manager         7036:  "   "    .  
                4          2015-10-15 01:34:17  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-15 01:34:17  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-15 01:34:17                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-10-15 01:34:18                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-15 01:34:18                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-15 01:34:18                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-15 01:34:18                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-15 01:34:18                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-15 01:34:18                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-15 01:34:18                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-15 01:34:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 01:34:18                                  Service Control Manager         7036:  "   "    .  
                        2015-10-15 01:34:18                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-15 01:34:18                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-15 01:34:18                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-15 01:34:18                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-15 01:34:18                                  Service Control Manager         7036:  " "    .  
                          2015-10-15 01:34:18                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-15 01:34:19                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-15 01:34:20                                  Service Control Manager         7036:  " Windows"    .  
                103        2015-10-15 01:34:21                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-15 01:34:32                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-15 07:32:09                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-15 07:32:12                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-15 07:32:17                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-15 07:32:17                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-15 07:32:20                                  nvlddmkm                        
                        2015-10-15 07:32:20                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-15 07:32:20                                  Service Control Manager         7036:  ""    .  
                        2015-10-15 07:32:20                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-15 07:32:20                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-15 07:32:21                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-15 07:32:21                                  EventLog                        6005:    .  
                        2015-10-15 07:32:21                                  EventLog                        6013:    11 .  
                        2015-10-15 07:32:21                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-15 07:32:21                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-15 07:32:21                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-15 07:32:21                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-15 07:32:21                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 07:32:21                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-15 07:32:21                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-15 07:32:21                                  Service Control Manager         7036:  ""    .  
                        2015-10-15 07:32:21                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 07:32:21                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 07:32:21                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-15 07:32:21                                  Service Control Manager         7036:  " "    .  
                        2015-10-15 07:32:21                                  Service Control Manager         7036:  "    "    .  
                        2015-10-15 07:32:21                                  Service Control Manager         7036:  "     "    .  
                        2015-10-15 07:32:21                                  Service Control Manager         7036:  "   "    .  
                        2015-10-15 07:32:21                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-15 07:32:22                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-15 07:32:22                                  Service Control Manager         7036:  "   "    .  
                        2015-10-15 07:32:22                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-15 07:32:22                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-15 07:32:22                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-15 07:32:22                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-15 07:32:22                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-15 07:32:22                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 07:32:22                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-10-15 07:32:22  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-15 07:32:22  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-15 07:32:23                                  Service Control Manager         7036:  " "    .  
                        2015-10-15 07:32:23                                  Service Control Manager         7036:  " "    .  
                        2015-10-15 07:32:23                                  Service Control Manager         7036:  "-"    .  
                        2015-10-15 07:32:23                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 07:32:23                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-15 07:32:23                                  Service Control Manager         7036:  " "    .  
                        2015-10-15 07:32:23                                  Service Control Manager         7036:  " "    .  
                        2015-10-15 07:32:23                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 07:32:23                                  Service Control Manager         7036:  " "    .  
                        2015-10-15 07:32:23                                  Service Control Manager         7036:  " "    .  
                        2015-10-15 07:32:23                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                1101       2015-10-15 07:32:23                           Microsoft-Windows-Winlogon      7001:           
                        2015-10-15 07:32:24                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-15 07:32:24                                  Service Control Manager         7036:  "    "    .  
                        2015-10-15 07:32:24                                  Service Control Manager         7036:  ""    .  
                        2015-10-15 07:32:24                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-15 07:32:24                                  Service Control Manager         7036:  "   "    .  
                        2015-10-15 07:32:24                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-15 07:32:24                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-15 07:32:24                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-15 07:32:25                                  Service Control Manager         7036:  "   "    .  
                        2015-10-15 07:32:25                                  Service Control Manager         7036:  ""    .  
                        2015-10-15 07:32:26                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-15 07:32:27                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 07:32:27                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 07:32:27                                  Service Control Manager         7036:  "   "    .  
                        2015-10-15 07:32:27                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 07:32:27                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-15 07:32:27                                  Service Control Manager         7036:  " "    .  
                        2015-10-15 07:32:27                                  Service Control Manager         7036:  "   "    .  
                        2015-10-15 07:32:27                                  Service Control Manager         7036:  "   "    .  
                        2015-10-15 07:32:27                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-15 07:32:28                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-15 07:32:28                                  Service Control Manager         7036:  "  PNP-"    .  
                7005       2015-10-15 07:32:30                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0001   : 0.  
                        2015-10-15 07:32:33                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-15 07:33:45                                  Service Control Manager         7036:  "    "    .  
                        2015-10-15 07:33:45                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-15 07:33:46                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-15 07:34:27                                  Service Control Manager         7036:  "   "    .  
                        2015-10-15 07:34:27                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 07:34:27                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-15 07:34:27                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 07:34:29                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-15 07:35:12                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-10-15 07:35:37  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     self-repair.mozilla.org        DNS.  
                        2015-10-15 07:35:41                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-15 07:35:41                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-15 07:35:41                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-15 07:35:41  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dub110.mail.live.com        DNS.  
                        2015-10-15 07:37:32                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 07:39:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 07:44:30                                  Service Control Manager         7036:  "   "    .  
                        2015-10-15 07:51:42                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-15 07:55:25                                  Service Control Manager         7036:  " "    .  
                        2015-10-15 08:02:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 08:02:18                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-15 08:05:24                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 08:08:24                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-15 08:12:23                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 08:31:35                                  Service Control Manager         7036:  " "    .  
                        2015-10-15 10:05:56  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-15 10:05:57                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 10:05:59                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-15 10:05:59                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 10:05:59                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 10:05:59                                  Service Control Manager         7036:  " "    .  
                        2015-10-15 10:05:59                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-15 10:05:59                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-15 10:05:59                                  Service Control Manager         7036:  ""    .  
                        2015-10-15 10:05:59                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-15 10:05:59                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 10:05:59                                  Service Control Manager         7036:  "-"    .  
                        2015-10-15 10:05:59                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 10:05:59                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-15 10:05:59                                  Service Control Manager         7036:  "     "    .  
                        2015-10-15 10:05:59                                  Service Control Manager         7036:  "   "    .  
                        2015-10-15 10:05:59                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-15 10:05:59                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-15 10:05:59                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-15 10:05:59                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-15 10:05:59                                  Service Control Manager         7036:  "   "    .  
                        2015-10-15 10:05:59                                  Service Control Manager         7036:  "  "    .  
                        2015-10-15 10:05:59  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-15 10:05:59                           Microsoft-Windows-Winlogon      7002:           
                4          2015-10-15 10:05:59  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-15 10:05:59  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-15 10:05:59                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-10-15 10:06:00                                  EventLog                        6006:    .  
                        2015-10-15 10:06:00                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-15 10:06:00                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-15 10:06:00                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-15 10:06:00                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-15 10:06:00                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-15 10:06:00                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-15 10:06:00                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-15 10:06:00                                  Service Control Manager         7036:  " "    .  
                        2015-10-15 10:06:00                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-15 10:06:00                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-15 10:06:00                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-10-15 10:06:00                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-15 10:06:12                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-18 21:41:20                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-18 21:41:23                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-18 21:41:27                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-18 21:41:27                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-18 21:41:30                                  nvlddmkm                        
                        2015-10-18 21:41:30                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-18 21:41:30                                  EventLog                        6005:    .  
                        2015-10-18 21:41:30                                  EventLog                        6013:    10 .  
                        2015-10-18 21:41:30                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-18 21:41:30                                  Service Control Manager         7036:  ""    .  
                        2015-10-18 21:41:30                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-18 21:41:30                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-18 21:41:30                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-18 21:41:30                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-18 21:41:30                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                101        2015-10-18 21:41:30                           Microsoft-Windows-DriverFrameworks-UserMode  10114:         ,       WUDFPf.       ,   Windows    .  
                7010       2015-10-18 21:41:30                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                  212        2015-10-18 21:41:30                           Microsoft-Windows-Kernel-PnP    219: 
                        2015-10-18 21:41:31                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 21:41:31                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-18 21:41:31                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-18 21:41:31                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 21:41:31                                  Service Control Manager         7036:  ""    .  
                        2015-10-18 21:41:31                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 21:41:31                                  Service Control Manager         7036:  " "    .  
                        2015-10-18 21:41:31                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-18 21:41:31                                  Service Control Manager         7036:  "    "    .  
                        2015-10-18 21:41:31                                  Service Control Manager         7036:  "     "    .  
                        2015-10-18 21:41:31                                  Service Control Manager         7036:  "   "    .  
                1101       2015-10-18 21:41:32                           Microsoft-Windows-Winlogon      7001:           
                        2015-10-18 21:41:38                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-18 21:41:38                                  Service Control Manager         7036:  "   "    .  
                        2015-10-18 21:41:38                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-18 21:41:38                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-18 21:41:38                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-18 21:41:38                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-18 21:41:38                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-18 21:41:38                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-18 21:41:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 21:41:38                                  Service Control Manager         7036:  " "    .  
                        2015-10-18 21:41:38                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-10-18 21:41:38  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-18 21:41:38  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-18 21:41:39                                  Service Control Manager         7036:  " "    .  
                        2015-10-18 21:41:39                                  Service Control Manager         7036:  "-"    .  
                        2015-10-18 21:41:39                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 21:41:39                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-18 21:41:39                                  Service Control Manager         7036:  " "    .  
                        2015-10-18 21:41:39                                  Service Control Manager         7036:  " "    .  
                        2015-10-18 21:41:39                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 21:41:39                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-18 21:41:39                                  Service Control Manager         7036:  " "    .  
                        2015-10-18 21:41:39                                  Service Control Manager         7036:  " "    .  
                        2015-10-18 21:41:39                                  Service Control Manager         7036:  ""    .  
                        2015-10-18 21:41:39                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-18 21:41:39                                  Service Control Manager         7036:  "   "    .  
                        2015-10-18 21:41:39                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-18 21:41:39                                  Service Control Manager         7036:  "    "    .  
                        2015-10-18 21:41:39                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-18 21:41:39                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-18 21:41:39                                  Service Control Manager         7036:  "   "    .  
                        2015-10-18 21:41:39                                  Service Control Manager         7036:  ""    .  
                        2015-10-18 21:41:39                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-18 21:41:40                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-18 21:41:40                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 21:41:40                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 21:41:40                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 21:41:41                                  Service Control Manager         7036:  "   "    .  
                        2015-10-18 21:41:41                                  Service Control Manager         7036:  "   "    .  
                        2015-10-18 21:41:41                                  Service Control Manager         7036:  "   "    .  
                        2015-10-18 21:41:41                                  Service Control Manager         7036:  " "    .  
                        2015-10-18 21:41:41                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-18 21:41:41                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-18 21:41:41                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-18 21:41:41                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-18 21:41:46                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-18 21:43:41                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-18 21:43:41                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 21:43:41                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-18 21:43:41                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 21:43:43                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-18 21:44:52                                  Service Control Manager         7036:  "   "    .  
                        2015-10-18 21:45:52                                  Service Control Manager         7036:  "   "    .  
                        2015-10-18 21:48:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 21:48:50                                  Service Control Manager         7036:  "   "    .  
                        2015-10-18 21:51:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 21:55:31                                  Service Control Manager         7036:  "   "    .  
                        2015-10-18 22:01:22                                  Service Control Manager         7036:  " "    .  
                        2015-10-18 22:06:10                                  Service Control Manager         7036:  " "    .  
                        2015-10-18 22:11:23                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 22:11:24                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-18 22:11:25                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-18 22:11:25                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-18 22:12:19                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-18 22:14:43                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 22:17:43                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-18 22:21:39                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 22:22:23                           Service Control Manager         7040:    "  Windows"    ""  "".  
                        2015-10-18 22:22:23                           Service Control Manager         7040:    "  Windows"    ""  "".  
                        2015-10-18 22:22:24                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-18 22:51:54                                  Service Control Manager         7036:  "   "    .  
                        2015-10-18 22:52:13                                  Service Control Manager         7036:  "  "    .  
                            2015-10-18 22:53:01                                  cdrom                           7:     \Device\CdRom0.  
                            2015-10-18 22:53:09                                  cdrom                           7:     \Device\CdRom0.  
                            2015-10-18 22:53:15                                  cdrom                           7:     \Device\CdRom0.  
                            2015-10-18 22:56:44                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-18 22:57:15                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-18 22:57:15                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-18 22:57:16                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-18 22:57:17                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-18 22:57:18                                  atapi                           11:     \Device\Ide\IdePort3.  
                            2015-10-18 22:57:18                                  cdrom                           15:    \Device\CdRom0  .  
                        2015-10-18 22:59:14                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 23:04:41                                  Service Control Manager         7036:  "   "    .  
                        2015-10-18 23:31:06                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 23:31:06  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-18 23:31:08                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-18 23:31:08  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-18 23:31:08                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  " "    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  ""    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "-"    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "     "    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "   "    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-18 23:31:09                                  EventLog                        6006:    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "   "    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "  "    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-18 23:31:09                                  Service Control Manager         7036:  " "    .  
                4          2015-10-18 23:31:09  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-18 23:31:09  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-18 23:31:09                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-10-18 23:31:09                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-18 23:31:10                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-18 23:31:10                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-18 23:31:22                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-19 17:22:49                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-19 17:22:52                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-19 17:22:56                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-19 17:22:56                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-19 17:23:02                                  nvlddmkm                        
                        2015-10-19 17:23:03                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-19 17:23:03                                  EventLog                        6005:    .  
                        2015-10-19 17:23:03                                  EventLog                        6013:    14 .  
                        2015-10-19 17:23:03                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-19 17:23:03                                  Service Control Manager         7036:  ""    .  
                        2015-10-19 17:23:03                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-19 17:23:03                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-19 17:23:03                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-19 17:23:03                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-19 17:23:03                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 17:23:03                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-19 17:23:03                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-19 17:23:04                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-19 17:23:04                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-19 17:23:04                                  Service Control Manager         7036:  ""    .  
                        2015-10-19 17:23:04                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 17:23:04                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 17:23:04                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-19 17:23:04                                  Service Control Manager         7036:  " "    .  
                        2015-10-19 17:23:04                                  Service Control Manager         7036:  "    "    .  
                        2015-10-19 17:23:04                                  Service Control Manager         7036:  "     "    .  
                        2015-10-19 17:23:04                                  Service Control Manager         7036:  "   "    .  
                        2015-10-19 17:23:04                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-19 17:23:04                                  Service Control Manager         7036:  "   "    .  
                        2015-10-19 17:23:04                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-19 17:23:04                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-19 17:23:04                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-19 17:23:04                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-19 17:23:04                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-19 17:23:04                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-19 17:23:04                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 17:23:04                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-10-19 17:23:04  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-19 17:23:04  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  " "    .  
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  " "    .  
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  "-"    .  
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  " "    .  
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  " "    .  
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  " "    .  
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  " "    .  
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  "   "    .  
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  ""    .  
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  "    "    .  
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  "   "    .  
                        2015-10-19 17:23:05                                  Service Control Manager         7036:  ""    .  
                1101       2015-10-19 17:23:05                           Microsoft-Windows-Winlogon      7001:           
                        2015-10-19 17:23:06                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-19 17:23:06                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 17:23:06                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-19 17:23:06                                  Service Control Manager         7036:  " "    .  
                        2015-10-19 17:23:06                                  Service Control Manager         7036:  "   "    .  
                        2015-10-19 17:23:06                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 17:23:06                                  Service Control Manager         7036:  "   "    .  
                        2015-10-19 17:23:06                                  Service Control Manager         7036:  "   "    .  
                        2015-10-19 17:23:06                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 17:23:06                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-19 17:23:08                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-19 17:23:08                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-19 17:23:12                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-19 17:23:48                                  Service Control Manager         7036:  "    "    .  
                        2015-10-19 17:23:48                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-19 17:25:06                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-19 17:25:06                                  Service Control Manager         7036:  "   "    .  
                        2015-10-19 17:25:06                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 17:25:06                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-19 17:25:07                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 17:25:08                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-19 17:30:08                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 17:30:21                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 17:33:50                                  Service Control Manager         7036:  "   "    .  
                        2015-10-19 17:49:58                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 17:49:58                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-19 17:49:59                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-19 17:49:59                                  Service Control Manager         7036:  "  Windows"    .  
                          2015-10-19 17:49:59  LOCAL SERVICE                   Microsoft-Windows-Time-Service  134: NTP-           -   DNS-  "". NTP-    3473457 .,      . :   . (0x80072AF9)  
                        2015-10-19 17:52:59                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 17:53:06                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 17:56:06                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 17:59:06                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-19 18:03:05                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 23:16:16                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 23:16:16  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-19 23:16:18                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-19 23:16:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 23:16:18  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-19 23:16:18                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-19 23:16:19                                  EventLog                        6006:    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  " "    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  ""    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "-"    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "     "    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "   "    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "   "    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "  "    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  " "    .  
                        2015-10-19 23:16:19                                  Service Control Manager         7036:  "Windows Search"    .  
                4          2015-10-19 23:16:19  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-19 23:16:19  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-19 23:16:19                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-10-19 23:16:19                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                103        2015-10-19 23:16:20                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-19 23:16:31                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-20 07:00:15                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-20 07:00:18                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-20 07:00:22                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-20 07:00:22                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-20 07:00:25                                  nvlddmkm                        
                        2015-10-20 07:00:25                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-20 07:00:25                                  Service Control Manager         7036:  ""    .  
                        2015-10-20 07:00:25                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-20 07:00:25                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-20 07:00:25                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-20 07:00:26                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-20 07:00:26                                  EventLog                        6005:    .  
                        2015-10-20 07:00:26                                  EventLog                        6013:    10 .  
                        2015-10-20 07:00:26                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-20 07:00:26                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-20 07:00:26                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-20 07:00:26                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 07:00:26                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-20 07:00:27                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-20 07:00:27                                  Service Control Manager         7036:  ""    .  
                        2015-10-20 07:00:27                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 07:00:27                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 07:00:27                                  Service Control Manager         7036:  " "    .  
                        2015-10-20 07:00:27                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-20 07:00:27                                  Service Control Manager         7036:  "    "    .  
                        2015-10-20 07:00:27                                  Service Control Manager         7036:  "     "    .  
                        2015-10-20 07:00:27                                  Service Control Manager         7036:  "   "    .  
                        2015-10-20 07:00:27                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-20 07:00:28                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-20 07:00:28                                  Service Control Manager         7036:  "   "    .  
                        2015-10-20 07:00:28                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-20 07:00:28                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-20 07:00:28                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-20 07:00:28                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-20 07:00:28                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-20 07:00:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 07:00:28                                  Service Control Manager         7036:  " "    .  
                        2015-10-20 07:00:28                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-10-20 07:00:28                           Microsoft-Windows-Winlogon      7001:           
                4          2015-10-20 07:00:28  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-20 07:00:28  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-20 07:00:29                                  Service Control Manager         7036:  " "    .  
                        2015-10-20 07:00:29                                  Service Control Manager         7036:  "-"    .  
                        2015-10-20 07:00:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 07:00:29                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-20 07:00:30                                  Service Control Manager         7036:  " "    .  
                        2015-10-20 07:00:30                                  Service Control Manager         7036:  " "    .  
                        2015-10-20 07:00:30                                  Service Control Manager         7036:  " "    .  
                        2015-10-20 07:00:30                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 07:00:30                                  Service Control Manager         7036:  " "    .  
                        2015-10-20 07:00:30                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-20 07:00:30                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-20 07:00:30                                  Service Control Manager         7036:  ""    .  
                        2015-10-20 07:00:30                                  Service Control Manager         7036:  "    "    .  
                        2015-10-20 07:00:30                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-20 07:00:30                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-20 07:00:30                                  Service Control Manager         7036:  "   "    .  
                        2015-10-20 07:00:31                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-20 07:00:31                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-20 07:00:32                                  Service Control Manager         7036:  "   "    .  
                        2015-10-20 07:00:32                                  Service Control Manager         7036:  ""    .  
                        2015-10-20 07:00:35                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-20 07:00:35                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 07:00:35                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 07:00:35                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 07:00:35                                  Service Control Manager         7036:  "   "    .  
                        2015-10-20 07:00:35                                  Service Control Manager         7036:  "   "    .  
                        2015-10-20 07:00:35                                  Service Control Manager         7036:  " "    .  
                        2015-10-20 07:00:35                                  Service Control Manager         7036:  "   "    .  
                        2015-10-20 07:00:35                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-20 07:00:35                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-20 07:00:36                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-20 07:00:36                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-20 07:00:39                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-20 07:02:35                                  Service Control Manager         7036:  "   "    .  
                        2015-10-20 07:02:35                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-20 07:02:35                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 07:02:35                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-20 07:02:36                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 07:02:37                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-20 07:05:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 07:07:37                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 07:10:35                                  Service Control Manager         7036:  "   "    .  
                        2015-10-20 07:17:05                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 07:17:13                                  Service Control Manager         7036:  "   "    .  
                            2015-10-20 07:17:35                                  ipnathlp                        
                        2015-10-20 07:17:36                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-20 07:17:37                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-20 07:17:37                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-20 07:17:37  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-20 07:17:37  LOCAL SERVICE                   Microsoft-Windows-Time-Service  35:          time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->104.209.134.106:123).  
                        2015-10-20 07:17:37  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-20 07:17:37  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-20 07:17:40  LOCAL SERVICE                   Microsoft-Windows-Time-Service  37: NTP-         time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->104.209.134.106:123).  
                        2015-10-20 07:19:59                                  Service Control Manager         7036:  "    "    .  
                        2015-10-20 07:19:59                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-20 07:28:24                                  Service Control Manager         7036:  "   "    .  
                        2015-10-20 07:29:22                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 07:29:48                                  Service Control Manager         7036:  "   "    .  
                          2015-10-20 07:33:10  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     download.cdn.mozilla.net        DNS.  
                        2015-10-20 07:33:49                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-10-20 07:39:12  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     d2o47bxgqzkcc3.cloudfront.net        DNS.  
                        2015-10-20 07:39:48                                  Service Control Manager         7036:  "   "    .  
                        2015-10-20 07:40:13                                  Service Control Manager         7036:  "  "    .  
                          2015-10-20 07:43:06  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                          2015-10-20 07:43:31  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-20 07:46:17                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-20 07:46:19                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-20 07:46:19                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-20 07:53:26                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-20 07:53:53                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-20 07:53:54                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-20 07:53:54                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-20 07:59:07                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 07:59:07                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-20 08:02:08                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 08:05:08                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-20 12:00:48                                  EventLog                        6013:    18050 .  
                        2015-10-20 22:31:09  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-20 22:31:10                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 22:31:12  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-20 22:31:12                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-20 22:31:13                                  EventLog                        6006:    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  " "    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  ""    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "-"    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "   "    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "     "    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "   "    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "  "    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  " "    .  
                        2015-10-20 22:31:13                                  Service Control Manager         7036:  "Superfetch"    .  
                4          2015-10-20 22:31:13  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-20 22:31:13  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-20 22:31:13                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-10-20 22:31:13                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-20 22:31:14                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-20 22:31:14                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-20 22:31:26                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-21 07:41:35                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-21 07:41:38                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-21 07:41:42                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-21 07:41:42                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-21 07:42:55                                  nvlddmkm                        
                        2015-10-21 07:42:56                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-21 07:42:56                                  EventLog                        6005:    .  
                        2015-10-21 07:42:56                                  EventLog                        6013:    80 .  
                        2015-10-21 07:42:56                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-21 07:42:56                                  Service Control Manager         7036:  ""    .  
                        2015-10-21 07:42:56                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-21 07:42:56                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-21 07:42:56                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-21 07:42:56                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-21 07:42:56                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 07:42:56                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-21 07:42:56                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-21 07:42:56                                  Service Control Manager         7036:  ""    .  
                        2015-10-21 07:42:56                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 07:42:56                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 07:42:56                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 07:42:56                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-21 07:42:56                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-21 07:42:57                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-21 07:42:57                                  Service Control Manager         7036:  "    "    .  
                        2015-10-21 07:42:57                                  Service Control Manager         7036:  "     "    .  
                        2015-10-21 07:42:57                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 07:42:57                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-21 07:42:57                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-21 07:42:57                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 07:42:57                                  Service Control Manager         7036:  "  CNG"    .  
                1101       2015-10-21 07:42:57                           Microsoft-Windows-Winlogon      7001:           
                        2015-10-21 07:42:58                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-21 07:42:58                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-21 07:42:58                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-21 07:42:58                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-21 07:42:58                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 07:42:58                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 07:42:58                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 07:42:58                                  Service Control Manager         7036:  "-"    .  
                        2015-10-21 07:42:58                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 07:42:58                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-21 07:42:58                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-10-21 07:42:58  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-21 07:42:58  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-21 07:42:59                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 07:42:59                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 07:42:59                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 07:42:59                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-21 07:42:59                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 07:42:59                                  Service Control Manager         7036:  "    "    .  
                        2015-10-21 07:42:59                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-21 07:42:59                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 07:42:59                                  Service Control Manager         7036:  ""    .  
                        2015-10-21 07:42:59                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-21 07:42:59                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-21 07:42:59                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-21 07:42:59                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 07:42:59                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-21 07:42:59                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 07:42:59                                  Service Control Manager         7036:  ""    .  
                        2015-10-21 07:43:00                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-21 07:43:00                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 07:43:00                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 07:43:00                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 07:43:00                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 07:43:00                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 07:43:00                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 07:43:00                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-21 07:43:00                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 07:43:00                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-21 07:43:00                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-21 07:43:00                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-21 07:43:05                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-21 07:45:00                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 07:45:00                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-21 07:45:00                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 07:45:00                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-21 07:45:01                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 07:45:02                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-21 07:50:02                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 07:55:04                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 08:06:47                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 08:18:07                                  Service Control Manager         7036:  "  "    .  
                            2015-10-21 08:19:02                                  ipnathlp                        
                            2015-10-21 08:19:02                                  ipnathlp                        
                        2015-10-21 08:19:03                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-21 08:20:08                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 08:20:19                                  Service Control Manager         7036:  "    "    .  
                        2015-10-21 08:20:19                           Microsoft-Windows-Application-Experience  201:       .  
                          2015-10-21 08:20:32  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     rtb.gumgum.com        DNS.  
                        2015-10-21 08:21:25                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 08:22:59                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 08:25:09                                  Service Control Manager         7036:  "  "    .  
                          2015-10-21 08:27:50  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.autonavi.com        DNS.  
                        2015-10-21 08:35:33                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-10-21 08:36:11  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     download-installer.cdn.mozilla.net        DNS.  
                        2015-10-21 08:36:12                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                          2015-10-21 08:36:13  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     download-installer.cdn.mozilla.net        DNS.  
                        2015-10-21 08:36:14                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-21 08:36:14                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-21 08:37:17                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-21 08:39:39                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-21 08:39:40                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-21 08:39:40                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                            2015-10-21 08:42:04                                  ipnathlp                        
                        2015-10-21 08:42:05                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-21 08:49:13  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     i.taobao.com        DNS.  
                          2015-10-21 09:07:27  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-21 09:12:02                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 09:12:53                                  Service Control Manager         7036:  " "    .  
                          2015-10-21 09:23:56  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                          2015-10-21 09:29:25  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     people.directory.live.com        DNS.  
                          2015-10-21 09:42:33  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     sync-256-us-west-2.sync.services.mozilla.com        DNS.  
                        2015-10-21 09:47:07                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 09:54:07                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 09:54:07                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-21 09:57:08                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 10:00:08                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-21 10:03:31                                  Service Control Manager         7036:  " "    .  
                          2015-10-21 10:03:52  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     img04.taobaocdn.com.danuoyi.tbcache.com        DNS.  
                          2015-10-21 10:13:39  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                        2015-10-21 10:16:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 10:16:28  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-21 10:16:30                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-21 10:16:30  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-21 10:16:30                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-21 10:16:31                                  EventLog                        6006:    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  ""    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "-"    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "     "    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-21 10:16:31                                  Service Control Manager         7036:  " "    .  
                4          2015-10-21 10:16:31  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-21 10:16:31  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-21 10:16:31                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-10-21 10:16:32                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-21 10:16:32                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-21 10:16:32                                  Service Control Manager         7036:  " Windows"    .  
                103        2015-10-21 10:16:32                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-10-21 10:16:32                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-21 10:16:40                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-21 12:08:56                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-21 12:08:59                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-21 12:09:03                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-21 12:09:03                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-21 12:10:17                                  nvlddmkm                        
                        2015-10-21 12:10:17                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-21 12:10:17                                  EventLog                        6005:    .  
                        2015-10-21 12:10:17                                  EventLog                        6013:    81 .  
                        2015-10-21 12:10:17                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-21 12:10:17                                  Service Control Manager         7036:  ""    .  
                        2015-10-21 12:10:17                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-21 12:10:17                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-21 12:10:17                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-21 12:10:17                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-21 12:10:17                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 12:10:17                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-21 12:10:17                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-21 12:10:17                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-21 12:10:18                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-21 12:10:18                                  Service Control Manager         7036:  ""    .  
                        2015-10-21 12:10:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 12:10:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 12:10:18                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-21 12:10:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 12:10:18                                  Service Control Manager         7036:  "    "    .  
                        2015-10-21 12:10:18                                  Service Control Manager         7036:  "     "    .  
                        2015-10-21 12:10:18                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 12:10:18                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-21 12:10:19                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 12:10:19                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-21 12:10:19                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-21 12:10:19                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-21 12:10:19                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-21 12:10:19                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-21 12:10:19                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-21 12:10:19                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 12:10:19                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 12:10:19                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 12:10:19                                  Service Control Manager         7036:  "-"    .  
                        2015-10-21 12:10:19                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 12:10:19                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-10-21 12:10:19                           Microsoft-Windows-Winlogon      7001:           
                4          2015-10-21 12:10:19  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-21 12:10:19  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  "    "    .  
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  ""    .  
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  ""    .  
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 12:10:20                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 12:10:21                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 12:10:21                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 12:10:21                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 12:10:21                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-21 12:10:21                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 12:10:21                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-21 12:10:22                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-21 12:10:22                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-21 12:10:22                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-10-21 12:10:25                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-10-21 12:10:27                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-21 12:11:06                                  Service Control Manager         7036:  "    "    .  
                        2015-10-21 12:11:06                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-21 12:11:08                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-21 12:12:21                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 12:12:21                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 12:12:21                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-21 12:12:21                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 12:12:23                                  Service Control Manager         7036:  "  Windows"    .  
                          2015-10-21 12:15:15  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     et2.gw.xiami.com        DNS.  
                        2015-10-21 12:15:26                                  Service Control Manager         7036:  "  "    .  
                          2015-10-21 12:15:54  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.alibaba.co.jp        DNS.  
                        2015-10-21 12:17:23                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 12:20:21                                  Service Control Manager         7036:  "   "    .  
                          2015-10-21 12:22:14  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     laiwang.lw.gds.taobao.com        DNS.  
                        2015-10-21 12:26:52                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-10-21 12:45:11  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.pingpinganan.gov.cn        DNS.  
                        2015-10-21 12:50:20                                  Service Control Manager         7036:  "  "    .  
                          2015-10-21 12:56:40  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.aliexpress.com        DNS.  
                        2015-10-21 13:06:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 13:06:25                           Microsoft-Windows-Application-Experience  206:          .  
                            2015-10-21 13:10:21                                  ipnathlp                        
                          2015-10-21 13:10:38  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-21 13:11:26                                  Service Control Manager         7036:  "  "    .  
                            2015-10-21 13:20:21                                  ipnathlp                        
                        2015-10-21 13:23:31                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 13:23:31  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-21 13:23:33                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-21 13:23:33                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 13:23:33  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-21 13:23:33                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-21 13:23:34                                  EventLog                        6006:    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  ""    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "-"    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "     "    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-21 13:23:34                                  Service Control Manager         7036:  "Windows Search"    .  
                4          2015-10-21 13:23:34  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-21 13:23:34  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-21 13:23:34                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-10-21 13:23:34                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                103        2015-10-21 13:23:35                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-21 13:23:46                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-21 15:39:54                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-21 15:39:57                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-21 15:40:02                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-21 15:40:02                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-21 15:41:15                                  nvlddmkm                        
                        2015-10-21 15:41:15                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-21 15:41:15                                  EventLog                        6005:    .  
                        2015-10-21 15:41:15                                  EventLog                        6013:    81 .  
                        2015-10-21 15:41:15                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-21 15:41:15                                  Service Control Manager         7036:  ""    .  
                        2015-10-21 15:41:15                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-21 15:41:15                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-21 15:41:15                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-21 15:41:15                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-21 15:41:15                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 15:41:15                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-21 15:41:15                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-21 15:41:16                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-21 15:41:16                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-21 15:41:16                                  Service Control Manager         7036:  ""    .  
                        2015-10-21 15:41:16                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 15:41:16                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 15:41:16                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-21 15:41:16                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 15:41:16                                  Service Control Manager         7036:  "    "    .  
                        2015-10-21 15:41:16                                  Service Control Manager         7036:  "     "    .  
                        2015-10-21 15:41:16                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 15:41:16                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                1101       2015-10-21 15:41:16                           Microsoft-Windows-Winlogon      7001:           
                        2015-10-21 15:41:17                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 15:41:17                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-21 15:41:17                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-21 15:41:17                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-21 15:41:17                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-21 15:41:17                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-21 15:41:17                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-21 15:41:17                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 15:41:17                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-10-21 15:41:17  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-21 15:41:17  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  "-"    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  "    "    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  ""    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  ""    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 15:41:18                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 15:41:19                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 15:41:19                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-21 15:41:19                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-21 15:41:19                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-21 15:41:19                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-21 15:41:24                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-21 15:43:18                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-21 15:43:19                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 15:43:19                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 15:43:19                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-21 15:43:20                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 15:43:21                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-21 15:46:24                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 15:48:21                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 15:51:18                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 15:58:48                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 16:11:19                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 16:11:19                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-21 16:14:20                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 16:17:20                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-21 16:21:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 16:39:05                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 17:25:23                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-10-21 17:25:23                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-10-21 17:27:23                                  Service Control Manager         7036:  "    "    .  
                        2015-10-21 17:27:23                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-21 17:41:53                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-10-21 17:42:54  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     textlink.simba.gds.taobao.com        DNS.  
                          2015-10-21 17:47:52  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     jubao.alibaba.com        DNS.  
                        2015-10-21 17:49:02                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 17:49:02  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-21 17:49:04  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-21 17:49:04                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 17:49:05                                  EventLog                        6006:    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  ""    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "-"    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "     "    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-21 17:49:05                                  Service Control Manager         7036:  " "    .  
                4          2015-10-21 17:49:05  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-21 17:49:05  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-21 17:49:05                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-10-21 17:49:06                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-21 17:49:06                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-21 17:49:06                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-10-21 17:49:06                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-21 17:49:18                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-21 22:45:54                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-21 22:45:57                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-21 22:46:02                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-21 22:46:02                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-21 22:47:15                                  nvlddmkm                        
                        2015-10-21 22:47:15                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-21 22:47:15                                  Service Control Manager         7036:  ""    .  
                        2015-10-21 22:47:15                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-21 22:47:15                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-21 22:47:15                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-21 22:47:15                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-21 22:47:15                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-21 22:47:16                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-21 22:47:16                                  EventLog                        6005:    .  
                        2015-10-21 22:47:16                                  EventLog                        6013:    81 .  
                        2015-10-21 22:47:16                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-21 22:47:16                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 22:47:16                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-21 22:47:16                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-21 22:47:16                                  Service Control Manager         7036:  ""    .  
                        2015-10-21 22:47:16                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 22:47:16                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 22:47:16                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 22:47:16                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-21 22:47:16                                  Service Control Manager         7036:  "    "    .  
                        2015-10-21 22:47:16                                  Service Control Manager         7036:  "     "    .  
                        2015-10-21 22:47:16                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 22:47:16                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-21 22:47:17                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 22:47:17                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-21 22:47:17                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-21 22:47:17                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-21 22:47:17                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-21 22:47:17                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-21 22:47:17                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-21 22:47:17                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 22:47:17                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-10-21 22:47:17                           Microsoft-Windows-Winlogon      7001:           
                4          2015-10-21 22:47:17  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-21 22:47:17  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  "-"    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  ""    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  "    "    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  ""    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  " "    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 22:47:18                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-21 22:47:19                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 22:47:19                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-21 22:47:19                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-21 22:47:19                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-21 22:47:24                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-21 22:49:18                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 22:49:18                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-21 22:49:19                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 22:49:19                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-21 22:49:19                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 22:49:21                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-21 22:52:24                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 22:54:21                                  Service Control Manager         7036:  "  "    .  
                            2015-10-21 22:57:02                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-21 22:57:02                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-21 22:57:02                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-21 22:57:02                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-21 22:57:02                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-21 22:57:02                                  atapi                           11:     \Device\Ide\IdePort3.  
                            2015-10-21 22:57:02                                  cdrom                           15:    \Device\CdRom0  .  
                        2015-10-21 22:57:18                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 23:00:56                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 23:01:23                                  Service Control Manager         7036:  "  "    .  
                7005       2015-10-21 23:01:24                           Microsoft-Windows-UserPnp       20003:       usbccgp      USB\VID_0421&PID_06FC\110000007AC0B1BC0000000000000000   : 0.  
                7005       2015-10-21 23:01:25                           Microsoft-Windows-UserPnp       20001:       FileRepository\usb.inf_x86_neutral_2620fd493cad7d41\usb.inf      USB\VID_0421&PID_06FC\110000007AC0B1BC0000000000000000   : 0x0.  
                7005       2015-10-21 23:01:25                           Microsoft-Windows-UserPnp       20001:       NULL Driver      USB\VID_0421&PID_06FC&MI_01\6&3404B490&0&0001   : 0xe0000203.  
                7005       2015-10-21 23:01:25                           Microsoft-Windows-UserPnp       20001:       NULL Driver      USB\VID_0421&PID_06FC&MI_02\6&3404B490&0&0002   : 0xe0000203.  
                7005       2015-10-21 23:01:25                           Microsoft-Windows-UserPnp       20001:       NULL Driver      USB\VID_0421&PID_06FC&MI_03\6&3404B490&0&0003   : 0xe0000203.  
                48         2015-10-21 23:01:26                           Microsoft-Windows-DriverFrameworks-UserMode  10000:  ,       1.9.0,    USB\VID_0421&PID_06FC&MI_00\6&3404B490&0&0000.  
                48         2015-10-21 23:01:26                           Microsoft-Windows-DriverFrameworks-UserMode  10002:      WpdMtpDriver (CLSID {AAAE762B-A6A2-4C45-B5D8-9A83AFB6BB70}) .      1.9.0    .  
                48         2015-10-21 23:01:26                           Microsoft-Windows-DriverFrameworks-UserMode  10100:     .  
                7005       2015-10-21 23:01:27                           Microsoft-Windows-UserPnp       20003:       WUDFRd      USB\VID_0421&PID_06FC&MI_00\6&3404B490&0&0000   : 0.  
                7005       2015-10-21 23:01:27                           Microsoft-Windows-UserPnp       20003:       WinUsb      USB\VID_0421&PID_06FC&MI_00\6&3404B490&0&0000   : 0.  
                16         2015-10-21 23:01:38                                  WPDClassInstaller               
                32         2015-10-21 23:01:38                                  WPDClassInstaller               
                32         2015-10-21 23:01:38                                  WPDClassInstaller               
                7005       2015-10-21 23:01:38                           Microsoft-Windows-UserPnp       20001:       FileRepository\wpdmtp.inf_x86_neutral_28f06ca2e38e8979\wpdmtp.inf      USB\VID_0421&PID_06FC&MI_00\6&3404B490&0&0000   : 0x0.  
                        2015-10-21 23:02:34                                  Service Control Manager         7036:  "    "    .  
                        2015-10-21 23:02:34                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-21 23:02:34                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-21 23:02:35                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-21 23:05:34                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-21 23:07:07                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 23:09:16                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-21 23:11:44                                  Service Control Manager         7036:  "   "    .  
                        2015-10-21 23:27:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 23:32:04                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 23:37:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-21 23:43:30                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-10-21 23:43:30                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-10-22 00:02:16                                  nvlddmkm                        
                        2015-10-22 00:02:16                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-22 00:02:21                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-22 00:02:41                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 00:02:47  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-22 00:02:50                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-22 00:02:50  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-22 00:02:50                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-22 00:02:51                                  EventLog                        6006:    .  
                        2015-10-22 00:02:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 00:02:51                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 00:02:51                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-22 00:02:51                                  Service Control Manager         7036:  ""    .  
                        2015-10-22 00:02:51                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-22 00:02:51                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-22 00:02:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 00:02:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 00:02:51                                  Service Control Manager         7036:  "-"    .  
                        2015-10-22 00:02:51                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-22 00:02:51                                  Service Control Manager         7036:  "     "    .  
                        2015-10-22 00:02:51                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 00:02:51                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-22 00:02:51                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-22 00:02:51                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-22 00:02:51                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-22 00:02:51                                  Service Control Manager         7036:  " SSDP"    .  
                4          2015-10-22 00:02:51  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-22 00:02:51  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                        2015-10-22 00:02:52                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-22 00:02:52                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-22 00:02:52                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-22 00:02:52                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 00:02:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-22 00:02:52                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 00:02:52                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-22 00:02:52                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-22 00:02:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-22 00:02:52                                  Service Control Manager         7036:  " "    .  
                7010       2015-10-22 00:02:52                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-10-22 00:02:52                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-22 00:02:53                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-22 00:02:53                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-22 00:04:18                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-22 00:04:19                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 00:04:19  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-10-21T14:43:30.249023400Z      : 2015-10-21T15:02:17.062500000Z     : 0  
                        2015-10-22 00:04:20                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-22 06:48:04                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-22 06:48:07                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-22 06:48:12                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-22 06:48:12                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-22 06:49:25                                  nvlddmkm                        
                        2015-10-22 06:49:26                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-22 06:49:26                                  EventLog                        6005:    .  
                        2015-10-22 06:49:26                                  EventLog                        6013:    81 .  
                        2015-10-22 06:49:26                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-22 06:49:26                                  Service Control Manager         7036:  ""    .  
                        2015-10-22 06:49:26                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-22 06:49:26                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-22 06:49:26                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-22 06:49:26                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-22 06:49:26                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 06:49:26                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-22 06:49:26                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-22 06:49:26                                  Service Control Manager         7036:  ""    .  
                        2015-10-22 06:49:26                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 06:49:26                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 06:49:26                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 06:49:26                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-22 06:49:26                                  Service Control Manager         7036:  "    "    .  
                        2015-10-22 06:49:26                                  Service Control Manager         7036:  "     "    .  
                        2015-10-22 06:49:26                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 06:49:26                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-22 06:49:26                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-22 06:49:26                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-22 06:49:27                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 06:49:27                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-22 06:49:27                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-22 06:49:27                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-22 06:49:27                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-22 06:49:27                                  Service Control Manager         7036:  "DNS-"    .  
                1101       2015-10-22 06:49:27                           Microsoft-Windows-Winlogon      7001:           
                4          2015-10-22 06:49:27  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-22 06:49:27  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-22 06:49:28                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-22 06:49:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 06:49:28                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 06:49:28                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 06:49:28                                  Service Control Manager         7036:  "-"    .  
                        2015-10-22 06:49:28                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 06:49:28                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-22 06:49:28                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 06:49:28                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 06:49:28                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 06:49:28                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  ""    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  "    "    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  ""    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-22 06:49:29                                  Service Control Manager         7036:  "  PNP-"    .  
                7005       2015-10-22 06:49:30                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                7005       2015-10-22 06:49:31                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0001   : 0.  
                        2015-10-22 06:49:35                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-22 06:50:57                                  Service Control Manager         7036:  "    "    .  
                        2015-10-22 06:50:57                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-22 06:50:59                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-22 06:51:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 06:51:29                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 06:51:30                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-22 06:51:30                                  Service Control Manager         7036:  "  "    .  
                            2015-10-22 06:51:31                                  ipnathlp                        
                        2015-10-22 06:51:32                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-22 06:51:33                                  Service Control Manager         7036:  "  Windows"    .  
                          2015-10-22 06:52:12  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     pipeline-tee-p-elb-gim7ovznno69-99790217.us-west-2.elb.amazonaws.com        DNS.  
                        2015-10-22 06:53:02                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-22 06:54:04                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-22 06:56:32                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 07:01:12                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 07:03:03                                  Service Control Manager         7036:  "   "    .  
                            2015-10-22 07:03:14                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-22 07:03:14                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-22 07:03:14                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-22 07:03:14                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-22 07:03:14                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-22 07:03:14                                  atapi                           11:     \Device\Ide\IdePort3.  
                            2015-10-22 07:03:14                                  cdrom                           15:    \Device\CdRom0  .  
                        2015-10-22 07:03:14                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 07:08:02                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-22 07:16:50                                  Service Control Manager         7036:  "  "    .  
                          2015-10-22 07:17:43  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.avito.ru        DNS.  
                        2015-10-22 07:20:11                                  Service Control Manager         7036:  "   "    .  
                          2015-10-22 07:27:32  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.avito.ru        DNS.  
                        2015-10-22 07:29:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 07:30:11                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 07:35:25                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-10-22 07:35:26                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-10-22 07:37:12                                  nvlddmkm                        
                        2015-10-22 07:37:12                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-22 07:37:17                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-22 07:37:17                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-22 07:37:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 07:37:18                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-22 07:37:18                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-22 07:37:21                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                            2015-10-22 07:37:22                                  ipnathlp                        
                          2015-10-22 07:38:07  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     01.img.avito.st        DNS.  
                        2015-10-22 07:38:40                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-22 07:38:46                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-22 07:38:47                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-22 07:38:47                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-22 07:38:48  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     28.img.avito.st        DNS.  
                        2015-10-22 07:40:13  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-10-21T22:35:25.325195300Z      : 2015-10-21T22:37:13.015625000Z     : 4 USB   
                        2015-10-22 07:42:20                                  Service Control Manager         7036:  "  "    .  
                            2015-10-22 07:42:52                                  ipnathlp                        
                        2015-10-22 07:42:55                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-22 07:44:58  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mscrl.microsoft.com        DNS.  
                        2015-10-22 07:45:00                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-22 07:45:01                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-22 07:45:01                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-22 07:52:25                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-10-22 07:52:25                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-10-22 08:40:12                                  nvlddmkm                        
                        2015-10-22 08:40:12                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-22 08:40:13                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                          2015-10-22 08:40:25  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.drom.ru        DNS.  
                        2015-10-22 08:40:27  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-10-21T22:52:25.336914000Z      : 2015-10-21T23:40:13.032226600Z     : 4 USB   
                        2015-10-22 08:40:30                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 08:40:35                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 08:40:45  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-22 08:40:47                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-22 08:40:47  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-22 08:40:47                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-22 08:40:48                                  EventLog                        6006:    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  ""    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "-"    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "     "    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-22 08:40:48                                  Service Control Manager         7036:  " "    .  
                4          2015-10-22 08:40:48  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-22 08:40:48  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-22 08:40:48                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-10-22 08:40:48                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-22 08:40:49                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-22 08:40:49                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-22 08:40:52                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-22 12:48:49                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-22 12:48:52                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-22 12:48:57                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-22 12:48:57                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-22 12:49:02                                  nvlddmkm                        
                        2015-10-22 12:49:02                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-22 12:49:02                                  Service Control Manager         7036:  ""    .  
                        2015-10-22 12:49:02                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-22 12:49:02                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-22 12:49:02                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-22 12:49:03                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-22 12:49:03                                  EventLog                        6005:    .  
                        2015-10-22 12:49:03                                  EventLog                        6013:    13 .  
                        2015-10-22 12:49:03                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-22 12:49:03                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-22 12:49:03                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-22 12:49:03                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 12:49:03                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-22 12:49:03                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-22 12:49:03                                  Service Control Manager         7036:  ""    .  
                        2015-10-22 12:49:03                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 12:49:03                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 12:49:03                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 12:49:03                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-22 12:49:03                                  Service Control Manager         7036:  "    "    .  
                        2015-10-22 12:49:03                                  Service Control Manager         7036:  "     "    .  
                        2015-10-22 12:49:03                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 12:49:04                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-22 12:49:04                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 12:49:04                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-22 12:49:04                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-22 12:49:04                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-22 12:49:04                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-22 12:49:04                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-22 12:49:04                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-22 12:49:04                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 12:49:04                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 12:49:04                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 12:49:04                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-10-22 12:49:04                           Microsoft-Windows-Winlogon      7001:           
                4          2015-10-22 12:49:04  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-22 12:49:04  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-22 12:49:05                                  Service Control Manager         7036:  "-"    .  
                        2015-10-22 12:49:05                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 12:49:05                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-22 12:49:05                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 12:49:05                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 12:49:05                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 12:49:05                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 12:49:06                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-22 12:49:06                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 12:49:06                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-22 12:49:06                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 12:49:06                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-22 12:49:06                                  Service Control Manager         7036:  ""    .  
                        2015-10-22 12:49:06                                  Service Control Manager         7036:  "    "    .  
                        2015-10-22 12:49:07                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-22 12:49:07                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-22 12:49:07                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-22 12:49:07                                  Service Control Manager         7036:  ""    .  
                        2015-10-22 12:49:07                                  Service Control Manager         7036:  "   "    .  
                            2015-10-22 12:49:09                                  Service Control Manager         7026:    ()    :   cdrom  
                        2015-10-22 12:49:09                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-22 12:49:09                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 12:49:09                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-22 12:49:09                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 12:49:09                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 12:49:09                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 12:49:09                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 12:49:09                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 12:49:09                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 12:49:10                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-22 12:49:10                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-22 12:49:10                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-22 12:49:11                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-22 12:49:15                                  Service Control Manager         7036:  "    "    .  
                        2015-10-22 12:49:15                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-22 12:49:15                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-22 12:49:18                                  Service Control Manager         7036:  "   Windows"    .  
                          2015-10-22 12:50:44  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                        2015-10-22 12:51:09                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 12:51:09                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-22 12:51:09                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 12:51:10                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 12:51:13                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-22 12:54:14                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 12:56:12                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 12:59:09                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 13:05:41                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-10-22 13:08:04  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     detailskip.taobao.com.danuoyi.tbcache.com        DNS.  
                        2015-10-22 13:11:26                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-22 13:11:26                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-22 13:19:08                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 13:29:05                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 13:29:08                                  Service Control Manager         7036:  "   "    .  
                          2015-10-22 13:45:56  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     maps.google.ru        DNS.  
                        2015-10-22 13:47:03  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-22 13:47:04                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 13:47:06                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-22 13:47:06                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 13:47:06  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-22 13:47:06                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-22 13:47:07                                  EventLog                        6006:    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  ""    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "-"    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "     "    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-22 13:47:07                                  Service Control Manager         7036:  "  WLAN"    .  
                4          2015-10-22 13:47:07  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-22 13:47:07  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-22 13:47:07                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-10-22 13:47:07                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-22 13:47:08                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-22 13:47:08                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-22 13:47:19                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-22 20:30:50                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-22 20:30:53                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-22 20:30:58                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-22 20:30:58                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-22 20:31:41                                  nvlddmkm                        
                        2015-10-22 20:31:41                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-22 20:31:41                                  EventLog                        6005:    .  
                        2015-10-22 20:31:41                                  EventLog                        6013:    51 .  
                        2015-10-22 20:31:41                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-22 20:31:41                                  Service Control Manager         7036:  ""    .  
                        2015-10-22 20:31:41                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-22 20:31:41                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-22 20:31:41                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-22 20:31:41                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-22 20:31:41                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-22 20:31:41                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-22 20:31:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 20:31:42                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-22 20:31:42                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-22 20:31:42                                  Service Control Manager         7036:  ""    .  
                        2015-10-22 20:31:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 20:31:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 20:31:42                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 20:31:42                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-22 20:31:42                                  Service Control Manager         7036:  "    "    .  
                        2015-10-22 20:31:42                                  Service Control Manager         7036:  "     "    .  
                        2015-10-22 20:31:42                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 20:31:42                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-22 20:31:43                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-22 20:31:43                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-22 20:31:43                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 20:31:43                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-22 20:31:43                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-22 20:31:43                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-22 20:31:43                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-22 20:31:43                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 20:31:43                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 20:31:43                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-10-22 20:31:43                           Microsoft-Windows-Winlogon      7001:           
                4          2015-10-22 20:31:43  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-22 20:31:43  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  "-"    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  ""    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  "    "    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  ""    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 20:31:44                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 20:31:45                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-22 20:31:45                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-22 20:31:45                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-22 20:31:50                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-22 20:33:44                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 20:33:44                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-22 20:33:45                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 20:33:45                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-22 20:33:45                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 20:33:47                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-22 20:38:27                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 20:38:47                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 20:43:43                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 20:43:56                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-10-22 20:43:58                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-10-22 23:19:25                                  nvlddmkm                        
                        2015-10-22 23:19:25                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-22 23:19:26                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-22 23:19:30                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 23:19:34  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 23:19:37                                  EventLog                        6006:    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  ""    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "-"    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "     "    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "   "    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  " "    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-22 23:19:37                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-22 23:19:37  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-22 23:19:37                           Microsoft-Windows-Winlogon      7002:           
                4          2015-10-22 23:19:37  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-22 23:19:37  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                          2015-10-22 23:19:37                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-22 23:19:38                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                7010       2015-10-22 23:19:38                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-10-22 23:19:40                                  Service Control Manager         7036:  "  "    .  
                        2015-10-22 23:19:40  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-10-22T11:43:56.754882800Z      : 2015-10-22T14:19:26.062500000Z     : 0  
                103        2015-10-22 23:19:41                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-22 23:19:43                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-24 00:12:13                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-24 00:12:16                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-24 00:12:21                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-24 00:12:21                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-24 00:12:24                                  nvlddmkm                        
                        2015-10-24 00:12:24                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-24 00:12:24                                  Service Control Manager         7036:  ""    .  
                        2015-10-24 00:12:24                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-24 00:12:24                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-24 00:12:24                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-24 00:12:24                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-24 00:12:24                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-24 00:12:25                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-24 00:12:25                                  EventLog                        6005:    .  
                        2015-10-24 00:12:25                                  EventLog                        6013:    11 .  
                        2015-10-24 00:12:25                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-24 00:12:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 00:12:25                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-24 00:12:25                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-24 00:12:25                                  Service Control Manager         7036:  ""    .  
                        2015-10-24 00:12:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 00:12:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 00:12:25                                  Service Control Manager         7036:  " "    .  
                        2015-10-24 00:12:25                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-24 00:12:25                                  Service Control Manager         7036:  "    "    .  
                        2015-10-24 00:12:25                                  Service Control Manager         7036:  "     "    .  
                        2015-10-24 00:12:25                                  Service Control Manager         7036:  "   "    .  
                        2015-10-24 00:12:25                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-24 00:12:26                                  Service Control Manager         7036:  "   "    .  
                        2015-10-24 00:12:26                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-24 00:12:26                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-24 00:12:26                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-24 00:12:26                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-24 00:12:26                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-24 00:12:26                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-24 00:12:26                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 00:12:26                                  Service Control Manager         7036:  " "    .  
                        2015-10-24 00:12:26                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-10-24 00:12:26  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-24 00:12:26  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-24 00:12:27                                  Service Control Manager         7036:  " "    .  
                        2015-10-24 00:12:27                                  Service Control Manager         7036:  "-"    .  
                        2015-10-24 00:12:27                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 00:12:27                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-24 00:12:27                                  Service Control Manager         7036:  " "    .  
                        2015-10-24 00:12:27                                  Service Control Manager         7036:  " "    .  
                        2015-10-24 00:12:27                                  Service Control Manager         7036:  " "    .  
                        2015-10-24 00:12:27                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 00:12:27                                  Service Control Manager         7036:  "    "    .  
                        2015-10-24 00:12:27                                  Service Control Manager         7036:  " "    .  
                        2015-10-24 00:12:27                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                1101       2015-10-24 00:12:27                           Microsoft-Windows-Winlogon      7001:           
                        2015-10-24 00:12:28                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-24 00:12:28                                  Service Control Manager         7036:  ""    .  
                        2015-10-24 00:12:28                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-24 00:12:28                                  Service Control Manager         7036:  "   "    .  
                        2015-10-24 00:12:28                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-24 00:12:28                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-24 00:12:28                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-24 00:12:28                                  Service Control Manager         7036:  "   "    .  
                        2015-10-24 00:12:28                                  Service Control Manager         7036:  ""    .  
                        2015-10-24 00:12:28                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-24 00:12:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 00:12:29                                  Service Control Manager         7036:  "   "    .  
                        2015-10-24 00:12:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 00:12:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 00:12:29                                  Service Control Manager         7036:  " "    .  
                        2015-10-24 00:12:29                                  Service Control Manager         7036:  "   "    .  
                        2015-10-24 00:12:29                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-24 00:12:29                                  Service Control Manager         7036:  "   "    .  
                        2015-10-24 00:12:30                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-24 00:12:30                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-24 00:12:31                                  Service Control Manager         7036:  "  IPsec"    .  
                7005       2015-10-24 00:12:34                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-10-24 00:12:37                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-24 00:13:18                                  Service Control Manager         7036:  "    "    .  
                        2015-10-24 00:13:18                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-24 00:14:28                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-24 00:14:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 00:14:29                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-24 00:14:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 00:14:29                                  Service Control Manager         7036:  "   "    .  
                        2015-10-24 00:14:31                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-24 00:14:57                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-24 00:15:00                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-24 00:15:55                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-24 00:15:59                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-24 00:19:31                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 00:20:03                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 00:26:16                                  Service Control Manager         7036:  "   "    .  
                        2015-10-24 00:52:27                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 01:08:54                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 01:08:54  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-24 01:08:56  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-24 01:08:56                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-24 01:08:57                                  EventLog                        6006:    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  " "    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  ""    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "-"    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "     "    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "   "    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "   "    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-24 01:08:57                                  Service Control Manager         7036:  " "    .  
                4          2015-10-24 01:08:57  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-24 01:08:57  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-24 01:08:57                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-10-24 01:08:57                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-24 01:08:58                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-24 01:08:58                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-24 01:09:03                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-24 10:20:20                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-24 10:20:23                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-10-24 10:20:28                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-24 10:20:28                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-24 10:20:31                                  nvlddmkm                        
                        2015-10-24 10:20:31                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-24 10:20:31                                  EventLog                        6005:    .  
                        2015-10-24 10:20:31                                  EventLog                        6013:    11 .  
                        2015-10-24 10:20:31                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-24 10:20:31                                  Service Control Manager         7036:  ""    .  
                        2015-10-24 10:20:31                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-24 10:20:31                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-24 10:20:31                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-24 10:20:31                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-24 10:20:31                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-10-24 10:20:31                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-24 10:20:32                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 10:20:32                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-24 10:20:32                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-24 10:20:32                                  Service Control Manager         7036:  ""    .  
                        2015-10-24 10:20:32                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 10:20:32                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 10:20:32                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-24 10:20:32                                  Service Control Manager         7036:  " "    .  
                        2015-10-24 10:20:32                                  Service Control Manager         7036:  "    "    .  
                        2015-10-24 10:20:32                                  Service Control Manager         7036:  "     "    .  
                        2015-10-24 10:20:32                                  Service Control Manager         7036:  "   "    .  
                        2015-10-24 10:20:32                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-24 10:20:33                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-24 10:20:33                                  Service Control Manager         7036:  "   "    .  
                        2015-10-24 10:20:33                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-24 10:20:33                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-24 10:20:33                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-24 10:20:33                                  Service Control Manager         7036:  "DNS-"    .  
                1101       2015-10-24 10:20:33                           Microsoft-Windows-Winlogon      7001:           
                4          2015-10-24 10:20:33  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-24 10:20:33  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-24 10:20:34                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-24 10:20:34                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 10:20:34                                  Service Control Manager         7036:  " "    .  
                        2015-10-24 10:20:34                                  Service Control Manager         7036:  " "    .  
                        2015-10-24 10:20:34                                  Service Control Manager         7036:  "-"    .  
                        2015-10-24 10:20:34                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 10:20:34                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-24 10:20:34                                  Service Control Manager         7036:  " "    .  
                        2015-10-24 10:20:34                                  Service Control Manager         7036:  " "    .  
                        2015-10-24 10:20:34                                  Service Control Manager         7036:  " "    .  
                        2015-10-24 10:20:34                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 10:20:34                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                        2015-10-24 10:20:35                                  Service Control Manager         7036:  "    "    .  
                        2015-10-24 10:20:35                                  Service Control Manager         7036:  " "    .  
                        2015-10-24 10:20:35                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-24 10:20:36                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-24 10:20:36                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-24 10:20:36                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-24 10:20:36                                  Service Control Manager         7036:  "   "    .  
                        2015-10-24 10:20:36                                  Service Control Manager         7036:  ""    .  
                        2015-10-24 10:20:36                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-24 10:20:36                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-24 10:20:36                                  Service Control Manager         7036:  "   "    .  
                        2015-10-24 10:20:37                                  Service Control Manager         7036:  ""    .  
                        2015-10-24 10:20:37                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-24 10:20:37                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-24 10:20:37                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-24 10:20:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 10:20:38                                  Service Control Manager         7036:  "   "    .  
                        2015-10-24 10:20:39                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 10:20:39                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 10:20:39                                  Service Control Manager         7036:  "   "    .  
                        2015-10-24 10:20:39                                  Service Control Manager         7036:  " "    .  
                        2015-10-24 10:20:39                                  Service Control Manager         7036:  "   "    .  
                        2015-10-24 10:20:40                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-24 10:20:40                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-24 10:20:40                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-24 10:20:48                                  Service Control Manager         7036:  "Windows Search"    .  
                1          2015-10-24 10:21:20  LOCAL SERVICE                   WudfUsbccidDriver               
                1          2015-10-24 10:21:20  LOCAL SERVICE                   WudfUsbccidDriver               
                            2015-10-24 10:21:21                                  SCardSvr                        
                    1          2015-10-24 10:21:21  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-10-24 10:21:21  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-10-24 10:21:21  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-10-24 10:21:21  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-10-24 10:21:21  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-10-24 10:21:21  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-10-24 10:21:21  LOCAL SERVICE                   WudfUsbccidDriver               
                            2015-10-24 10:21:22                                  SCardSvr                        
                            2015-10-24 10:21:22                                  SCardSvr                        
                    1          2015-10-24 10:21:22  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-10-24 10:21:22  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-10-24 10:21:22  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-10-24 10:21:22  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-10-24 10:21:22  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-10-24 10:21:22  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-10-24 10:21:22  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-10-24 10:21:22  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-10-24 10:21:22  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-10-24 10:21:22  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-10-24 10:21:22  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-10-24 10:21:22  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-10-24 10:21:22  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-10-24 10:21:22  LOCAL SERVICE                   WudfUsbccidDriver               
                        2015-10-24 10:21:31                                  Service Control Manager         7036:  "    "    .  
                        2015-10-24 10:21:31                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-24 10:22:37                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-24 10:22:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 10:22:38                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-24 10:22:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 10:22:40                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-24 10:23:07                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-24 10:27:40                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 10:27:54  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-24 10:27:56                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-24 10:27:56  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-24 10:27:56                           Microsoft-Windows-Winlogon      7002:           
                    1          2015-10-24 10:27:57  LOCAL SERVICE                   WudfUsbccidDriver               
                        2015-10-24 10:27:57                                  EventLog                        6006:    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  " "    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  ""    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "-"    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "     "    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "   "    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "   "    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "  "    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  " "    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-24 10:27:57                                  Service Control Manager         7036:  "Superfetch"    .  
                4          2015-10-24 10:27:57  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-24 10:27:57  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-24 10:27:57                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-10-24 10:27:57                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-24 10:27:58                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-24 10:27:58                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-24 10:28:01                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-25 09:03:40                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-25 09:03:43                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-10-25 09:03:48                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-25 09:03:48                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-25 09:03:51                                  nvlddmkm                        
                        2015-10-25 09:03:51                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-25 09:03:51                                  EventLog                        6005:    .  
                        2015-10-25 09:03:51                                  EventLog                        6013:    11 .  
                        2015-10-25 09:03:51                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-25 09:03:51                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 09:03:51                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-25 09:03:51                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-25 09:03:51                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-25 09:03:51                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 09:03:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:03:51                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-10-25 09:03:51                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-25 09:03:52                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-25 09:03:52                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-25 09:03:52                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 09:03:52                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:03:52                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:03:52                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:03:52                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-25 09:03:52                                  Service Control Manager         7036:  "    "    .  
                        2015-10-25 09:03:52                                  Service Control Manager         7036:  "     "    .  
                        2015-10-25 09:03:52                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:03:52                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-25 09:03:53                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-25 09:03:53                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:03:53                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-25 09:03:53                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-25 09:03:53                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-25 09:03:53                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-25 09:03:53                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-25 09:03:53                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:03:53                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:03:53                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:03:53                                  Service Control Manager         7036:  "-"    .  
                        2015-10-25 09:03:53                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:03:53                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-25 09:03:53                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:03:53                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:03:53                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:03:53                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:03:53                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:03:53                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-25 09:03:53                                  Service Control Manager         7036:  "    "    .  
                        2015-10-25 09:03:53                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-10-25 09:03:53                           Microsoft-Windows-Winlogon      7001:           
                4          2015-10-25 09:03:53  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-25 09:03:53  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-25 09:03:56                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-25 09:03:56                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-25 09:03:56                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-25 09:03:56                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:03:56                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 09:03:56                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 09:03:56                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-25 09:03:57                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 09:03:57                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:03:58                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-25 09:03:58                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:03:58                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:03:58                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-25 09:03:58                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-25 09:03:58                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:03:58                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:03:58                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:03:58                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:03:58                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:03:59                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-25 09:03:59                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-25 09:03:59                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-25 09:04:06                                  Service Control Manager         7036:  "Windows Search"    .  
                            2015-10-25 09:04:46                                  Service Control Manager         7011:    (30000 )       "LanmanServer".  
                            2015-10-25 09:05:16                                  Service Control Manager         7011:    (30000 )       "WSearch".  
                            2015-10-25 09:05:46                                  Service Control Manager         7011:    (30000 )       "ShellHWDetection".  
                        2015-10-25 09:05:58                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-25 09:05:58                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:05:58                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-25 09:05:59                                  Service Control Manager         7036:  "  "    .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-10-25 09:06:11                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                  2          2015-10-25 09:06:11                                  Ntfs                            57:       .   .  
                        2015-10-25 09:06:12                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 09:08:17                                  Service Control Manager         7036:  "   "    .  
                          2015-10-25 09:08:17                                  Disk                            51:     \Device\Harddisk3\DR5      .  
                          2015-10-25 09:08:17                                  Disk                            51:     \Device\Harddisk3\DR5      .  
                          2015-10-25 09:08:17                                  Disk                            51:     \Device\Harddisk3\DR5      .  
                          2015-10-25 09:08:17                                  Disk                            51:     \Device\Harddisk3\DR5      .  
                  2          2015-10-25 09:08:17                                  Ntfs                            57:       .   .  
                        2015-10-25 09:08:33                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:10:33                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:11:00                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:12:16  sima                            USER32                          1074:  Explorer.EXE   ""   VLADIMIR    vladimir\sima  :  ()     : 0x0     :     :   
                  2          2015-10-25 09:14:53                                  Ntfs                            57:       .   .  
                        2015-10-25 09:14:55                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 09:14:55                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:14:55                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:14:55                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:14:55                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:14:55                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-25 09:14:55                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-25 09:14:55                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 09:14:55                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:14:55                                  Service Control Manager         7036:  "-"    .  
                        2015-10-25 09:14:55                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-25 09:14:55                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-25 09:14:55  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   ""   VLADIMIR    vladimir\sima  :        : 0x500ff     :     :   
                1102       2015-10-25 09:14:55                           Microsoft-Windows-Winlogon      7002:           
                4          2015-10-25 09:14:55  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-25 09:14:55  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                        2015-10-25 09:14:56                                  EventLog                        6006:    .  
                        2015-10-25 09:14:56                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:14:56                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-25 09:14:56                                  Service Control Manager         7036:  "     "    .  
                        2015-10-25 09:14:56                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:14:56                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-25 09:14:56                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:14:56                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-25 09:14:56                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-25 09:14:56                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 09:14:56                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-25 09:14:56                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:14:56                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-25 09:14:56                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-25 09:14:56                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-25 09:14:56                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-25 09:14:56                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 09:14:56                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:14:56                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-25 09:14:56                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-25 09:14:56                                  Service Control Manager         7036:  "Windows Search"    .  
                7010       2015-10-25 09:14:56                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-10-25 09:14:56                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                103        2015-10-25 09:14:57                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-25 09:14:59                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:14:59                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-25 09:15:28                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-25 09:15:31                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-10-25 09:15:36                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-25 09:15:36                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-25 09:15:39                                  nvlddmkm                        
                        2015-10-25 09:15:39                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-25 09:15:39                                  EventLog                        6005:    .  
                        2015-10-25 09:15:39                                  EventLog                        6013:    11 .  
                        2015-10-25 09:15:39                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-25 09:15:39                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 09:15:39                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-25 09:15:39                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-25 09:15:39                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-25 09:15:39                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 09:15:39                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:15:39                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-10-25 09:15:39                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-25 09:15:40                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-25 09:15:40                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-25 09:15:40                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 09:15:40                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:15:40                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:15:40                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:15:40                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-25 09:15:40                                  Service Control Manager         7036:  "    "    .  
                        2015-10-25 09:15:40                                  Service Control Manager         7036:  "     "    .  
                        2015-10-25 09:15:40                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:15:40                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-25 09:15:41                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:15:41                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-25 09:15:41                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-25 09:15:41                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-25 09:15:41                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-25 09:15:41                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-25 09:15:41                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-25 09:15:41                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:15:41                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-10-25 09:15:41                           Microsoft-Windows-Winlogon      7001:           
                4          2015-10-25 09:15:41  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-25 09:15:41  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-25 09:15:42                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:15:42                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:15:42                                  Service Control Manager         7036:  "-"    .  
                        2015-10-25 09:15:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:15:42                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-25 09:15:42                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:15:42                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:15:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:15:42                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:15:42                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-25 09:15:43                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:15:43                                  Service Control Manager         7036:  "    "    .  
                        2015-10-25 09:15:44                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-25 09:15:44                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 09:15:44                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-25 09:15:44                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-25 09:15:44                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:15:44                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 09:15:44                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-25 09:15:44                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:15:44                                  Service Control Manager         7036:  ""    .  
                            2015-10-25 09:15:45                                  Service Control Manager         7026:    ()    :   cdrom  
                        2015-10-25 09:15:45                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-25 09:15:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:15:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:15:46                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:15:46                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-25 09:15:46                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:15:46                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:15:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:15:46                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-25 09:15:46                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:15:47                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-25 09:15:48                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-25 09:15:48                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-25 09:15:56                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-25 09:17:46                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-25 09:17:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:17:46                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-25 09:17:46                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:17:47                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:17:49                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 09:18:56                                  Service Control Manager         7036:  "    "    .  
                        2015-10-25 09:18:56                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-25 09:20:14                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-25 09:21:26  sima                            USER32                          1074:  Setup.exe   ""   VLADIMIR    vladimir\sima  :  ()     : 0x0     :     :   
                        2015-10-25 09:21:28  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   ""   VLADIMIR    vladimir\sima  :        : 0x500ff     :     :   
                1102       2015-10-25 09:21:28                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-25 09:21:29                                  EventLog                        6006:    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "-"    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "     "    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:21:29                                  Service Control Manager         7036:  "  WLAN"    .  
                4          2015-10-25 09:21:29  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-25 09:21:29  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-25 09:21:29                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-10-25 09:21:29                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-25 09:21:30                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:21:30                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-25 09:21:30                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-25 09:21:31                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-25 09:21:35                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-25 09:22:50                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-25 09:22:53                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-10-25 09:22:58                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-25 09:22:58                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-25 09:23:40                                  nvlddmkm                        
                101        2015-10-25 09:23:40                           Microsoft-Windows-DriverFrameworks-UserMode  10114:         ,       WUDFPf.       ,   Windows    .  
                  212        2015-10-25 09:23:40                           Microsoft-Windows-Kernel-PnP    219: 
                        2015-10-25 09:23:42                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-25 09:23:42                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 09:23:42                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-25 09:23:42                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-10-25 09:23:42                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-25 09:23:43                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-25 09:23:43                                  EventLog                        6005:    .  
                        2015-10-25 09:23:43                                  EventLog                        6013:    53 .  
                        2015-10-25 09:23:43                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-25 09:23:43                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-25 09:23:43                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 09:23:43                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:23:43                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-25 09:23:44                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-25 09:23:44                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 09:23:44                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:23:44                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:23:44                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:23:44                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-25 09:23:44                                  Service Control Manager         7036:  "    "    .  
                        2015-10-25 09:23:44                                  Service Control Manager         7036:  "     "    .  
                        2015-10-25 09:23:44                                  Service Control Manager         7036:  "   "    .  
                1101       2015-10-25 09:23:44                           Microsoft-Windows-Winlogon      7001:           
                        2015-10-25 09:23:46                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-25 09:23:46                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:23:46                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-25 09:23:46                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-25 09:23:46                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-25 09:23:46                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-25 09:23:46                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-25 09:23:46                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-25 09:23:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:23:46                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-10-25 09:23:46  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-25 09:23:46  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  "-"    .  
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  "    "    .  
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 09:23:47                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-25 09:23:49                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-25 09:23:50                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-25 09:23:50                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:23:50                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:23:50                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:23:50                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:23:50                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:23:50                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-25 09:23:50                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:23:50                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:23:50                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-25 09:23:51                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-25 09:23:51                                  Service Control Manager         7036:  "  PNP-"    .  
                7005       2015-10-25 09:23:53                           Microsoft-Windows-UserPnp       20001:       NULL Driver      PCI\VEN_13F6&DEV_8788&SUBSYS_834F1043&REV_00\4&3829F325&0&00F0   : 0xe0000203.  
                        2015-10-25 09:23:55                                  Service Control Manager         7036:  "Windows Search"    .  
                7005       2015-10-25 09:23:57                           Microsoft-Windows-UserPnp       20003:       HdAudAddService      HDAUDIO\FUNC_01&VEN_10EC&DEV_0888&SUBSYS_14627235&REV_1000\4&ADBBC3C&0&0001   : 0.  
                7005       2015-10-25 09:23:57                           Microsoft-Windows-UserPnp       20001:       FileRepository\hdaudio.inf_x86_neutral_5a5e688ecb9e273f\hdaudio.inf      HDAUDIO\FUNC_01&VEN_10EC&DEV_0888&SUBSYS_14627235&REV_1000\4&ADBBC3C&0&0001   : 0x0.  
                        2015-10-25 09:24:16                                  Service Control Manager         7036:  "    "    .  
                        2015-10-25 09:24:16                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-25 09:24:21                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-25 09:24:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:24:25                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-25 09:24:38                           Service Control Manager         7045:    .     :  ASUS Xonar D1 Audio Interface    :  system32\drivers\cmudaxp.sys   :        :      :    
                7005       2015-10-25 09:24:40                           Microsoft-Windows-UserPnp       20003:       cmudaxp      PCI\VEN_13F6&DEV_8788&SUBSYS_834F1043&REV_00\4&3829F325&0&00F0   : 0.  
                7005       2015-10-25 09:24:45                           Microsoft-Windows-UserPnp       20001:       FileRepository\xonard1.inf_x86_neutral_29f4a7b3dd3a1dc3\xonard1.inf      PCI\VEN_13F6&DEV_8788&SUBSYS_834F1043&REV_00\4&3829F325&0&00F0   : 0x0.  
                        2015-10-25 09:25:50                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-25 09:25:50                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:25:50                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:25:50                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-25 09:25:50                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:25:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 09:27:45                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:28:35  sima                            USER32                          1074:  Cmeauvist.exe   ""   VLADIMIR    vladimir\sima  :  ()     : 0x0     :     :   
                        2015-10-25 09:28:37  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   ""   VLADIMIR    vladimir\sima  :        : 0x500ff     :     :   
                1102       2015-10-25 09:28:37                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:28:38                                  EventLog                        6006:    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "-"    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "     "    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-25 09:28:38                                  Service Control Manager         7036:  "  "    .  
                4          2015-10-25 09:28:38  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-25 09:28:38  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-25 09:28:38                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-10-25 09:28:38                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-25 09:28:39                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:28:39                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-25 09:28:39                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-25 09:28:40                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-25 09:28:43                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-25 09:29:13                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-25 09:29:16                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-10-25 09:29:24                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-25 09:29:24                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                101        2015-10-25 09:29:30                           Microsoft-Windows-DriverFrameworks-UserMode  10114:         ,       WUDFPf.       ,   Windows    .  
                  212        2015-10-25 09:29:30                           Microsoft-Windows-Kernel-PnP    219: 
                            2015-10-25 09:29:33                                  nvlddmkm                        
                        2015-10-25 09:29:42                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-25 09:29:42                                  EventLog                        6005:    .  
                        2015-10-25 09:29:42                                  EventLog                        6013:    28 .  
                        2015-10-25 09:29:42                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-25 09:29:42                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 09:29:42                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-25 09:29:42                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-25 09:29:42                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-25 09:29:42                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 09:29:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:29:42                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-25 09:29:42                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-25 09:29:42                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 09:29:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:29:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:29:42                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:29:42                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-10-25 09:29:42                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-25 09:29:43                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-25 09:29:43                                  Service Control Manager         7036:  "    "    .  
                        2015-10-25 09:29:43                                  Service Control Manager         7036:  "     "    .  
                        2015-10-25 09:29:43                                  Service Control Manager         7036:  "   "    .  
                1101       2015-10-25 09:29:44                           Microsoft-Windows-Winlogon      7001:           
                        2015-10-25 09:29:48                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-25 09:29:48                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:29:48                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-25 09:29:48                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-25 09:29:48                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-25 09:29:48                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-25 09:29:48                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-25 09:29:48                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-25 09:29:48                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:29:48                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-10-25 09:29:48  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-25 09:29:48  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-25 09:29:49                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:29:49                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:29:49                                  Service Control Manager         7036:  "-"    .  
                        2015-10-25 09:29:49                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:29:49                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-25 09:29:49                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:29:49                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:29:49                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-25 09:29:49                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:29:49                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:29:49                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-25 09:29:49                                  Service Control Manager         7036:  "    "    .  
                        2015-10-25 09:29:49                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:29:50                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-25 09:29:50                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 09:29:50                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 09:29:50                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:29:50                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-25 09:29:50                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:29:50                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 09:29:51                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                            2015-10-25 09:30:00                                  Service Control Manager         7026:    ()    :   cdrom  
                        2015-10-25 09:30:00                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-25 09:30:00                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:30:00                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:30:00                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-25 09:30:00                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 09:30:00                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-25 09:30:00                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:30:00                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:30:00                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:30:00                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:30:01                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-25 09:30:01                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-25 09:30:01                                  Service Control Manager         7036:  "  PNP-"    .  
                7005       2015-10-25 09:30:06                           Microsoft-Windows-UserPnp       20003:       HidUsb      USB\VID_044F&PID_B323\5&2E6C04A1&0&1   : 0.  
                7005       2015-10-25 09:30:07                           Microsoft-Windows-UserPnp       20001:       FileRepository\input.inf_x86_neutral_9e1eba5724be176f\input.inf      USB\VID_044F&PID_B323\5&2E6C04A1&0&1   : 0x0.  
                        2015-10-25 09:30:08                                  Service Control Manager         7036:  "Windows Search"    .  
                7005       2015-10-25 09:30:08                           Microsoft-Windows-UserPnp       20001:       FileRepository\input.inf_x86_neutral_9e1eba5724be176f\input.inf      HID\VID_044F&PID_B323\6&2D6CC4E1&0&0000   : 0x0.  
                        2015-10-25 09:32:00                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-25 09:32:00                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:32:00                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:32:01                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-25 09:32:01                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:32:03                                  Service Control Manager         7036:  "  Windows"    .  
                7005       2015-10-25 09:35:28                           Microsoft-Windows-UserPnp       20003:       monitor      DISPLAY\SAM07C0\5&7C7907&0&UID16777489   : 0.  
                7005       2015-10-25 09:35:28                           Microsoft-Windows-UserPnp       20001:       FileRepository\monitor.inf_x86_neutral_f7168ca1d7f8ec24\monitor.inf      DISPLAY\SAM07C0\5&7C7907&0&UID16777489   : 0x0.  
                        2015-10-25 09:37:02                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:38:40                                  Service Control Manager         7036:  "    "    .  
                        2015-10-25 09:38:40                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-25 09:42:59                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:48:40                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:48:46                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 09:49:12                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:54:13                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:55:54                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 09:59:03                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 10:04:58                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 10:05:48                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-10-25 10:05:50                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-10-25 10:47:32                                  nvlddmkm                        
                        2015-10-25 10:47:32                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-25 10:47:33                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 10:47:33                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-25 10:50:33  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-10-25T01:05:48.676757800Z      : 2015-10-25T01:47:33.120117200Z     : 4 USB   
                        2015-10-25 10:52:34                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 10:57:33                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-10-25 10:57:34                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-10-25 10:57:44                                  nvlddmkm                        
                        2015-10-25 10:57:44                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-25 10:57:45                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-25 11:00:45  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-10-25T01:57:33.675781300Z      : 2015-10-25T01:57:45.009765600Z     : 4 USB   
                        2015-10-25 11:02:32                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 11:07:48                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-10-25 11:07:48                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-10-25 11:07:58                                  nvlddmkm                        
                        2015-10-25 11:07:58                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-25 11:07:58                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-25 11:08:06                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 11:08:17                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 11:08:27                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-25 11:10:37  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-25 11:10:50                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 11:10:50                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 11:10:50                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 11:10:50                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-25 11:10:50                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-25 11:10:50                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-25 11:10:50                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 11:10:50                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 11:10:50                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-25 11:10:50  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-25 11:10:50                           Microsoft-Windows-Winlogon      7002:           
                4          2015-10-25 11:10:50  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-25 11:10:50  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-25 11:10:50                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-10-25 11:10:51                                  EventLog                        6006:    .  
                        2015-10-25 11:10:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 11:10:51                                  Service Control Manager         7036:  "-"    .  
                        2015-10-25 11:10:51                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-25 11:10:51                                  Service Control Manager         7036:  "     "    .  
                        2015-10-25 11:10:51                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 11:10:51                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-25 11:10:51                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 11:10:51                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-25 11:10:51                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-25 11:10:51                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 11:10:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 11:10:51                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-25 11:10:51                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-25 11:10:51                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-25 11:10:51                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 11:10:51                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-25 11:10:51                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 11:10:51                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-25 11:10:51                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-25 11:10:51                                  Service Control Manager         7036:  "Windows Search"    .  
                          2015-10-25 11:10:51                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-25 11:10:59                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                103        2015-10-25 11:10:59                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-25 11:11:00                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 11:11:00  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-10-25T02:07:48.689453100Z      : 2015-10-25T02:07:58.945312500Z     : 0  
                        2015-10-25 11:11:01                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-25 19:55:38                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-25 19:55:41                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-10-25 19:55:46                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-25 19:55:46                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-25 19:56:59                                  nvlddmkm                        
                        2015-10-25 19:56:59                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-25 19:56:59                                  Service Control Manager         7036:  ""    .  
                101        2015-10-25 19:56:59                           Microsoft-Windows-DriverFrameworks-UserMode  10114:         ,       WUDFPf.       ,   Windows    .  
                7010       2015-10-25 19:56:59                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                  212        2015-10-25 19:56:59                           Microsoft-Windows-Kernel-PnP    219: 
                        2015-10-25 19:57:00                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-25 19:57:00                                  EventLog                        6005:    .  
                        2015-10-25 19:57:00                                  EventLog                        6013:    81 .  
                        2015-10-25 19:57:00                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-25 19:57:00                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-25 19:57:00                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-25 19:57:00                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 19:57:00                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 19:57:00                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-25 19:57:00                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-25 19:57:00                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 19:57:00                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 19:57:00                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 19:57:00                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 19:57:00                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-25 19:57:00                                  Service Control Manager         7036:  "    "    .  
                        2015-10-25 19:57:00                                  Service Control Manager         7036:  "     "    .  
                        2015-10-25 19:57:00                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 19:57:00                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                1101       2015-10-25 19:57:01                           Microsoft-Windows-Winlogon      7001:           
                        2015-10-25 19:57:09                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-25 19:57:09                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 19:57:09                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-25 19:57:09                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-25 19:57:09                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-25 19:57:09                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-25 19:57:09                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-25 19:57:09                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-25 19:57:09                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 19:57:09                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 19:57:09                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 19:57:09                                  Service Control Manager         7036:  "-"    .  
                        2015-10-25 19:57:09                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 19:57:09                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-25 19:57:09                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 19:57:09                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 19:57:09                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-25 19:57:09                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 19:57:09                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 19:57:09                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-10-25 19:57:09  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-25 19:57:09  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-25 19:57:10                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-25 19:57:10                                  Service Control Manager         7036:  "    "    .  
                        2015-10-25 19:57:10                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-25 19:57:10                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 19:57:10                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 19:57:10                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 19:57:10                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-25 19:57:10                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 19:57:10                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 19:57:10                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-25 19:57:10                                  Service Control Manager         7036:  ""    .  
                        2015-10-25 19:57:12                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-25 19:57:12                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-25 19:57:12                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 19:57:12                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 19:57:12                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 19:57:12                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 19:57:12                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 19:57:12                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 19:57:12                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-25 19:57:12                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 19:57:12                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-25 19:57:13                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-25 19:57:13                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-25 19:57:16                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-25 19:59:12                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-25 19:59:12                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 19:59:12                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 19:59:13                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-25 19:59:13                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 19:59:14                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 19:59:49                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 20:01:49                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 20:04:14                                  Service Control Manager         7036:  "  "    .  
                            2015-10-25 20:04:54                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-25 20:05:24                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-25 20:05:24                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-25 20:05:24                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-25 20:05:24                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-25 20:05:24                                  atapi                           11:     \Device\Ide\IdePort3.  
                            2015-10-25 20:05:24                                  cdrom                           15:    \Device\CdRom0  .  
                        2015-10-25 20:10:04                                  Service Control Manager         7036:  "    "    .  
                        2015-10-25 20:10:04                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-25 20:10:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 20:10:52                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 20:15:52                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 20:20:04                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 20:21:13                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-10-25 20:21:16                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-10-25 22:50:02                                  nvlddmkm                        
                        2015-10-25 22:50:02                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-25 22:50:03                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-25 22:50:07                                  Service Control Manager         7036:  "  "    .  
                            2015-10-25 22:51:45                                  ipnathlp                        
                        2015-10-25 22:51:46                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 22:51:47                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-25 22:51:49  LOCAL SERVICE                   Microsoft-Windows-Time-Service  37: NTP-         time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->104.209.134.106:123).  
                        2015-10-25 22:51:51                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 22:51:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-25 22:51:52  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-25 22:51:52  LOCAL SERVICE                   Microsoft-Windows-Time-Service  35:          time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->104.209.134.106:123).  
                        2015-10-25 22:51:52  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-25 22:51:52  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-25 22:51:53                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-10-25 22:51:55  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     osdsc.alicdn.com        DNS.  
                        2015-10-25 22:52:52  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-10-25T11:21:13.897460900Z      : 2015-10-25T13:50:03.083984400Z     : 4 USB   
                          2015-10-25 22:56:59  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     cs3-3.4pda.to        DNS.  
                        2015-10-25 22:57:07                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 23:01:40                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 23:04:52                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 23:05:35                                  Service Control Manager         7036:  "   "    .  
                          2015-10-25 23:07:08  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mdata.yandex.net        DNS.  
                        2015-10-25 23:08:13                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-10-25 23:14:53  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.google.com        DNS.  
                        2015-10-25 23:15:35                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 23:16:50                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 23:17:37                                  Service Control Manager         7036:  "  "    .  
                7005       2015-10-25 23:18:31                           Microsoft-Windows-UserPnp       20003:       USBSTOR      USB\VID_13FE&PID_3100\5&2532234B&0&1   : 0.  
                7005       2015-10-25 23:18:31                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbstor.inf_x86_neutral_c77d41a490bdc63d\usbstor.inf      USB\VID_13FE&PID_3100\5&2532234B&0&1   : 0x0.  
                        2015-10-25 23:18:32                                  Service Control Manager         7036:  "   "    .  
                7005       2015-10-25 23:18:32                           Microsoft-Windows-UserPnp       20003:       disk      USBSTOR\DISK&VEN_&PROD_2250_PRAM&REV_1.00\6&10A6A72D&0   : 0.  
                7005       2015-10-25 23:18:32                           Microsoft-Windows-UserPnp       20001:       FileRepository\disk.inf_x86_neutral_b431b61a11f8df6c\disk.inf      USBSTOR\DISK&VEN_&PROD_2250_PRAM&REV_1.00\6&10A6A72D&0   : 0x0.  
                7005       2015-10-25 23:18:33                           Microsoft-Windows-UserPnp       20003:       volsnap      STORAGE\VOLUME\_??_USBSTOR#DISK&VEN_&PROD_2250_PRAM&REV_1.00#6&10A6A72D&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}   : 0.  
                7005       2015-10-25 23:18:33                           Microsoft-Windows-UserPnp       20001:       FileRepository\volume.inf_x86_neutral_6dee0205881d1a1d\volume.inf      STORAGE\VOLUME\_??_USBSTOR#DISK&VEN_&PROD_2250_PRAM&REV_1.00#6&10A6A72D&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}   : 0x0.  
                16         2015-10-25 23:18:34                                  WPDClassInstaller               
                32         2015-10-25 23:18:34                                  WPDClassInstaller               
                32         2015-10-25 23:18:34                                  WPDClassInstaller               
                48         2015-10-25 23:18:34                           Microsoft-Windows-DriverFrameworks-UserMode  10000:  ,       1.9.0,    WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_2250_PRAM&REV_1.00#6&10A6A72D&0#.  
                48         2015-10-25 23:18:34                           Microsoft-Windows-DriverFrameworks-UserMode  10002:      WpdFs (CLSID {112DE495-AC4C-46F8-B663-6A4266C53313}) .      1.9.0    .  
                48         2015-10-25 23:18:34                           Microsoft-Windows-DriverFrameworks-UserMode  10100:     .  
                7005       2015-10-25 23:18:34                           Microsoft-Windows-UserPnp       20003:       WUDFRd      WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_2250_PRAM&REV_1.00#6&10A6A72D&0#   : 0.  
                          2015-10-25 23:18:34  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     cse.google.com        DNS.  
                7005       2015-10-25 23:18:35                           Microsoft-Windows-UserPnp       20001:       FileRepository\wpdfs.inf_x86_neutral_fc4ebadff3a40ae4\wpdfs.inf      WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_2250_PRAM&REV_1.00#6&10A6A72D&0#   : 0x0.  
                        2015-10-25 23:27:16                                  Service Control Manager         7036:  " "    .  
                        2015-10-25 23:33:46                                  Service Control Manager         7036:  "  "    .  
                          2015-10-25 23:37:18  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-25 23:40:37                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-25 23:40:37                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-25 23:40:37                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                            2015-10-25 23:40:39                                  ipnathlp                        
                        2015-10-25 23:40:40                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-25 23:40:42                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-25 23:40:53                                  Service Control Manager         7036:  "   "    .  
                        2015-10-25 23:42:21                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-25 23:42:21                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-25 23:42:21                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-25 23:42:30  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                            2015-10-25 23:42:33                                  ipnathlp                        
                            2015-10-25 23:42:33                                  ipnathlp                        
                        2015-10-25 23:42:34                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-25 23:42:45  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-25 23:42:58                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-25 23:42:58                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-25 23:42:58                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-25 23:43:00  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     top-fwz1.mail.ru        DNS.  
                        2015-10-25 23:43:23                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-25 23:43:34  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-25 23:43:59                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-25 23:43:59                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-25 23:43:59                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-25 23:44:24                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-25 23:44:27                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-25 23:44:27                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-25 23:44:38  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-25 23:44:52                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-25 23:45:04  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-25 23:45:13                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-25 23:45:13                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-25 23:45:13                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-25 23:45:16  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-25 23:45:31                                  Service Control Manager         7036:  "  "    .  
                        2015-10-25 23:47:10                                  Service Control Manager         7036:  "   "    .  
                            2015-10-25 23:48:14                                  ipnathlp                        
                        2015-10-25 23:48:15                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-25 23:48:27  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-10-25 23:49:30                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-25 23:49:30                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-25 23:49:30                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                7005       2015-10-25 23:50:01                           Microsoft-Windows-UserPnp       20003:       USBSTOR      USB\VID_13FE&PID_3100\5&9965632&0&6   : 0.  
                7005       2015-10-25 23:50:01                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbstor.inf_x86_neutral_c77d41a490bdc63d\usbstor.inf      USB\VID_13FE&PID_3100\5&9965632&0&6   : 0x0.  
                7005       2015-10-25 23:50:02                           Microsoft-Windows-UserPnp       20003:       disk      USBSTOR\DISK&VEN_&PROD_2250_PRAM&REV_1.00\6&2E78F1E7&0   : 0.  
                7005       2015-10-25 23:50:02                           Microsoft-Windows-UserPnp       20001:       FileRepository\disk.inf_x86_neutral_b431b61a11f8df6c\disk.inf      USBSTOR\DISK&VEN_&PROD_2250_PRAM&REV_1.00\6&2E78F1E7&0   : 0x0.  
                48         2015-10-25 23:50:03                           Microsoft-Windows-DriverFrameworks-UserMode  10000:  ,       1.9.0,    WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_2250_PRAM&REV_1.00#6&2E78F1E7&0#.  
                48         2015-10-25 23:50:03                           Microsoft-Windows-DriverFrameworks-UserMode  10002:      WpdFs (CLSID {112DE495-AC4C-46F8-B663-6A4266C53313}) .      1.9.0    .  
                7005       2015-10-25 23:50:03                           Microsoft-Windows-UserPnp       20003:       volsnap      STORAGE\VOLUME\_??_USBSTOR#DISK&VEN_&PROD_2250_PRAM&REV_1.00#6&2E78F1E7&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}   : 0.  
                7005       2015-10-25 23:50:03                           Microsoft-Windows-UserPnp       20001:       FileRepository\volume.inf_x86_neutral_6dee0205881d1a1d\volume.inf      STORAGE\VOLUME\_??_USBSTOR#DISK&VEN_&PROD_2250_PRAM&REV_1.00#6&2E78F1E7&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}   : 0x0.  
                16         2015-10-25 23:50:04                                  WPDClassInstaller               
                32         2015-10-25 23:50:04                                  WPDClassInstaller               
                32         2015-10-25 23:50:04                                  WPDClassInstaller               
                48         2015-10-25 23:50:04                           Microsoft-Windows-DriverFrameworks-UserMode  10100:     .  
                7005       2015-10-25 23:50:04                           Microsoft-Windows-UserPnp       20003:       WUDFRd      WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_2250_PRAM&REV_1.00#6&2E78F1E7&0#   : 0.  
                7005       2015-10-25 23:50:04                           Microsoft-Windows-UserPnp       20001:       FileRepository\wpdfs.inf_x86_neutral_fc4ebadff3a40ae4\wpdfs.inf      WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_&PROD_2250_PRAM&REV_1.00#6&2E78F1E7&0#   : 0x0.  
                12         2015-10-25 23:50:58  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:     :            :     . . . . . . . . . . : ASUS USB-N10 150Mbps 11n Wireless USB dongle     . . . . . . . : ASUSTeK Computer Inc.     . . . . . . . . . . : Realtek Semiconductor Corp.     . . . . . . . . . . : 1021.3.912.2012     INF- . . . . . . . . . : C:\Windows\INF\oem2.inf     INF- . . . . . . . . . : 19  2013 .  14:56:04        . . . . . . . . . : RTL8192cu.ndi      . . . . . . . . . : usb\vid_0b05&pid_17ba       . . . . . : 0x180600a        . . : 0     If  . . . . . . . . . . . . : 71       . . . . . . : 9   
                12         2015-10-25 23:51:04  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:        :          GUID : 211835d6-e914-4a4d-824e-a3809356f2d8   : ASUS USB-N10 150Mbps 11n Wireless USB dongle   :  WiFi  : Lumia 920 2339  SSID: Lumia 920 2339   SSID: 14   :   :         :          : 1   : 2         : 2015-10-25 22:50:41-430   :    :   :      :       :  : 1,  : 1         BSSID  BSS  PHY () /    SSID ------------------------------------------------------------------------- 3C-C2-43-17-AF-E6   < > -45  6  Lumia 920 2339          2      :   - 1;   - 1   BSS  PHY  (RSSI)  SSID   ------------------------------------------------------------------------------     < >   100   Lumia 920 2339      :   - 2    : Lumia 920 2339     SSID: Lumia 920 2339      SSID: 14      :      :        :            :      :     : Windows Phone8415     SSID: Windows Phone8415      SSID: 17      :      :        :            :      :       : 0x00028002       3   : 2015-10-25 22:50:53-272     : 2   : Lumia 920 2339   SSID: Lumia 920 2339    SSID: 14    :    :                 (IHV):      ,     (IHV):        :      :      :  0x00000000      : 0x00000000       1      :   - 1;   - 1   BSS  PHY  (RSSI)  SSID   ------------------------------------------------------------------------------     < >   100   Lumia 920 2339      :   - 2    : Lumia 920 2339     SSID: Lumia 920 2339      SSID: 14      :      :        :            :      :       : 0x00028006    : Windows Phone8415     SSID: Windows Phone8415      SSID: 17      :      :        :            :      :       : 0x00028002       2   : 2015-10-25 22:50:41-430     : 1   : Lumia 920 2339   SSID: Lumia 920 2339    SSID: 14    :    :                 (IHV):      ,     (IHV):        :      :      :  0x00038002      : 0x00000002       1   : 2015-10-25 22:49:46-367     : 1   : Lumia 920 2339   SSID: Lumia 920 2339    SSID: 14    :    :                 (IHV):      ,     (IHV):        :      :      :  0x00038002      : 0x00000002    
                12         2015-10-25 23:51:04  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:        :            .     .    :    :        GUID : 211835d6-e914-4a4d-824e-a3809356f2d8   : ASUS USB-N10 150Mbps 11n Wireless USB dongle   :  WiFi  : Lumia 920 2339  SSID: Lumia 920 2339   SSID: 14   :   :         :    :     : RNWF MSM Helper Class   :     "Lumia 920 2339".  .   :     .     "  "        .    
                12         2015-10-25 23:51:04  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:      :            .     .    :  WiFi MSM   :        GUID : 211835d6-e914-4a4d-824e-a3809356f2d8   : ASUS USB-N10 150Mbps 11n Wireless USB dongle   :  WiFi  : Lumia 920 2339  SSID: Lumia 920 2339   SSID: 14   :   :         :    :     :        "Lumia 920 2339"        .    ():      .  Windows          .   :           -   .             Windows.    
                4          2015-10-25 23:51:04  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  4000:      .    :        : RNWF MSM Helper Class     :        "Lumia 920 2339"        .     Guid  : {0576AC9E-F3D4-4148-AC43-0820B503D3B3}      :           -   .             Windows.     Guid : {CDF735DA-71DE-471E-85A6-98B05DF7D631}      (),   : 300      ,   : 0    :    ({211835D6-E914-4A4D-824E-A3809356F2D8})  
                4          2015-10-25 23:51:04  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  4000:      .    :        : RNWF MSM Helper Class     :        "Lumia 920 2339"        .     Guid  : {0576AC9E-F3D4-4148-AC43-0820B503D3B3}      :     .     "  "        .     Guid : {07D37F7B-FA5E-4443-BDA7-AB107B29AFB9}      (),   : 300      ,   : 80    :    ({211835D6-E914-4A4D-824E-A3809356F2D8})  
                12         2015-10-25 23:51:35  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:     :            :     . . . . . . . . . . : ASUS USB-N10 150Mbps 11n Wireless USB dongle     . . . . . . . : ASUSTeK Computer Inc.     . . . . . . . . . . : Realtek Semiconductor Corp.     . . . . . . . . . . : 1021.3.912.2012     INF- . . . . . . . . . : C:\Windows\INF\oem2.inf     INF- . . . . . . . . . : 19  2013 .  14:56:04        . . . . . . . . . : RTL8192cu.ndi      . . . . . . . . . : usb\vid_0b05&pid_17ba       . . . . . : 0x180600a        . . : 0     If  . . . . . . . . . . . . : 71       . . . . . . : 9   
                12         2015-10-25 23:51:35  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:        :          GUID : 211835d6-e914-4a4d-824e-a3809356f2d8   : ASUS USB-N10 150Mbps 11n Wireless USB dongle   :  WiFi  : Lumia 920 2339  SSID: Lumia 920 2339   SSID: 14   :   :         :          : 1   : 1         : 2015-10-25 22:51:08-721   :    :   :      :       :  : 1,  : 1         BSSID  BSS  PHY () /    SSID ------------------------------------------------------------------------- 3C-C2-43-17-AF-E6   < > -45  6  Lumia 920 2339          1      :   - 1;   - 1   BSS  PHY  (RSSI)  SSID   ------------------------------------------------------------------------------     < >   100   Lumia 920 2339      :   - 2    : Lumia 920 2339     SSID: Lumia 920 2339      SSID: 14      :      :        :            :      :     : Windows Phone8415     SSID: Windows Phone8415      SSID: 17      :      :        :            :      :       : 0x00028002       1   : 2015-10-25 22:51:08-721     : 1   : Lumia 920 2339   SSID: Lumia 920 2339    SSID: 14    :    :                 (IHV):      ,     (IHV):        :      :      :  0x00038002      : 0x00000002    
                12         2015-10-25 23:51:35  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:        :            .     .    :    :        GUID : 211835d6-e914-4a4d-824e-a3809356f2d8   : ASUS USB-N10 150Mbps 11n Wireless USB dongle   :  WiFi  : Lumia 920 2339  SSID: Lumia 920 2339   SSID: 14   :   :         :    :     : RNWF MSM Helper Class   :     "Lumia 920 2339".  .   :     .     "  "        .    
                12         2015-10-25 23:51:35  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  6100:      :            .     .    :  WiFi MSM   :        GUID : 211835d6-e914-4a4d-824e-a3809356f2d8   : ASUS USB-N10 150Mbps 11n Wireless USB dongle   :  WiFi  : Lumia 920 2339  SSID: Lumia 920 2339   SSID: 14   :   :         :    :     :        "Lumia 920 2339"        .    ():      .  Windows          .   :           -   .             Windows.    
                4          2015-10-25 23:51:35  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  4000:      .    :        : RNWF MSM Helper Class     :        "Lumia 920 2339"        .     Guid  : {0576AC9E-F3D4-4148-AC43-0820B503D3B3}      :           -   .             Windows.     Guid : {CDF735DA-71DE-471E-85A6-98B05DF7D631}      (),   : 300      ,   : 0    :    ({211835D6-E914-4A4D-824E-A3809356F2D8})  
                4          2015-10-25 23:51:35  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  4000:      .    :        : RNWF MSM Helper Class     :        "Lumia 920 2339"        .     Guid  : {0576AC9E-F3D4-4148-AC43-0820B503D3B3}      :     .     "  "        .     Guid : {07D37F7B-FA5E-4443-BDA7-AB107B29AFB9}      (),   : 300      ,   : 80    :    ({211835D6-E914-4A4D-824E-A3809356F2D8})  
                7          2015-10-25 23:51:35  LOCAL SERVICE                   Microsoft-Windows-Diagnostics-Networking  5100:         .     :        : RNWF MSM Helper Class      :     .     "  "        .     Guid : {07D37F7B-FA5E-4443-BDA7-AB107B29AFB9}     n,    ,   .   NDF     .        NDF .  
                        2015-10-25 23:55:36                                  Service Control Manager         7036:  "   "    .  
                            2015-10-25 23:55:54                                  ipnathlp                        
                        2015-10-25 23:55:55                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-10-25 23:56:56  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     counter.rambler.ru        DNS.  
                        2015-10-25 23:57:12                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-25 23:57:13                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-25 23:57:13                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-25 23:57:13                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-25 23:57:15  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     counter.rambler.ru        DNS.  
                        2015-10-26 00:01:41                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 00:14:00  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-26 00:14:03                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-26 00:14:03                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 00:14:03                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 00:14:03                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 00:14:03                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-26 00:14:03  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-26 00:14:03                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-26 00:14:04                                  EventLog                        6006:    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  ""    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  "-"    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  "     "    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-26 00:14:04                                  Service Control Manager         7036:  " "    .  
                4          2015-10-26 00:14:04  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-26 00:14:04  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-26 00:14:04                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-10-26 00:14:04                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-26 00:14:05                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-26 00:14:05                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-26 00:14:10                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-26 08:28:20                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-26 08:28:23                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-10-26 08:28:28                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-26 08:28:28                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-26 08:29:41                                  nvlddmkm                        
                        2015-10-26 08:29:42                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-26 08:29:42                                  EventLog                        6005:    .  
                        2015-10-26 08:29:42                                  EventLog                        6013:    82 .  
                        2015-10-26 08:29:42                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-26 08:29:42                                  Service Control Manager         7036:  ""    .  
                        2015-10-26 08:29:42                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-26 08:29:42                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-26 08:29:42                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-26 08:29:42                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-26 08:29:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 08:29:42                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-10-26 08:29:42                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  ""    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  "    "    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  "     "    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  "-"    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-26 08:29:43                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 08:29:43                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-10-26 08:29:43  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-26 08:29:43  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-26 08:29:44                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 08:29:44                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 08:29:44                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 08:29:44                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 08:29:44                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-26 08:29:44                                  Service Control Manager         7036:  "    "    .  
                        2015-10-26 08:29:44                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-26 08:29:44                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-26 08:29:44                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-26 08:29:44                                  Service Control Manager         7036:  ""    .  
                        2015-10-26 08:29:44                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 08:29:44                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-26 08:29:44                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-26 08:29:44                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 08:29:44                                  Service Control Manager         7036:  ""    .  
                1101       2015-10-26 08:29:44                           Microsoft-Windows-Winlogon      7001:           
                        2015-10-26 08:29:45                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-26 08:29:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 08:29:46                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-26 08:29:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 08:29:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 08:29:46                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 08:29:46                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 08:29:46                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 08:29:46                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-26 08:29:46                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 08:29:46                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-26 08:29:46                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-26 08:29:46                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-26 08:29:48                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-26 08:29:52                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-26 08:31:46                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-26 08:31:46                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 08:31:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 08:31:46                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-26 08:31:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 08:31:48                                  Service Control Manager         7036:  "  Windows"    .  
                            2015-10-26 08:33:45                           Microsoft-Windows-Application-Experience  205:           .  
                        2015-10-26 08:33:45                                  Service Control Manager         7036:  "    "    .  
                        2015-10-26 08:33:45                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-26 08:35:54                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-26 08:36:47                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 08:38:43                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-26 08:38:47  LOCAL SERVICE                   Microsoft-Windows-Time-Service  37: NTP-         time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->23.99.222.162:123).  
                        2015-10-26 08:38:54                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 08:39:00                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-26 08:39:00  LOCAL SERVICE                   Microsoft-Windows-Time-Service  35:          time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->23.99.222.162:123).  
                        2015-10-26 08:39:00  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-26 08:43:49                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 08:46:18                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-10-26 09:00:01  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-10-26 09:06:35                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 09:06:35  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-26 09:06:37  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-26 09:06:37                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-26 09:06:38                                  EventLog                        6006:    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  ""    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "-"    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "     "    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-26 09:06:38                                  Service Control Manager         7036:  "Superfetch"    .  
                4          2015-10-26 09:06:38  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-26 09:06:38  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-26 09:06:38                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-10-26 09:06:39                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-26 09:06:39                                  Service Control Manager         7036:  "  WLAN"    .  
                103        2015-10-26 09:06:39                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-10-26 09:06:39                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-26 09:06:51                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-26 14:21:19                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-26 14:21:22                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-10-26 14:21:27                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-26 14:21:27                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-26 14:22:40                                  nvlddmkm                        
                        2015-10-26 14:22:40                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-26 14:22:40                                  EventLog                        6005:    .  
                        2015-10-26 14:22:40                                  EventLog                        6013:    81 .  
                        2015-10-26 14:22:40                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-26 14:22:40                                  Service Control Manager         7036:  ""    .  
                        2015-10-26 14:22:40                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-26 14:22:40                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-26 14:22:40                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-26 14:22:40                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-26 14:22:40                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 14:22:40                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-10-26 14:22:40                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  ""    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  "    "    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  "     "    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 14:22:41                                  Service Control Manager         7036:  "-"    .  
                        2015-10-26 14:22:41                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-10-26 14:22:41                           Microsoft-Windows-Winlogon      7001:           
                4          2015-10-26 14:22:41  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-26 14:22:41  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-26 14:22:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 14:22:42                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-26 14:22:42                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 14:22:42                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 14:22:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 14:22:42                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-26 14:22:42                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 14:22:42                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-26 14:22:42                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 14:22:42                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-26 14:22:42                                  Service Control Manager         7036:  ""    .  
                        2015-10-26 14:22:42                                  Service Control Manager         7036:  "    "    .  
                        2015-10-26 14:22:42                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 14:22:42                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-26 14:22:42                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-26 14:22:42                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-26 14:22:42                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 14:22:42                                  Service Control Manager         7036:  ""    .  
                        2015-10-26 14:22:43                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-26 14:22:43                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 14:22:43                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 14:22:43                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 14:22:43                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-26 14:22:43                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 14:22:43                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 14:22:43                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-26 14:22:43                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 14:22:43                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 14:22:43                                  Service Control Manager         7036:  "  IPsec"    .  
                          2015-10-26 14:22:44                                  ipnathlp                        
                        2015-10-26 14:22:49                                  Service Control Manager         7036:  "Windows Search"    .  
                7005       2015-10-26 14:23:05                           Microsoft-Windows-UserPnp       20001:       FileRepository\usb.inf_x86_neutral_2620fd493cad7d41\usb.inf      USB\VID_0000&PID_0000\5&2532234B&0&2   : 0x0.  
                        2015-10-26 14:23:56                                  Service Control Manager         7036:  "    "    .  
                        2015-10-26 14:23:56                           Microsoft-Windows-Application-Experience  201:       .  
                            2015-10-26 14:24:42                                  Disk                            11:     \Device\Harddisk3\DR3.  
                            2015-10-26 14:24:43                                  Disk                            11:     \Device\Harddisk3\DR3.  
                        2015-10-26 14:24:43                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-26 14:24:43                                  Service Control Manager         7036:  "  "    .  
                            2015-10-26 14:24:44                                  Disk                            11:     \Device\Harddisk3\DR3.  
                        2015-10-26 14:24:44                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-26 14:24:44                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 14:24:45                                  Service Control Manager         7036:  "  Windows"    .  
                            2015-10-26 14:24:51                                  Disk                            11:     \Device\Harddisk3\DR3.  
                            2015-10-26 14:24:52                                  Disk                            11:     \Device\Harddisk3\DR3.  
                            2015-10-26 14:24:53                                  Disk                            11:     \Device\Harddisk3\DR3.  
                        2015-10-26 14:27:12  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-26 14:27:14                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-26 14:27:14                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 14:27:14  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-26 14:27:14                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-26 14:27:15                                  EventLog                        6006:    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  ""    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "-"    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "     "    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "   "    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "  "    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  " "    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-26 14:27:15                                  Service Control Manager         7036:  "Windows Search"    .  
                4          2015-10-26 14:27:15  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-26 14:27:15  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-26 14:27:15                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-10-26 14:27:15                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                103        2015-10-26 14:27:16                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-26 14:27:20                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-27 06:51:27                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-27 06:51:30                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-10-27 06:51:35                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-27 06:51:35                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-27 06:52:48                                  nvlddmkm                        
                        2015-10-27 06:52:49                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-27 06:52:49                                  EventLog                        6005:    .  
                        2015-10-27 06:52:49                                  EventLog                        6013:    82 .  
                        2015-10-27 06:52:49                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-27 06:52:49                                  Service Control Manager         7036:  ""    .  
                        2015-10-27 06:52:49                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-27 06:52:49                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-27 06:52:49                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-27 06:52:49                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-27 06:52:49                                  Service Control Manager         7036:  "  "    .  
                        2015-10-27 06:52:49                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-10-27 06:52:49                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  ""    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  "  "    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  "  "    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  " "    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  "    "    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  "     "    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  "   "    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  "   "    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  "  "    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  " "    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  " "    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  "-"    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  "  "    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  " "    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  "  "    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  " "    .  
                        2015-10-27 06:52:50                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-27 06:52:50                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-10-27 06:52:50  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-27 06:52:50  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  " "    .  
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  "   "    .  
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  ""    .  
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  "    "    .  
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  " "    .  
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  "   "    .  
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  ""    .  
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  "  "    .  
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  "   "    .  
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  "   "    .  
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  " "    .  
                        2015-10-27 06:52:51                                  Service Control Manager         7036:  "  HID-"    .  
                1101       2015-10-27 06:52:51                           Microsoft-Windows-Winlogon      7001:           
                        2015-10-27 06:52:52                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-27 06:52:53                                  Service Control Manager         7036:  "   "    .  
                        2015-10-27 06:52:53                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-27 06:52:53                                  Service Control Manager         7036:  "  PNP-"    .  
                7005       2015-10-27 06:52:54                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0001   : 0.  
                        2015-10-27 06:52:59                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-27 06:54:51                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-27 06:54:52                                  Service Control Manager         7036:  "   "    .  
                        2015-10-27 06:54:52                                  Service Control Manager         7036:  "  "    .  
                        2015-10-27 06:54:52                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-27 06:54:53                                  Service Control Manager         7036:  "  "    .  
                        2015-10-27 06:54:54                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-27 06:54:55                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-27 06:55:01                                  Service Control Manager         7036:  "    "    .  
                        2015-10-27 06:55:01                           Microsoft-Windows-Application-Experience  201:       .  
                          2015-10-27 06:55:22  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     validator.w3.org        DNS.  
                        2015-10-27 06:56:06                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-27 06:56:14                                  Service Control Manager         7036:  " "    .  
                        2015-10-27 06:59:55                                  Service Control Manager         7036:  "  "    .  
                        2015-10-27 07:02:18                                  Service Control Manager         7036:  "  "    .  
                        2015-10-27 07:07:09                                  Service Control Manager         7036:  "   "    .  
                        2015-10-27 07:07:49                                  Service Control Manager         7036:  "  "    .  
                        2015-10-27 07:07:49  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-27 07:07:51  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-27 07:07:51                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "  "    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "  "    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "  "    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  " "    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-27 07:07:52                                  EventLog                        6006:    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  ""    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "  "    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "-"    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "  "    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "     "    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "   "    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "   "    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "  "    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  " "    .  
                        2015-10-27 07:07:52                                  Service Control Manager         7036:  "Superfetch"    .  
                4          2015-10-27 07:07:52  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-27 07:07:52  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-27 07:07:52                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-10-27 07:07:53                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-27 07:07:53                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-27 07:07:53                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-10-27 07:07:53                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-27 07:07:55                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-29 13:05:16                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-29 13:05:19                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-10-29 13:05:24                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-29 13:05:24                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-29 13:06:37                                  nvlddmkm                        
                        2015-10-29 13:06:38                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-29 13:06:38                                  EventLog                        6005:    .  
                        2015-10-29 13:06:38                                  EventLog                        6013:    82 .  
                        2015-10-29 13:06:38                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-29 13:06:38                                  Service Control Manager         7036:  ""    .  
                        2015-10-29 13:06:38                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-29 13:06:38                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-29 13:06:38                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-29 13:06:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-29 13:06:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-29 13:06:38                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-10-29 13:06:38                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  ""    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  "  "    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  "  "    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  " "    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  "    "    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  "     "    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  "   "    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  "   "    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  "  "    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  " "    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  " "    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  "-"    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  "  "    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-29 13:06:39                                  Service Control Manager         7036:  " "    .  
                        2015-10-29 13:06:39                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-10-29 13:06:39  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-29 13:06:39  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-29 13:06:40                                  Service Control Manager         7036:  " "    .  
                        2015-10-29 13:06:40                                  Service Control Manager         7036:  " "    .  
                        2015-10-29 13:06:40                                  Service Control Manager         7036:  " "    .  
                        2015-10-29 13:06:40                                  Service Control Manager         7036:  "  "    .  
                        2015-10-29 13:06:40                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-29 13:06:40                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-29 13:06:40                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-29 13:06:40                                  Service Control Manager         7036:  "    "    .  
                        2015-10-29 13:06:40                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-29 13:06:40                                  Service Control Manager         7036:  ""    .  
                        2015-10-29 13:06:40                                  Service Control Manager         7036:  "   "    .  
                        2015-10-29 13:06:40                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-29 13:06:40                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-29 13:06:40                                  Service Control Manager         7036:  "   "    .  
                        2015-10-29 13:06:40                                  Service Control Manager         7036:  ""    .  
                        2015-10-29 13:06:40                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-29 13:06:40                                  Service Control Manager         7036:  "  "    .  
                        2015-10-29 13:06:40                                  Service Control Manager         7036:  "  "    .  
                1101       2015-10-29 13:06:40                           Microsoft-Windows-Winlogon      7001:           
                        2015-10-29 13:06:41                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-29 13:06:41                                  Service Control Manager         7036:  "  "    .  
                        2015-10-29 13:06:41                                  Service Control Manager         7036:  " "    .  
                        2015-10-29 13:06:41                                  Service Control Manager         7036:  "   "    .  
                        2015-10-29 13:06:41                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-29 13:06:41                                  Service Control Manager         7036:  "   "    .  
                        2015-10-29 13:06:41                                  Service Control Manager         7036:  "   "    .  
                        2015-10-29 13:06:41                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-29 13:06:42                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-29 13:06:42                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-29 13:06:49                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-29 13:07:02                                  Service Control Manager         7036:  "    "    .  
                        2015-10-29 13:07:02                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-29 13:07:03                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-29 13:08:41                                  Service Control Manager         7036:  "  "    .  
                        2015-10-29 13:08:41                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-29 13:08:41                                  Service Control Manager         7036:  "  "    .  
                        2015-10-29 13:08:41                                  Service Control Manager         7036:  "   "    .  
                        2015-10-29 13:08:43                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-29 13:11:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-29 13:13:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-29 13:13:53                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-29 13:16:45                                  Service Control Manager         7036:  "   "    .  
                        2015-10-29 13:20:03                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-29 13:20:03                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-29 13:20:03                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-10-29 13:30:20                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-29 13:30:23                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-10-29 13:36:59                           Microsoft-Windows-Application-Experience  206:          .  
                          2015-10-29 13:39:53  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     wagbridge.alicdn.com.gds.alibabadns.com        DNS.  
                        2015-10-29 13:46:40                                  Service Control Manager         7036:  "  "    .  
                        2015-10-29 13:54:21                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-10-29 13:54:28                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-10-29 16:32:40                                  nvlddmkm                        
                        2015-10-29 16:32:40                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-29 16:32:41                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-29 16:32:45                                  Service Control Manager         7036:  "  "    .  
                        2015-10-29 16:32:47                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-10-29 16:32:48                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-29 16:32:48                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-10-29 16:32:53  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     services.addons.mozilla.org        DNS.  
                        2015-10-29 16:32:55  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-10-29T04:54:21.932617100Z      : 2015-10-29T07:32:40.999023500Z     : 4 USB   
                        2015-10-29 16:33:22  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-10-29 16:33:24  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-29 16:33:24                           Microsoft-Windows-Winlogon      7002:           
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  " "    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-29 16:33:25                                  EventLog                        6006:    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  ""    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "-"    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "     "    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "   "    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "   "    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "  "    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  " "    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-29 16:33:25                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                4          2015-10-29 16:33:25  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-29 16:33:25  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-29 16:33:25                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-10-29 16:33:25                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-29 16:33:26                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-29 16:33:26                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-29 16:33:28                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-31 19:15:09                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-31 19:15:12                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-10-31 19:15:17                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-31 19:15:17                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-31 19:16:30                                  nvlddmkm                        
                        2015-10-31 19:16:31                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-31 19:16:31                                  EventLog                        6005:    .  
                        2015-10-31 19:16:31                                  EventLog                        6013:    82 .  
                        2015-10-31 19:16:31                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-31 19:16:31                                  Service Control Manager         7036:  ""    .  
                        2015-10-31 19:16:31                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-31 19:16:31                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-31 19:16:31                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-31 19:16:31                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-31 19:16:31                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-10-31 19:16:31                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  ""    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  " "    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "    "    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "     "    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "   "    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "   "    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  " "    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  " "    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "-"    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  " "    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  " "    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  " "    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  " "    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:16:32                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-31 19:16:32                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-10-31 19:16:32  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-31 19:16:32  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-31 19:16:33                                  Service Control Manager         7036:  "   "    .  
                        2015-10-31 19:16:33                                  Service Control Manager         7036:  ""    .  
                        2015-10-31 19:16:33                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-31 19:16:33                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-31 19:16:33                                  Service Control Manager         7036:  "    "    .  
                        2015-10-31 19:16:33                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-31 19:16:33                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-31 19:16:33                                  Service Control Manager         7036:  "   "    .  
                        2015-10-31 19:16:33                                  Service Control Manager         7036:  ""    .  
                1101       2015-10-31 19:16:33                           Microsoft-Windows-Winlogon      7001:           
                        2015-10-31 19:16:34                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-31 19:16:34                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:16:34                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:16:34                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-31 19:16:35                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:16:35                                  Service Control Manager         7036:  "   "    .  
                        2015-10-31 19:16:35                                  Service Control Manager         7036:  "   "    .  
                        2015-10-31 19:16:35                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-31 19:16:35                                  Service Control Manager         7036:  " "    .  
                        2015-10-31 19:16:35                                  Service Control Manager         7036:  "   "    .  
                        2015-10-31 19:16:35                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-31 19:16:36                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-31 19:16:36                                  Service Control Manager         7036:  "  PNP-"    .  
                7005       2015-10-31 19:16:37                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                7005       2015-10-31 19:16:38                           Microsoft-Windows-UserPnp       20003:       HidUsb      USB\VID_044F&PID_B323\5&20753C85&0&2   : 0.  
                7005       2015-10-31 19:16:38                           Microsoft-Windows-UserPnp       20001:       FileRepository\input.inf_x86_neutral_9e1eba5724be176f\input.inf      USB\VID_044F&PID_B323\5&20753C85&0&2   : 0x0.  
                7005       2015-10-31 19:16:38                           Microsoft-Windows-UserPnp       20001:       FileRepository\input.inf_x86_neutral_9e1eba5724be176f\input.inf      HID\VID_044F&PID_B323\6&8472628&0&0000   : 0x0.  
                        2015-10-31 19:16:41                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-31 19:16:51                                  Service Control Manager         7036:  "    "    .  
                        2015-10-31 19:16:51                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-31 19:17:06                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  " "    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:17:33                                  EventLog                        6006:    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  ""    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "-"    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "     "    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "   "    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "   "    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  " "    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-31 19:17:33                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-31 19:17:33  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-31 19:17:33                           Microsoft-Windows-Winlogon      7002:           
                4          2015-10-31 19:17:33  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-31 19:17:33  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-31 19:17:33                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-10-31 19:17:33                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-31 19:17:34                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-31 19:17:35                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-31 19:17:38                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-10-31 19:18:16                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-10-31 19:18:19                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-10-31 19:18:23                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-10-31 19:18:23                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-10-31 19:19:37                                  nvlddmkm                        
                        2015-10-31 19:19:37                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-31 19:19:37                                  Service Control Manager         7036:  ""    .  
                        2015-10-31 19:19:37                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-10-31 19:19:37                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-10-31 19:19:37                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-10-31 19:19:38                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-10-31 19:19:38                                  EventLog                        6005:    .  
                        2015-10-31 19:19:38                                  EventLog                        6013:    81 .  
                        2015-10-31 19:19:38                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-10-31 19:19:38                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-10-31 19:19:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-31 19:19:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:19:38                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-10-31 19:19:38                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-10-31 19:19:38                                  Service Control Manager         7036:  ""    .  
                        2015-10-31 19:19:38                                  Service Control Manager         7036:  " "    .  
                        2015-10-31 19:19:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:19:38                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:19:38                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-10-31 19:19:38                                  Service Control Manager         7036:  "    "    .  
                        2015-10-31 19:19:38                                  Service Control Manager         7036:  "     "    .  
                        2015-10-31 19:19:38                                  Service Control Manager         7036:  "   "    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  "   "    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  " "    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  " "    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  "-"    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  " "    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  " "    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  " "    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  " "    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  "   "    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  ""    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  "  IP"    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  "    "    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-31 19:19:39                                  Service Control Manager         7036:  "   "    .  
                        2015-10-31 19:19:39                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-10-31 19:19:39  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-10-31 19:19:39  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-10-31 19:19:40                                  Service Control Manager         7036:  ""    .  
                1101       2015-10-31 19:19:40                           Microsoft-Windows-Winlogon      7001:           
                        2015-10-31 19:19:41                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-10-31 19:19:41                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:19:41                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:19:41                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-31 19:19:41                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:19:41                                  Service Control Manager         7036:  " "    .  
                        2015-10-31 19:19:41                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-31 19:19:41                                  Service Control Manager         7036:  "   "    .  
                        2015-10-31 19:19:41                                  Service Control Manager         7036:  "   "    .  
                        2015-10-31 19:19:41                                  Service Control Manager         7036:  "   "    .  
                        2015-10-31 19:19:41                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-31 19:19:42                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-31 19:19:42                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-31 19:19:47                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-10-31 19:19:48                                  Service Control Manager         7036:  "    "    .  
                        2015-10-31 19:19:48                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-10-31 19:21:41                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-31 19:21:41                                  Service Control Manager         7036:  "   "    .  
                        2015-10-31 19:21:41                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:21:42                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-31 19:21:42                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:21:44                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-31 19:24:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:26:44                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:29:45                                  Service Control Manager         7036:  "   "    .  
                        2015-10-31 19:30:13                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-10-31 19:30:13                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-10-31 19:31:33                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-31 19:31:33                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-10-31 19:34:10                                  nvlddmkm                        
                        2015-10-31 19:34:10                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-31 19:34:11                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                            2015-10-31 19:34:14                                  cdrom                           15:    \Device\CdRom0  .  
                        2015-10-31 19:34:17                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:34:26  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-10-31T10:30:06.628906200Z      : 2015-10-31T10:34:11.161132800Z     : 4 USB   
                        2015-10-31 19:39:19                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 19:56:43                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-10-31 19:56:43                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-10-31 20:06:52                                  nvlddmkm                        
                        2015-10-31 20:06:52                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-10-31 20:06:52                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 20:06:53                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-31 20:07:07  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-10-31T10:56:36.638671900Z      : 2015-10-31T11:06:53.099609400Z     : 4 USB   
                        2015-10-31 20:07:10                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 20:08:46                                  EventLog                        6006:    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  " "    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  ""    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "-"    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "   "    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "     "    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "   "    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "  "    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  " Windows"    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-10-31 20:08:46                                  Service Control Manager         7036:  " "    .  
                        2015-10-31 20:08:46  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-10-31 20:08:46                           Microsoft-Windows-Winlogon      7002:           
                4          2015-10-31 20:08:46  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-10-31 20:08:46  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-10-31 20:08:46                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-10-31 20:08:46                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-10-31 20:08:47                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-10-31 20:08:47                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-10-31 20:08:47                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-10-31 20:08:49                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-01 07:18:15                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-01 07:18:18                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-11-01 07:18:22                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-01 07:18:22                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-01 07:19:36                                  nvlddmkm                        
                        2015-11-01 07:19:36                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-01 07:19:36                                  Service Control Manager         7036:  ""    .  
                        2015-11-01 07:19:36                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-01 07:19:36                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-11-01 07:19:36                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-01 07:19:37                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-01 07:19:37                                  EventLog                        6005:    .  
                        2015-11-01 07:19:37                                  EventLog                        6013:    82 .  
                        2015-11-01 07:19:37                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-01 07:19:37                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-01 07:19:37                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 07:19:37                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 07:19:37                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  ""    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "    "    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "     "    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "-"    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "    "    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  ""    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-01 07:19:38                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-01 07:19:38                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-01 07:19:38  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-01 07:19:38  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-01 07:19:39                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 07:19:39                                  Service Control Manager         7036:  ""    .  
                1101       2015-11-01 07:19:39                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-01 07:19:40                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-01 07:19:40                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 07:19:40                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-01 07:19:40                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 07:19:40                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 07:19:40                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 07:19:40                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 07:19:40                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-01 07:19:40                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 07:19:40                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 07:19:40                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-01 07:19:41                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-01 07:19:41                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-01 07:19:42                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-01 07:19:46                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-01 07:21:29                                  Service Control Manager         7036:  "    "    .  
                        2015-11-01 07:21:29                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-01 07:21:30                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-01 07:21:32                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-01 07:21:40                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 07:21:40                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 07:21:41                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-01 07:21:41                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 07:21:43                                  Service Control Manager         7036:  "  Windows"    .  
                          2015-11-01 07:24:06  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     e4194.g.akamaiedge.net        DNS.  
                        2015-11-01 07:24:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 07:25:50                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-01 07:25:51                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-01 07:25:51                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-11-01 07:25:52  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     x.cnt.my        DNS.  
                        2015-11-01 07:25:54                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-11-01 07:26:03  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     ib.anycast.adnxs.com        DNS.  
                        2015-11-01 07:26:43                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 07:28:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 07:28:39  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-01 07:28:39  LOCAL SERVICE                   Microsoft-Windows-Time-Service  35:          time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->191.233.81.105:123).  
                        2015-11-01 07:28:40                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 07:28:40  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-01 07:28:40  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-01 07:28:42  LOCAL SERVICE                   Microsoft-Windows-Time-Service  37: NTP-         time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->191.233.81.105:123).  
                        2015-11-01 07:29:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 07:30:54                                  Service Control Manager         7036:  "   "    .  
                          2015-11-01 07:31:36  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     kupinatao.com        DNS.  
                        2015-11-01 07:31:41                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-01 07:31:42                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-01 07:31:42                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                            2015-11-01 07:31:46                                  ipnathlp                        
                        2015-11-01 07:31:47                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-11-01 07:31:48  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                          2015-11-01 07:31:50  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     kupinatao.com        DNS.  
                        2015-11-01 07:34:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 07:35:57                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-01 07:38:43                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-01 07:38:44                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-01 07:38:44                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-11-01 07:38:49  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     g-search3.alicdn.com        DNS.  
                        2015-11-01 07:39:47                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-11-01 07:40:48  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     cityads.ru        DNS.  
                          2015-11-01 07:50:37  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     aldcdn.tmall.com        DNS.  
                        2015-11-01 07:59:23                                  Service Control Manager         7036:  "  "    .  
                          2015-11-01 08:09:36  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     1234.my6cduffll8cavbt70amyfxw.451892048.cmos.greencompute.org        DNS.  
                          2015-11-01 08:14:01  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     hdc1.alicdn.com        DNS.  
                          2015-11-01 08:15:59  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.1688.com.danuoyi.tbcache.com        DNS.  
                        2015-11-01 08:17:24                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-01 08:17:25                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-01 08:17:25                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-11-01 08:29:50                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-11-01 08:29:56                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-11-01 08:35:21                                  nvlddmkm                        
                        2015-11-01 08:35:21                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-01 08:35:22                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-01 08:35:25                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 08:35:36  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-10-31T23:29:50.846101500Z      : 2015-10-31T23:35:22.030273400Z     : 4 USB   
                          2015-11-01 08:35:36  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-11-01 08:40:16  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                        2015-11-01 08:40:17                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-11-01 08:41:23  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.odnoklassniki.ru        DNS.  
                        2015-11-01 08:42:03                                  Service Control Manager         7036:  "  "    .  
                          2015-11-01 08:42:08  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     img.alicdn.com        DNS.  
                        2015-11-01 08:55:05                                  Service Control Manager         7036:  "   "    .  
                          2015-11-01 08:59:15  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     gtms04.alicdn.com.danuoyi.alicdn.com        DNS.  
                        2015-11-01 09:05:05                                  Service Control Manager         7036:  "   "    .  
                          2015-11-01 09:11:01  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     ai.taobao.com        DNS.  
                        2015-11-01 09:22:31  sima                            USER32                          1074:  Explorer.EXE   ""   VLADIMIR    vladimir\sima  :  ()     : 0x0     :     :   
                        2015-11-01 09:22:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:22:34                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 09:22:34                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:22:34  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   ""   VLADIMIR    vladimir\sima  :        : 0x500ff     :     :   
                1102       2015-11-01 09:22:34                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-01 09:22:35                                  EventLog                        6006:    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  ""    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "-"    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "     "    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-01 09:22:35                                  Service Control Manager         7036:  "Windows Search"    .  
                4          2015-11-01 09:22:35  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-01 09:22:35  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-01 09:22:35                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-01 09:22:35                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                103        2015-11-01 09:22:36                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-01 09:22:47                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-01 09:23:54                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-01 09:23:57                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-11-01 09:24:02                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-01 09:24:02                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-01 09:24:06                                  nvlddmkm                        
                        2015-11-01 09:24:07                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-01 09:24:07                                  Service Control Manager         7036:  ""    .  
                7010       2015-11-01 09:24:07                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-01 09:24:08                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-01 09:24:08                                  EventLog                        6005:    .  
                        2015-11-01 09:24:08                                  EventLog                        6013:    13 .  
                        2015-11-01 09:24:08                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-01 09:24:08                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-01 09:24:08                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-01 09:24:08                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 09:24:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:24:08                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-01 09:24:08                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-01 09:24:08                                  Service Control Manager         7036:  ""    .  
                        2015-11-01 09:24:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:24:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:24:08                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-01 09:24:08                                  Service Control Manager         7036:  "    "    .  
                        2015-11-01 09:24:08                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                        2015-11-01 09:24:09                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:24:09                                  Service Control Manager         7036:  "     "    .  
                        2015-11-01 09:24:09                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:24:10                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-01 09:24:10                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:24:10                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-01 09:24:10                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-01 09:24:10                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-01 09:24:10                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-01 09:24:10                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-01 09:24:10                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-01 09:24:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:24:10                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:24:10                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:24:10                                  Service Control Manager         7036:  "-"    .  
                        2015-11-01 09:24:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:24:10                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-01 09:24:10                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:24:10                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:24:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:24:10                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:24:10                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:24:10                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-01 09:24:10  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-01 09:24:10  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                            2015-11-01 09:24:11                                  Service Control Manager         7026:    ()    :   cdrom  
                        2015-11-01 09:24:11                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-01 09:24:11                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-01 09:24:11                                  Service Control Manager         7036:  ""    .  
                        2015-11-01 09:24:11                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-01 09:24:11                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:24:11                                  Service Control Manager         7036:  "    "    .  
                        2015-11-01 09:24:11                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 09:24:11                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-01 09:24:11                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-01 09:24:11                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:24:11                                  Service Control Manager         7036:  ""    .  
                        2015-11-01 09:24:11                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-01 09:24:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:24:11                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-01 09:24:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:24:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:24:11                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:24:11                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:24:11                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:24:11                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-01 09:24:12                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                1101       2015-11-01 09:24:12                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-01 09:24:13                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-01 09:24:14                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:24:15                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-01 09:24:19                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-01 09:24:28  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-01 09:24:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:24:31                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:24:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:24:31                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-01 09:24:31                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-01 09:24:31                                  Service Control Manager         7036:  ""    .  
                        2015-11-01 09:24:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:24:31                                  Service Control Manager         7036:  "-"    .  
                        2015-11-01 09:24:31  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-01 09:24:31                           Microsoft-Windows-Winlogon      7002:           
                4          2015-11-01 09:24:31  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-01 09:24:31  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                        2015-11-01 09:24:32                                  EventLog                        6006:    .  
                        2015-11-01 09:24:32                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-01 09:24:32                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-01 09:24:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:24:32                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-01 09:24:32                                  Service Control Manager         7036:  "     "    .  
                        2015-11-01 09:24:32                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:24:32                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-01 09:24:32                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:24:32                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-01 09:24:32                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-01 09:24:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:24:32                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:24:32                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 09:24:32                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-01 09:24:32                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 09:24:32                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-01 09:24:32                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-01 09:24:32                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-01 09:24:32                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-01 09:24:32                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                103        2015-11-01 09:24:32                                  Microsoft-Windows-Kernel-Power  109:      .  
                7010       2015-11-01 09:24:32                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-01 09:24:32                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-01 09:24:35                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-01 09:25:18                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-01 09:25:21                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-11-01 09:25:25                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-01 09:25:25                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-01 09:26:07                                  cdrom                           15:    \Device\CdRom0  .  
                            2015-11-01 09:26:09                                  nvlddmkm                        
                        2015-11-01 09:26:09                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-01 09:26:09                                  Service Control Manager         7036:  ""    .  
                        2015-11-01 09:26:09                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-01 09:26:09                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-11-01 09:26:09                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-01 09:26:10                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-01 09:26:10                                  EventLog                        6005:    .  
                        2015-11-01 09:26:10                                  EventLog                        6013:    51 .  
                        2015-11-01 09:26:10                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-01 09:26:10                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-01 09:26:10                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 09:26:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:26:10                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-01 09:26:10                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-01 09:26:10                                  Service Control Manager         7036:  ""    .  
                        2015-11-01 09:26:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:26:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:26:10                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:26:10                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-01 09:26:10                                  Service Control Manager         7036:  "    "    .  
                        2015-11-01 09:26:10                                  Service Control Manager         7036:  "     "    .  
                        2015-11-01 09:26:10                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  "-"    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  "    "    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  ""    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:26:11                                  Service Control Manager         7036:  ""    .  
                        2015-11-01 09:26:11                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-11-01 09:26:11                           Microsoft-Windows-Winlogon      7001:           
                4          2015-11-01 09:26:11  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-01 09:26:11  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                            2015-11-01 09:26:12                                  Service Control Manager         7026:    ()    :   cdrom  
                        2015-11-01 09:26:12                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-01 09:26:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:26:12                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-01 09:26:12                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-01 09:26:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:26:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:26:12                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:26:12                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:26:12                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:26:12                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:26:13                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-01 09:26:13                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-01 09:26:13                                  Service Control Manager         7036:  "  PNP-"    .  
                7005       2015-11-01 09:26:14                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0001   : 0.  
                        2015-11-01 09:26:19                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-01 09:28:12                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-01 09:28:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:28:12                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-01 09:28:12                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:28:13                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:28:14                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 09:30:16                                  Service Control Manager         7036:  "    "    .  
                        2015-11-01 09:30:16                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-01 09:30:16                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-01 09:30:25                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-01 09:30:52                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:33:14                                  Service Control Manager         7036:  "  "    .  
                7005       2015-11-01 09:33:38                           Microsoft-Windows-UserPnp       20003:       HidUsb      USB\VID_044F&PID_B323\5&20753C85&0&1   : 0.  
                7005       2015-11-01 09:33:38                           Microsoft-Windows-UserPnp       20001:       FileRepository\input.inf_x86_neutral_9e1eba5724be176f\input.inf      USB\VID_044F&PID_B323\5&20753C85&0&1   : 0x0.  
                7005       2015-11-01 09:33:39                           Microsoft-Windows-UserPnp       20001:       FileRepository\input.inf_x86_neutral_9e1eba5724be176f\input.inf      HID\VID_044F&PID_B323\6&1B00D6CD&0&0000   : 0x0.  
                        2015-11-01 09:34:07  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-01 09:34:07                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-01 09:34:08                                  EventLog                        6006:    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  ""    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "-"    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "     "    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-01 09:34:08                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                4          2015-11-01 09:34:08  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-01 09:34:08  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-01 09:34:08                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-01 09:34:08                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-01 09:34:09                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-01 09:34:09                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-01 09:34:11                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-01 16:13:20                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-01 16:13:23                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-11-01 16:13:28                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-01 16:13:28                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-01 16:14:42                                  nvlddmkm                        
                        2015-11-01 16:14:43                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-01 16:14:43                                  EventLog                        6005:    .  
                        2015-11-01 16:14:43                                  EventLog                        6013:    82 .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  ""    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  ""    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "    "    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "     "    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-01 16:14:43                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-01 16:14:43                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                4          2015-11-01 16:14:43  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-01 16:14:43  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                7010       2015-11-01 16:14:43                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-01 16:14:44                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-01 16:14:44                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 16:14:44                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 16:14:44                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 16:14:44                                  Service Control Manager         7036:  "-"    .  
                        2015-11-01 16:14:44                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 16:14:44                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-01 16:14:44                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 16:14:44                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 16:14:44                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 16:14:44                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 16:14:44                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-01 16:14:44                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-01 16:14:44                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-01 16:14:44                                  Service Control Manager         7036:  ""    .  
                        2015-11-01 16:14:44                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 16:14:44                                  Service Control Manager         7036:  "    "    .  
                        2015-11-01 16:14:44                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 16:14:44                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 16:14:44                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-11-01 16:14:44                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-01 16:14:45                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-01 16:14:45                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-01 16:14:45                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 16:14:45                                  Service Control Manager         7036:  ""    .  
                        2015-11-01 16:14:46                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-01 16:14:46                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 16:14:46                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-01 16:14:46                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 16:14:46                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 16:14:46                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-01 16:14:46                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 16:14:46                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 16:14:46                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 16:14:46                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 16:14:46                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-01 16:14:46                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-01 16:14:46                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-01 16:14:52                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-01 16:14:52                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-01 16:16:46                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 16:16:46                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-01 16:16:46                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 16:16:46                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-01 16:16:47                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 16:16:48                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 16:16:52                                  Service Control Manager         7036:  "    "    .  
                        2015-11-01 16:16:52                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-01 16:17:11                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-01 16:20:02                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 16:21:48                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 16:22:02                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 16:22:20                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 16:22:44                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 16:22:46  LOCAL SERVICE                   Microsoft-Windows-Time-Service  37: NTP-         time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->23.102.23.44:123).  
                        2015-11-01 16:23:00                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 16:23:00  LOCAL SERVICE                   Microsoft-Windows-Time-Service  35:          time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->23.102.23.44:123).  
                        2015-11-01 16:23:00  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-01 16:24:20                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 16:25:18                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 16:29:45                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 16:31:29                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 16:39:09                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 16:41:31                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 16:46:22                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-01 16:49:10                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-11-01 16:49:12                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-11-01 20:09:20                                  nvlddmkm                        
                        2015-11-01 20:09:20                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-01 20:09:20                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 20:09:26                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-01 20:09:27                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-01 20:09:29                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-01 20:09:29                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-11-01 20:09:33  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     safebrowsing.google.com        DNS.  
                        2015-11-01 20:09:36  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-11-01T07:49:10.935101400Z      : 2015-11-01T11:09:21.239257800Z     : 4 USB   
                        2015-11-01 20:09:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 20:09:45                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 20:11:45                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 20:12:04  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-01 20:12:07  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-01 20:12:07                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 20:12:08                                  EventLog                        6006:    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  ""    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "-"    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "     "    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "   "    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  " "    .  
                        2015-11-01 20:12:08                                  Service Control Manager         7036:  "Superfetch"    .  
                4          2015-11-01 20:12:08  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-01 20:12:08  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-01 20:12:08                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-01 20:12:08                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-01 20:12:09                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-01 20:12:09                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-01 20:12:12                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-03 06:58:52                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-03 06:58:55                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-11-03 06:59:00                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-03 06:59:00                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-03 06:59:05                                  nvlddmkm                        
                        2015-11-03 06:59:05                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-03 06:59:05                                  EventLog                        6005:    .  
                        2015-11-03 06:59:05                                  EventLog                        6013:    13 .  
                        2015-11-03 06:59:05                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-03 06:59:05                                  Service Control Manager         7036:  ""    .  
                        2015-11-03 06:59:05                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-03 06:59:05                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-03 06:59:05                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-03 06:59:05                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-03 06:59:05                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 06:59:05                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-11-03 06:59:05                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-03 06:59:06                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-03 06:59:06                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-03 06:59:06                                  Service Control Manager         7036:  ""    .  
                        2015-11-03 06:59:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 06:59:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 06:59:06                                  Service Control Manager         7036:  " "    .  
                        2015-11-03 06:59:06                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-03 06:59:06                                  Service Control Manager         7036:  "    "    .  
                        2015-11-03 06:59:06                                  Service Control Manager         7036:  "     "    .  
                        2015-11-03 06:59:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-03 06:59:06                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-03 06:59:06                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-03 06:59:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-03 06:59:06                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-03 06:59:06                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-03 06:59:06                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-03 06:59:06                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-03 06:59:06                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-03 06:59:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 06:59:06                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-03 06:59:06  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-03 06:59:06  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                1101       2015-11-03 06:59:07                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-03 06:59:10                                  Service Control Manager         7036:  " "    .  
                        2015-11-03 06:59:10                                  Service Control Manager         7036:  " "    .  
                        2015-11-03 06:59:10                                  Service Control Manager         7036:  "-"    .  
                        2015-11-03 06:59:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 06:59:10                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-03 06:59:10                                  Service Control Manager         7036:  " "    .  
                        2015-11-03 06:59:10                                  Service Control Manager         7036:  " "    .  
                        2015-11-03 06:59:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 06:59:11                                  Service Control Manager         7036:  " "    .  
                        2015-11-03 06:59:11                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-03 06:59:11                                  Service Control Manager         7036:  "    "    .  
                        2015-11-03 06:59:11                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-03 06:59:11                                  Service Control Manager         7036:  ""    .  
                        2015-11-03 06:59:11                                  Service Control Manager         7036:  "   "    .  
                        2015-11-03 06:59:11                                  Service Control Manager         7036:  " "    .  
                        2015-11-03 06:59:11                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-03 06:59:11                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-03 06:59:11                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-03 06:59:11                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-03 06:59:11                                  Service Control Manager         7036:  "   "    .  
                        2015-11-03 06:59:11                                  Service Control Manager         7036:  ""    .  
                        2015-11-03 06:59:11                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-03 06:59:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 06:59:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 06:59:11                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-03 06:59:12                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-03 06:59:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 06:59:12                                  Service Control Manager         7036:  "   "    .  
                        2015-11-03 06:59:12                                  Service Control Manager         7036:  "   "    .  
                        2015-11-03 06:59:12                                  Service Control Manager         7036:  "   "    .  
                        2015-11-03 06:59:12                                  Service Control Manager         7036:  " "    .  
                        2015-11-03 06:59:12                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-03 06:59:12                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-03 06:59:12                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-03 06:59:13                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-03 06:59:19                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-03 06:59:34                                  Service Control Manager         7036:  "    "    .  
                        2015-11-03 06:59:34                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-03 06:59:47                                  Service Control Manager         7036:  " "    .  
                        2015-11-03 06:59:47                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-03 06:59:53                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-03 07:00:52                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-03 07:01:12                                  Service Control Manager         7036:  "   "    .  
                        2015-11-03 07:01:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 07:01:12                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-03 07:01:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 07:01:14                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-03 07:02:11                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-03 07:02:13  LOCAL SERVICE                   Microsoft-Windows-Time-Service  37: NTP-         time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->23.102.23.44:123).  
                        2015-11-03 07:02:23                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-03 07:02:23  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-03 07:02:23  LOCAL SERVICE                   Microsoft-Windows-Time-Service  35:          time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->23.102.23.44:123).  
                        2015-11-03 07:02:23  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-03 07:02:23  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-03 07:02:48                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-03 07:06:09                                  Service Control Manager         7036:  "  "    .  
                          2015-11-03 07:06:43  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     wide-docs.l.google.com        DNS.  
                        2015-11-03 07:06:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 07:08:44                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 07:13:05  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-03 07:13:07                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-03 07:13:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 07:13:07  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-03 07:13:07                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-03 07:13:08                                  EventLog                        6006:    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  " "    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  ""    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "-"    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "     "    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "   "    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "   "    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  " "    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-03 07:13:08                                  Service Control Manager         7036:  "  WLAN"    .  
                4          2015-11-03 07:13:08  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-03 07:13:08  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-03 07:13:08                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-03 07:13:08                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                103        2015-11-03 07:13:09                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-03 07:13:11                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-03 22:21:13                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-03 22:21:16                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-11-03 22:21:21                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-03 22:21:21                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-03 22:21:25                                  nvlddmkm                        
                        2015-11-03 22:21:25                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-03 22:21:25                                  EventLog                        6005:    .  
                        2015-11-03 22:21:25                                  EventLog                        6013:    12 .  
                        2015-11-03 22:21:25                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-03 22:21:25                                  Service Control Manager         7036:  ""    .  
                        2015-11-03 22:21:25                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-03 22:21:25                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-03 22:21:25                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-03 22:21:25                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-03 22:21:25                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 22:21:25                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-11-03 22:21:25                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-03 22:21:26                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-03 22:21:26                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-03 22:21:26                                  Service Control Manager         7036:  ""    .  
                        2015-11-03 22:21:26                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 22:21:26                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 22:21:26                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-03 22:21:26                                  Service Control Manager         7036:  " "    .  
                        2015-11-03 22:21:26                                  Service Control Manager         7036:  "    "    .  
                        2015-11-03 22:21:26                                  Service Control Manager         7036:  "     "    .  
                        2015-11-03 22:21:26                                  Service Control Manager         7036:  "   "    .  
                        2015-11-03 22:21:26                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-03 22:21:26                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-03 22:21:26                                  Service Control Manager         7036:  "   "    .  
                        2015-11-03 22:21:26                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-03 22:21:26                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-03 22:21:26                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-03 22:21:26                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-03 22:21:26                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-03 22:21:26                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 22:21:26                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-03 22:21:26  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-03 22:21:26  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-03 22:21:27                                  Service Control Manager         7036:  " "    .  
                        2015-11-03 22:21:27                                  Service Control Manager         7036:  " "    .  
                1101       2015-11-03 22:21:27                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-03 22:21:28                                  Service Control Manager         7036:  "-"    .  
                        2015-11-03 22:21:28                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 22:21:29                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-03 22:21:31                                  Service Control Manager         7036:  " "    .  
                        2015-11-03 22:21:31                                  Service Control Manager         7036:  " "    .  
                        2015-11-03 22:21:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 22:21:31                                  Service Control Manager         7036:  " "    .  
                        2015-11-03 22:21:31                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-03 22:21:31                                  Service Control Manager         7036:  " "    .  
                        2015-11-03 22:21:31                                  Service Control Manager         7036:  "    "    .  
                        2015-11-03 22:21:31                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-03 22:21:31                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-03 22:21:31                                  Service Control Manager         7036:  ""    .  
                        2015-11-03 22:21:31                                  Service Control Manager         7036:  "   "    .  
                        2015-11-03 22:21:31                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-03 22:21:31                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-03 22:21:31                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-03 22:21:31                                  Service Control Manager         7036:  ""    .  
                        2015-11-03 22:21:32                                  Service Control Manager         7036:  "   "    .  
                        2015-11-03 22:21:32                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-03 22:21:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 22:21:32                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-03 22:21:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 22:21:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 22:21:32                                  Service Control Manager         7036:  " "    .  
                        2015-11-03 22:21:32                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-03 22:21:32                                  Service Control Manager         7036:  "   "    .  
                        2015-11-03 22:21:32                                  Service Control Manager         7036:  "   "    .  
                        2015-11-03 22:21:32                                  Service Control Manager         7036:  "   "    .  
                        2015-11-03 22:21:32                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-03 22:21:34                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-03 22:21:34                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-03 22:21:41                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-03 22:22:09                                  Service Control Manager         7036:  "    "    .  
                        2015-11-03 22:22:09                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-03 22:23:32                                  Service Control Manager         7036:  "   "    .  
                        2015-11-03 22:23:32                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-03 22:23:33                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 22:23:33                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-03 22:23:33                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 22:23:35                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-03 22:28:35                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 22:34:00                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-03 22:34:01                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-03 22:36:00                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-03 22:58:34                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 22:59:02                                  Service Control Manager         7036:  "   "    .  
                        2015-11-03 23:01:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-03 23:04:35                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-11-03 23:04:36                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-11-04 00:07:55                                  nvlddmkm                        
                        2015-11-04 00:07:55                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-04 00:07:59                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 00:08:01                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-04 00:08:10  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-11-03T14:04:33.778320300Z      : 2015-11-03T15:07:56.046875000Z     : 4 USB   
                        2015-11-04 00:08:48                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 00:42:05                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 00:42:53                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 00:47:18                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-11-04 00:47:20                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-11-04 01:05:31                                  nvlddmkm                        
                        2015-11-04 01:05:31                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-04 01:05:36                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 01:05:37                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-04 01:05:46  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-11-03T15:47:18.785156300Z      : 2015-11-03T16:05:32.025390700Z     : 4 USB   
                        2015-11-04 01:06:45                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-11-04 01:07:41  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mdskip.taobao.com.danuoyi.tbcache.com        DNS.  
                        2015-11-04 01:10:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 01:23:15                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-11-04 02:07:56  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     pass.tmall.com        DNS.  
                          2015-11-04 02:25:57  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     prf.audiencemanager.de        DNS.  
                        2015-11-04 02:38:25                                  Service Control Manager         7036:  "   "    .  
                          2015-11-04 02:40:35  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     ecpm.tanx.com        DNS.  
                        2015-11-04 02:44:19                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                          2015-11-04 02:44:19  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.kupinatao.com        DNS.  
                        2015-11-04 02:44:20                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-04 02:44:20                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-11-04 02:44:51                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-11-04 02:45:34  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     s.taobao.com        DNS.  
                        2015-11-04 02:46:56                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:46:56  sima                            USER32                          1074:  Explorer.EXE   ""   VLADIMIR    vladimir\sima  :  ()     : 0x0     :     :   
                        2015-11-04 02:46:59                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-04 02:46:59                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:46:59                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 02:46:59                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-04 02:46:59                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-04 02:46:59                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-04 02:46:59                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-04 02:46:59                                  Service Control Manager         7036:  ""    .  
                        2015-11-04 02:46:59                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:46:59  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   ""   VLADIMIR    vladimir\sima  :        : 0x500ff     :     :   
                1102       2015-11-04 02:46:59                           Microsoft-Windows-Winlogon      7002:           
                4          2015-11-04 02:46:59  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-04 02:46:59  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-04 02:46:59                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-11-04 02:47:00                                  EventLog                        6006:    .  
                        2015-11-04 02:47:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:47:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:47:00                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-04 02:47:00                                  Service Control Manager         7036:  "     "    .  
                        2015-11-04 02:47:00                                  Service Control Manager         7036:  "-"    .  
                        2015-11-04 02:47:00                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 02:47:00                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-04 02:47:00                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-04 02:47:00                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-04 02:47:00                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-04 02:47:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:47:00                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-04 02:47:00                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 02:47:00                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-04 02:47:00                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-04 02:47:00                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-04 02:47:00                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-04 02:47:00                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-04 02:47:01                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-04 02:47:01                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 02:47:01                                  Service Control Manager         7036:  " Windows"    .  
                          2015-11-04 02:47:01                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-04 02:47:02                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-04 02:47:02                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-04 02:47:14                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-04 02:47:44                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-04 02:47:47                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-11-04 02:47:52                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-04 02:47:52                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                101        2015-11-04 02:47:55                           Microsoft-Windows-DriverFrameworks-UserMode  10114:         ,       WUDFPf.       ,   Windows    .  
                  212        2015-11-04 02:47:55                           Microsoft-Windows-Kernel-PnP    219: 
                            2015-11-04 02:47:56                                  nvlddmkm                        
                        2015-11-04 02:47:56                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-04 02:47:56                                  Service Control Manager         7036:  ""    .  
                7010       2015-11-04 02:47:56                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-04 02:47:57                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-04 02:47:57                                  EventLog                        6005:    .  
                        2015-11-04 02:47:57                                  EventLog                        6013:    12 .  
                        2015-11-04 02:47:57                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-04 02:47:57                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-04 02:47:57                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-04 02:47:57                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-04 02:47:57                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:47:57                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-04 02:47:57                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-04 02:47:57                                  Service Control Manager         7036:  ""    .  
                        2015-11-04 02:47:57                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:47:57                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:47:57                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 02:47:57                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-04 02:47:57                                  Service Control Manager         7036:  "    "    .  
                        2015-11-04 02:47:57                                  Service Control Manager         7036:  "     "    .  
                        2015-11-04 02:47:57                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 02:47:57                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                1101       2015-11-04 02:47:58                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-04 02:48:02                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-04 02:48:02                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 02:48:02                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-04 02:48:02                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-04 02:48:02                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-04 02:48:02                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-04 02:48:02                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-04 02:48:02                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-04 02:48:02                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:48:02                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 02:48:02                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 02:48:02                                  Service Control Manager         7036:  "-"    .  
                        2015-11-04 02:48:02                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:48:02                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-04 02:48:02  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-04 02:48:02  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  ""    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  "    "    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  ""    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:48:03                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 02:48:04                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 02:48:04                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 02:48:04                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-04 02:48:04                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-04 02:48:05                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-04 02:48:05                                  Service Control Manager         7036:  "  PNP-"    .  
                7005       2015-11-04 02:48:10                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-11-04 02:48:14                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-04 02:49:07                                  Service Control Manager         7036:  "    "    .  
                        2015-11-04 02:49:07                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-04 02:49:10                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-04 02:50:04                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 02:50:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:50:06                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-04 02:50:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:50:10                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-04 02:53:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:55:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:55:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:55:49  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-04 02:55:51  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-04 02:55:51                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-04 02:55:52                                  EventLog                        6006:    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  ""    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "-"    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "     "    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-04 02:55:52                                  Service Control Manager         7036:  "Superfetch"    .  
                4          2015-11-04 02:55:52  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-04 02:55:52  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-04 02:55:52                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-11-04 02:55:53                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-04 02:55:53                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-04 02:55:53                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-11-04 02:55:53                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-04 02:55:57                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-04 21:10:25                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-04 21:10:28                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-11-04 21:10:33                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-04 21:10:33                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-04 21:10:36                                  nvlddmkm                        
                        2015-11-04 21:10:36                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-04 21:10:36                                  Service Control Manager         7036:  ""    .  
                        2015-11-04 21:10:36                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-04 21:10:36                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-04 21:10:36                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-11-04 21:10:36                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-04 21:10:37                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-04 21:10:37                                  EventLog                        6005:    .  
                        2015-11-04 21:10:37                                  EventLog                        6013:    11 .  
                        2015-11-04 21:10:37                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-04 21:10:37                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-04 21:10:37                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 21:10:37                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-04 21:10:37                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-04 21:10:37                                  Service Control Manager         7036:  ""    .  
                        2015-11-04 21:10:37                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 21:10:37                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 21:10:37                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 21:10:37                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-04 21:10:37                                  Service Control Manager         7036:  "    "    .  
                        2015-11-04 21:10:37                                  Service Control Manager         7036:  "     "    .  
                        2015-11-04 21:10:37                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 21:10:37                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-04 21:10:37                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 21:10:37                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-04 21:10:37                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-04 21:10:37                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-04 21:10:38                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-04 21:10:38                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-04 21:10:38                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-04 21:10:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 21:10:38                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 21:10:38                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 21:10:38                                  Service Control Manager         7036:  "-"    .  
                        2015-11-04 21:10:38                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-11-04 21:10:38                           Microsoft-Windows-Winlogon      7001:           
                4          2015-11-04 21:10:38  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-04 21:10:38  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-04 21:10:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 21:10:39                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-04 21:10:40                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 21:10:40                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 21:10:40                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 21:10:40                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-04 21:10:40                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 21:10:40                                  Service Control Manager         7036:  "    "    .  
                        2015-11-04 21:10:40                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-04 21:10:40                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 21:10:40                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 21:10:40                                  Service Control Manager         7036:  ""    .  
                        2015-11-04 21:10:40                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-04 21:10:42                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-04 21:10:42                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-04 21:10:42                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-04 21:10:42                                  Service Control Manager         7036:  ""    .  
                        2015-11-04 21:10:42                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 21:10:42                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-04 21:10:42                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 21:10:42                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-04 21:10:42                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-04 21:10:42                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 21:10:42                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 21:10:42                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 21:10:42                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 21:10:42                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 21:10:42                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 21:10:43                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-04 21:10:43                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-04 21:10:43                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-04 21:10:49                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-04 21:12:42                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 21:12:42                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-04 21:12:43                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 21:12:43                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-04 21:12:43                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 21:12:45                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-04 21:15:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 21:17:45                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 21:17:54                                  Service Control Manager         7036:  "    "    .  
                        2015-11-04 21:17:54                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-04 21:18:17                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-04 21:18:24                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 21:20:44                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-11-04 21:20:44                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                          2015-11-04 21:20:57  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-11-04 21:24:23  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-11-04 21:24:26                                  Service Control Manager         7036:  "  "    .  
                          2015-11-04 21:26:46  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.simplemachines.org        DNS.  
                        2015-11-04 21:29:44                                  Service Control Manager         7036:  "  "    .  
                          2015-11-04 21:30:57  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     r7---sn-4g57kue6.googlevideo.com        DNS.  
                        2015-11-04 21:34:44                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 21:35:42                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 21:36:46                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 21:45:19                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 21:50:40                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 21:50:43                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 21:51:01                                  Service Control Manager         7036:  " "    .  
                          2015-11-04 21:54:11  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     a1005.dspw42.akamai.net        DNS.  
                          2015-11-04 21:57:58  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     yastatic.net        DNS.  
                        2015-11-04 22:02:34                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 22:10:48                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 22:26:44                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-04 22:40:01                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-11-04 22:40:02                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-11-04 22:43:42                                  nvlddmkm                        
                        2015-11-04 22:43:42                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-04 22:43:42                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 22:43:46                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 22:43:47                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-04 22:43:52                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-04 22:43:57  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-11-04T13:40:00.860351500Z      : 2015-11-04T13:43:43.001953100Z     : 4 USB   
                        2015-11-04 22:44:41  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-04 22:44:43                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-04 22:44:43                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 22:44:43  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-04 22:44:43                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-04 22:44:44                                  EventLog                        6006:    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  ""    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "-"    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "     "    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "   "    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "  "    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  " "    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-04 22:44:44                                  Service Control Manager         7036:  "  WLAN"    .  
                4          2015-11-04 22:44:44  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-04 22:44:44  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-04 22:44:44                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-04 22:44:44                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                103        2015-11-04 22:44:45                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-04 22:44:47                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-05 07:25:21                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-05 07:25:24                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-11-05 07:25:29                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-05 07:25:29                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-05 07:25:32                                  nvlddmkm                        
                        2015-11-05 07:25:32                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-05 07:25:32                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 07:25:32                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-05 07:25:32                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-11-05 07:25:32                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-05 07:25:33                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-05 07:25:33                                  EventLog                        6005:    .  
                        2015-11-05 07:25:33                                  EventLog                        6013:    11 .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  "    "    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  "     "    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-05 07:25:33                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-05 07:25:33                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-05 07:25:33  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-05 07:25:33  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-05 07:25:34                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 07:25:34                                  Service Control Manager         7036:  " "    .  
                1101       2015-11-05 07:25:34                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-05 07:25:35                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 07:25:35                                  Service Control Manager         7036:  "-"    .  
                        2015-11-05 07:25:35                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 07:25:35                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-05 07:25:35                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 07:25:35                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 07:25:35                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 07:25:35                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 07:25:36                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-05 07:25:36                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-05 07:25:36                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 07:25:36                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-05 07:25:36                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 07:25:36                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-05 07:25:36                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 07:25:36                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-05 07:25:37                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 07:25:37                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 07:25:37                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 07:25:37                                  Service Control Manager         7036:  "    "    .  
                        2015-11-05 07:25:40                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-05 07:25:41                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-05 07:25:41                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 07:25:41                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 07:25:41                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 07:25:41                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 07:25:41                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-05 07:25:41                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 07:25:41                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 07:25:41                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 07:25:41                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-05 07:25:41                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-05 07:25:41                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-05 07:25:43                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-11-05 07:25:48                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-11-05 07:25:49                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-05 07:27:40                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-05 07:27:40                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 07:27:41                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-05 07:27:41                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 07:27:41                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 07:27:43                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 07:30:48                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 07:32:42                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 07:35:41                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-11-05 07:35:44                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-11-05 07:36:34                                  nvlddmkm                        
                        2015-11-05 07:36:34                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-05 07:36:34                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-05 07:36:34                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 07:36:35                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-05 07:36:35                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-05 07:36:35                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-11-05 07:36:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 07:36:39                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-05 07:36:43  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-05 07:36:45  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-05 07:36:45                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 07:36:46                                  EventLog                        6006:    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "-"    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "     "    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-05 07:36:46                                  Service Control Manager         7036:  "Superfetch"    .  
                4          2015-11-05 07:36:46  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-05 07:36:46  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-05 07:36:46                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-11-05 07:36:47                                  Service Control Manager         7036:  "  WLAN"    .  
                          2015-11-05 07:36:47                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-05 07:36:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 07:36:49  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-11-04T22:35:41.910156200Z      : 2015-11-04T22:36:35.013671900Z     : 0  
                103        2015-11-05 07:36:49                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-05 07:36:51                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-05 09:19:50                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-05 09:19:53                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-11-05 09:19:57                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-05 09:19:57                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-05 09:20:01                                  nvlddmkm                        
                        2015-11-05 09:20:02                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-05 09:20:02                                  EventLog                        6005:    .  
                        2015-11-05 09:20:02                                  EventLog                        6013:    11 .  
                        2015-11-05 09:20:02                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-05 09:20:02                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 09:20:02                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-05 09:20:02                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-05 09:20:02                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-05 09:20:02                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 09:20:02                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 09:20:02                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-05 09:20:02                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-05 09:20:02                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 09:20:02                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 09:20:02                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 09:20:02                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 09:20:02                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-11-05 09:20:02                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-05 09:20:03                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-05 09:20:03                                  Service Control Manager         7036:  "    "    .  
                        2015-11-05 09:20:03                                  Service Control Manager         7036:  "     "    .  
                        2015-11-05 09:20:03                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 09:20:03                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-05 09:20:03                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 09:20:03                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-05 09:20:03                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-05 09:20:03                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-05 09:20:03                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-05 09:20:03                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-05 09:20:03                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-05 09:20:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 09:20:03                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 09:20:03                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 09:20:03                                  Service Control Manager         7036:  "-"    .  
                        2015-11-05 09:20:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 09:20:03                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-05 09:20:03                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 09:20:03                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-11-05 09:20:03                           Microsoft-Windows-Winlogon      7001:           
                4          2015-11-05 09:20:03  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-05 09:20:03  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-05 09:20:04                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 09:20:04                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 09:20:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 09:20:04                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 09:20:05                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-05 09:20:05                                  Service Control Manager         7036:  "    "    .  
                        2015-11-05 09:20:05                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-05 09:20:05                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 09:20:05                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-05 09:20:05                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-05 09:20:05                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 09:20:05                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 09:20:06                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-05 09:20:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 09:20:06                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 09:20:06                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-05 09:20:07                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-05 09:20:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 09:20:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 09:20:07                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-05 09:20:07                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 09:20:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 09:20:07                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 09:20:07                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-05 09:20:07                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-05 09:20:07                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 09:20:07                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 09:20:07                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-05 09:20:09                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-11-05 09:20:13                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-11-05 09:20:16                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-05 09:20:40                                  Service Control Manager         7036:  "    "    .  
                        2015-11-05 09:20:40                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-05 09:20:41                                  Service Control Manager         7036:  "   Windows"    .  
                          2015-11-05 09:20:52  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     d2o47bxgqzkcc3.cloudfront.net        DNS.  
                        2015-11-05 09:22:07                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 09:22:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 09:22:08                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-05 09:22:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 09:22:12                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 09:25:15                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 09:27:12                                  Service Control Manager         7036:  "  "    .  
                          2015-11-05 09:28:24  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                        2015-11-05 09:30:11                                  Service Control Manager         7036:  "   "    .  
                          2015-11-05 09:30:11  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     client-s.gateway.messenger.live.com        DNS.  
                        2015-11-05 09:36:39                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-11-05 09:39:32  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                          2015-11-05 09:40:12  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     img04.taobaocdn.com        DNS.  
                          2015-11-05 09:46:00  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     client-s.gateway.messenger.live.com        DNS.  
                        2015-11-05 09:46:03                           Microsoft-Windows-Application-Experience  206:          .  
                          2015-11-05 09:50:15  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                          2015-11-05 09:57:22  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                        2015-11-05 09:59:01                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 10:00:04                                  Service Control Manager         7036:  "  "    .  
                          2015-11-05 10:00:14  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     gtms01.alicdn.com        DNS.  
                        2015-11-05 10:00:18                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-11-05 10:08:45  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mai.taobao.com        DNS.  
                        2015-11-05 10:09:01                                  Service Control Manager         7036:  "   "    .  
                          2015-11-05 10:10:26  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     client-s.gateway.messenger.live.com        DNS.  
                          2015-11-05 10:15:33  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     s.click.taobao.com        DNS.  
                        2015-11-05 10:16:48                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-11-05 10:20:34  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     client-s.gateway.messenger.live.com        DNS.  
                          2015-11-05 10:29:09  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     a.tbcdn.cn        DNS.  
                          2015-11-05 10:30:34  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.ttpod.com        DNS.  
                        2015-11-05 10:31:56                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-05 10:31:57                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-05 10:31:57                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-11-05 10:32:06  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                        2015-11-05 10:39:55                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                            2015-11-05 10:39:56                                  ipnathlp                        
                          2015-11-05 10:40:08  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     1234.my6cduffll8cavbt70amyfxw.1424905040.cmos.greencompute.org        DNS.  
                          2015-11-05 10:45:58  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                          2015-11-05 10:50:16  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     img.alicdn.com        DNS.  
                          2015-11-05 10:58:15  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     kupinatao.com        DNS.  
                          2015-11-05 11:00:29  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                        2015-11-05 11:03:20                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 11:03:20  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 11:03:23                                  EventLog                        6006:    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  "-"    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  "     "    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 11:03:23                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 11:03:23  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-05 11:03:23                           Microsoft-Windows-Winlogon      7002:           
                4          2015-11-05 11:03:23  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-05 11:03:23  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-05 11:03:23                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-11-05 11:03:24                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-05 11:03:24                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-05 11:03:24                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 11:03:24                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-05 11:03:24                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-05 11:03:24                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-05 11:03:24                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-05 11:03:24                                  Service Control Manager         7036:  "Windows Search"    .  
                          2015-11-05 11:03:24                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                103        2015-11-05 11:03:25                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-05 11:03:36                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-05 12:50:53                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-05 12:50:56                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-11-05 12:51:01                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-05 12:51:01                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-05 12:51:05                                  nvlddmkm                        
                        2015-11-05 12:51:05                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-05 12:51:05                                  EventLog                        6005:    .  
                        2015-11-05 12:51:05                                  EventLog                        6013:    12 .  
                        2015-11-05 12:51:05                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-05 12:51:05                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 12:51:05                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-05 12:51:05                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-05 12:51:05                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-05 12:51:05                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 12:51:05                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 12:51:05                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-11-05 12:51:05                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-05 12:51:06                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-05 12:51:06                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-05 12:51:06                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 12:51:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 12:51:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 12:51:06                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 12:51:06                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-05 12:51:06                                  Service Control Manager         7036:  "    "    .  
                        2015-11-05 12:51:06                                  Service Control Manager         7036:  "     "    .  
                        2015-11-05 12:51:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 12:51:06                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-05 12:51:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 12:51:06                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-05 12:51:06                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-05 12:51:06                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-05 12:51:06                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-05 12:51:06                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-05 12:51:06                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-05 12:51:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 12:51:06                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-05 12:51:06  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-05 12:51:06  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-05 12:51:07                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 12:51:07                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 12:51:07                                  Service Control Manager         7036:  "-"    .  
                        2015-11-05 12:51:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 12:51:07                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-05 12:51:07                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 12:51:07                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 12:51:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 12:51:07                                  Service Control Manager         7036:  " "    .  
                1101       2015-11-05 12:51:07                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-05 12:51:09                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 12:51:09                                  Service Control Manager         7036:  "    "    .  
                        2015-11-05 12:51:09                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-05 12:51:09                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-05 12:51:09                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 12:51:09                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-05 12:51:09                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 12:51:09                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 12:51:09                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-05 12:51:10                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-05 12:51:10                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 12:51:10                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 12:51:11                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-05 12:51:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 12:51:11                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-05 12:51:11                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-05 12:51:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 12:51:11                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 12:51:11                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 12:51:11                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 12:51:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 12:51:11                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 12:51:11                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-05 12:51:11                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-05 12:51:12                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-05 12:51:17                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-11-05 12:51:17                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-11-05 12:51:18                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-05 12:52:08                                  Service Control Manager         7036:  "    "    .  
                        2015-11-05 12:52:08                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-05 12:52:10                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-05 12:53:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 12:53:11                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 12:53:11                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-05 12:53:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 12:53:13                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 12:56:19                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 12:58:13                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 13:00:59                                  EventLog                        6013:    605 .  
                        2015-11-05 13:01:15                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 13:07:47                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-05 13:31:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 13:31:36                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-05 13:31:38                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-05 13:31:38                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-11-05 13:31:45  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     client-s.gateway.messenger.live.com        DNS.  
                        2015-11-05 13:33:43                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                            2015-11-05 13:33:45                                  ipnathlp                        
                          2015-11-05 13:35:49  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-11-05 13:45:29                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-11-05 13:45:36                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-11-05 13:56:41                                  nvlddmkm                        
                        2015-11-05 13:56:41                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-05 13:56:42                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-05 13:56:46                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 13:56:48                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-05 13:56:51                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-11-05 13:56:54  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     go.trouter.io        DNS.  
                        2015-11-05 13:56:56  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-11-05T04:45:29.274414000Z      : 2015-11-05T04:56:42.061523400Z     : 4 USB   
                        2015-11-05 13:58:48                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-05 14:04:43                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:05:33                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:05:35                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 14:05:35  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-05 14:05:35                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-05 14:05:36                                  EventLog                        6006:    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "-"    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "     "    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-05 14:05:36                                  Service Control Manager         7036:  "Windows Search"    .  
                4          2015-11-05 14:05:36  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-05 14:05:36  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-05 14:05:36                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-11-05 14:05:37                                  Service Control Manager         7036:  "  WLAN"    .  
                103        2015-11-05 14:05:37                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-11-05 14:05:37                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-05 14:05:39                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-05 14:07:49                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-05 14:07:52                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-11-05 14:07:57                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-05 14:07:57                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-05 14:08:00                                  nvlddmkm                        
                        2015-11-05 14:08:00                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-05 14:08:00                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 14:08:00                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-05 14:08:00                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-11-05 14:08:00                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-05 14:08:01                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-05 14:08:01                                  EventLog                        6005:    .  
                        2015-11-05 14:08:01                                  EventLog                        6013:    11 .  
                        2015-11-05 14:08:01                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-05 14:08:01                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-05 14:08:01                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 14:08:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:08:01                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-05 14:08:01                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-05 14:08:01                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 14:08:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:08:01                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 14:08:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:08:01                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-05 14:08:01                                  Service Control Manager         7036:  "    "    .  
                        2015-11-05 14:08:01                                  Service Control Manager         7036:  "     "    .  
                        2015-11-05 14:08:01                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 14:08:02                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-05 14:08:02                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 14:08:02                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-05 14:08:02                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-05 14:08:02                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-05 14:08:02                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-05 14:08:02                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-05 14:08:02                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-05 14:08:02                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:08:02                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 14:08:02                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 14:08:02                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-05 14:08:02  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-05 14:08:02  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-05 14:08:03                                  Service Control Manager         7036:  "-"    .  
                        2015-11-05 14:08:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:08:03                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-05 14:08:03                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 14:08:03                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 14:08:03                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 14:08:03                                  Service Control Manager         7036:  "  "    .  
                1101       2015-11-05 14:08:03                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-05 14:08:05                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-05 14:08:05                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 14:08:05                                  Service Control Manager         7036:  "    "    .  
                        2015-11-05 14:08:05                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 14:08:05                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-05 14:08:05                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-05 14:08:05                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 14:08:05                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 14:08:06                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-05 14:08:06                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-05 14:08:06                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 14:08:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 14:08:07                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-05 14:08:07                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-05 14:08:07                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 14:08:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:08:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:08:07                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-05 14:08:07                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 14:08:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:08:08                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-05 14:08:08                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 14:08:08                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-05 14:08:08                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 14:08:08                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-05 14:08:08                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-11-05 14:08:12                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-11-05 14:08:14                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-05 14:08:40                                  Service Control Manager         7036:  "    "    .  
                        2015-11-05 14:08:40                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-05 14:08:42                                  Service Control Manager         7036:  "   Windows"    .  
                          2015-11-05 14:08:57  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     profile.accounts.firefox.com        DNS.  
                        2015-11-05 14:10:07                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 14:10:15                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:10:17                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-05 14:10:17                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:10:20                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 14:14:20                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:15:17                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:15:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:15:49  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-05 14:15:51  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-05 14:15:51                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-05 14:15:52                                  EventLog                        6006:    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "-"    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "     "    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-05 14:15:52                                  Service Control Manager         7036:  "Superfetch"    .  
                4          2015-11-05 14:15:52  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-05 14:15:52  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-05 14:15:52                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-11-05 14:15:53                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-05 14:15:53                                  Service Control Manager         7036:  "  WLAN"    .  
                103        2015-11-05 14:15:53                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-11-05 14:15:53                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-05 14:15:57                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-05 21:48:38                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-05 21:48:41                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-11-05 21:48:46                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-05 21:48:46                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-05 21:48:49                                  nvlddmkm                        
                        2015-11-05 21:48:49                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-05 21:48:49                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 21:48:49                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-05 21:48:49                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-11-05 21:48:49                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-05 21:48:50                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-05 21:48:50                                  EventLog                        6005:    .  
                        2015-11-05 21:48:50                                  EventLog                        6013:    11 .  
                        2015-11-05 21:48:50                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-05 21:48:50                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-05 21:48:50                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 21:48:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 21:48:50                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-05 21:48:50                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-05 21:48:50                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 21:48:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 21:48:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 21:48:50                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 21:48:50                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-05 21:48:50                                  Service Control Manager         7036:  "    "    .  
                        2015-11-05 21:48:50                                  Service Control Manager         7036:  "     "    .  
                        2015-11-05 21:48:50                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 21:48:50                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-05 21:48:51                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 21:48:51                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-05 21:48:51                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-05 21:48:51                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-05 21:48:51                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-05 21:48:51                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-05 21:48:51                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-05 21:48:51                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 21:48:51                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-05 21:48:51  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-05 21:48:51  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-05 21:48:52                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 21:48:52                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 21:48:52                                  Service Control Manager         7036:  "-"    .  
                        2015-11-05 21:48:52                                  Service Control Manager         7036:  "  "    .  
                1101       2015-11-05 21:48:52                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-05 21:48:53                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-05 21:48:53                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 21:48:53                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 21:48:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 21:48:54                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 21:48:54                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 21:48:54                                  Service Control Manager         7036:  "    "    .  
                        2015-11-05 21:48:54                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-05 21:48:54                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 21:48:54                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-05 21:48:54                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-05 21:48:55                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 21:48:55                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 21:48:55                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-05 21:48:55                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-05 21:48:56                                  Service Control Manager         7036:  ""    .  
                        2015-11-05 21:48:56                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 21:48:56                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-05 21:48:57                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-05 21:48:57                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 21:48:57                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-05 21:48:57                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 21:48:57                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 21:48:57                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 21:48:57                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 21:48:57                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-05 21:48:57                                  Service Control Manager         7036:  " "    .  
                        2015-11-05 21:48:57                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 21:48:57                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-05 21:48:57                                  Service Control Manager         7036:  "  IPsec"    .  
                7005       2015-11-05 21:49:04                           Microsoft-Windows-UserPnp       20003:       cdrom      IDE\CDROMHL-DT-ST_DVD-RAM_GH82N__________________KU02____\5&4248B16&0&1.0.0   : 0.  
                        2015-11-05 21:49:05                                  Service Control Manager         7036:  "Windows Search"    .  
                7005       2015-11-05 21:49:05                           Microsoft-Windows-UserPnp       20001:       FileRepository\cdrom.inf_x86_neutral_6381e09675524225\cdrom.inf      IDE\CDROMHL-DT-ST_DVD-RAM_GH82N__________________KU02____\5&4248B16&0&1.0.0   : 0x0.  
                        2015-11-05 21:50:29                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-05 21:50:30                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-05 21:50:31                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 21:50:57                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-05 21:50:57                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 21:50:58                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-05 21:50:58                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 21:50:59                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-05 21:51:05                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 21:51:12                                  Service Control Manager         7036:  "    "    .  
                        2015-11-05 21:51:12                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-05 21:51:22                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-05 21:55:59                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 21:59:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 22:02:24                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 22:04:58                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-11-05 22:05:01                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-11-05 23:15:12                                  nvlddmkm                        
                        2015-11-05 23:15:12                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-05 23:15:13                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-05 23:15:17                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 23:15:28  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-11-05T13:04:58.897460900Z      : 2015-11-05T14:15:13.060546900Z     : 4 USB   
                        2015-11-05 23:15:39                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-05 23:16:36                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 23:17:53                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-05 23:23:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 23:25:41                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 23:26:42                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 23:29:29                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 23:30:12                                  Service Control Manager         7036:  "  "    .  
                7005       2015-11-05 23:33:25                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-11-05 23:33:26                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-05 23:39:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 23:42:48                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 23:45:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 23:51:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-05 23:58:25                                  Service Control Manager         7036:  "   "    .  
                        2015-11-05 23:59:46                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-05 23:59:48                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-05 23:59:48                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-11-06 00:00:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-06 00:03:26                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-06 00:03:43                                  Service Control Manager         7036:  "  "    .  
                        2015-11-06 00:03:54                                  Service Control Manager         7036:  "   "    .  
                        2015-11-06 00:04:10                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-06 00:08:44                                  Service Control Manager         7036:  "  "    .  
                        2015-11-06 00:14:05                                  Service Control Manager         7036:  "   "    .  
                        2015-11-06 00:14:33                                  Service Control Manager         7036:  "   "    .  
                        2015-11-06 00:14:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-06 00:19:48                                  Service Control Manager         7036:  "  "    .  
                        2015-11-06 00:20:40                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-06 00:25:00                                  Service Control Manager         7036:  "   "    .  
                        2015-11-06 00:25:13                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-11-06 00:25:14                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-11-06 00:33:01                                  nvlddmkm                        
                        2015-11-06 00:33:01                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-06 00:33:05                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-06 00:33:07  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-11-05T15:25:13.899414100Z      : 2015-11-05T15:33:02.009765600Z     : 5    "\Microsoft\Windows\Media Center\mcupdate_scheduled",      .  
                          2015-11-06 00:33:15  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-11-06 00:36:31                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-06 00:36:38                                  Service Control Manager         7036:  "   "    .  
                        2015-11-06 00:36:39                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-06 00:36:49                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-06 00:37:39                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-06 00:43:13                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-11-06 00:43:14                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-11-06 02:28:16                                  nvlddmkm                        
                        2015-11-06 02:28:16                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-06 02:28:16                                  Service Control Manager         7036:  "   "    .  
                        2015-11-06 02:28:17                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-06 02:28:30                                  Service Control Manager         7036:  "  "    .  
                        2015-11-06 02:28:31                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-06 02:28:31  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-11-05T15:43:13.900390600Z      : 2015-11-05T17:28:17.054687500Z     : 4 USB   
                        2015-11-06 02:28:49                                  Service Control Manager         7036:  "   "    .  
                        2015-11-06 02:33:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-06 02:39:09                                  Service Control Manager         7036:  "   "    .  
                          2015-11-06 02:57:04  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     cdb29c7a3a9dea2f073b-52ae14416b947d19d947f392900a3d71.r1.cf3.rackcdn.com        DNS.  
                        2015-11-06 02:57:16                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                            2015-11-06 02:57:17                                  ipnathlp                        
                        2015-11-06 02:57:17                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-06 02:57:17                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-11-06 02:57:17  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                          2015-11-06 02:57:18  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     img03.taobaocdn.com        DNS.  
                        2015-11-06 02:57:19                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-11-06 03:19:30  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     hdc1.alicdn.com.danuoyi.alicdn.com        DNS.  
                        2015-11-06 03:19:43                                  Service Control Manager         7036:  "   "    .  
                        2015-11-06 03:28:37                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-06 03:28:43                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-06 03:29:37                                  Service Control Manager         7036:  "    (BITS)"    .  
                        2015-11-06 03:29:37                           Service Control Manager         7040:    "    (BITS)"    ""  "".  
                        2015-11-06 03:29:43                                  Service Control Manager         7036:  "   "    .  
                        2015-11-06 03:30:13                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-06 03:30:23                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-06 03:31:13                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-06 03:45:13                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-11-06 03:59:22  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.taobao.com        DNS.  
                        2015-11-06 04:08:37                                  Service Control Manager         7036:  "  "    .  
                        2015-11-06 04:13:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-06 04:19:25                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-06 04:30:07                           Service Control Manager         7040:    "    (BITS)"    ""  "".  
                        2015-11-06 04:35:55                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-06 04:51:58                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-11-06 04:51:59                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-11-06 04:58:19                                  nvlddmkm                        
                        2015-11-06 04:58:19                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-06 04:58:20                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-06 04:58:24                                  Service Control Manager         7036:  "  "    .  
                        2015-11-06 04:58:25                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-06 04:58:25                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-06 04:58:25                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-11-06 04:58:32  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     token.services.mozilla.com        DNS.  
                        2015-11-06 04:58:34  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-11-05T19:51:58.893554700Z      : 2015-11-05T19:58:20.040039100Z     : 4 USB   
                        2015-11-06 05:00:36  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-06 05:00:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-06 05:00:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-06 05:00:38  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-06 05:00:38                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-06 05:00:39                                  EventLog                        6006:    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  " "    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  ""    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "-"    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "     "    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "   "    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "   "    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-06 05:00:39                                  Service Control Manager         7036:  " "    .  
                4          2015-11-06 05:00:39  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-06 05:00:39  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-06 05:00:39                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-06 05:00:39                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-06 05:00:40                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-06 05:00:40                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-06 05:00:40                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-06 05:00:43                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-07 11:48:27                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-07 11:48:30                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-11-07 11:48:36                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-07 11:48:36                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-07 11:48:39                                  nvlddmkm                        
                        2015-11-07 11:48:39                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-07 11:48:39                                  Service Control Manager         7036:  ""    .  
                        2015-11-07 11:48:39                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-07 11:48:39                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-07 11:48:39                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-07 11:48:39                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-11-07 11:48:39                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-07 11:48:40                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-07 11:48:40                                  EventLog                        6005:    .  
                        2015-11-07 11:48:40                                  EventLog                        6013:    12 .  
                        2015-11-07 11:48:40                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-07 11:48:40                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 11:48:40                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-07 11:48:40                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-07 11:48:40                                  Service Control Manager         7036:  ""    .  
                        2015-11-07 11:48:40                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 11:48:40                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 11:48:40                                  Service Control Manager         7036:  " "    .  
                        2015-11-07 11:48:40                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-07 11:48:40                                  Service Control Manager         7036:  "    "    .  
                        2015-11-07 11:48:40                                  Service Control Manager         7036:  "     "    .  
                        2015-11-07 11:48:40                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 11:48:40                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-07 11:48:40                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 11:48:40                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-07 11:48:40                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-07 11:48:40                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-07 11:48:40                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-07 11:48:40                                  Service Control Manager         7036:  "DNS-"    .  
                4          2015-11-07 11:48:40  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-07 11:48:40  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-07 11:48:41                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-07 11:48:41                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 11:48:41                                  Service Control Manager         7036:  " "    .  
                        2015-11-07 11:48:41                                  Service Control Manager         7036:  " "    .  
                        2015-11-07 11:48:41                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                        2015-11-07 11:48:42                                  Service Control Manager         7036:  "-"    .  
                1101       2015-11-07 11:48:42                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-07 11:48:43                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 11:48:43                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-07 11:48:43                                  Service Control Manager         7036:  " "    .  
                        2015-11-07 11:48:43                                  Service Control Manager         7036:  " "    .  
                        2015-11-07 11:48:43                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 11:48:43                                  Service Control Manager         7036:  " "    .  
                        2015-11-07 11:48:44                                  Service Control Manager         7036:  "    "    .  
                        2015-11-07 11:48:44                                  Service Control Manager         7036:  " "    .  
                        2015-11-07 11:48:44                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-07 11:48:44                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-07 11:48:44                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-07 11:48:44                                  Service Control Manager         7036:  ""    .  
                        2015-11-07 11:48:44                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-07 11:48:44                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 11:48:44                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-07 11:48:45                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-07 11:48:45                                  Service Control Manager         7036:  ""    .  
                        2015-11-07 11:48:45                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 11:48:46                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-07 11:48:46                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-07 11:48:46                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 11:48:46                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 11:48:46                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-07 11:48:46                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 11:48:46                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 11:48:46                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 11:48:46                                  Service Control Manager         7036:  " "    .  
                        2015-11-07 11:48:46                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 11:48:47                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-07 11:48:49                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-07 11:48:49                                  Service Control Manager         7036:  "  PNP-"    .  
                7005       2015-11-07 11:48:51                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0001   : 0.  
                        2015-11-07 11:48:55                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-07 11:50:46                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-07 11:50:46                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 11:50:47                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 11:50:47                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-07 11:50:47                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 11:50:49                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-07 11:51:46                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-07 11:52:06                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-07 11:52:16                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-07 11:53:06                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-07 11:53:54                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 11:55:48                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 11:58:48                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-07 11:58:51                                  Service Control Manager         7036:  "   "    .  
                64         2015-11-07 11:58:51                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-11-07 12:25:19                                  nvlddmkm                        
                        2015-11-07 12:25:19                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-07 12:25:24                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 12:25:24                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-07 12:25:34  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-11-07T02:58:48.708007800Z      : 2015-11-07T03:25:20.056640700Z     : 4 USB   
                        2015-11-07 12:30:26                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 12:35:33                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-11-07 12:35:33                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-11-07 12:51:35                                  nvlddmkm                        
                        2015-11-07 12:51:35                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-07 12:51:35                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 12:51:39                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-07 12:51:40  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-11-07T03:35:33.711914100Z      : 2015-11-07T03:51:36.009765600Z     : 5    "\Microsoft\Windows\Media Center\mcupdate_scheduled",      .  
                        2015-11-07 12:55:05                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-07 12:55:16                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-07 12:55:26                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-07 12:56:16                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-07 13:01:48                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-11-07 13:01:48                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-11-07 13:54:45                                  nvlddmkm                        
                        2015-11-07 13:54:45                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-07 13:54:49                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-07 13:54:50                                  EventLog                        6013:    1859 .  
                        2015-11-07 13:54:50  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-11-07T04:01:48.712890600Z      : 2015-11-07T04:54:46.085937500Z     : 5    "\Microsoft\Windows\Media Center\mcupdate_scheduled",      .  
                        2015-11-07 13:58:15                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-07 13:58:26                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-07 13:58:36                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-07 13:59:26                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-07 14:04:48                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-11-07 14:04:48                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-11-07 14:09:10                                  nvlddmkm                        
                        2015-11-07 14:09:10                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-07 14:09:11                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-07 14:09:14                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 14:09:25  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-11-07T05:04:48.708984300Z      : 2015-11-07T05:09:11.007812500Z     : 4 USB   
                        2015-11-07 14:09:26  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-07 14:09:28                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-07 14:09:28                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 14:09:28                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 14:09:28                                  Service Control Manager         7036:  " "    .  
                        2015-11-07 14:09:28  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-07 14:09:28                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-07 14:09:29                                  EventLog                        6006:    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  ""    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "-"    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "     "    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  " "    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-07 14:09:29                                  Service Control Manager         7036:  "Windows Search"    .  
                4          2015-11-07 14:09:29  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-07 14:09:29  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-07 14:09:29                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-07 14:09:29                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                103        2015-11-07 14:09:30                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-07 14:09:32                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-07 17:00:49                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-07 17:00:52                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-11-07 17:00:56                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-07 17:00:56                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-07 17:00:59                                  nvlddmkm                        
                        2015-11-07 17:01:00                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-07 17:01:00                                  EventLog                        6005:    .  
                        2015-11-07 17:01:00                                  EventLog                        6013:    11 .  
                        2015-11-07 17:01:00                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-07 17:01:00                                  Service Control Manager         7036:  ""    .  
                        2015-11-07 17:01:00                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-07 17:01:00                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-07 17:01:00                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-07 17:01:00                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-07 17:01:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 17:01:00                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-11-07 17:01:00                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  ""    .  
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  " "    .  
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  "    "    .  
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  "     "    .  
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  " "    .  
                        2015-11-07 17:01:01                                  Service Control Manager         7036:  " "    .  
                        2015-11-07 17:01:01                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-07 17:01:01  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-07 17:01:01  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-07 17:01:02                                  Service Control Manager         7036:  "-"    .  
                        2015-11-07 17:01:02                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 17:01:02                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-07 17:01:02                                  Service Control Manager         7036:  " "    .  
                        2015-11-07 17:01:02                                  Service Control Manager         7036:  " "    .  
                        2015-11-07 17:01:02                                  Service Control Manager         7036:  "  "    .  
                1101       2015-11-07 17:01:02                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-07 17:01:04                                  Service Control Manager         7036:  " "    .  
                        2015-11-07 17:01:04                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-07 17:01:04                                  Service Control Manager         7036:  " "    .  
                        2015-11-07 17:01:04                                  Service Control Manager         7036:  "    "    .  
                        2015-11-07 17:01:05                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-07 17:01:05                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-07 17:01:05                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 17:01:05                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-07 17:01:05                                  Service Control Manager         7036:  ""    .  
                        2015-11-07 17:01:06                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-07 17:01:07                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-07 17:01:07                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 17:01:07                                  Service Control Manager         7036:  ""    .  
                        2015-11-07 17:01:08                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-07 17:01:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 17:01:08                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-07 17:01:08                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 17:01:08                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-07 17:01:08                                  Service Control Manager         7036:  " "    .  
                        2015-11-07 17:01:08                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 17:01:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 17:01:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 17:01:08                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 17:01:08                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-07 17:01:09                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-07 17:01:09                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-07 17:01:17                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-07 17:01:39                                  Service Control Manager         7036:  "    "    .  
                        2015-11-07 17:01:39                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-07 17:01:40                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-07 17:01:51                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-07 17:01:55                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-07 17:03:08                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 17:03:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 17:03:09                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-07 17:03:09                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 17:03:10                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-07 17:04:09                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-07 17:04:53                                  Service Control Manager         7036:  "    (BITS)"    .  
                        2015-11-07 17:04:53                           Service Control Manager         7040:    "    (BITS)"    ""  "".  
                        2015-11-07 17:05:20                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-07 17:05:30                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-07 17:05:48                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-07 17:05:48                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-07 17:05:48                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-11-07 17:05:53  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                        2015-11-07 17:06:20                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-07 17:08:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 17:11:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 17:16:58                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 17:21:21                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-07 17:35:24                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-11-07 17:35:26                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                        2015-11-07 17:59:34                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-07 17:59:34                                  Service Control Manager         7036:  "  "    .  
                            2015-11-07 17:59:38                                  nvlddmkm                        
                        2015-11-07 17:59:39                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-07 17:59:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 17:59:55  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-11-07T08:35:24.742187500Z      : 2015-11-07T08:59:39.078125000Z     : 4 USB   
                        2015-11-07 18:02:35  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-07 18:02:38                                  EventLog                        6006:    .  
                        2015-11-07 18:02:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-07 18:02:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 18:02:38                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-07 18:02:38                                  Service Control Manager         7036:  " "    .  
                        2015-11-07 18:02:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 18:02:38                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-07 18:02:38                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-07 18:02:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 18:02:38                                  Service Control Manager         7036:  ""    .  
                        2015-11-07 18:02:38                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-07 18:02:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 18:02:38                                  Service Control Manager         7036:  "-"    .  
                        2015-11-07 18:02:38                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-07 18:02:38                                  Service Control Manager         7036:  "     "    .  
                        2015-11-07 18:02:38                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 18:02:38                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-07 18:02:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-07 18:02:38                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-07 18:02:38                                  Service Control Manager         7036:  "   "    .  
                        2015-11-07 18:02:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-07 18:02:38  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-07 18:02:38                           Microsoft-Windows-Winlogon      7002:           
                4          2015-11-07 18:02:38  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-07 18:02:38  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-07 18:02:38                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-11-07 18:02:39                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-07 18:02:39                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-07 18:02:39                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-07 18:02:39                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-07 18:02:39                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-07 18:02:39                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-07 18:02:39                                  Service Control Manager         7036:  " "    .  
                        2015-11-07 18:02:39                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-07 18:02:39                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-07 18:02:39                                  Service Control Manager         7036:  "  PNP-"    .  
                          2015-11-07 18:02:39                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-07 18:02:40                                  Service Control Manager         7036:  " Windows"    .  
                103        2015-11-07 18:02:40                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-07 18:02:43                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-09 06:31:14                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-09 06:31:17                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T07:21:51.000000000Z)       .  
                4          2015-11-09 06:31:22                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-09 06:31:22                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-09 06:31:25                                  nvlddmkm                        
                        2015-11-09 06:31:25                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-09 06:31:25                                  Service Control Manager         7036:  ""    .  
                        2015-11-09 06:31:25                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-09 06:31:25                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-09 06:31:25                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-09 06:31:25                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T07:15:44.000000000Z)       .  
                7010       2015-11-09 06:31:25                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-09 06:31:26                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-09 06:31:26                                  EventLog                        6005:    .  
                        2015-11-09 06:31:26                                  EventLog                        6013:    11 .  
                        2015-11-09 06:31:26                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-09 06:31:26                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 06:31:26                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-09 06:31:26                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-09 06:31:26                                  Service Control Manager         7036:  ""    .  
                        2015-11-09 06:31:26                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 06:31:26                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 06:31:26                                  Service Control Manager         7036:  " "    .  
                        2015-11-09 06:31:26                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-09 06:31:26                                  Service Control Manager         7036:  "    "    .  
                        2015-11-09 06:31:26                                  Service Control Manager         7036:  "     "    .  
                        2015-11-09 06:31:26                                  Service Control Manager         7036:  "   "    .  
                        2015-11-09 06:31:26                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-09 06:31:26                                  Service Control Manager         7036:  "   "    .  
                        2015-11-09 06:31:26                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-09 06:31:26                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-09 06:31:26                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-09 06:31:26                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-09 06:31:26                                  Service Control Manager         7036:  "    (EAP)"    .  
                4          2015-11-09 06:31:26  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-09 06:31:26  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-09 06:31:27                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-09 06:31:27                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 06:31:27                                  Service Control Manager         7036:  " "    .  
                        2015-11-09 06:31:27                                  Service Control Manager         7036:  " "    .  
                        2015-11-09 06:31:27                                  Service Control Manager         7036:  "-"    .  
                        2015-11-09 06:31:27                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                        2015-11-09 06:31:28                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 06:31:28                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-09 06:31:28                                  Service Control Manager         7036:  " "    .  
                        2015-11-09 06:31:28                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 06:31:28                                  Service Control Manager         7036:  " "    .  
                1101       2015-11-09 06:31:28                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-09 06:31:30                                  Service Control Manager         7036:  " "    .  
                        2015-11-09 06:31:30                                  Service Control Manager         7036:  "    "    .  
                        2015-11-09 06:31:30                                  Service Control Manager         7036:  " "    .  
                        2015-11-09 06:31:30                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-09 06:31:31                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-09 06:31:31                                  Service Control Manager         7036:  ""    .  
                        2015-11-09 06:31:31                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-09 06:31:31                                  Service Control Manager         7036:  "   "    .  
                        2015-11-09 06:31:31                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-09 06:31:31                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-09 06:31:32                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-09 06:31:33                                  Service Control Manager         7036:  ""    .  
                        2015-11-09 06:31:33                                  Service Control Manager         7036:  "   "    .  
                        2015-11-09 06:31:34                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-09 06:31:34                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-09 06:31:34                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 06:31:34                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 06:31:34                                  Service Control Manager         7036:  "   "    .  
                        2015-11-09 06:31:34                                  Service Control Manager         7036:  "   "    .  
                        2015-11-09 06:31:34                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-09 06:31:34                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 06:31:34                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-09 06:31:34                                  Service Control Manager         7036:  " "    .  
                        2015-11-09 06:31:34                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-09 06:31:34                                  Service Control Manager         7036:  "   "    .  
                        2015-11-09 06:31:34                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-09 06:31:35                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-09 06:31:43                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-09 06:31:46                                  Service Control Manager         7036:  "    "    .  
                        2015-11-09 06:31:46                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-09 06:31:46                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-09 06:31:49                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-09 06:32:21                                  Service Control Manager         7036:  " "    .  
                        2015-11-09 06:33:34                                  Service Control Manager         7036:  "   "    .  
                        2015-11-09 06:33:34                                  Service Control Manager         7036:  "    (BITS)"    .  
                        2015-11-09 06:33:34                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 06:33:35                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-09 06:33:35                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 06:33:37                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-09 06:33:48                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-09 06:34:06  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-09 06:34:06  LOCAL SERVICE                   Microsoft-Windows-Time-Service  35:          time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->104.209.134.106:123).  
                        2015-11-09 06:34:06  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-09 06:34:18                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-09 06:34:19  LOCAL SERVICE                   Microsoft-Windows-Time-Service  37: NTP-         time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->104.209.134.106:123).  
                        2015-11-09 06:34:45                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-09 06:34:51                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-09 06:35:01                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-09 06:35:51                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-09 06:37:12                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-09 06:37:26                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 06:38:23                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 06:41:16                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 06:41:26                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-09 06:41:27                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-09 06:41:27                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-11-09 06:41:28  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     i-50.b-000.xyz.bench.utorrent.com        DNS.  
                            2015-11-09 06:42:16                                  ipnathlp                        
                        2015-11-09 06:42:16                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-09 06:47:10                                  Service Control Manager         7036:  "   "    .  
                        2015-11-09 06:47:14                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 06:50:52                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-09 07:03:31                                  Service Control Manager         7036:  "  "    .  
                7005       2015-11-09 07:03:32                           Microsoft-Windows-UserPnp       20003:       USBSTOR      USB\VID_8564&PID_1000\2774130346   : 0.  
                7005       2015-11-09 07:03:32                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbstor.inf_x86_neutral_c77d41a490bdc63d\usbstor.inf      USB\VID_8564&PID_1000\2774130346   : 0x0.  
                7005       2015-11-09 07:03:33                           Microsoft-Windows-UserPnp       20003:       disk      USBSTOR\DISK&VEN_JETFLASH&PROD_TRANSCEND_8GB&REV_1.00\2774130346&0   : 0.  
                7005       2015-11-09 07:03:33                           Microsoft-Windows-UserPnp       20001:       FileRepository\disk.inf_x86_neutral_b431b61a11f8df6c\disk.inf      USBSTOR\DISK&VEN_JETFLASH&PROD_TRANSCEND_8GB&REV_1.00\2774130346&0   : 0x0.  
                        2015-11-09 07:03:34                                  Service Control Manager         7036:  "   "    .  
                7005       2015-11-09 07:03:34                           Microsoft-Windows-UserPnp       20003:       volsnap      STORAGE\VOLUME\_??_USBSTOR#DISK&VEN_JETFLASH&PROD_TRANSCEND_8GB&REV_1.00#2774130346&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}   : 0.  
                7005       2015-11-09 07:03:34                           Microsoft-Windows-UserPnp       20001:       FileRepository\volume.inf_x86_neutral_6dee0205881d1a1d\volume.inf      STORAGE\VOLUME\_??_USBSTOR#DISK&VEN_JETFLASH&PROD_TRANSCEND_8GB&REV_1.00#2774130346&0#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}   : 0x0.  
                48         2015-11-09 07:03:36                           Microsoft-Windows-DriverFrameworks-UserMode  10000:  ,       1.9.0,    WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_JETFLASH&PROD_TRANSCEND_8GB&REV_1.00#2774130346&0#.  
                48         2015-11-09 07:03:36                           Microsoft-Windows-DriverFrameworks-UserMode  10002:      WpdFs (CLSID {112DE495-AC4C-46F8-B663-6A4266C53313}) .      1.9.0    .  
                48         2015-11-09 07:03:36                           Microsoft-Windows-DriverFrameworks-UserMode  10100:     .  
                7005       2015-11-09 07:03:36                           Microsoft-Windows-UserPnp       20003:       WUDFRd      WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_JETFLASH&PROD_TRANSCEND_8GB&REV_1.00#2774130346&0#   : 0.  
                16         2015-11-09 07:03:37                                  WPDClassInstaller               
                32         2015-11-09 07:03:37                                  WPDClassInstaller               
                32         2015-11-09 07:03:37                                  WPDClassInstaller               
                7005       2015-11-09 07:03:37                           Microsoft-Windows-UserPnp       20001:       FileRepository\wpdfs.inf_x86_neutral_fc4ebadff3a40ae4\wpdfs.inf      WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_JETFLASH&PROD_TRANSCEND_8GB&REV_1.00#2774130346&0#   : 0x0.  
                        2015-11-09 07:05:13                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-09 07:05:14                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-09 07:05:14                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-11-09 07:10:19  sima                            Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-09 07:10:27  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-09 07:10:30  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-09 07:10:30                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-09 07:10:31                                  EventLog                        6006:    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  " "    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  ""    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  "     "    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  "-"    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  "   "    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-09 07:10:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 07:10:31  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                4          2015-11-09 07:10:31  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-09 07:10:31  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-09 07:10:31                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-11-09 07:10:32                                  Service Control Manager         7036:  "   "    .  
                        2015-11-09 07:10:32                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-09 07:10:32                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-09 07:10:32                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-09 07:10:32                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-09 07:10:32                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-09 07:10:32                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-09 07:10:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-09 07:10:32                                  Service Control Manager         7036:  " "    .  
                        2015-11-09 07:10:32                                  Service Control Manager         7036:  "  PNP-"    .  
                          2015-11-09 07:10:32                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-09 07:10:33                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-09 07:10:33                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-09 07:10:33                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-09 07:10:39                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-10 01:26:41                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-10 01:26:44                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-10 01:26:49                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-10 01:26:49                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-10 01:26:52                                  nvlddmkm                        
                        2015-11-10 01:26:52                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-10 01:26:52                                  EventLog                        6005:    .  
                        2015-11-10 01:26:52                                  EventLog                        6013:    11 .  
                        2015-11-10 01:26:52                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-10 01:26:52                                  Service Control Manager         7036:  ""    .  
                        2015-11-10 01:26:52                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-10 01:26:52                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-10 01:26:52                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-10 01:26:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-10 01:26:52                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-10 01:26:52                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-10 01:26:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 01:26:53                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-10 01:26:53                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-10 01:26:53                                  Service Control Manager         7036:  ""    .  
                        2015-11-10 01:26:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 01:26:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 01:26:53                                  Service Control Manager         7036:  " "    .  
                        2015-11-10 01:26:53                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-10 01:26:53                                  Service Control Manager         7036:  "    "    .  
                        2015-11-10 01:26:53                                  Service Control Manager         7036:  "     "    .  
                        2015-11-10 01:26:53                                  Service Control Manager         7036:  "   "    .  
                        2015-11-10 01:26:54                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-10 01:26:54                                  Service Control Manager         7036:  "   "    .  
                        2015-11-10 01:26:54                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-10 01:26:54                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-10 01:26:54                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-10 01:26:54                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-10 01:26:54                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-10 01:26:54                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-10 01:26:54                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 01:26:54                                  Service Control Manager         7036:  " "    .  
                        2015-11-10 01:26:54                                  Service Control Manager         7036:  " "    .  
                        2015-11-10 01:26:54                                  Service Control Manager         7036:  "-"    .  
                        2015-11-10 01:26:54                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-10 01:26:54  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-10 01:26:54  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                1101       2015-11-10 01:26:55                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-10 01:26:56                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 01:26:56                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-10 01:26:56                                  Service Control Manager         7036:  " "    .  
                        2015-11-10 01:26:56                                  Service Control Manager         7036:  " "    .  
                        2015-11-10 01:26:56                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 01:26:56                                  Service Control Manager         7036:  " "    .  
                        2015-11-10 01:26:58                                  Service Control Manager         7036:  " "    .  
                        2015-11-10 01:26:58                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-10 01:26:59                                  Service Control Manager         7036:  ""    .  
                        2015-11-10 01:26:59                                  Service Control Manager         7036:  "    "    .  
                        2015-11-10 01:26:59                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-10 01:26:59                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-10 01:26:59                                  Service Control Manager         7036:  "   "    .  
                        2015-11-10 01:26:59                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-10 01:27:00                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-10 01:27:00                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-10 01:27:00                                  Service Control Manager         7036:  ""    .  
                        2015-11-10 01:27:00                                  Service Control Manager         7036:  "   "    .  
                        2015-11-10 01:27:01                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-10 01:27:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 01:27:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 01:27:01                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-10 01:27:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 01:27:01                                  Service Control Manager         7036:  "   "    .  
                        2015-11-10 01:27:01                                  Service Control Manager         7036:  " "    .  
                        2015-11-10 01:27:01                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-10 01:27:01                                  Service Control Manager         7036:  "   "    .  
                        2015-11-10 01:27:01                                  Service Control Manager         7036:  "   "    .  
                        2015-11-10 01:27:02                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-10 01:27:02                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-10 01:27:02                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-10 01:27:03                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-10 01:27:10                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-10 01:29:01                                  Service Control Manager         7036:  "    (BITS)"    .  
                        2015-11-10 01:29:01                                  Service Control Manager         7036:  "   "    .  
                        2015-11-10 01:29:02                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-10 01:29:02                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 01:29:03                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-10 01:29:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 01:29:04                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-10 01:29:26                                  Service Control Manager         7036:  "    "    .  
                        2015-11-10 01:29:26                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-10 01:31:56                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-10 01:32:01                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-10 01:32:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 01:32:32                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-10 01:32:42                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-10 01:33:32                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-10 01:34:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 01:43:33                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-10 01:43:55                                  Service Control Manager         7036:  "   "    .  
                            2015-11-10 01:52:01                                  ipnathlp                        
                        2015-11-10 02:06:47                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                64         2015-11-10 02:06:48                                  Microsoft-Windows-Kernel-Power  42:     .        : 7  
                            2015-11-10 02:10:58                                  nvlddmkm                        
                        2015-11-10 02:10:58                                  Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-10 02:10:58                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 02:10:59                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-10 02:11:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 02:11:13  LOCAL SERVICE                   Microsoft-Windows-Power-Troubleshooter  1:     .        : 2015-11-09T17:06:47.286132800Z      : 2015-11-09T17:10:59.036132800Z     : 4 USB   
                        2015-11-10 02:16:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 02:29:01                           Service Control Manager         7040:    "    (BITS)"    ""  "".  
                          2015-11-10 03:26:06  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     pipe.skype.com        DNS.  
                          2015-11-10 03:26:18  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-11-10 03:28:28                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-10 03:28:29                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-10 03:28:29                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-11-10 03:28:30  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     client-s.gateway.messenger.live.com        DNS.  
                          2015-11-10 03:28:31  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     bn1-client-s.gateway.messenger.msnmessenger.msn.com.akadns.net        DNS.  
                        2015-11-10 03:28:32                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-11-10 03:28:37  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-11-10 03:33:36  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     g-search1.alicdn.com        DNS.  
                          2015-11-10 03:38:19  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     pipe.skype.com        DNS.  
                        2015-11-10 03:38:42                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-10 03:38:44                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-10 03:38:44                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-11-10 03:38:44  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     client-s.gateway.messenger.live.com        DNS.  
                            2015-11-10 03:40:47                                  ipnathlp                        
                            2015-11-10 03:40:50                                  ipnathlp                        
                        2015-11-10 03:40:50                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-11-10 03:41:03  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     a3.dscg10.akamai.net        DNS.  
                          2015-11-10 04:54:02  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     img02.taobaocdn.com        DNS.  
                        2015-11-10 05:09:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 05:09:01  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-10 05:09:03  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-10 05:09:03                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-10 05:09:04                                  EventLog                        6006:    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  " "    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  ""    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "-"    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "     "    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "   "    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "   "    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-10 05:09:04                                  Service Control Manager         7036:  " "    .  
                4          2015-11-10 05:09:04  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-10 05:09:04  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-10 05:09:04                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-11-10 05:09:05                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-10 05:09:05                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-10 05:09:05                                  Service Control Manager         7036:  "  PNP-"    .  
                103        2015-11-10 05:09:05                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-11-10 05:09:05                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-10 05:09:17                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-11 01:24:40                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-11 01:24:43                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-11 01:24:49                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-11 01:24:49                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-11 01:24:51                                  nvlddmkm                        
                        2015-11-11 01:24:52                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-11 01:24:52                                  EventLog                        6005:    .  
                        2015-11-11 01:24:52                                  EventLog                        6013:    11 .  
                        2015-11-11 01:24:52                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-11 01:24:52                                  Service Control Manager         7036:  ""    .  
                        2015-11-11 01:24:52                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-11 01:24:52                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-11 01:24:52                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-11 01:24:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-11 01:24:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 01:24:52                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-11 01:24:52                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-11 01:24:53                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-11 01:24:53                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-11 01:24:53                                  Service Control Manager         7036:  ""    .  
                        2015-11-11 01:24:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 01:24:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 01:24:53                                  Service Control Manager         7036:  " "    .  
                        2015-11-11 01:24:53                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-11 01:24:53                                  Service Control Manager         7036:  "    "    .  
                        2015-11-11 01:24:53                                  Service Control Manager         7036:  "     "    .  
                        2015-11-11 01:24:53                                  Service Control Manager         7036:  "   "    .  
                        2015-11-11 01:24:53                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-11 01:24:53                                  Service Control Manager         7036:  "   "    .  
                        2015-11-11 01:24:53                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-11 01:24:53                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-11 01:24:53                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-11 01:24:53                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-11 01:24:53                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-11 01:24:53                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-11 01:24:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 01:24:53                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-11 01:24:53  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-11 01:24:53  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-11 01:24:54                                  Service Control Manager         7036:  " "    .  
                        2015-11-11 01:24:54                                  Service Control Manager         7036:  " "    .  
                        2015-11-11 01:24:54                                  Service Control Manager         7036:  "-"    .  
                        2015-11-11 01:24:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 01:24:55                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-11 01:24:55                                  Service Control Manager         7036:  " "    .  
                        2015-11-11 01:24:55                                  Service Control Manager         7036:  " "    .  
                        2015-11-11 01:24:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 01:24:55                                  Service Control Manager         7036:  " "    .  
                1101       2015-11-11 01:24:55                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-11 01:24:57                                  Service Control Manager         7036:  " "    .  
                        2015-11-11 01:24:57                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-11 01:24:57                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-11 01:24:57                                  Service Control Manager         7036:  ""    .  
                        2015-11-11 01:24:57                                  Service Control Manager         7036:  "    "    .  
                        2015-11-11 01:24:57                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-11 01:24:57                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-11 01:24:57                                  Service Control Manager         7036:  "   "    .  
                        2015-11-11 01:24:58                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-11 01:24:58                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-11 01:24:58                                  Service Control Manager         7036:  ""    .  
                        2015-11-11 01:24:59                                  Service Control Manager         7036:  "   "    .  
                        2015-11-11 01:25:00                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-11 01:25:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 01:25:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 01:25:00                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-11 01:25:00                                  Service Control Manager         7036:  "   "    .  
                        2015-11-11 01:25:00                                  Service Control Manager         7036:  "   "    .  
                        2015-11-11 01:25:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 01:25:01                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-11 01:25:01                                  Service Control Manager         7036:  " "    .  
                        2015-11-11 01:25:01                                  Service Control Manager         7036:  "   "    .  
                        2015-11-11 01:25:01                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-11 01:25:03                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-11 01:25:03                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-11 01:25:03                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-11-11 01:25:06                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-11-11 01:25:08                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-11 01:27:00                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-11 01:27:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 01:27:00                                  Service Control Manager         7036:  "   "    .  
                        2015-11-11 01:27:01                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-11 01:27:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 01:27:03                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-11 01:27:58                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-11 01:28:38                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-11 01:28:48                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-11 01:29:02                                  Service Control Manager         7036:  "    "    .  
                        2015-11-11 01:29:02                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-11 01:29:02                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-11 01:29:38                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-11 01:30:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 01:32:02                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 01:35:05                                  Service Control Manager         7036:  "   "    .  
                          2015-11-11 01:39:01  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     go.trouter.io        DNS.  
                          2015-11-11 01:40:06  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     go.trouter.io        DNS.  
                        2015-11-11 01:41:33                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-11-11 01:42:13  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     img.alicdn.com        DNS.  
                        2015-11-11 01:42:34                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-11 01:42:35                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-11 01:42:35                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-11-11 01:42:35  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                            2015-11-11 01:43:37                                  ipnathlp                        
                        2015-11-11 01:43:39                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-11-11 01:44:39  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     a.tbcdn.cn.danuoyi.tbcache.com        DNS.  
                        2015-11-11 02:04:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 02:23:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 02:28:38                                  Service Control Manager         7036:  "  "    .  
                          2015-11-11 02:40:12  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     zcainfo.miitbeian.gov.cn        DNS.  
                        2015-11-11 03:06:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 03:09:46                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-11 03:12:28                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 03:26:16                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-11-11 03:39:33  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.alimama.com        DNS.  
                        2015-11-11 03:44:57                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-11 03:45:04                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-11 03:45:40                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-11 03:46:04                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                          2015-11-11 04:31:26  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.xn--28-glcio9aocrk4b3c4b.xn--p1ai        DNS.  
                        2015-11-11 04:39:47                                  Service Control Manager         7036:  "   "    .  
                        2015-11-11 04:39:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 04:39:50  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-11 04:39:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-11 04:39:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 04:39:52  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-11 04:39:52                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-11 04:39:53                                  EventLog                        6006:    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  " "    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  ""    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "-"    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "     "    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "   "    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "   "    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  " "    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-11 04:39:53                                  Service Control Manager         7036:  "Windows Search"    .  
                4          2015-11-11 04:39:53  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-11 04:39:53  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-11 04:39:53                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-11 04:39:53                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                103        2015-11-11 04:39:54                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-11 04:40:06                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-13 13:52:10                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-13 13:52:13                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-13 13:52:19                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-13 13:52:19                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-13 13:52:21                                  nvlddmkm                        
                        2015-11-13 13:52:22                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-13 13:52:22                                  EventLog                        6005:    .  
                        2015-11-13 13:52:22                                  EventLog                        6013:    11 .  
                        2015-11-13 13:52:22                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-13 13:52:22                                  Service Control Manager         7036:  ""    .  
                        2015-11-13 13:52:22                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-13 13:52:22                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-13 13:52:22                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-13 13:52:22                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-13 13:52:22                                  Service Control Manager         7036:  "  "    .  
                        2015-11-13 13:52:22                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-13 13:52:22                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-13 13:52:23                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-13 13:52:23                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-13 13:52:23                                  Service Control Manager         7036:  ""    .  
                        2015-11-13 13:52:23                                  Service Control Manager         7036:  "  "    .  
                        2015-11-13 13:52:23                                  Service Control Manager         7036:  "  "    .  
                        2015-11-13 13:52:23                                  Service Control Manager         7036:  " "    .  
                        2015-11-13 13:52:23                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-13 13:52:23                                  Service Control Manager         7036:  "    "    .  
                        2015-11-13 13:52:23                                  Service Control Manager         7036:  "     "    .  
                        2015-11-13 13:52:23                                  Service Control Manager         7036:  "   "    .  
                        2015-11-13 13:52:23                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-13 13:52:23                                  Service Control Manager         7036:  "   "    .  
                        2015-11-13 13:52:23                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-13 13:52:23                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-13 13:52:23                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-13 13:52:23                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-13 13:52:23                                  Service Control Manager         7036:  "    (EAP)"    .  
                4          2015-11-13 13:52:23  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-13 13:52:23  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-13 13:52:24                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-13 13:52:24                                  Service Control Manager         7036:  "  "    .  
                        2015-11-13 13:52:24                                  Service Control Manager         7036:  " "    .  
                        2015-11-13 13:52:24                                  Service Control Manager         7036:  " "    .  
                        2015-11-13 13:52:24                                  Service Control Manager         7036:  "-"    .  
                        2015-11-13 13:52:24                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                        2015-11-13 13:52:25                                  Service Control Manager         7036:  "  "    .  
                        2015-11-13 13:52:25                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-13 13:52:25                                  Service Control Manager         7036:  " "    .  
                        2015-11-13 13:52:25                                  Service Control Manager         7036:  " "    .  
                        2015-11-13 13:52:25                                  Service Control Manager         7036:  " "    .  
                        2015-11-13 13:52:25                                  Service Control Manager         7036:  "  "    .  
                1101       2015-11-13 13:52:25                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-13 13:52:26                                  Service Control Manager         7036:  " "    .  
                        2015-11-13 13:52:27                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-13 13:52:27                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-13 13:52:27                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-13 13:52:28                                  Service Control Manager         7036:  ""    .  
                        2015-11-13 13:52:28                                  Service Control Manager         7036:  "    "    .  
                        2015-11-13 13:52:28                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-13 13:52:28                                  Service Control Manager         7036:  "   "    .  
                        2015-11-13 13:52:28                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-13 13:52:28                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-13 13:52:29                                  Service Control Manager         7036:  ""    .  
                        2015-11-13 13:52:29                                  Service Control Manager         7036:  "   "    .  
                        2015-11-13 13:52:30                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-13 13:52:30                                  Service Control Manager         7036:  "  "    .  
                        2015-11-13 13:52:30                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-13 13:52:30                                  Service Control Manager         7036:  "  "    .  
                        2015-11-13 13:52:30                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-13 13:52:30                                  Service Control Manager         7036:  "   "    .  
                        2015-11-13 13:52:31                                  Service Control Manager         7036:  " "    .  
                        2015-11-13 13:52:31                                  Service Control Manager         7036:  "   "    .  
                        2015-11-13 13:52:31                                  Service Control Manager         7036:  "   "    .  
                        2015-11-13 13:52:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-13 13:52:31                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-13 13:52:31                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-13 13:52:31                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-13 13:52:33                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-11-13 13:52:37                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-11-13 13:52:38                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-13 13:53:18                                  Service Control Manager         7036:  "    "    .  
                        2015-11-13 13:53:18                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-13 13:53:20                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-13 13:54:30                                  Service Control Manager         7036:  "  "    .  
                        2015-11-13 13:54:31                                  Service Control Manager         7036:  "   "    .  
                        2015-11-13 13:54:31                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-13 13:54:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-13 13:54:33                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-13 13:57:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-13 13:59:27                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-13 13:59:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-13 14:00:00                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-13 14:00:10                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-13 14:01:00                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-13 14:02:35                                  Service Control Manager         7036:  "   "    .  
                        2015-11-13 14:15:03                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-13 14:18:51                                  Service Control Manager         7036:  "   "    .  
                          2015-11-13 14:20:56  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     s2.listing.ozstatic.by        DNS.  
                        2015-11-13 14:28:51                                  Service Control Manager         7036:  "   "    .  
                        2015-11-13 14:32:25                                  Service Control Manager         7036:  "  "    .  
                        2015-11-13 14:34:43                           Microsoft-Windows-Application-Experience  206:          .  
                          2015-11-13 14:38:13  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     top-fwz1.mail.ru        DNS.  
                        2015-11-13 14:42:02  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-13 14:42:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-13 14:42:05                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-13 14:42:05                                  Service Control Manager         7036:  "  "    .  
                        2015-11-13 14:42:05  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-13 14:42:05                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-13 14:42:06                                  EventLog                        6006:    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  " "    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  ""    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "-"    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "     "    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  " "    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-13 14:42:06                                  Service Control Manager         7036:  "Windows Search"    .  
                4          2015-11-13 14:42:06  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-13 14:42:06  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-13 14:42:06                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-13 14:42:06                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                103        2015-11-13 14:42:07                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-13 14:42:19                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-14 03:20:39                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-14 03:20:42                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-14 03:20:47                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-14 03:20:47                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-14 03:20:50                                  nvlddmkm                        
                        2015-11-14 03:20:50                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-14 03:20:50                                  EventLog                        6005:    .  
                        2015-11-14 03:20:50                                  EventLog                        6013:    11 .  
                        2015-11-14 03:20:50                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-14 03:20:50                                  Service Control Manager         7036:  ""    .  
                        2015-11-14 03:20:50                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-14 03:20:50                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-14 03:20:50                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-14 03:20:50                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-14 03:20:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-14 03:20:50                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-14 03:20:50                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-14 03:20:51                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-14 03:20:51                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-14 03:20:51                                  Service Control Manager         7036:  ""    .  
                        2015-11-14 03:20:51                                  Service Control Manager         7036:  "  "    .  
                        2015-11-14 03:20:51                                  Service Control Manager         7036:  "  "    .  
                        2015-11-14 03:20:51                                  Service Control Manager         7036:  " "    .  
                        2015-11-14 03:20:51                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-14 03:20:51                                  Service Control Manager         7036:  "    "    .  
                        2015-11-14 03:20:51                                  Service Control Manager         7036:  "     "    .  
                        2015-11-14 03:20:51                                  Service Control Manager         7036:  "   "    .  
                        2015-11-14 03:20:51                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-14 03:20:51                                  Service Control Manager         7036:  "   "    .  
                        2015-11-14 03:20:51                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-14 03:20:51                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-14 03:20:51                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-14 03:20:51                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-14 03:20:51                                  Service Control Manager         7036:  "DNS-"    .  
                4          2015-11-14 03:20:51  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-14 03:20:51  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-14 03:20:52                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-14 03:20:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-14 03:20:52                                  Service Control Manager         7036:  " "    .  
                        2015-11-14 03:20:52                                  Service Control Manager         7036:  " "    .  
                        2015-11-14 03:20:52                                  Service Control Manager         7036:  "-"    .  
                        2015-11-14 03:20:52                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-11-14 03:20:53                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-14 03:20:54                                  Service Control Manager         7036:  "  "    .  
                        2015-11-14 03:20:54                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-14 03:20:54                                  Service Control Manager         7036:  " "    .  
                        2015-11-14 03:20:54                                  Service Control Manager         7036:  " "    .  
                        2015-11-14 03:20:54                                  Service Control Manager         7036:  "  "    .  
                        2015-11-14 03:20:54                                  Service Control Manager         7036:  " "    .  
                        2015-11-14 03:20:54                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-14 03:20:54                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-14 03:20:55                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-14 03:20:55                                  Service Control Manager         7036:  ""    .  
                        2015-11-14 03:20:55                                  Service Control Manager         7036:  "    "    .  
                        2015-11-14 03:20:55                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-14 03:20:55                                  Service Control Manager         7036:  " "    .  
                        2015-11-14 03:20:55                                  Service Control Manager         7036:  "   "    .  
                        2015-11-14 03:20:56                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-14 03:20:56                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-14 03:20:56                                  Service Control Manager         7036:  ""    .  
                        2015-11-14 03:20:56                                  Service Control Manager         7036:  "   "    .  
                        2015-11-14 03:20:57                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-14 03:20:58                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-14 03:20:58                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-14 03:20:58                                  Service Control Manager         7036:  "  "    .  
                        2015-11-14 03:20:58                                  Service Control Manager         7036:  "   "    .  
                        2015-11-14 03:20:58                                  Service Control Manager         7036:  "  "    .  
                        2015-11-14 03:20:58                                  Service Control Manager         7036:  "  "    .  
                        2015-11-14 03:20:58                                  Service Control Manager         7036:  "   "    .  
                        2015-11-14 03:20:58                                  Service Control Manager         7036:  " "    .  
                        2015-11-14 03:20:58                                  Service Control Manager         7036:  "   "    .  
                        2015-11-14 03:20:59                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-14 03:20:59                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-14 03:20:59                                  Service Control Manager         7036:  "  PNP-"    .  
                7005       2015-11-14 03:21:04                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-11-14 03:21:05                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-14 03:21:09                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-14 03:21:11                                  Service Control Manager         7036:  "    "    .  
                        2015-11-14 03:21:11                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-14 03:21:13                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-14 03:22:58                                  Service Control Manager         7036:  "   "    .  
                        2015-11-14 03:22:59                                  Service Control Manager         7036:  "  "    .  
                        2015-11-14 03:22:59                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-14 03:22:59                                  Service Control Manager         7036:  "  "    .  
                        2015-11-14 03:23:01                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-14 03:26:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-14 03:28:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-14 03:31:03                                  Service Control Manager         7036:  "   "    .  
                        2015-11-14 03:37:39                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-11-14 03:45:58  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                          2015-11-14 03:46:10  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-11-14 03:48:43                                  Service Control Manager         7036:  "   "    .  
                          2015-11-14 03:51:23  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     stats.l.doubleclick.net        DNS.  
                          2015-11-14 03:55:27  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     safebrowsing.google.com        DNS.  
                        2015-11-14 03:55:51                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-14 03:55:51                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-14 03:55:51                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-11-14 03:55:51  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-11-14 03:56:56                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-14 03:58:43                                  Service Control Manager         7036:  "   "    .  
                          2015-11-14 03:59:30  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     img01.taobaocdn.com        DNS.  
                        2015-11-14 04:00:54                                  Service Control Manager         7036:  "  "    .  
                          2015-11-14 04:09:52  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     videoclick.ru        DNS.  
                        2015-11-14 04:11:27  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-14 04:11:28                                  Service Control Manager         7036:  "  "    .  
                        2015-11-14 04:11:30                                  EventLog                        6006:    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  "  "    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  " "    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  "  "    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  ""    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  "  "    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  "-"    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  "  "    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  "     "    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  "   "    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  "   "    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  "  "    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-14 04:11:30                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-14 04:11:30  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-14 04:11:30                           Microsoft-Windows-Winlogon      7002:           
                4          2015-11-14 04:11:30  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-14 04:11:30  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-14 04:11:30                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-11-14 04:11:31                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-14 04:11:31                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-14 04:11:31                                  Service Control Manager         7036:  " "    .  
                        2015-11-14 04:11:31                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-14 04:11:31                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-14 04:11:31                                  Service Control Manager         7036:  "  WLAN"    .  
                103        2015-11-14 04:11:31                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-11-14 04:11:31                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-14 04:11:43                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-15 01:53:12                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-15 01:53:15                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-15 01:53:20                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-15 01:53:20                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-15 01:53:23                                  nvlddmkm                        
                        2015-11-15 01:53:23                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-15 01:53:23                                  EventLog                        6005:    .  
                        2015-11-15 01:53:23                                  EventLog                        6013:    11 .  
                        2015-11-15 01:53:23                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-15 01:53:23                                  Service Control Manager         7036:  ""    .  
                        2015-11-15 01:53:23                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-15 01:53:23                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-15 01:53:23                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-15 01:53:23                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 01:53:23                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 01:53:23                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-15 01:53:23                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-15 01:53:24                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-15 01:53:24                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-15 01:53:24                                  Service Control Manager         7036:  ""    .  
                        2015-11-15 01:53:24                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 01:53:24                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 01:53:24                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 01:53:24                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-15 01:53:24                                  Service Control Manager         7036:  "    "    .  
                        2015-11-15 01:53:24                                  Service Control Manager         7036:  "     "    .  
                        2015-11-15 01:53:24                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 01:53:24                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-15 01:53:24                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 01:53:25                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-15 01:53:25                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-15 01:53:25                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-15 01:53:25                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-15 01:53:25                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-15 01:53:25                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-15 01:53:25                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 01:53:25                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 01:53:25                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 01:53:25                                  Service Control Manager         7036:  "-"    .  
                        2015-11-15 01:53:25                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-15 01:53:25  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-15 01:53:25  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-15 01:53:26                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 01:53:26                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-15 01:53:26                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 01:53:26                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 01:53:26                                  Service Control Manager         7036:  "  "    .  
                1101       2015-11-15 01:53:26                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-15 01:53:27                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 01:53:27                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 01:53:27                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-15 01:53:27                                  Service Control Manager         7036:  ""    .  
                        2015-11-15 01:53:27                                  Service Control Manager         7036:  "    "    .  
                        2015-11-15 01:53:28                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-15 01:53:28                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-15 01:53:28                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 01:53:29                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 01:53:29                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-15 01:53:29                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-15 01:53:29                                  Service Control Manager         7036:  ""    .  
                        2015-11-15 01:53:30                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 01:53:30                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-15 01:53:31                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-15 01:53:31                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-15 01:53:31                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 01:53:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 01:53:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 01:53:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 01:53:31                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 01:53:31                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 01:53:31                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 01:53:31                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-15 01:53:33                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-15 01:53:33                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-15 01:53:33                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-11-15 01:53:36                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-11-15 01:53:38                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-15 01:54:13                                  Service Control Manager         7036:  "    "    .  
                        2015-11-15 01:54:13                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-15 01:54:14                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-15 01:55:30                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 01:55:31                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 01:55:31                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-15 01:55:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 01:55:33                                  Service Control Manager         7036:  "  Windows"    .  
                          2015-11-15 01:55:48  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     img01.taobaocdn.com        DNS.  
                        2015-11-15 01:56:26                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 01:56:30                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 01:56:30  LOCAL SERVICE                   Microsoft-Windows-Time-Service  37: NTP-         time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->23.102.23.44:123).  
                        2015-11-15 01:56:30  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-15 01:56:30  LOCAL SERVICE                   Microsoft-Windows-Time-Service  35:          time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->23.102.23.44:123).  
                        2015-11-15 01:56:30  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-15 01:56:30  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-15 01:56:32                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-15 01:56:58                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-15 01:57:08                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-15 01:57:58                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-15 01:58:27                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 01:59:03                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-15 02:00:20                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 02:03:23                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 02:09:51                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-11-15 02:23:22  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                          2015-11-15 02:23:31  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     img01.taobaocdn.com        DNS.  
                        2015-11-15 02:33:14                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 02:40:22                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 02:50:22                                  Service Control Manager         7036:  "   "    .  
                          2015-11-15 03:04:10  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-11-15 03:05:29  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                          2015-11-15 03:13:03  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     img04.taobaocdn.com.danuoyi.tbcache.com        DNS.  
                          2015-11-15 03:14:02  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     e8218.dscb1.akamaiedge.net        DNS.  
                          2015-11-15 03:28:45  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                        2015-11-15 09:48:04                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-15 09:48:07                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-15 09:48:17                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-15 09:48:17                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                63         2015-11-15 09:48:17                           Microsoft-Windows-Kernel-Power  41:  ,    .      ,    ,   ,    .  
                            2015-11-15 09:48:22                                  nvlddmkm                        
                            2015-11-15 09:48:23                                  EventLog                        6008:      3:36:06  ?15.?11.?2015  .  
                        2015-11-15 09:48:23                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-15 09:48:23                                  EventLog                        6005:    .  
                        2015-11-15 09:48:23                                  EventLog                        6013:    18 .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  ""    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  ""    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "    "    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "     "    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-15 09:48:23                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-15 09:48:23                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                        2015-11-15 09:48:23                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-15 09:48:23  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-15 09:48:23  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                7010       2015-11-15 09:48:23                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-15 09:48:24                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 09:48:24                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 09:48:24                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 09:48:24                                  Service Control Manager         7036:  "-"    .  
                1101       2015-11-15 09:48:24                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-15 09:48:25                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 09:48:25                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-15 09:48:25                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 09:48:25                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 09:48:25                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 09:48:25                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 09:48:26                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 09:48:26                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-15 09:48:26                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-15 09:48:26                                  Service Control Manager         7036:  ""    .  
                        2015-11-15 09:48:26                                  Service Control Manager         7036:  "    "    .  
                        2015-11-15 09:48:26                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-15 09:48:27                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-15 09:48:27                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 09:48:28                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 09:48:28                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-15 09:48:29                                  Service Control Manager         7036:  ""    .  
                        2015-11-15 09:48:29                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 09:48:34                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-15 09:48:34                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 09:48:34                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 09:48:34                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-15 09:48:34                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-15 09:48:34                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 09:48:34                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 09:48:34                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 09:48:35                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 09:48:35                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 09:48:35                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-15 09:48:36                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-15 09:48:36                                  Service Control Manager         7036:  "  PNP-"    .  
                7005       2015-11-15 09:48:39                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0001   : 0.  
                        2015-11-15 09:48:40                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-15 09:49:46                                  Service Control Manager         7036:  "    "    .  
                        2015-11-15 09:49:46                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-15 09:50:34                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-15 09:50:35                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 09:50:35                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 09:50:35                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-15 09:50:35                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 09:50:37                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 09:50:56                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-15 09:55:36                                  Service Control Manager         7036:  "  "    .  
                7005       2015-11-15 10:01:40                           Microsoft-Windows-UserPnp       20003:       USBSTOR      USB\VID_1058&PID_1010\57442D575833314138314D39363531   : 0.  
                7005       2015-11-15 10:01:40                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbstor.inf_x86_neutral_c77d41a490bdc63d\usbstor.inf      USB\VID_1058&PID_1010\57442D575833314138314D39363531   : 0x0.  
                        2015-11-15 10:01:41                                  Service Control Manager         7036:  "   "    .  
                7005       2015-11-15 10:01:41                           Microsoft-Windows-UserPnp       20003:       disk      USBSTOR\DISK&VEN_WD&PROD_2500BEV_EXTERNAL&REV_1.75\57442D575833314138314D39363531&0   : 0.  
                7005       2015-11-15 10:01:41                           Microsoft-Windows-UserPnp       20001:       FileRepository\disk.inf_x86_neutral_b431b61a11f8df6c\disk.inf      USBSTOR\DISK&VEN_WD&PROD_2500BEV_EXTERNAL&REV_1.75\57442D575833314138314D39363531&0   : 0x0.  
                7005       2015-11-15 10:01:42                           Microsoft-Windows-UserPnp       20003:       volsnap      STORAGE\VOLUME\{88DCD9B1-8B32-11E5-B152-0000DB4D6DEE}#0000000000100000   : 0.  
                7005       2015-11-15 10:01:42                           Microsoft-Windows-UserPnp       20001:       FileRepository\volume.inf_x86_neutral_6dee0205881d1a1d\volume.inf      STORAGE\VOLUME\{88DCD9B1-8B32-11E5-B152-0000DB4D6DEE}#0000000000100000   : 0x0.  
                        2015-11-15 10:02:27                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 10:03:41                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 10:20:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 10:21:28                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 10:21:28                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 10:27:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 10:28:25                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 10:31:15                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 10:31:29                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 10:37:16                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 10:44:17                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 10:44:48                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 10:49:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 10:54:48                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 10:59:35                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 11:09:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:09:39                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 11:09:39                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-15 11:09:41                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 11:10:45                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 11:12:58                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:15:58                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-15 11:21:47                           Service Control Manager         7040:    "  Windows"    ""  "".  
                        2015-11-15 11:21:48                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 11:21:48                           Service Control Manager         7040:    "  Windows"    ""  "".  
                        2015-11-15 11:23:15                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:23:15                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 11:23:15                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 11:25:43                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 11:28:56                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:29:10                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 11:29:17                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:31:07                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-15 11:32:02                           USER32                          1074:  wininit.exe   ""   VLADIMIR    NT AUTHORITY\  :        : 0x50006     :     :     "C:\Windows\system32\lsm.exe"    1.     .  
                        2015-11-15 11:32:18                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:34:19                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-15 11:34:22                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-15 11:34:27                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-15 11:34:27                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-15 11:34:36                                  nvlddmkm                        
                        2015-11-15 11:34:39                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-15 11:34:39                                  Service Control Manager         7036:  ""    .  
                7010       2015-11-15 11:34:39                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                            2015-11-15 11:34:40                                  EventLog                        6008:      11:32:02  ?15.?11.?2015  .  
                        2015-11-15 11:34:40                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-15 11:34:40                                  EventLog                        6005:    .  
                        2015-11-15 11:34:40                                  EventLog                        6013:    20 .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  ""    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "    "    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "     "    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-15 11:34:40                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:34:40                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                        2015-11-15 11:34:40                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-15 11:34:40  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-15 11:34:40  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-15 11:34:41                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 11:34:41                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 11:34:41                                  Service Control Manager         7036:  "-"    .  
                1101       2015-11-15 11:34:41                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-15 11:34:42                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:34:42                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-15 11:34:42                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 11:34:42                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-15 11:34:42                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 11:34:42                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:34:42                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 11:34:42                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-15 11:34:42                                  Service Control Manager         7036:  ""    .  
                        2015-11-15 11:34:42                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 11:34:42                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 11:34:42                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-15 11:34:42                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-15 11:34:42                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 11:34:42                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-15 11:34:42                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 11:34:42                                  Service Control Manager         7036:  ""    .  
                        2015-11-15 11:34:43                                  Service Control Manager         7036:  "    "    .  
                        2015-11-15 11:34:50                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-15 11:34:50                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-15 11:34:50                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-15 11:34:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:34:50                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 11:34:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:34:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:34:50                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 11:34:50                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 11:34:50                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 11:34:51                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-15 11:34:51                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-15 11:34:51                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-15 11:34:52                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-15 11:36:50                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-15 11:36:50                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 11:36:51                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:36:51                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-15 11:36:51                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:36:53                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 11:38:52  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-15 11:38:54                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 11:38:54  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-15 11:38:54                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-15 11:38:55                                  EventLog                        6006:    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  ""    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "-"    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "     "    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 11:38:55                                  Service Control Manager         7036:  " "    .  
                4          2015-11-15 11:38:55  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-15 11:38:55  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-15 11:38:55                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-15 11:38:55                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-15 11:38:56                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-15 11:38:56                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-15 11:38:56                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-15 11:39:04                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-15 20:04:55                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-15 20:04:58                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-15 20:05:03                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-15 20:05:03                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-15 20:05:06                                  nvlddmkm                        
                        2015-11-15 20:05:07                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-15 20:05:07                                  EventLog                        6005:    .  
                        2015-11-15 20:05:07                                  EventLog                        6013:    11 .  
                        2015-11-15 20:05:07                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-15 20:05:07                                  Service Control Manager         7036:  ""    .  
                        2015-11-15 20:05:07                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-15 20:05:07                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-15 20:05:07                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-15 20:05:07                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 20:05:07                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-15 20:05:07                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-15 20:05:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 20:05:08                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-15 20:05:08                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-15 20:05:08                                  Service Control Manager         7036:  ""    .  
                        2015-11-15 20:05:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 20:05:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 20:05:08                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 20:05:08                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-15 20:05:08                                  Service Control Manager         7036:  "    "    .  
                        2015-11-15 20:05:08                                  Service Control Manager         7036:  "     "    .  
                        2015-11-15 20:05:08                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 20:05:08                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-15 20:05:09                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 20:05:09                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-15 20:05:09                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-15 20:05:09                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-15 20:05:09                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-15 20:05:09                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-15 20:05:09                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-15 20:05:09                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 20:05:09                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 20:05:09                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 20:05:09                                  Service Control Manager         7036:  "-"    .  
                        2015-11-15 20:05:09                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-15 20:05:09  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-15 20:05:09  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-15 20:05:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 20:05:10                                  Service Control Manager         7036:  " Windows"    .  
                1101       2015-11-15 20:05:10                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-15 20:05:11                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 20:05:11                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 20:05:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 20:05:11                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 20:05:12                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-15 20:05:12                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-15 20:05:12                                  Service Control Manager         7036:  ""    .  
                        2015-11-15 20:05:12                                  Service Control Manager         7036:  "    "    .  
                        2015-11-15 20:05:13                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 20:05:13                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-15 20:05:13                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 20:05:14                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 20:05:14                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-15 20:05:14                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-15 20:05:14                                  Service Control Manager         7036:  ""    .  
                        2015-11-15 20:05:14                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 20:05:15                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-15 20:05:15                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 20:05:15                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 20:05:15                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-15 20:05:16                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 20:05:16                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 20:05:16                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 20:05:16                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-15 20:05:16                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 20:05:16                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 20:05:16                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-15 20:05:17                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-15 20:05:17                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-15 20:05:23                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-15 20:07:15                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-15 20:07:16                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 20:07:16                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 20:07:16                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-15 20:07:16                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 20:07:18                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 20:12:17                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 20:12:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 20:25:30                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 20:30:30                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 20:31:21                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 20:37:47                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 20:41:21                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 20:45:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 20:53:56                                  Service Control Manager         7036:  "    "    .  
                        2015-11-15 20:53:56                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-15 20:54:01                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 20:54:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 20:59:36                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 21:04:01                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 21:12:29                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 21:12:30                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 21:17:34                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 21:29:59                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 21:39:45                                  Service Control Manager         7036:  "  "    .  
                7005       2015-11-15 21:41:04                           Microsoft-Windows-UserPnp       20003:       usbccgp      USB\VID_1E4E&PID_0109\5&9965632&0&1   : 0.  
                7005       2015-11-15 21:41:05                           Microsoft-Windows-UserPnp       20001:       FileRepository\usb.inf_x86_neutral_2620fd493cad7d41\usb.inf      USB\VID_1E4E&PID_0109\5&9965632&0&1   : 0x0.  
                7005       2015-11-15 21:41:06                           Microsoft-Windows-UserPnp       20003:       usbaudio      USB\VID_1E4E&PID_0109&MI_02\6&1595670B&0&0002   : 0.  
                7005       2015-11-15 21:41:06                           Microsoft-Windows-UserPnp       20001:       FileRepository\wdma_usb.inf_x86_neutral_a721e4f3907a2769\wdma_usb.inf      USB\VID_1E4E&PID_0109&MI_02\6&1595670B&0&0002   : 0x0.  
                7005       2015-11-15 21:41:07                           Microsoft-Windows-UserPnp       20003:       usbvideo      USB\VID_1E4E&PID_0109&MI_00\6&1595670B&0&0000   : 0.  
                7005       2015-11-15 21:41:07                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbvideo.inf_x86_neutral_8fe3504355514e0c\usbvideo.inf      USB\VID_1E4E&PID_0109&MI_00\6&1595670B&0&0000   : 0x0.  
                        2015-11-15 21:45:44                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 21:45:44                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-15 21:45:46                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 21:45:47                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 21:46:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 21:48:47                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 21:51:47                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-15 22:15:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 22:25:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 22:47:30                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 22:52:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 23:57:31                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-15 23:58:06  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-15 23:58:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 23:58:09                                  EventLog                        6006:    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  ""    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  "-"    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  "     "    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  "   "    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  "  "    .  
                        2015-11-15 23:58:09                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-15 23:58:09  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-15 23:58:09                           Microsoft-Windows-Winlogon      7002:           
                4          2015-11-15 23:58:09  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-15 23:58:09  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-15 23:58:09                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-11-15 23:58:10                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-15 23:58:10                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-15 23:58:10                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-15 23:58:10                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-15 23:58:10                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-15 23:58:10                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-15 23:58:10                                  Service Control Manager         7036:  " "    .  
                        2015-11-15 23:58:10                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-15 23:58:10                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-11-15 23:58:10                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-15 23:58:22                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-16 11:09:47                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-16 11:09:50                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-16 11:09:55                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-16 11:09:55                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-16 11:09:58                                  nvlddmkm                        
                        2015-11-16 11:09:58                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-16 11:09:58                                  EventLog                        6005:    .  
                        2015-11-16 11:09:58                                  EventLog                        6013:    11 .  
                        2015-11-16 11:09:58                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-16 11:09:58                                  Service Control Manager         7036:  ""    .  
                        2015-11-16 11:09:58                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-16 11:09:58                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-16 11:09:58                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-16 11:09:58                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 11:09:58                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-16 11:09:58                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-16 11:09:59                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 11:09:59                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-16 11:09:59                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-16 11:09:59                                  Service Control Manager         7036:  ""    .  
                        2015-11-16 11:09:59                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 11:09:59                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 11:09:59                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-16 11:09:59                                  Service Control Manager         7036:  "    "    .  
                        2015-11-16 11:09:59                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 11:09:59                                  Service Control Manager         7036:  "     "    .  
                        2015-11-16 11:09:59                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 11:09:59                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-16 11:10:00                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 11:10:00                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-16 11:10:00                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-16 11:10:00                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-16 11:10:00                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-16 11:10:00                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-16 11:10:00                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-16 11:10:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 11:10:00                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 11:10:00                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 11:10:00                                  Service Control Manager         7036:  "-"    .  
                        2015-11-16 11:10:00                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-16 11:10:00  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-16 11:10:00  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-16 11:10:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 11:10:01                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-16 11:10:01                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 11:10:01                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 11:10:01                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 11:10:01                                  Service Control Manager         7036:  "  "    .  
                1101       2015-11-16 11:10:01                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-16 11:10:02                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 11:10:02                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-16 11:10:02                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-16 11:10:03                                  Service Control Manager         7036:  ""    .  
                        2015-11-16 11:10:03                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-16 11:10:03                                  Service Control Manager         7036:  "    "    .  
                        2015-11-16 11:10:03                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-16 11:10:03                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 11:10:05                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 11:10:05                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-16 11:10:05                                  Service Control Manager         7036:  ""    .  
                        2015-11-16 11:10:05                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 11:10:06                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-16 11:10:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 11:10:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 11:10:06                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-16 11:10:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 11:10:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 11:10:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 11:10:06                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 11:10:06                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-16 11:10:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 11:10:06                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-16 11:10:08                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-16 11:10:08                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-16 11:10:14                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-16 11:12:06                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-16 11:12:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 11:12:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 11:12:06                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-16 11:12:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 11:12:08                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 11:15:15                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 11:17:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 11:19:02                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-16 11:19:19                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-16 11:19:29                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-16 11:20:11                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 11:20:19                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-16 11:31:24                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 11:36:24                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 11:50:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 12:00:08                                  EventLog                        6013:    3020 .  
                        2015-11-16 12:16:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 12:16:32                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-16 12:16:33                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 12:16:34                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 12:19:18                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-16 12:19:29                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-16 12:19:34                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 12:19:39                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-16 12:20:29                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-16 12:22:34                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                            2015-11-16 12:27:06                                  ipnathlp                        
                        2015-11-16 12:27:07                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 12:27:07                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-11-16 12:27:19  LOCAL SERVICE                   Microsoft-Windows-Time-Service  134: NTP-           -   DNS-  "". NTP-    3473457 .,      . :   ,      . (0x80072AFC)  
                          2015-11-16 12:27:19  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     time.windows.com        DNS.  
                        2015-11-16 12:28:19                                  Service Control Manager         7036:  "    "    .  
                        2015-11-16 12:28:19                           Microsoft-Windows-Application-Experience  201:       .  
                          2015-11-16 12:28:43  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     api.accounts.firefox.com        DNS.  
                        2015-11-16 12:29:09                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-16 12:29:09                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-16 12:29:09                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-11-16 12:29:11  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.google.com        DNS.  
                            2015-11-16 12:29:51                                  ipnathlp                        
                        2015-11-16 12:29:53                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-11-16 12:41:15  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     dns.msftncsi.com        DNS.  
                          2015-11-16 12:42:31  LOCAL SERVICE                   Microsoft-Windows-Time-Service  134: NTP-           -   DNS-  "". NTP-    3473457 .,      . :   ,      . (0x80072AFC)  
                          2015-11-16 12:44:54  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     fhr.data.mozilla.com        DNS.  
                        2015-11-16 12:45:07                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-11-16 12:46:28  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-11-16 12:51:19  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     top-fwz1.mail.ru        DNS.  
                          2015-11-16 12:57:01  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-11-16 13:01:28  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     safebrowsing.google.com        DNS.  
                          2015-11-16 13:06:43  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-11-16 13:11:44  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-11-16 13:16:47  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-11-16 13:19:28                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-16 13:20:30                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-16 13:20:40                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-16 13:21:30                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                          2015-11-16 13:21:45  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-11-16 13:26:46  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-11-16 13:31:55  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-11-16 13:36:49  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-11-16 13:41:17  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-11-16 13:46:19  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-11-16 13:51:44  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-11-16 13:56:49  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-11-16 14:01:32  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-11-16 14:05:54                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-16 14:05:55                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-16 14:05:55                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                            2015-11-16 14:06:57                                  ipnathlp                        
                        2015-11-16 14:07:00                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                          2015-11-16 14:07:09  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-11-16 14:12:17  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-11-16 14:17:18  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-11-16 14:22:32  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-11-16 14:24:00                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-16 14:25:02                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-16 14:25:12                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-16 14:26:02                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                          2015-11-16 14:27:40  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                          2015-11-16 14:32:49  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-11-16 14:35:50                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-16 14:35:51                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-16 14:35:51                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-11-16 14:43:07  LOCAL SERVICE                   Microsoft-Windows-Time-Service  134: NTP-           -   DNS-  "". NTP-    3473457 .,      . :   ,      . (0x80072AFC)  
                        2015-11-16 15:09:26                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 15:09:26  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-16 15:09:28                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 15:09:28  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-16 15:09:28                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-16 15:09:29                                  EventLog                        6006:    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  ""    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "-"    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "     "    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-16 15:09:29                                  Service Control Manager         7036:  " "    .  
                4          2015-11-16 15:09:29  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-16 15:09:29  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-16 15:09:29                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-16 15:09:29                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-16 15:09:30                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-16 15:09:30                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-16 15:09:42                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-16 15:47:52                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-16 15:47:55                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-16 15:48:00                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-16 15:48:00                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-16 15:48:03                                  nvlddmkm                        
                        2015-11-16 15:48:03                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-16 15:48:03                                  EventLog                        6005:    .  
                        2015-11-16 15:48:03                                  EventLog                        6013:    11 .  
                        2015-11-16 15:48:03                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-16 15:48:03                                  Service Control Manager         7036:  ""    .  
                        2015-11-16 15:48:03                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-16 15:48:03                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-16 15:48:03                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-16 15:48:03                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 15:48:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 15:48:03                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-16 15:48:03                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-16 15:48:04                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-16 15:48:04                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-16 15:48:04                                  Service Control Manager         7036:  ""    .  
                        2015-11-16 15:48:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 15:48:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 15:48:04                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-16 15:48:04                                  Service Control Manager         7036:  "    "    .  
                        2015-11-16 15:48:04                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 15:48:04                                  Service Control Manager         7036:  "     "    .  
                        2015-11-16 15:48:04                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 15:48:04                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-16 15:48:04                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 15:48:05                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-16 15:48:05                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-16 15:48:05                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-16 15:48:05                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-16 15:48:05                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-16 15:48:05                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-16 15:48:05                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 15:48:05                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 15:48:05                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 15:48:05                                  Service Control Manager         7036:  "-"    .  
                        2015-11-16 15:48:05                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-16 15:48:05  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-16 15:48:05  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-16 15:48:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 15:48:06                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-16 15:48:06                                  Service Control Manager         7036:  " "    .  
                1101       2015-11-16 15:48:06                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-16 15:48:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 15:48:07                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 15:48:08                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-16 15:48:08                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 15:48:09                                  Service Control Manager         7036:  ""    .  
                        2015-11-16 15:48:09                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-16 15:48:09                                  Service Control Manager         7036:  "    "    .  
                        2015-11-16 15:48:09                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-16 15:48:09                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 15:48:10                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 15:48:10                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 15:48:11                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-16 15:48:11                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-16 15:48:11                                  Service Control Manager         7036:  ""    .  
                        2015-11-16 15:48:11                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 15:48:12                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-16 15:48:12                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-16 15:48:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 15:48:12                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 15:48:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 15:48:12                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 15:48:13                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 15:48:13                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 15:48:13                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-16 15:48:13                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 15:48:13                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-16 15:48:16                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-16 15:48:16                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-16 15:48:20                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-16 15:50:12                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-16 15:50:12                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 15:50:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 15:50:13                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-16 15:50:13                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 15:50:15                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 15:55:14                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 15:55:23                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 16:01:12                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 16:14:42                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 16:14:42                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 16:19:57                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 16:22:48                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 16:24:54                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 16:27:51                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 16:28:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 16:39:44                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 16:39:44                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-16 16:42:45                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 16:45:45                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-16 17:03:36                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 17:03:36  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-16 17:03:39                                  EventLog                        6006:    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  ""    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "-"    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "     "    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 17:03:39                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-16 17:03:39  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-16 17:03:39                           Microsoft-Windows-Winlogon      7002:           
                4          2015-11-16 17:03:39  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-16 17:03:39  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-16 17:03:39                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-16 17:03:39                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-16 17:03:40                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-16 17:03:40                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-16 17:03:45                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-16 18:57:14                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-16 18:57:17                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-16 18:57:21                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-16 18:57:21                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-16 18:57:24                                  nvlddmkm                        
                        2015-11-16 18:57:25                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-16 18:57:25                                  EventLog                        6005:    .  
                        2015-11-16 18:57:25                                  EventLog                        6013:    10 .  
                        2015-11-16 18:57:25                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-16 18:57:25                                  Service Control Manager         7036:  ""    .  
                        2015-11-16 18:57:25                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-16 18:57:25                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-16 18:57:25                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-16 18:57:25                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 18:57:25                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 18:57:25                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-16 18:57:25                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-16 18:57:25                                  Service Control Manager         7036:  ""    .  
                        2015-11-16 18:57:25                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-16 18:57:25                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-16 18:57:26                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 18:57:26                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 18:57:26                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-16 18:57:26                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 18:57:26                                  Service Control Manager         7036:  "    "    .  
                        2015-11-16 18:57:26                                  Service Control Manager         7036:  "     "    .  
                        2015-11-16 18:57:26                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 18:57:26                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-16 18:57:26                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 18:57:26                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-16 18:57:26                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-16 18:57:26                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-16 18:57:26                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-16 18:57:26                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-16 18:57:26                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-16 18:57:26                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 18:57:26                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 18:57:26                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 18:57:26                                  Service Control Manager         7036:  "-"    .  
                        2015-11-16 18:57:26                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-16 18:57:26  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-16 18:57:26  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-16 18:57:27                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 18:57:27                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-16 18:57:27                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 18:57:27                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 18:57:27                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 18:57:27                                  Service Control Manager         7036:  "  "    .  
                1101       2015-11-16 18:57:27                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-16 18:57:28                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 18:57:28                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-16 18:57:29                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-16 18:57:29                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-16 18:57:29                                  Service Control Manager         7036:  ""    .  
                        2015-11-16 18:57:29                                  Service Control Manager         7036:  "    "    .  
                        2015-11-16 18:57:29                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-16 18:57:29                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 18:57:30                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 18:57:30                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-16 18:57:30                                  Service Control Manager         7036:  ""    .  
                        2015-11-16 18:57:30                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 18:57:31                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-16 18:57:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 18:57:32                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 18:57:32                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-16 18:57:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 18:57:32                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-16 18:57:32                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 18:57:32                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 18:57:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 18:57:32                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 18:57:32                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-16 18:57:35                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-16 18:57:35                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-16 18:57:38                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-16 18:59:31                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-16 18:59:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 18:59:32                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 18:59:32                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-16 18:59:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 18:59:34                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 19:02:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 19:04:34                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 19:07:36                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 19:08:29                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 19:08:48                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 19:09:08                                  Service Control Manager         7036:  "   "    .  
                          2015-11-16 19:09:08                                  Disk                            51:     \Device\Harddisk3\DR3      .  
                          2015-11-16 19:09:43                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-11-16 19:09:43                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-11-16 19:09:43                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-11-16 19:09:43                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-11-16 19:09:43                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-11-16 19:09:43                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-11-16 19:09:43                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                          2015-11-16 19:09:43                                  Disk                            51:     \Device\Harddisk3\DR4      .  
                        2015-11-16 19:11:03  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-16 19:11:06                                  EventLog                        6006:    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  ""    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "-"    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "     "    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-16 19:11:06                                  Service Control Manager         7036:  " "    .  
                        2015-11-16 19:11:06  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-16 19:11:06                           Microsoft-Windows-Winlogon      7002:           
                4          2015-11-16 19:11:06  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-16 19:11:06  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                          2015-11-16 19:11:06                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-16 19:11:07                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-16 19:11:07                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-16 19:11:07                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-16 19:11:07                                  Microsoft-Windows-Kernel-Power  109:      .  
                7010       2015-11-16 19:11:07                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-11-16 19:11:10                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-17 06:37:48                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-17 06:37:51                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-17 06:37:56                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-17 06:37:56                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-17 06:37:58                                  nvlddmkm                        
                        2015-11-17 06:37:59                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-17 06:37:59                                  EventLog                        6005:    .  
                        2015-11-17 06:37:59                                  EventLog                        6013:    11 .  
                        2015-11-17 06:37:59                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-17 06:37:59                                  Service Control Manager         7036:  ""    .  
                        2015-11-17 06:37:59                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-17 06:37:59                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-17 06:37:59                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-17 06:37:59                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-17 06:37:59                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 06:37:59                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-17 06:37:59                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-17 06:38:00                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-17 06:38:00                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-17 06:38:00                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 06:38:00                                  Service Control Manager         7036:  ""    .  
                        2015-11-17 06:38:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 06:38:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 06:38:00                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-17 06:38:00                                  Service Control Manager         7036:  "    "    .  
                        2015-11-17 06:38:00                                  Service Control Manager         7036:  "     "    .  
                        2015-11-17 06:38:00                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 06:38:00                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-17 06:38:00                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 06:38:00                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-17 06:38:00                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-17 06:38:00                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-17 06:38:00                                  Service Control Manager         7036:  "    (EAP)"    .  
                4          2015-11-17 06:38:00  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-17 06:38:00  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-17 06:38:01                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-17 06:38:01                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-17 06:38:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 06:38:01                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 06:38:01                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 06:38:01                                  Service Control Manager         7036:  "-"    .  
                        2015-11-17 06:38:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 06:38:01                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                        2015-11-17 06:38:02                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-17 06:38:02                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 06:38:02                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 06:38:02                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 06:38:02                                  Service Control Manager         7036:  "  "    .  
                1101       2015-11-17 06:38:02                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-17 06:38:03                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-17 06:38:03                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-17 06:38:03                                  Service Control Manager         7036:  ""    .  
                        2015-11-17 06:38:03                                  Service Control Manager         7036:  "    "    .  
                        2015-11-17 06:38:04                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-17 06:38:04                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 06:38:04                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 06:38:04                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-17 06:38:05                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-17 06:38:05                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-17 06:38:05                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 06:38:05                                  Service Control Manager         7036:  ""    .  
                        2015-11-17 06:38:06                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-17 06:38:06                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-17 06:38:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 06:38:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 06:38:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 06:38:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 06:38:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 06:38:06                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 06:38:06                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-17 06:38:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 06:38:06                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-17 06:38:07                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-17 06:38:07                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-17 06:38:08                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-17 06:38:13                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-17 06:38:18                                  Service Control Manager         7036:  "    "    .  
                        2015-11-17 06:38:18                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-17 06:38:20                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-17 06:39:32                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-17 06:40:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 06:40:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 06:40:07                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-17 06:40:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 06:40:09                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-17 06:43:13                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 06:45:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 06:47:03                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-17 06:47:42                                  Service Control Manager         7036:  "    (BITS)"    .  
                        2015-11-17 06:47:42                           Service Control Manager         7040:    "    (BITS)"    ""  "".  
                          2015-11-17 06:49:00  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     2x2.su        DNS.  
                        2015-11-17 06:49:30                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-17 06:49:35                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 06:49:59                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-17 06:50:30                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-17 06:56:35                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 06:56:36                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 07:01:24                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 07:03:24                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 07:03:38                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-17 07:06:24                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 07:06:35                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 07:07:34  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-17 07:07:35                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 07:07:37                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-17 07:07:37  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-17 07:07:37                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-17 07:07:38                                  EventLog                        6006:    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  ""    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "-"    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "     "    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-17 07:07:38                                  Service Control Manager         7036:  " "    .  
                4          2015-11-17 07:07:38  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-17 07:07:38  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-17 07:07:38                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-11-17 07:07:39                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-17 07:07:39                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-17 07:07:39                                  Service Control Manager         7036:  "  PNP-"    .  
                103        2015-11-17 07:07:39                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-11-17 07:07:39                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-17 07:07:48                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-17 17:40:08                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-17 17:40:11                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-17 17:40:16                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-17 17:40:16                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-17 17:40:19                                  nvlddmkm                        
                        2015-11-17 17:40:19                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-17 17:40:19                                  EventLog                        6005:    .  
                        2015-11-17 17:40:19                                  EventLog                        6013:    11 .  
                        2015-11-17 17:40:19                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-17 17:40:19                                  Service Control Manager         7036:  ""    .  
                        2015-11-17 17:40:19                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-17 17:40:19                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-17 17:40:19                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-17 17:40:19                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-17 17:40:19                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-17 17:40:19                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-17 17:40:20                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 17:40:20                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-17 17:40:20                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-17 17:40:20                                  Service Control Manager         7036:  ""    .  
                        2015-11-17 17:40:20                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 17:40:20                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 17:40:20                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 17:40:20                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-17 17:40:20                                  Service Control Manager         7036:  "    "    .  
                        2015-11-17 17:40:20                                  Service Control Manager         7036:  "     "    .  
                        2015-11-17 17:40:20                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 17:40:21                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-17 17:40:21                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 17:40:21                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-17 17:40:21                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-17 17:40:21                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-17 17:40:21                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-17 17:40:21                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-17 17:40:21                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-17 17:40:21                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 17:40:21                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 17:40:21                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 17:40:21                                  Service Control Manager         7036:  "-"    .  
                        2015-11-17 17:40:21                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 17:40:21                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-17 17:40:21  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-17 17:40:21  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                1101       2015-11-17 17:40:22                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-17 17:40:23                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-17 17:40:23                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 17:40:23                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 17:40:23                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 17:40:23                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 17:40:23                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 17:40:23                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-17 17:40:24                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-17 17:40:24                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-17 17:40:24                                  Service Control Manager         7036:  ""    .  
                        2015-11-17 17:40:24                                  Service Control Manager         7036:  "    "    .  
                        2015-11-17 17:40:25                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 17:40:25                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-17 17:40:26                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-17 17:40:26                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-17 17:40:27                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 17:40:27                                  Service Control Manager         7036:  ""    .  
                        2015-11-17 17:40:28                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-17 17:40:28                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 17:40:29                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 17:40:29                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 17:40:29                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-17 17:40:29                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 17:40:29                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-17 17:40:29                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 17:40:29                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 17:40:29                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 17:40:29                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-17 17:40:30                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-17 17:40:30                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-17 17:40:31                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                7005       2015-11-17 17:40:36                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-11-17 17:40:37                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-17 17:41:02                                  Service Control Manager         7036:  "    "    .  
                        2015-11-17 17:41:02                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-17 17:41:04                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-17 17:42:29                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 17:42:32                                  Service Control Manager         7036:  "    (BITS)"    .  
                        2015-11-17 17:42:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 17:42:33                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-17 17:42:33                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 17:42:35                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-17 17:45:37                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 17:47:34                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 17:48:39                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-17 17:50:34                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 17:57:01                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-17 18:20:23                                  Service Control Manager         7036:  "  "    .  
                          2015-11-17 18:30:55  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     teredo.ipv6.microsoft.com        DNS.  
                        2015-11-17 18:42:32                           Service Control Manager         7040:    "    (BITS)"    ""  "".  
                        2015-11-17 18:51:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 18:51:53                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-17 18:54:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 18:57:07                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-17 18:57:07                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-17 18:57:07                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-11-17 18:57:55                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-17 19:09:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 19:09:01  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-17 19:09:04                                  EventLog                        6006:    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  ""    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  "-"    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  "     "    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-17 19:09:04                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-17 19:09:04  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-17 19:09:04                           Microsoft-Windows-Winlogon      7002:           
                4          2015-11-17 19:09:04  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-17 19:09:04  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-17 19:09:04                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-17 19:09:04                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-17 19:09:05                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-17 19:09:05                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-17 19:09:05                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-17 19:09:05                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 19:09:05                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-17 19:09:05                                  Service Control Manager         7036:  "  PNP-"    .  
                103        2015-11-17 19:09:06                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-17 19:09:11                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-17 23:43:55                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-17 23:43:58                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-17 23:44:03                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-17 23:44:03                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-17 23:44:05                                  nvlddmkm                        
                        2015-11-17 23:44:06                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-17 23:44:06                                  EventLog                        6005:    .  
                        2015-11-17 23:44:06                                  EventLog                        6013:    10 .  
                        2015-11-17 23:44:06                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-17 23:44:06                                  Service Control Manager         7036:  ""    .  
                        2015-11-17 23:44:06                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-17 23:44:06                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-17 23:44:06                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-17 23:44:06                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-17 23:44:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 23:44:06                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-17 23:44:06                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-17 23:44:06                                  Service Control Manager         7036:  ""    .  
                        2015-11-17 23:44:06                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-17 23:44:06                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-17 23:44:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 23:44:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 23:44:07                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 23:44:07                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-17 23:44:07                                  Service Control Manager         7036:  "    "    .  
                        2015-11-17 23:44:07                                  Service Control Manager         7036:  "     "    .  
                        2015-11-17 23:44:07                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 23:44:07                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-17 23:44:07                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 23:44:07                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-17 23:44:07                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-17 23:44:07                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-17 23:44:07                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-17 23:44:07                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-17 23:44:07                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-17 23:44:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 23:44:07                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-17 23:44:07  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-17 23:44:07  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-17 23:44:08                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 23:44:08                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 23:44:08                                  Service Control Manager         7036:  "-"    .  
                        2015-11-17 23:44:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 23:44:08                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-17 23:44:08                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 23:44:08                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 23:44:08                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 23:44:08                                  Service Control Manager         7036:  "  "    .  
                1101       2015-11-17 23:44:08                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-17 23:44:09                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 23:44:09                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-17 23:44:09                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-17 23:44:09                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-17 23:44:09                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-17 23:44:09                                  Service Control Manager         7036:  ""    .  
                        2015-11-17 23:44:09                                  Service Control Manager         7036:  "    "    .  
                        2015-11-17 23:44:10                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 23:44:10                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-17 23:44:11                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-17 23:44:11                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 23:44:11                                  Service Control Manager         7036:  ""    .  
                        2015-11-17 23:44:12                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-17 23:44:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 23:44:12                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-17 23:44:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 23:44:12                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 23:44:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 23:44:12                                  Service Control Manager         7036:  " "    .  
                        2015-11-17 23:44:12                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-17 23:44:12                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 23:44:12                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 23:44:12                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-17 23:44:15                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-17 23:44:15                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-17 23:44:19                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-17 23:46:12                                  Service Control Manager         7036:  "   "    .  
                        2015-11-17 23:46:12                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-17 23:46:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 23:46:13                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-17 23:46:13                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 23:46:15                                  Service Control Manager         7036:  "  Windows"    .  
                            2015-11-17 23:47:12                                  ipnathlp                        
                        2015-11-17 23:47:13                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-17 23:49:18                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 23:50:10                                  Service Control Manager         7036:  "    "    .  
                        2015-11-17 23:50:10                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-17 23:51:14                                  Service Control Manager         7036:  "  "    .  
                        2015-11-17 23:54:17                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 00:03:43                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-18 00:21:57                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-18 00:24:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 00:32:27                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 00:33:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 00:34:44                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-18 00:34:45                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-18 00:34:45                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-11-18 00:35:18                                  Application Popup               26:   : Brothers.exe -   :   ,      MSVCR100.dll.   .   
                        2015-11-18 00:35:30                                  Application Popup               26:   : Brothers.exe -   :   ,      MSVCR100.dll.   .   
                        2015-11-18 00:35:49                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-18 00:40:57                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 00:48:32                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 00:50:14                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-18 00:50:15                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 00:50:15                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-18 00:50:15                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                          2015-11-18 00:50:24  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     sync-256-us-west-2.sync.services.mozilla.com        DNS.  
                        2015-11-18 00:50:59                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-18 00:51:21                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-18 00:51:32                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-18 00:51:55                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-18 00:52:07                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-18 00:52:21                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-18 00:53:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 00:53:14                                  Application Popup               26:   : trine2_32bit.exe -   :   ,      d3dx9_38.dll.   .   
                        2015-11-18 00:53:24  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-18 00:53:27                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-18 00:53:27                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 00:53:27                                  Service Control Manager         7036:  " "    .  
                        2015-11-18 00:53:27  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-18 00:53:27                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-18 00:53:28                                  EventLog                        6006:    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  ""    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  "-"    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  "     "    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-18 00:53:28                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                4          2015-11-18 00:53:28  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-18 00:53:28  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-18 00:53:28                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-18 00:53:28                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-18 00:53:29                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-18 00:53:29                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-18 00:53:29                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 00:53:29                                  Service Control Manager         7036:  " "    .  
                        2015-11-18 00:53:29                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-18 00:53:30                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-18 00:53:30                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-18 00:53:36                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-18 18:53:15                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-18 18:53:18                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-18 18:53:23                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-18 18:53:23                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-18 18:53:25                                  nvlddmkm                        
                        2015-11-18 18:53:35                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-18 18:53:35                                  EventLog                        6005:    .  
                        2015-11-18 18:53:35                                  EventLog                        6013:    19 .  
                        2015-11-18 18:53:35                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-18 18:53:35                                  Service Control Manager         7036:  ""    .  
                        2015-11-18 18:53:35                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-18 18:53:35                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-18 18:53:35                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-18 18:53:35                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-18 18:53:35                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 18:53:35                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-18 18:53:35                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-18 18:53:35                                  Service Control Manager         7036:  ""    .  
                        2015-11-18 18:53:35                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 18:53:35                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 18:53:35                                  Service Control Manager         7036:  " "    .  
                        2015-11-18 18:53:35                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-18 18:53:35                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-18 18:53:36                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-18 18:53:36                                  Service Control Manager         7036:  "    "    .  
                        2015-11-18 18:53:36                                  Service Control Manager         7036:  "     "    .  
                        2015-11-18 18:53:36                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 18:53:36                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-18 18:53:36                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 18:53:36                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-18 18:53:36                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-18 18:53:36                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-18 18:53:36                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-18 18:53:36                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-18 18:53:36                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-18 18:53:36                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 18:53:36                                  Service Control Manager         7036:  " "    .  
                        2015-11-18 18:53:36                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-11-18 18:53:36                           Microsoft-Windows-Winlogon      7001:           
                4          2015-11-18 18:53:36  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-18 18:53:36  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-18 18:53:37                                  Service Control Manager         7036:  " "    .  
                        2015-11-18 18:53:37                                  Service Control Manager         7036:  "-"    .  
                        2015-11-18 18:53:37                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 18:53:37                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-18 18:53:37                                  Service Control Manager         7036:  " "    .  
                        2015-11-18 18:53:37                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 18:53:37                                  Service Control Manager         7036:  " "    .  
                        2015-11-18 18:53:37                                  Service Control Manager         7036:  " "    .  
                        2015-11-18 18:53:37                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-18 18:53:37                                  Service Control Manager         7036:  " "    .  
                        2015-11-18 18:53:37                                  Service Control Manager         7036:  "    "    .  
                        2015-11-18 18:53:37                                  Service Control Manager         7036:  ""    .  
                        2015-11-18 18:53:37                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-18 18:53:37                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 18:53:37                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-18 18:53:37                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-18 18:53:37                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-18 18:53:37                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-18 18:53:37                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 18:53:37                                  Service Control Manager         7036:  ""    .  
                        2015-11-18 18:53:39                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-18 18:53:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 18:53:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 18:53:39                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-18 18:53:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 18:53:39                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-18 18:53:39                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 18:53:39                                  Service Control Manager         7036:  " "    .  
                        2015-11-18 18:53:39                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 18:53:39                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 18:53:39                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-18 18:53:40                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-18 18:53:40                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-18 18:53:44                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-18 18:55:39                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-18 18:55:39                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 18:55:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 18:55:39                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-18 18:55:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 18:55:41                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-18 18:56:41                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-18 18:56:59                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-18 18:57:09                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-18 18:57:59                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-18 19:00:41                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 19:04:42                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 19:05:27                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 19:10:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 19:21:27                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 19:23:56                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 19:32:40                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 19:33:37                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 19:43:02                                  Service Control Manager         7036:  " "    .  
                        2015-11-18 19:53:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 19:53:00                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-18 19:56:02                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 19:56:13                                  Service Control Manager         7036:  " "    .  
                        2015-11-18 19:58:36                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-18 19:58:52                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-18 19:59:02                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-18 19:59:02                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-18 19:59:52                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-18 20:00:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 20:11:48                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 20:27:56                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 20:37:56                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 20:58:57                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-18 20:59:14                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-18 20:59:24                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-18 21:00:14                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-18 21:15:54                                  Service Control Manager         7036:  " "    .  
                        2015-11-18 21:50:56                                  Service Control Manager         7036:  " "    .  
                        2015-11-18 23:01:14                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 23:04:47                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 23:09:17                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 23:17:38                                  Service Control Manager         7036:  "   "    .  
                        2015-11-18 23:18:30                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 23:23:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 23:33:21                                  Service Control Manager         7036:  "  "    .  
                        2015-11-18 23:38:22                                  Service Control Manager         7036:  "  "    .  
                        2015-11-19 00:05:20                                  Service Control Manager         7036:  "  "    .  
                        2015-11-19 00:06:01                                  Service Control Manager         7036:  "   "    .  
                        2015-11-19 00:10:46  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-19 00:10:49                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-19 00:10:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-19 00:10:49  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-19 00:10:49                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-19 00:10:50                                  EventLog                        6006:    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  " "    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  ""    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  "-"    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  "   "    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  "     "    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  "   "    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-19 00:10:50                                  Service Control Manager         7036:  "  WLAN"    .  
                4          2015-11-19 00:10:50  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-19 00:10:50  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-19 00:10:50                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-19 00:10:50                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-19 00:10:51                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-19 00:10:51                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-19 00:10:51                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-19 00:10:51                                  Service Control Manager         7036:  " "    .  
                        2015-11-19 00:10:52                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-19 00:10:53                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-19 00:10:53                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-19 00:11:05                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-21 05:21:33                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-21 05:21:36                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-21 05:21:42                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-21 05:21:42                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-21 05:21:45                                  nvlddmkm                        
                        2015-11-21 05:21:45                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-21 05:21:45                                  EventLog                        6005:    .  
                        2015-11-21 05:21:45                                  EventLog                        6013:    12 .  
                        2015-11-21 05:21:45                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-21 05:21:45                                  Service Control Manager         7036:  ""    .  
                        2015-11-21 05:21:45                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-21 05:21:45                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-21 05:21:45                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-21 05:21:45                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-21 05:21:45                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-21 05:21:45                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-21 05:21:46                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 05:21:47                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-21 05:21:47                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-21 05:21:47                                  Service Control Manager         7036:  ""    .  
                        2015-11-21 05:21:47                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 05:21:47                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 05:21:47                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-21 05:21:47                                  Service Control Manager         7036:  "    "    .  
                        2015-11-21 05:21:47                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 05:21:47                                  Service Control Manager         7036:  "     "    .  
                        2015-11-21 05:21:47                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 05:21:47                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-21 05:21:47                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-21 05:21:47                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 05:21:47                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-21 05:21:47                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-21 05:21:47                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-21 05:21:47                                  Service Control Manager         7036:  "DNS-"    .  
                4          2015-11-21 05:21:47  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-21 05:21:47  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-21 05:21:48                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-21 05:21:48                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 05:21:48                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 05:21:48                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 05:21:48                                  Service Control Manager         7036:  "-"    .  
                        2015-11-21 05:21:48                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 05:21:48                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-21 05:21:48                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 05:21:48                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-11-21 05:21:48                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-21 05:21:49                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 05:21:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 05:21:49                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 05:21:49                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 05:21:49                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-21 05:21:49                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-21 05:21:49                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-21 05:21:49                                  Service Control Manager         7036:  ""    .  
                        2015-11-21 05:21:51                                  Service Control Manager         7036:  "    "    .  
                        2015-11-21 05:21:51                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 05:21:51                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-21 05:21:52                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-21 05:21:53                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-21 05:21:53                                  Service Control Manager         7036:  ""    .  
                        2015-11-21 05:21:53                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 05:21:55                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-21 05:21:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 05:21:55                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 05:21:55                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-21 05:21:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 05:21:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 05:21:55                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 05:21:55                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-21 05:21:55                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 05:21:55                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 05:21:55                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-21 05:21:58                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-21 05:21:58                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-21 05:22:03                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-21 05:23:55                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-21 05:23:55                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 05:23:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 05:23:56                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-21 05:23:56                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 05:23:58                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-21 05:25:54                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-21 05:26:12                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-21 05:26:22                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-21 05:27:12                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-21 05:27:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 05:28:57                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 05:34:39                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 05:56:47                                  Service Control Manager         7036:  "    "    .  
                        2015-11-21 05:56:47                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-21 06:01:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 06:11:26                                  Service Control Manager         7036:  "  "    .  
                1          2015-11-21 06:11:26  LOCAL SERVICE                   WudfUsbccidDriver               
                1          2015-11-21 06:11:26  LOCAL SERVICE                   WudfUsbccidDriver               
                        2015-11-21 06:11:27                                  Service Control Manager         7036:  "   "    .  
                            2015-11-21 06:11:28                                  SCardSvr                        
                    1          2015-11-21 06:11:28  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-11-21 06:11:28  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-11-21 06:11:28  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-11-21 06:11:28  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-11-21 06:11:28  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-11-21 06:11:28  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-11-21 06:11:28  LOCAL SERVICE                   WudfUsbccidDriver               
                            2015-11-21 06:11:29                                  SCardSvr                        
                            2015-11-21 06:11:29                                  SCardSvr                        
                    1          2015-11-21 06:11:29  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-11-21 06:11:29  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-11-21 06:11:29  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-11-21 06:11:29  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-11-21 06:11:29  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-11-21 06:11:29  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-11-21 06:11:29  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-11-21 06:11:29  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-11-21 06:11:29  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-11-21 06:11:29  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-11-21 06:11:29  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-11-21 06:11:29  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-11-21 06:11:29  LOCAL SERVICE                   WudfUsbccidDriver               
                    1          2015-11-21 06:11:29  LOCAL SERVICE                   WudfUsbccidDriver               
                        2015-11-21 06:18:27                                  Service Control Manager         7036:  "  "    .  
                            2015-11-21 06:20:33                                  SCardSvr                        
                    1          2015-11-21 06:20:33  LOCAL SERVICE                   WudfUsbccidDriver               
                        2015-11-21 06:20:33                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 06:22:34                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 06:26:12                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-21 06:26:28                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-21 06:26:38                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-21 06:27:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 06:27:28                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-21 06:47:57                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 06:54:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 06:54:53                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-21 06:57:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 07:00:55                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-21 07:26:35                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-21 07:26:46                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-21 07:26:56                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-21 07:27:45                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 07:27:46                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-21 08:26:45                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-21 08:26:56                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-21 08:27:06                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-21 08:27:56                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-21 08:47:23  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-21 08:47:24                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 08:47:26                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-21 08:47:26                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 08:47:26  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-21 08:47:26                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  ""    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "     "    .  
                        2015-11-21 08:47:27                                  EventLog                        6006:    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "-"    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-21 08:47:27                                  Service Control Manager         7036:  " "    .  
                4          2015-11-21 08:47:27  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-21 08:47:27  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-21 08:47:27                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-21 08:47:27                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-21 08:47:28                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-21 08:47:28                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-21 08:47:40                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-21 13:19:37                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-21 13:19:40                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-21 13:19:47                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-21 13:19:47                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-21 13:19:50                                  nvlddmkm                        
                        2015-11-21 13:19:51                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-21 13:19:51                                  Service Control Manager         7036:  ""    .  
                        2015-11-21 13:19:51                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-21 13:19:51                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-21 13:19:51                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-21 13:19:51                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-21 13:19:51                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-21 13:19:52                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-21 13:19:52                                  EventLog                        6005:    .  
                        2015-11-21 13:19:52                                  EventLog                        6013:    14 .  
                        2015-11-21 13:19:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-21 13:19:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 13:19:53                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-21 13:19:53                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-21 13:19:53                                  Service Control Manager         7036:  ""    .  
                        2015-11-21 13:19:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 13:19:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 13:19:53                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 13:19:53                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-21 13:19:53                                  Service Control Manager         7036:  "    "    .  
                        2015-11-21 13:19:53                                  Service Control Manager         7036:  "     "    .  
                        2015-11-21 13:19:53                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 13:19:53                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-21 13:19:53                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 13:19:53                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-21 13:19:53                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-21 13:19:53                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-21 13:19:53                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-21 13:19:53                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-21 13:19:53                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-21 13:19:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 13:19:53                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-21 13:19:53  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-21 13:19:53  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-21 13:19:54                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 13:19:54                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 13:19:54                                  Service Control Manager         7036:  "-"    .  
                        2015-11-21 13:19:54                                  Service Control Manager         7036:  "  "    .  
                1101       2015-11-21 13:19:54                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-21 13:19:55                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-21 13:19:55                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 13:19:55                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 13:19:55                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 13:19:55                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 13:19:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 13:19:55                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-21 13:19:55                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-21 13:19:56                                  Service Control Manager         7036:  ""    .  
                        2015-11-21 13:19:56                                  Service Control Manager         7036:  "    "    .  
                        2015-11-21 13:19:56                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-21 13:19:56                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 13:19:57                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-21 13:19:57                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-21 13:19:58                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-21 13:19:58                                  Service Control Manager         7036:  ""    .  
                        2015-11-21 13:19:58                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 13:20:00                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-21 13:20:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 13:20:00                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-21 13:20:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 13:20:00                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 13:20:00                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 13:20:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 13:20:00                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-21 13:20:00                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 13:20:00                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 13:20:00                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-21 13:20:04                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-21 13:20:04                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-21 13:20:08                                  Service Control Manager         7036:  "Windows Search"    .  
                7005       2015-11-21 13:21:07                           Microsoft-Windows-UserPnp       20003:       USBSTOR      USB\VID_8564&PID_1000\VN3ASBOP   : 0.  
                7005       2015-11-21 13:21:07                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbstor.inf_x86_neutral_c77d41a490bdc63d\usbstor.inf      USB\VID_8564&PID_1000\VN3ASBOP   : 0x0.  
                7005       2015-11-21 13:21:08                           Microsoft-Windows-UserPnp       20003:       cdrom      USBSTOR\CDROM&VEN_GENERIC&PROD_AUTORUN_DISK&REV_8.00\VN3ASBOP&0   : 0.  
                7005       2015-11-21 13:21:08                           Microsoft-Windows-UserPnp       20001:       FileRepository\cdrom.inf_x86_neutral_6381e09675524225\cdrom.inf      USBSTOR\CDROM&VEN_GENERIC&PROD_AUTORUN_DISK&REV_8.00\VN3ASBOP&0   : 0x0.  
                7005       2015-11-21 13:21:09                           Microsoft-Windows-UserPnp       20003:       disk      USBSTOR\DISK&VEN_JETFLASH&PROD_TRANSCEND_16GB&REV_8.01\VN3ASBOP&1   : 0.  
                7005       2015-11-21 13:21:10                           Microsoft-Windows-UserPnp       20001:       FileRepository\disk.inf_x86_neutral_b431b61a11f8df6c\disk.inf      USBSTOR\DISK&VEN_JETFLASH&PROD_TRANSCEND_16GB&REV_8.01\VN3ASBOP&1   : 0x0.  
                7005       2015-11-21 13:21:11                           Microsoft-Windows-UserPnp       20003:       volsnap      STORAGE\VOLUME\_??_USBSTOR#DISK&VEN_JETFLASH&PROD_TRANSCEND_16GB&REV_8.01#VN3ASBOP&1#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}   : 0.  
                7005       2015-11-21 13:21:11                           Microsoft-Windows-UserPnp       20001:       FileRepository\volume.inf_x86_neutral_6dee0205881d1a1d\volume.inf      STORAGE\VOLUME\_??_USBSTOR#DISK&VEN_JETFLASH&PROD_TRANSCEND_16GB&REV_8.01#VN3ASBOP&1#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}   : 0x0.  
                48         2015-11-21 13:21:12                           Microsoft-Windows-DriverFrameworks-UserMode  10000:  ,       1.9.0,    WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_JETFLASH&PROD_TRANSCEND_16GB&REV_8.01#VN3ASBOP&1#.  
                48         2015-11-21 13:21:13                           Microsoft-Windows-DriverFrameworks-UserMode  10002:      WpdFs (CLSID {112DE495-AC4C-46F8-B663-6A4266C53313}) .      1.9.0    .  
                48         2015-11-21 13:21:13                           Microsoft-Windows-DriverFrameworks-UserMode  10100:     .  
                7005       2015-11-21 13:21:13                           Microsoft-Windows-UserPnp       20003:       WUDFRd      WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_JETFLASH&PROD_TRANSCEND_16GB&REV_8.01#VN3ASBOP&1#   : 0.  
                16         2015-11-21 13:21:14                                  WPDClassInstaller               
                32         2015-11-21 13:21:14                                  WPDClassInstaller               
                32         2015-11-21 13:21:14                                  WPDClassInstaller               
                7005       2015-11-21 13:21:14                           Microsoft-Windows-UserPnp       20001:       FileRepository\wpdfs.inf_x86_neutral_fc4ebadff3a40ae4\wpdfs.inf      WPDBUSENUMROOT\UMB\2&37C186B&0&STORAGE#VOLUME#_??_USBSTOR#DISK&VEN_JETFLASH&PROD_TRANSCEND_16GB&REV_8.01#VN3ASBOP&1#   : 0x0.  
                        2015-11-21 13:22:00                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-21 13:22:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 13:22:01                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-21 13:22:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 13:22:03                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-21 13:22:12                                  Service Control Manager         7036:  "    "    .  
                        2015-11-21 13:22:12                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-21 13:23:27                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-21 13:27:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 13:30:24                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 13:33:28                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 13:59:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 14:34:17                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 14:34:17                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-21 14:37:19                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 14:40:19                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-21 15:47:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 15:47:53                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 15:47:57                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-21 15:49:57                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-21 15:52:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 15:57:53                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 17:16:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 17:18:04                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 17:21:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 18:17:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 18:22:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 18:57:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 18:57:24  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-21 18:57:28  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-21 18:57:28                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-21 18:57:29                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-21 18:57:29                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 18:57:29                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 18:57:29                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-21 18:57:29                                  Service Control Manager         7036:  ""    .  
                        2015-11-21 18:57:29                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-21 18:57:29                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                4          2015-11-21 18:57:29  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-21 18:57:29  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-21 18:57:29                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-11-21 18:57:30                                  EventLog                        6006:    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  "-"    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  "     "    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-21 18:57:30                                  Service Control Manager         7036:  " "    .  
                          2015-11-21 18:57:30                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-21 18:57:31                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-21 18:57:33                                  Service Control Manager         7036:  " Windows"    .  
                103        2015-11-21 18:57:33                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-21 18:57:38                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-21 21:01:37                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-21 21:01:40                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-21 21:01:47                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-21 21:01:47                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-21 21:01:53                                  nvlddmkm                        
                        2015-11-21 21:01:53                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-21 21:01:53                                  Service Control Manager         7036:  ""    .  
                7010       2015-11-21 21:01:53                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-21 21:01:54                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-21 21:01:54                                  EventLog                        6005:    .  
                        2015-11-21 21:01:54                                  EventLog                        6013:    16 .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  ""    .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  "    "    .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  "     "    .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-21 21:01:54                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-21 21:01:54                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                4          2015-11-21 21:01:54  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-21 21:01:54  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-21 21:01:55                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-21 21:01:55                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-21 21:01:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 21:01:55                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 21:01:55                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 21:01:55                                  Service Control Manager         7036:  "-"    .  
                        2015-11-21 21:01:55                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-11-21 21:01:55                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-21 21:01:56                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 21:01:56                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-21 21:01:56                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 21:01:56                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 21:01:56                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 21:01:56                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-21 21:01:56                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 21:01:56                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-21 21:01:56                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 21:01:56                                  Service Control Manager         7036:  "    "    .  
                        2015-11-21 21:01:56                                  Service Control Manager         7036:  ""    .  
                        2015-11-21 21:01:56                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-21 21:01:56                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-21 21:01:56                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 21:01:56                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-21 21:01:56                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-21 21:01:57                                  Service Control Manager         7036:  ""    .  
                        2015-11-21 21:01:57                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 21:01:58                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-21 21:01:58                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 21:01:58                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-21 21:01:58                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-21 21:01:58                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 21:01:58                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 21:01:58                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 21:01:58                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 21:01:58                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 21:01:58                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 21:01:58                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-21 21:02:03                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-21 21:02:03                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-21 21:02:05                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-21 21:02:29                                  Service Control Manager         7036:  "    "    .  
                        2015-11-21 21:02:29                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-21 21:03:24                                  Service Control Manager         7036:  "  Windows"    .  
                            2015-11-21 21:03:31                                  DCOM                            
                            2015-11-21 21:03:47                                  ipnathlp                        
                        2015-11-21 21:03:48                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-21 21:03:50                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-21 21:03:51                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-21 21:03:58                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 21:03:58                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 21:03:59                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-21 21:03:59                                  Service Control Manager         7036:  "  "    .  
                          2015-11-21 21:07:30  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     s-static.ak.facebook.com        DNS.  
                        2015-11-21 21:08:33                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 21:09:00                                  Service Control Manager         7036:  "  "    .  
                          2015-11-21 21:10:04  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     aus5.mozilla.org        DNS.  
                        2015-11-21 21:12:34                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 21:15:53                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 21:16:11                                  Service Control Manager         7036:  "  "    .  
                          2015-11-21 21:21:52  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     counter.yadro.ru        DNS.  
                          2015-11-21 21:23:50  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     portal.mail.ru        DNS.  
                        2015-11-21 21:26:20                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 21:27:47                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-21 21:27:47                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-21 21:27:47                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-11-21 21:28:16                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 21:28:16  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-21 21:28:18                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-21 21:28:18                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 21:28:18  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-21 21:28:18                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-21 21:28:19                                  EventLog                        6006:    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  ""    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "-"    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "     "    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "   "    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "  "    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  " "    .  
                        2015-11-21 21:28:19                                  Service Control Manager         7036:  "Superfetch"    .  
                4          2015-11-21 21:28:19  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-21 21:28:19  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-21 21:28:19                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-21 21:28:19                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-21 21:28:20                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-21 21:28:20                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-21 21:28:26                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-22 02:22:08                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-22 02:22:11                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-22 02:22:18                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-22 02:22:18                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-22 02:22:24                                  nvlddmkm                        
                        2015-11-22 02:22:31                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                7010       2015-11-22 02:22:31                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-22 02:22:32                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-22 02:22:32                                  EventLog                        6005:    .  
                        2015-11-22 02:22:32                                  EventLog                        6013:    23 .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "     "    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-22 02:22:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 02:22:32                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                        2015-11-22 02:22:32                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-22 02:22:32  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-22 02:22:32  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-22 02:22:33                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 02:22:33                                  Service Control Manager         7036:  " "    .  
                1101       2015-11-22 02:22:33                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-22 02:22:34                                  Service Control Manager         7036:  "-"    .  
                        2015-11-22 02:22:34                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 02:22:34                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 02:22:34                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 02:22:34                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 02:22:34                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 02:22:34                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-22 02:22:34                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-22 02:22:34                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 02:22:34                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-22 02:22:34                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 02:22:34                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 02:22:34                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 02:22:34                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 02:22:34                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 02:22:34                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-22 02:22:34                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-22 02:22:34                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 02:22:34                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 02:22:37                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-22 02:22:37                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 02:22:37                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-22 02:22:37                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 02:22:37                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 02:22:37                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-22 02:22:37                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 02:22:37                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 02:22:37                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 02:22:37                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 02:22:37                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-22 02:22:37                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-22 02:22:37                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-22 02:22:39                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-22 02:22:43                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-22 02:23:24                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 02:23:24                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-22 02:23:28                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-22 02:24:37                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 02:24:37                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 02:24:37                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 02:24:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 02:24:39                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 02:25:15                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-22 02:25:34                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 02:25:35                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 02:25:35  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-22 02:25:35  LOCAL SERVICE                   Microsoft-Windows-Time-Service  35:          time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->104.41.150.68:123).  
                        2015-11-22 02:25:35  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-22 02:25:35  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-22 02:25:36  LOCAL SERVICE                   Microsoft-Windows-Time-Service  37: NTP-         time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->104.41.150.68:123).  
                        2015-11-22 02:25:37                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-22 02:25:47                                  Service Control Manager         7036:  "    (BITS)"    .  
                        2015-11-22 02:25:47                           Service Control Manager         7040:    "    (BITS)"    ""  "".  
                        2015-11-22 02:26:11                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-22 02:26:21                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-22 02:27:11                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-22 02:27:25                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 02:29:24                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 02:35:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 02:46:24                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-22 03:02:19                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 03:26:01                           Service Control Manager         7040:    "    (BITS)"    ""  "".  
                        2015-11-22 03:26:09                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-22 03:26:13                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-22 03:26:46                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-22 03:27:13                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                          2015-11-22 03:45:02  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     textlink.simba.taobao.com        DNS.  
                          2015-11-22 04:08:08  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     detailskip.taobao.com        DNS.  
                        2015-11-22 08:13:30                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-22 08:13:33                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-22 08:13:41                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-22 08:13:41                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                63         2015-11-22 08:13:41                           Microsoft-Windows-Kernel-Power  41:  ,    .      ,    ,   ,    .  
                            2015-11-22 08:13:48                                  nvlddmkm                        
                        2015-11-22 08:13:48                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                7010       2015-11-22 08:13:48                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                            2015-11-22 08:13:49                                  EventLog                        6008:      4:25:00  ?22.?11.?2015  .  
                        2015-11-22 08:13:49                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-22 08:13:49                                  EventLog                        6005:    .  
                        2015-11-22 08:13:49                                  EventLog                        6013:    19 .  
                        2015-11-22 08:13:49                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 08:13:49                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-22 08:13:49                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-22 08:13:49                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-22 08:13:49                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 08:13:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:13:49                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-22 08:13:49                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-22 08:13:49                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 08:13:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:13:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:13:49                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 08:13:49                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-22 08:13:49                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                        2015-11-22 08:13:50                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 08:13:50                                  Service Control Manager         7036:  "     "    .  
                        2015-11-22 08:13:50                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:13:50                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-22 08:13:50                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-22 08:13:50                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:13:50                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-22 08:13:50                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-22 08:13:50                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-22 08:13:50                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-22 08:13:50                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-22 08:13:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:13:50                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 08:13:50                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 08:13:50                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-11-22 08:13:50                           Microsoft-Windows-Winlogon      7001:           
                4          2015-11-22 08:13:50  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-22 08:13:50  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-22 08:13:51                                  Service Control Manager         7036:  "-"    .  
                        2015-11-22 08:13:51                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:13:51                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 08:13:51                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 08:13:51                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 08:13:51                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 08:13:51                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:13:51                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-22 08:13:52                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-22 08:13:52                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-22 08:13:53                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 08:13:53                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 08:13:53                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:13:54                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 08:13:54                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 08:13:55                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-22 08:13:56                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-22 08:13:56                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:13:56                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 08:14:03                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-22 08:14:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:14:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:14:03                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 08:14:03                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-22 08:14:03                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-22 08:14:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:14:03                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:14:03                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:14:03                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:14:03                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-22 08:14:05                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-22 08:14:05                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-22 08:14:05                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-22 08:14:14                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-22 08:16:03                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-22 08:16:03                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:16:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:16:04                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 08:16:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:16:06                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 08:16:36                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-22 08:16:37                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-22 08:16:37                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-11-22 08:17:18                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 08:17:18                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-22 08:18:34                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-22 08:20:01                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:21:05                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:22:01                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:22:46  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 08:22:49                                  EventLog                        6006:    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "-"    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "     "    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-22 08:22:49                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-22 08:22:49  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-22 08:22:49                           Microsoft-Windows-Winlogon      7002:           
                4          2015-11-22 08:22:49  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-22 08:22:49  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-22 08:22:49                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-22 08:22:49                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-22 08:22:50                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-22 08:22:50                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-22 08:22:50                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 08:22:50                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 08:22:50                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-22 08:22:50                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-22 08:22:50                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-22 08:22:54                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-22 08:27:23                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-22 08:27:26                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-22 08:27:33                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-22 08:27:33                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-22 08:27:37                                  nvlddmkm                        
                        2015-11-22 08:27:38                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-22 08:27:38                                  EventLog                        6005:    .  
                        2015-11-22 08:27:38                                  EventLog                        6013:    14 .  
                        2015-11-22 08:27:38                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-22 08:27:38                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 08:27:38                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-22 08:27:38                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-22 08:27:38                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-22 08:27:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 08:27:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:27:38                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-22 08:27:38                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-22 08:27:40                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-22 08:27:40                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-22 08:27:40                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 08:27:40                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:27:40                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:27:40                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 08:27:40                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-22 08:27:40                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 08:27:40                                  Service Control Manager         7036:  "     "    .  
                        2015-11-22 08:27:40                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:27:40                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-22 08:27:40                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:27:40                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-22 08:27:40                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-22 08:27:40                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-22 08:27:40                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-22 08:27:40                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-22 08:27:40                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-22 08:27:40                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:27:40                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-22 08:27:40  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-22 08:27:40  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-22 08:27:41                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 08:27:41                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 08:27:41                                  Service Control Manager         7036:  "-"    .  
                        2015-11-22 08:27:41                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:27:41                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 08:27:41                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 08:27:41                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 08:27:41                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-22 08:27:41                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 08:27:41                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:27:41                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 08:27:41                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 08:27:41                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-22 08:27:41                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 08:27:41                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:27:41                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 08:27:41                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                1101       2015-11-22 08:27:41                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-22 08:27:42                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-22 08:27:42                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-22 08:27:43                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 08:27:43                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:27:46                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-22 08:27:46                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-22 08:27:46                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:27:46                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:27:46                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-22 08:27:46                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:27:46                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:27:46                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:27:46                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 08:27:46                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:27:46                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-22 08:27:49                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-22 08:27:49                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-22 08:27:51                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-22 08:29:46                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-22 08:29:46                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:29:46                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:29:47                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 08:29:47                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:29:49                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 08:32:51                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:34:48                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 08:37:50                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 08:54:14                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 09:03:40                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 09:04:14                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 09:04:14                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-22 09:04:17                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 09:04:17                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 09:07:17                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 09:07:41                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 09:10:17                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-22 09:49:52                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 09:49:52                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-22 09:53:46                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-22 09:53:49                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-22 09:53:55                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-22 09:53:55                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                63         2015-11-22 09:53:55                           Microsoft-Windows-Kernel-Power  41:  ,    .      ,    ,   ,    .  
                            2015-11-22 09:53:58                                  nvlddmkm                        
                        2015-11-22 09:53:59                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-22 09:53:59                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 09:53:59                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-22 09:53:59                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-22 09:53:59                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                            2015-11-22 09:54:00                                  EventLog                        6008:      9:51:01  ?22.?11.?2015  .  
                        2015-11-22 09:54:00                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-22 09:54:00                                  EventLog                        6005:    .  
                        2015-11-22 09:54:00                                  EventLog                        6013:    13 .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  "     "    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-22 09:54:00                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-22 09:54:00                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-22 09:54:00  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-22 09:54:00  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-22 09:54:01                                  Service Control Manager         7036:  "  "    .  
                1101       2015-11-22 09:54:01                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-22 09:54:02                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 09:54:02                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 09:54:02                                  Service Control Manager         7036:  "-"    .  
                        2015-11-22 09:54:02                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 09:54:02                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 09:54:02                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 09:54:02                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 09:54:02                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 09:54:02                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 09:54:02                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 09:54:02                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-22 09:54:03                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-22 09:54:03                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 09:54:03                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 09:54:03                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-22 09:54:03                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-22 09:54:03                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 09:54:03                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 09:54:04                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-22 09:54:04                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 09:54:05                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 09:54:10                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-22 09:54:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 09:54:10                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-22 09:54:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 09:54:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 09:54:10                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 09:54:10                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 09:54:10                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 09:54:10                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-22 09:54:10                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 09:54:10                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-22 09:54:12                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-22 09:54:12                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-22 09:54:14                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-22 09:56:10                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-22 09:56:10                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 09:56:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 09:56:11                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 09:56:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 09:56:12                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 09:59:14                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 10:01:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 10:04:14                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 12:45:25                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-22 12:45:28                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-22 12:45:33                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-22 12:45:33                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                63         2015-11-22 12:45:33                           Microsoft-Windows-Kernel-Power  41:  ,    .      ,    ,   ,    .  
                            2015-11-22 12:45:37                                  nvlddmkm                        
                        2015-11-22 12:45:37                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-22 12:45:37                                  Service Control Manager         7036:  ""    .  
                7010       2015-11-22 12:45:37                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                            2015-11-22 12:45:38                                  EventLog                        6008:      10:12:40  ?22.?11.?2015  .  
                        2015-11-22 12:45:38                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-22 12:45:38                                  EventLog                        6005:    .  
                        2015-11-22 12:45:38                                  EventLog                        6013:    12 .  
                        2015-11-22 12:45:38                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-22 12:45:38                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-22 12:45:38                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-22 12:45:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 12:45:38                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-22 12:45:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 12:45:38                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                        2015-11-22 12:45:39                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-22 12:45:39                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 12:45:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 12:45:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 12:45:39                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 12:45:39                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-22 12:45:39                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 12:45:39                                  Service Control Manager         7036:  "     "    .  
                        2015-11-22 12:45:39                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 12:45:39                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-22 12:45:39                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 12:45:39                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-22 12:45:39                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-22 12:45:39                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-22 12:45:39                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-22 12:45:39                                  Service Control Manager         7036:  "    (EAP)"    .  
                4          2015-11-22 12:45:39  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-22 12:45:39  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-22 12:45:40                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-22 12:45:40                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 12:45:40                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                        2015-11-22 12:45:41                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 12:45:41                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 12:45:41                                  Service Control Manager         7036:  "-"    .  
                        2015-11-22 12:45:41                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 12:45:41                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 12:45:41                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 12:45:41                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 12:45:41                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 12:45:41                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 12:45:41                                  Service Control Manager         7036:  " "    .  
                1101       2015-11-22 12:45:41                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-22 12:45:42                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-22 12:45:42                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 12:45:42                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 12:45:42                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-22 12:45:42                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-22 12:45:42                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 12:45:43                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 12:45:43                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-22 12:45:43                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-22 12:45:44                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 12:45:44                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 12:45:49                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-22 12:45:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 12:45:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 12:45:50                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-22 12:45:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 12:45:50                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 12:45:50                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 12:45:50                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-22 12:45:50                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 12:45:50                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 12:45:50                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-22 12:45:51                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-22 12:45:51                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-22 12:45:54                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-22 12:47:50                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-22 12:47:50                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 12:47:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 12:47:50                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 12:47:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 12:47:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 12:49:46                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 12:49:46                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-22 12:52:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 12:54:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 13:30:25                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-22 13:30:37                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                63         2015-11-22 13:30:42                           Microsoft-Windows-Kernel-Power  41:  ,    .      ,    ,   ,    .  
                4          2015-11-22 13:30:43                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-22 13:30:43                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                            2015-11-22 13:30:46                                  nvlddmkm                        
                        2015-11-22 13:30:46                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                7010       2015-11-22 13:30:46                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                            2015-11-22 13:30:47                                  EventLog                        6008:      12:55:33  ?22.?11.?2015  .  
                        2015-11-22 13:30:47                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-22 13:30:47                                  EventLog                        6005:    .  
                        2015-11-22 13:30:47                                  EventLog                        6013:    22 .  
                        2015-11-22 13:30:47                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 13:30:47                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-22 13:30:47                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-22 13:30:47                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-22 13:30:47                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 13:30:47                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                        2015-11-22 13:30:48                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-22 13:30:48                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 13:30:48                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-22 13:30:49                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 13:30:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 13:30:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 13:30:49                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 13:30:49                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-22 13:30:49                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 13:30:49                                  Service Control Manager         7036:  "     "    .  
                        2015-11-22 13:30:49                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 13:30:49                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-22 13:30:49                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 13:30:49                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-22 13:30:49                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-22 13:30:49                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-22 13:30:49                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-22 13:30:49                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-22 13:30:49                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-22 13:30:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 13:30:49                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-22 13:30:49  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-22 13:30:49  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-22 13:30:50                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 13:30:50                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 13:30:50                                  Service Control Manager         7036:  "-"    .  
                1101       2015-11-22 13:30:50                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-22 13:30:51                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 13:30:51                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 13:30:51                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 13:30:51                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 13:30:51                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-22 13:30:51                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 13:30:51                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 13:30:51                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-22 13:30:51                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 13:30:51                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 13:30:52                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-22 13:30:52                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-22 13:30:52                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 13:30:52                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 13:30:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 13:30:52                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-22 13:30:53                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 13:30:53                                  Service Control Manager         7036:  ""    .  
                            2015-11-22 13:30:59                                  Service Control Manager         7026:    ()    :   cdrom  
                        2015-11-22 13:30:59                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-22 13:30:59                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 13:30:59                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-22 13:30:59                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-22 13:30:59                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 13:30:59                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 13:30:59                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 13:30:59                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 13:30:59                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 13:30:59                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 13:30:59                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-22 13:31:00                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-22 13:31:00                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-22 13:31:03                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-22 13:31:03                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 13:31:03                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-22 13:32:27  sima                            Service Control Manager         7045:    .     :  Lavalys EVEREST Kernel Driver    :  C:\my_programs\setup\system ytilit\EVEREST Ultimate Edition\kerneld.wnt   :        :      :    
                        2015-11-22 13:32:59                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 13:32:59                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-22 13:32:59                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 13:32:59                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 13:33:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 13:33:01                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 13:35:02                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-22 13:35:43                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 13:35:44                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-22 13:35:47  LOCAL SERVICE                   Microsoft-Windows-Time-Service  37: NTP-         time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->104.41.150.68:123).  
                        2015-11-22 13:36:00                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 13:36:00  LOCAL SERVICE                   Microsoft-Windows-Time-Service  35:          time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->104.41.150.68:123).  
                        2015-11-22 13:36:00  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-22 13:36:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 13:36:24                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-22 13:38:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 13:38:23  sima                            Service Control Manager         7045:    .     :  cpuz138    :  C:\Users\sima\AppData\Local\Temp\\cpuz138\cpuz138_x32.sys   :        :      :    
                        2015-11-22 13:38:24                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 13:38:24                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-22 13:38:25                                  Service Control Manager         7036:  " PNRP"    .  
                        2015-11-22 13:38:26  sima                            Service Control Manager         7045:    .     :  speccy    :  C:\Users\sima\AppData\Local\Temp\4f38e278-1720-49a7-9327-e7b801aae760   :        :      :    
                        2015-11-22 13:38:32                                  Service Control Manager         7036:  "WMI Performance Adapter"    .  
                        2015-11-22 13:40:35                                  Service Control Manager         7036:  "WMI Performance Adapter"    .  
                        2015-11-22 13:40:36                                  Service Control Manager         7036:  "WMI Performance Adapter"    .  
                        2015-11-22 13:44:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 13:46:35                                  Service Control Manager         7036:  "WMI Performance Adapter"    .  
                        2015-11-22 13:48:32                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 13:49:43                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 13:52:14                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-22 13:55:52                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 13:56:59                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:02:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:05:25                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-22 14:05:25                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-22 14:05:25                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-11-22 14:05:30                                  Service Control Manager         7036:  "    (BITS)"    .  
                        2015-11-22 14:05:30                           Service Control Manager         7040:    "    (BITS)"    ""  "".  
                1          2015-11-22 14:05:35                           Microsoft-Windows-WindowsUpdateClient  27:   .  
                        2015-11-22 14:06:08                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-22 14:06:17                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-22 14:06:34                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 14:06:34                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:06:34                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-22 14:06:46                                  volsnap                         33:      C:      ,     C:,  ,  .  
                        2015-11-22 14:06:46                                  volsnap                         33:      C:      ,     C:,  ,  .  
                        2015-11-22 14:06:47                           Service Control Manager         7040:    "  Windows"    ""  "".  
                        2015-11-22 14:06:57                           Service Control Manager         7040:    "  Windows"    ""  "".  
                1          2015-11-22 14:07:03                           Microsoft-Windows-WindowsUpdateClient  19:  :     :    Windows (KB958488)  
                        2015-11-22 14:09:37                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 14:09:41  sima                            Service Control Manager         7040:    "Microsoft .NET Framework NGEN v2.0.50727_X86"    ""  "".  
                        2015-11-22 14:09:57                           Service Control Manager         7045:    .     :  Microsoft .NET Framework NGEN v4.0.30319_X86    :  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe   :        :      :  LocalSystem  
                        2015-11-22 14:09:58                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:10:01                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v4.0.30319_X86"    .  
                        2015-11-22 14:10:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:11:04                           Service Control Manager         7045:    .     :  Net.Tcp Listener Adapter    :  C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe   :        :      :  NT AUTHORITY\LocalService  
                        2015-11-22 14:11:07                           Service Control Manager         7045:    .     :  Net.Pipe Listener Adapter    :  C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe   :        :      :  NT AUTHORITY\LocalService  
                        2015-11-22 14:11:10                           Service Control Manager         7045:    .     :  Net.Msmq Listener Adapter    :  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe" -NetMsmqActivator   :        :      :  NT AUTHORITY\NetworkService  
                        2015-11-22 14:11:21  sima                            Service Control Manager         7045:    .     :  ASP.NET State Service    :  %SystemRoot%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe   :        :      :  LocalSystem  
                        2015-11-22 14:12:08                                  Service Control Manager         7036:  " Windows"    .  
                1          2015-11-22 14:12:13                           Microsoft-Windows-WindowsUpdateClient  28:   .  
                7005       2015-11-22 14:12:46                           Microsoft-Windows-UserPnp       20003:       nvlddmkm      PCI\VEN_10DE&DEV_0613&SUBSYS_00000000&REV_A2\4&1591CBDA&0&0008   : 0.  
                7005       2015-11-22 14:12:48                           Microsoft-Windows-UserPnp       20001:       FileRepository\nv_dispi.inf_x86_neutral_e4db36aea06d09cd\nv_dispi.inf      PCI\VEN_10DE&DEV_0613&SUBSYS_00000000&REV_A2\4&1591CBDA&0&0008   : 0x0.  
                        2015-11-22 14:12:49                                  Service Control Manager         7036:  "  "    .  
                7005       2015-11-22 14:12:53                           Microsoft-Windows-UserPnp       20003:       monitor      DISPLAY\SAM07C0\5&7C7907&0&UID1048849   : 0.  
                7005       2015-11-22 14:12:53                           Microsoft-Windows-UserPnp       20001:       FileRepository\monitor.inf_x86_neutral_f7168ca1d7f8ec24\monitor.inf      DISPLAY\SAM07C0\5&7C7907&0&UID1048849   : 0x0.  
                7005       2015-11-22 14:12:54                           Microsoft-Windows-UserPnp       20003:       monitor      DISPLAY\ACR0053\5&7C7907&0&UID1048833   : 0.  
                7005       2015-11-22 14:12:54                           Microsoft-Windows-UserPnp       20001:       FileRepository\monitor.inf_x86_neutral_f7168ca1d7f8ec24\monitor.inf      DISPLAY\ACR0053\5&7C7907&0&UID1048833   : 0x0.  
                        2015-11-22 14:12:58                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-22 14:13:15  sima                            Service Control Manager         7045:    .     :  NVIDIA Display Driver Service    :  "C:\Windows\system32\nvvsvc.exe"   :        :      :  LocalSystem  
                        2015-11-22 14:13:20                                  Service Control Manager         7036:  "NVIDIA Display Driver Service"    .  
                        2015-11-22 14:13:20  sima                            Service Control Manager         7045:    .     :  NVIDIA Network Service    :  "C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe"   :        :      :  LocalSystem  
                        2015-11-22 14:13:22                                  Service Control Manager         7036:  "NVIDIA Network Service"    .  
                        2015-11-22 14:13:36  sima                            Service Control Manager         7045:    .     :  NVIDIA Stereoscopic 3D Driver Service    :  "C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe"   :        :      :  .\LocalSystem  
                        2015-11-22 14:13:37                                  Service Control Manager         7036:  "NVIDIA Stereoscopic 3D Driver Service"    .  
                        2015-11-22 14:13:48                           Service Control Manager         7045:    .     :  NVIDIA Virtual Audio Device (Wave Extensible) (WDM)    :  system32\drivers\nvvad32v.sys   :        :      :    
                7005       2015-11-22 14:13:48                           Microsoft-Windows-UserPnp       20003:       nvvad_WaveExtensible      ROOT\UNNAMED_DEVICE\0000   : 0.  
                        2015-11-22 14:13:49                                  Service Control Manager         7036:  " Windows"    .  
                7005       2015-11-22 14:13:49                           Microsoft-Windows-UserPnp       20001:       FileRepository\nvvad.inf_x86_neutral_25d3b9b9169d137c\nvvad.inf      ROOT\UNNAMED_DEVICE\0000   : 0x0.  
                        2015-11-22 14:14:15  sima                            Service Control Manager         7045:    .     :  NVIDIA Streamer Service    :  "C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe"   :        :      :  LocalSystem  
                        2015-11-22 14:14:18                                  Service Control Manager         7036:  "NVIDIA Streamer Service"    .  
                        2015-11-22 14:14:20                           Service Control Manager         7045:    .     :  NvStreamKms    :  C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys   :        :      :    
                        2015-11-22 14:14:22                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:14:22                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-22 14:14:49  sima                            Service Control Manager         7045:    .     :  NVIDIA GeForce Experience Service    :  "C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe"   :        :      :  LocalSystem  
                        2015-11-22 14:14:50                                  Service Control Manager         7036:  "NVIDIA GeForce Experience Service"    .  
                          2015-11-22 14:15:03  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     ocsp.usertrust.com        DNS.  
                        2015-11-22 14:16:04                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                        2015-11-22 14:16:06                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-22 14:16:06                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-11-22 14:16:58                           Service Control Manager         7040:    "  Windows"    ""  "".  
                        2015-11-22 14:17:00                           Service Control Manager         7040:    "  Windows"    ""  "".  
                        2015-11-22 14:17:01                                  Service Control Manager         7036:  "  Windows"    .  
                            2015-11-22 14:17:07                                  ipnathlp                        
                        2015-11-22 14:17:09                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-22 14:17:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:17:44                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v4.0.30319_X86"    .  
                        2015-11-22 14:17:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:20:26  sima                            USER32                          1074:  Explorer.EXE   ""   VLADIMIR    vladimir\sima  :  ()     : 0x0     :     :   
                        2015-11-22 14:20:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:20:35                                  EventLog                        6006:    .  
                        2015-11-22 14:20:35                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 14:20:35                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:20:35                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 14:20:35                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 14:20:35                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-22 14:20:35                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-22 14:20:35                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 14:20:35                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-22 14:20:35                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:20:35  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   ""   VLADIMIR    vladimir\sima  :        : 0x500ff     :     :   
                1102       2015-11-22 14:20:35                           Microsoft-Windows-Winlogon      7002:           
                4          2015-11-22 14:20:35  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-22 14:20:35  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-22 14:20:35                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  " PNRP"    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  "-"    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  "     "    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  "NVIDIA Display Driver Service"    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  "NVIDIA Network Service"    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  "NVIDIA Stereoscopic 3D Driver Service"    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  "NVIDIA Streamer Service"    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-22 14:20:36                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-22 14:20:37                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-22 14:20:37                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-22 14:20:37                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 14:20:37                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 14:20:37                                  Service Control Manager         7036:  "  PNP-"    .  
                          2015-11-22 14:20:37                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-22 14:20:38                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-22 14:20:38                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-22 14:20:41                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-22 14:21:12                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-22 14:21:15                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-22 14:21:19                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-22 14:21:19                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                        2015-11-22 14:21:30                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-22 14:21:30                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 14:21:30                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-22 14:21:30                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-22 14:21:31                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-22 14:21:31                                  EventLog                        6005:    .  
                        2015-11-22 14:21:31                                  EventLog                        6013:    18 .  
                        2015-11-22 14:21:31                                  Service Control Manager         7036:  "NVIDIA Display Driver Service"    .  
                        2015-11-22 14:21:31                                  Service Control Manager         7036:  "NVIDIA Stereoscopic 3D Driver Service"    .  
                        2015-11-22 14:21:31                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-22 14:21:31                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-22 14:21:31                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-22 14:21:31                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 14:21:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:21:31                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-22 14:21:31                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-22 14:21:31                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 14:21:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:21:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:21:31                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 14:21:31                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-22 14:21:31                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 14:21:31                                  Service Control Manager         7036:  "     "    .  
                        2015-11-22 14:21:31                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 14:21:31                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-22 14:21:32                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 14:21:32                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-22 14:21:32                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-22 14:21:32                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-22 14:21:32                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-22 14:21:32                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-22 14:21:32                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-22 14:21:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:21:32                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                1101       2015-11-22 14:21:32                           Microsoft-Windows-Winlogon      7001:           
                4          2015-11-22 14:21:32  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-22 14:21:32  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-22 14:21:33                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 14:21:33                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 14:21:33                                  Service Control Manager         7036:  "-"    .  
                        2015-11-22 14:21:33                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:21:33                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 14:21:33                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 14:21:33                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 14:21:33                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:21:33                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 14:21:34                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 14:21:34                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-22 14:21:34                                  Service Control Manager         7036:  "NVIDIA GeForce Experience Service"    .  
                        2015-11-22 14:21:34                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 14:21:35                                  Service Control Manager         7036:  "NVIDIA Network Service"    .  
                        2015-11-22 14:21:38                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-22 14:21:38                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-22 14:21:38                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 14:21:38                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 14:21:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 14:21:38                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-22 14:21:38                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-22 14:21:38                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 14:21:38                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 14:21:44                                  Service Control Manager         7036:  "NVIDIA Streamer Service"    .  
                        2015-11-22 14:21:45                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-22 14:21:45                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:21:45                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-22 14:21:49                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-22 14:21:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:21:50                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 14:21:50                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 14:21:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:21:50                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 14:21:50                                  Service Control Manager         7036:  "   "    .  
                7005       2015-11-22 14:21:50                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0001   : 0.  
                        2015-11-22 14:21:51                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-22 14:21:51                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-22 14:21:53                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-22 14:21:53                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-22 14:21:58                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-22 14:23:45                                  Service Control Manager         7036:  "    (BITS)"    .  
                        2015-11-22 14:23:46                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v4.0.30319_X86"    .  
                        2015-11-22 14:23:46                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v4.0.30319_X86"    .  
                        2015-11-22 14:23:47                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-22 14:23:47                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:23:47                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 14:23:47                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:23:49                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 14:23:49                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 14:23:49                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-22 14:23:50                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 14:25:33                                  Service Control Manager         7036:  "  Windows"    .  
                          2015-11-22 14:25:45  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     time.windows.com        DNS.  
                        2015-11-22 14:28:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:28:57                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:35:47                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 14:38:21                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-22 14:53:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:53:00                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-22 14:53:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 14:56:01                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 14:59:01                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-22 15:01:33                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 15:04:23                           Service Control Manager         7040:    "  Windows"    ""  "".  
                        2015-11-22 15:04:25                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 15:04:25                           Service Control Manager         7040:    "  Windows"    ""  "".  
                        2015-11-22 15:23:45                           Service Control Manager         7040:    "    (BITS)"    ""  "".  
                        2015-11-22 15:37:09                                  BROWSER                         8033:        \Device\NetBT_Tcpip_{211835D6-E914-4A4D-824E-A3809356F2D8},       .  
                          2015-11-22 15:37:09  LOCAL SERVICE                   Microsoft-Windows-Time-Service  134: NTP-           -   DNS-  "". NTP-    3473457 .,      . :   ,      . (0x80072AFC)  
                        2015-11-22 15:37:10                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-22 15:37:10                           Service Control Manager         7042:    NetBIOS  TCP/IP     .      : 0x40030011 [ :   ()]     :   
                        2015-11-22 16:37:19                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-22 16:37:28                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 16:38:31                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 16:43:15                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 16:48:38                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 16:52:57                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 16:53:06                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-22 16:56:05                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 17:01:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 17:09:36                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-22 17:10:48                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 17:38:47                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 17:39:02                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-22 17:40:32  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-22 17:40:34                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 17:40:36                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 17:40:36  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-22 17:40:36                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-22 17:40:37                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 17:40:37                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 17:40:37                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-22 17:40:37                                  Service Control Manager         7036:  "NVIDIA Network Service"    .  
                        2015-11-22 17:40:37                                  Service Control Manager         7036:  "NVIDIA Display Driver Service"    .  
                        2015-11-22 17:40:37                                  EventLog                        6006:    .  
                        2015-11-22 17:40:37                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-22 17:40:37                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 17:40:37                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-22 17:40:37                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 17:40:37                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-22 17:40:37                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 17:40:37                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 17:40:37                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-22 17:40:37                                  Service Control Manager         7036:  "NVIDIA Stereoscopic 3D Driver Service"    .  
                        2015-11-22 17:40:37                                  Service Control Manager         7036:  "-"    .  
                        2015-11-22 17:40:37                                  Service Control Manager         7036:  "     "    .  
                        2015-11-22 17:40:37                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 17:40:37                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-22 17:40:37                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 17:40:37                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                4          2015-11-22 17:40:37  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-22 17:40:37  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-22 17:40:37                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-11-22 17:40:38                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-22 17:40:38                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-22 17:40:38                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 17:40:38                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-22 17:40:38                                  Service Control Manager         7036:  "NVIDIA Streamer Service"    .  
                        2015-11-22 17:40:38                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-22 17:40:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 17:40:38                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-22 17:40:38                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 17:40:38                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 17:40:38                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-22 17:40:38                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 17:40:38                                  Service Control Manager         7036:  " Windows"    .  
                          2015-11-22 17:40:38                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-22 17:40:39                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-22 17:40:39                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-22 17:40:40                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-22 17:40:43                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-22 19:50:37                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-22 19:50:40                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-22 19:50:45                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-22 19:50:45                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                        2015-11-22 19:50:49                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                7010       2015-11-22 19:50:49                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-22 19:50:50                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 19:50:50                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                        2015-11-22 19:50:51                                  Service Control Manager         7036:  "NVIDIA Display Driver Service"    .  
                        2015-11-22 19:50:51                                  Service Control Manager         7036:  "NVIDIA Stereoscopic 3D Driver Service"    .  
                        2015-11-22 19:50:52                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-22 19:50:52                                  EventLog                        6005:    .  
                        2015-11-22 19:50:52                                  EventLog                        6013:    14 .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "     "    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-22 19:50:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 19:50:52                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-22 19:50:52  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-22 19:50:52  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-22 19:50:53                                  Service Control Manager         7036:  " "    .  
                1101       2015-11-22 19:50:54                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-22 19:50:55                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 19:50:55                                  Service Control Manager         7036:  "-"    .  
                        2015-11-22 19:50:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 19:50:56                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 19:50:56                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 19:50:56                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 19:50:56                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 19:50:56                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 19:50:56                                  Service Control Manager         7036:  "NVIDIA GeForce Experience Service"    .  
                        2015-11-22 19:50:56                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 19:50:57                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-22 19:50:57                                  Service Control Manager         7036:  "NVIDIA Network Service"    .  
                        2015-11-22 19:50:57                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-22 19:50:58                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-22 19:50:58                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 19:50:58                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-22 19:50:59                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 19:50:59                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 19:51:00                                  Service Control Manager         7036:  "NVIDIA Streamer Service"    .  
                        2015-11-22 19:51:01                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 19:51:01                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-22 19:51:03                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 19:51:03                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 19:51:07                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-22 19:51:09                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 19:51:09                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-22 19:51:09                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 19:51:09                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 19:51:09                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 19:51:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 19:51:10                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-22 19:51:10                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 19:51:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 19:51:11                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-22 19:51:12                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-22 19:51:12                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-22 19:51:15                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-22 19:53:08                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v4.0.30319_X86"    .  
                        2015-11-22 19:53:08                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v4.0.30319_X86"    .  
                        2015-11-22 19:53:08                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-22 19:53:09                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 19:53:09                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 19:53:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 19:53:10                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 19:53:12                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 19:56:17                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 19:57:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 19:58:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 19:59:24                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 20:00:37                                  Service Control Manager         7036:  "    "    .  
                        2015-11-22 20:00:37                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-22 20:00:47                                  Application Popup               26:   : Brothers.exe -   :   ,      MSVCR100.dll.   .   
                        2015-11-22 20:00:54                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-22 20:01:24                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 20:02:59  sima                            Service Control Manager         7045:    .     :  Portable WinCDEmu driver    :  system32\drivers\BazisPortableCDBus.sys   :        :      :    
                7005       2015-11-22 20:03:15                           Microsoft-Windows-UserPnp       20003:       cdrom      BAZISVIRTUALCDBUS\STANDARDDEVICE\PORTABLEVIRTUALCD_0000   : 0.  
                7005       2015-11-22 20:03:16                           Microsoft-Windows-UserPnp       20001:       FileRepository\cdrom.inf_x86_neutral_6381e09675524225\cdrom.inf      BAZISVIRTUALCDBUS\STANDARDDEVICE\PORTABLEVIRTUALCD_0000   : 0x0.  
                        2015-11-22 20:05:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 20:05:00                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-22 20:06:17                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 20:06:21                                  Service Control Manager         7036:  " Windows"    .  
                1          2015-11-22 20:06:42                           Microsoft-Windows-WindowsUpdateClient  27:   .  
                        2015-11-22 20:06:44                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 20:06:45                                  volsnap                         33:      C:      ,     C:,  ,  .  
                1          2015-11-22 20:07:20                           Microsoft-Windows-WindowsUpdateClient  28:   .  
                        2015-11-22 20:09:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 20:12:52                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-22 20:16:51                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 20:24:26                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 20:28:22                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 20:30:56                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 20:43:57                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 20:43:57                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-22 20:44:00                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 20:44:00                                  Service Control Manager         7036:  "  Windows"    .  
                          2015-11-22 20:44:00  LOCAL SERVICE                   Microsoft-Windows-Time-Service  134: NTP-           -   DNS-  "". NTP-    3473457 .,      . :   . (0x80072AF9)  
                        2015-11-22 20:44:36                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 20:47:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 20:50:00                                  Service Control Manager         7036:  "    (Microsoft)"    .  
                        2015-11-22 20:55:15                           Service Control Manager         7040:    "  Windows"    ""  "".  
                        2015-11-22 20:55:17                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 20:55:17                           Service Control Manager         7040:    "  Windows"    ""  "".  
                        2015-11-22 21:05:28                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 21:05:29                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-22 21:05:33                                  Service Control Manager         7036:  "   "    .  
                          2015-11-22 21:05:40  LOCAL SERVICE                   Microsoft-Windows-Time-Service  134: NTP-           -   DNS-  "". NTP-    3473457 .,      . :   ,      . (0x80072AFC)  
                          2015-11-22 21:05:40  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     time.windows.com        DNS.  
                          2015-11-22 21:05:52  LOCAL SERVICE                   Microsoft-Windows-Time-Service  134: NTP-           -   DNS-  "". NTP-    3473457 .,      . :   ,      . (0x80072AFC)  
                        2015-11-22 21:05:57                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 21:20:52  LOCAL SERVICE                   Microsoft-Windows-Time-Service  137: Ntp-      time.windows.com,0x9   .  
                        2015-11-22 21:20:53                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 21:20:53  LOCAL SERVICE                   Microsoft-Windows-Time-Service  37: NTP-         time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->23.102.23.44:123).  
                        2015-11-22 21:20:53  LOCAL SERVICE                   Microsoft-Windows-Time-Service  35:          time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->23.102.23.44:123).  
                        2015-11-22 21:20:53  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-22 21:21:19                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 21:22:53                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 21:23:59                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 21:29:17                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 21:29:26                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 21:33:59                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-22 21:38:40                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 21:43:41                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 21:56:45                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-22 22:05:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 22:08:55  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-22 22:08:58  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-22 22:08:58                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-22 22:08:59                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 22:08:59                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 22:08:59                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 22:08:59                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-22 22:08:59                                  EventLog                        6006:    .  
                        2015-11-22 22:08:59                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-22 22:08:59                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 22:08:59                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 22:08:59                                  Service Control Manager         7036:  "NVIDIA Network Service"    .  
                        2015-11-22 22:08:59                                  Service Control Manager         7036:  "NVIDIA Display Driver Service"    .  
                        2015-11-22 22:08:59                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-22 22:08:59                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-22 22:08:59                                  Service Control Manager         7036:  ""    .  
                        2015-11-22 22:08:59                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-22 22:08:59                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 22:08:59                                  Service Control Manager         7036:  "-"    .  
                        2015-11-22 22:08:59                                  Service Control Manager         7036:  "NVIDIA Stereoscopic 3D Driver Service"    .  
                        2015-11-22 22:08:59                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-22 22:08:59                                  Service Control Manager         7036:  "     "    .  
                        2015-11-22 22:08:59                                  Service Control Manager         7036:  "   "    .  
                4          2015-11-22 22:08:59  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-22 22:08:59  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-22 22:08:59                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-11-22 22:09:00                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 22:09:00                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-22 22:09:00                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-22 22:09:00                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-22 22:09:00                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-22 22:09:00                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-22 22:09:00                                  Service Control Manager         7036:  "  "    .  
                        2015-11-22 22:09:00                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-22 22:09:00                                  Service Control Manager         7036:  "   "    .  
                        2015-11-22 22:09:00                                  Service Control Manager         7036:  "NVIDIA Streamer Service"    .  
                        2015-11-22 22:09:00                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-22 22:09:00                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-22 22:09:00                                  Service Control Manager         7036:  " "    .  
                        2015-11-22 22:09:00                                  Service Control Manager         7036:  "  WLAN"    .  
                          2015-11-22 22:09:00                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-22 22:09:01                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-22 22:09:02                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-22 22:09:02                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-22 22:09:06                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-23 22:38:44                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-23 22:38:47                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-23 22:38:52                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-23 22:38:52                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                        2015-11-23 22:39:02                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-23 22:39:02                                  Service Control Manager         7036:  ""    .  
                        2015-11-23 22:39:02                                  Service Control Manager         7036:  "NVIDIA Display Driver Service"    .  
                        2015-11-23 22:39:02                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-23 22:39:02                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-23 22:39:03                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-23 22:39:03                                  EventLog                        6005:    .  
                        2015-11-23 22:39:03                                  EventLog                        6013:    18 .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "NVIDIA Stereoscopic 3D Driver Service"    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  ""    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  " "    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "    "    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "     "    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "   "    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "   "    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-23 22:39:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 22:39:03                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-23 22:39:03  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-23 22:39:03  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-23 22:39:04                                  Service Control Manager         7036:  " "    .  
                1101       2015-11-23 22:39:04                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-23 22:39:05                                  Service Control Manager         7036:  " "    .  
                        2015-11-23 22:39:05                                  Service Control Manager         7036:  "-"    .  
                        2015-11-23 22:39:05                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 22:39:05                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-23 22:39:05                                  Service Control Manager         7036:  " "    .  
                        2015-11-23 22:39:05                                  Service Control Manager         7036:  " "    .  
                        2015-11-23 22:39:05                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 22:39:05                                  Service Control Manager         7036:  " "    .  
                        2015-11-23 22:39:05                                  Service Control Manager         7036:  " "    .  
                        2015-11-23 22:39:05                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-23 22:39:05                                  Service Control Manager         7036:  "NVIDIA GeForce Experience Service"    .  
                        2015-11-23 22:39:05                                  Service Control Manager         7036:  "    "    .  
                        2015-11-23 22:39:07                                  Service Control Manager         7036:  "NVIDIA Network Service"    .  
                        2015-11-23 22:39:08                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-23 22:39:08                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-23 22:39:08                                  Service Control Manager         7036:  ""    .  
                        2015-11-23 22:39:08                                  Service Control Manager         7036:  "   "    .  
                        2015-11-23 22:39:08                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-23 22:39:08                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-23 22:39:08                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-23 22:39:08                                  Service Control Manager         7036:  "   "    .  
                        2015-11-23 22:39:09                                  Service Control Manager         7036:  ""    .  
                        2015-11-23 22:39:09                                  Service Control Manager         7036:  "NVIDIA Streamer Service"    .  
                        2015-11-23 22:39:14                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-23 22:39:14                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 22:39:18                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-23 22:39:18                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-23 22:39:18                                  Service Control Manager         7036:  "   "    .  
                        2015-11-23 22:39:18                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 22:39:18                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 22:39:18                                  Service Control Manager         7036:  " "    .  
                        2015-11-23 22:39:18                                  Service Control Manager         7036:  "   "    .  
                        2015-11-23 22:39:18                                  Service Control Manager         7036:  "   "    .  
                        2015-11-23 22:39:18                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-23 22:39:19                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-23 22:39:19                                  Service Control Manager         7036:  "  PNP-"    .  
                7005       2015-11-23 22:39:20                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-11-23 22:39:25                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-23 22:41:14                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v4.0.30319_X86"    .  
                        2015-11-23 22:41:14                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v4.0.30319_X86"    .  
                        2015-11-23 22:41:14                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-23 22:41:15                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 22:41:15                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-23 22:41:15                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 22:41:17                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-23 22:41:18                                  Service Control Manager         7036:  "   "    .  
                        2015-11-23 22:41:46                                  Service Control Manager         7036:  "    "    .  
                        2015-11-23 22:41:46                           Microsoft-Windows-Application-Experience  201:       .  
                            2015-11-23 22:42:03                                  ipnathlp                        
                            2015-11-23 22:42:03                                  ipnathlp                        
                        2015-11-23 22:42:04                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-23 22:42:05                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-23 22:42:07  LOCAL SERVICE                   Microsoft-Windows-Time-Service  37: NTP-         time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->23.101.187.68:123).  
                        2015-11-23 22:42:09                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-23 22:42:17                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-23 22:42:17  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-23 22:42:17  LOCAL SERVICE                   Microsoft-Windows-Time-Service  35:          time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->23.101.187.68:123).  
                        2015-11-23 22:42:17  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-23 22:42:17  LOCAL SERVICE                   Microsoft-Windows-Kernel-General  1:  .  
                        2015-11-23 22:42:34                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-23 22:42:44                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-23 22:43:34                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-23 22:46:12                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 22:51:08                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 22:53:22                                  Service Control Manager         7036:  "   "    .  
                        2015-11-23 22:58:30                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-23 23:01:16                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 23:01:32                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-23 23:01:33                                  Service Control Manager         7036:  "   "    .  
                        2015-11-23 23:02:33                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-23 23:04:33                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-23 23:06:27                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 23:11:33                                  Service Control Manager         7036:  "   "    .  
                        2015-11-23 23:15:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 23:20:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 23:26:45  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-23 23:26:46                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 23:26:48                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-23 23:26:48                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 23:26:48  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-23 23:26:48                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  " "    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-23 23:26:49                                  EventLog                        6006:    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "NVIDIA Network Service"    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "NVIDIA Display Driver Service"    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  ""    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "-"    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "   "    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "NVIDIA Stereoscopic 3D Driver Service"    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "     "    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "   "    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "NVIDIA Streamer Service"    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  " "    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-23 23:26:49                                  Service Control Manager         7036:  "  WLAN"    .  
                4          2015-11-23 23:26:49  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-23 23:26:49  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-23 23:26:49                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-23 23:26:49                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                103        2015-11-23 23:26:50                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-23 23:26:52                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-24 21:29:51                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-24 21:29:54                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-24 21:29:59                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-24 21:29:59                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                        2015-11-24 21:30:02                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-24 21:30:02                                  Service Control Manager         7036:  ""    .  
                        2015-11-24 21:30:02                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-24 21:30:02                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-24 21:30:04                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-24 21:30:04                                  EventLog                        6005:    .  
                        2015-11-24 21:30:04                                  EventLog                        6013:    13 .  
                        2015-11-24 21:30:04                                  Service Control Manager         7036:  "NVIDIA Display Driver Service"    .  
                        2015-11-24 21:30:04                                  Service Control Manager         7036:  "NVIDIA Stereoscopic 3D Driver Service"    .  
                        2015-11-24 21:30:04                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-24 21:30:04                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-24 21:30:04                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-24 21:30:04                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-24 21:30:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 21:30:05                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-24 21:30:05                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-24 21:30:05                                  Service Control Manager         7036:  ""    .  
                        2015-11-24 21:30:05                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 21:30:05                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 21:30:05                                  Service Control Manager         7036:  " "    .  
                        2015-11-24 21:30:05                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-24 21:30:05                                  Service Control Manager         7036:  "    "    .  
                        2015-11-24 21:30:05                                  Service Control Manager         7036:  "     "    .  
                        2015-11-24 21:30:05                                  Service Control Manager         7036:  "   "    .  
                        2015-11-24 21:30:05                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-24 21:30:05                                  Service Control Manager         7036:  "   "    .  
                        2015-11-24 21:30:05                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-24 21:30:05                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-24 21:30:05                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-24 21:30:05                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-24 21:30:05                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-24 21:30:05                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-24 21:30:05                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 21:30:05                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-24 21:30:05  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-24 21:30:05  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                1101       2015-11-24 21:30:06                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-24 21:30:07                                  Service Control Manager         7036:  " "    .  
                        2015-11-24 21:30:07                                  Service Control Manager         7036:  " "    .  
                        2015-11-24 21:30:07                                  Service Control Manager         7036:  "-"    .  
                        2015-11-24 21:30:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 21:30:07                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-24 21:30:07                                  Service Control Manager         7036:  " "    .  
                        2015-11-24 21:30:07                                  Service Control Manager         7036:  " "    .  
                        2015-11-24 21:30:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 21:30:07                                  Service Control Manager         7036:  " "    .  
                        2015-11-24 21:30:07                                  Service Control Manager         7036:  "NVIDIA GeForce Experience Service"    .  
                        2015-11-24 21:30:07                                  Service Control Manager         7036:  " "    .  
                        2015-11-24 21:30:07                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-24 21:30:09                                  Service Control Manager         7036:  "NVIDIA Network Service"    .  
                        2015-11-24 21:30:10                                  Service Control Manager         7036:  "    "    .  
                        2015-11-24 21:30:15                                  Service Control Manager         7036:  ""    .  
                        2015-11-24 21:30:15                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-24 21:30:15                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-24 21:30:15                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-24 21:30:15                                  Service Control Manager         7036:  "   "    .  
                        2015-11-24 21:30:15                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-24 21:30:15                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-24 21:30:15                                  Service Control Manager         7036:  "   "    .  
                        2015-11-24 21:30:15                                  Service Control Manager         7036:  ""    .  
                        2015-11-24 21:30:16                                  Service Control Manager         7036:  "NVIDIA Streamer Service"    .  
                        2015-11-24 21:30:18                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-24 21:30:18                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 21:30:18                                  Service Control Manager         7036:  "   "    .  
                        2015-11-24 21:30:18                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-24 21:30:18                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 21:30:18                                  Service Control Manager         7036:  "   "    .  
                        2015-11-24 21:30:18                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 21:30:18                                  Service Control Manager         7036:  " "    .  
                        2015-11-24 21:30:18                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-24 21:30:18                                  Service Control Manager         7036:  "   "    .  
                        2015-11-24 21:30:18                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-24 21:30:19                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-24 21:30:19                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-24 21:30:24                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-24 21:32:18                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v4.0.30319_X86"    .  
                        2015-11-24 21:32:18                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v4.0.30319_X86"    .  
                        2015-11-24 21:32:18                                  Service Control Manager         7036:  "   "    .  
                        2015-11-24 21:32:18                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-24 21:32:19                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 21:32:19                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-24 21:32:19                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 21:32:21                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-24 21:32:32                                  Service Control Manager         7036:  "    "    .  
                        2015-11-24 21:32:32                           Microsoft-Windows-Application-Experience  201:       .  
                            2015-11-24 21:33:10                                  ipnathlp                        
                        2015-11-24 21:33:11                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-24 21:35:10                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-24 21:35:25                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 21:35:30                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-24 21:35:41                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-24 21:36:30                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-24 21:37:21                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 21:37:27                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-24 21:37:35                                  Service Control Manager         7036:  " "    .  
                        2015-11-24 21:37:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 21:45:26                                  Service Control Manager         7036:  "   "    .  
                        2015-11-24 21:54:11                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-24 21:58:25                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 22:04:28                                  Service Control Manager         7036:  "   "    .  
                        2015-11-24 22:07:30                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 22:10:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 22:12:31                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 22:31:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 22:36:09                                  Service Control Manager         7036:  "   "    .  
                        2015-11-24 22:40:20                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 22:42:50                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 22:45:38                                  Service Control Manager         7036:  "   "    .  
                        2015-11-24 22:49:05                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 22:50:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 22:51:10                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-24 22:55:57                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 23:00:36                                  Service Control Manager         7036:  "   "    .  
                        2015-11-24 23:07:40                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-24 23:22:47                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-24 23:23:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 23:24:47                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-24 23:28:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 23:46:43                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 23:47:29  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  " "    .  
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  "NVIDIA Network Service"    .  
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  "NVIDIA Display Driver Service"    .  
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  ""    .  
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  "-"    .  
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  "   "    .  
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  "NVIDIA Stereoscopic 3D Driver Service"    .  
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  "     "    .  
                        2015-11-24 23:47:32                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-24 23:47:32  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-24 23:47:32                           Microsoft-Windows-Winlogon      7002:           
                4          2015-11-24 23:47:32  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-24 23:47:32  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-24 23:47:32                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-11-24 23:47:33                                  EventLog                        6006:    .  
                        2015-11-24 23:47:33                                  Service Control Manager         7036:  "   "    .  
                        2015-11-24 23:47:33                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-24 23:47:33                                  Service Control Manager         7036:  "NVIDIA Streamer Service"    .  
                        2015-11-24 23:47:33                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-24 23:47:33                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-24 23:47:33                                  Service Control Manager         7036:  "  "    .  
                        2015-11-24 23:47:33                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-24 23:47:33                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-24 23:47:33                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-24 23:47:33                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-24 23:47:33                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-24 23:47:33                                  Service Control Manager         7036:  " "    .  
                        2015-11-24 23:47:33                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-24 23:47:33                                  Service Control Manager         7036:  "  WLAN"    .  
                          2015-11-24 23:47:33                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                103        2015-11-24 23:47:34                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-24 23:47:36                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-25 09:21:53                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-25 09:21:56                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-25 09:22:01                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-25 09:22:01                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                        2015-11-25 09:22:04                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-25 09:22:04                                  Service Control Manager         7036:  ""    .  
                        2015-11-25 09:22:04                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-25 09:22:04                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-25 09:22:05                                  Service Control Manager         7036:  "NVIDIA Display Driver Service"    .  
                        2015-11-25 09:22:05                                  Service Control Manager         7036:  "NVIDIA Stereoscopic 3D Driver Service"    .  
                        2015-11-25 09:22:05                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-25 09:22:06                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-25 09:22:06                                  EventLog                        6005:    .  
                        2015-11-25 09:22:06                                  EventLog                        6013:    12 .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  ""    .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  "    "    .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  "     "    .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-25 09:22:06                                  Service Control Manager         7036:  "    (EAP)"    .  
                4          2015-11-25 09:22:06  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-25 09:22:06  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-25 09:22:07                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-25 09:22:07                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 09:22:07                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                        2015-11-25 09:22:08                                  Service Control Manager         7036:  " "    .  
                1101       2015-11-25 09:22:08                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-25 09:22:09                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 09:22:09                                  Service Control Manager         7036:  "-"    .  
                        2015-11-25 09:22:09                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 09:22:09                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-25 09:22:09                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 09:22:09                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 09:22:09                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 09:22:09                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 09:22:09                                  Service Control Manager         7036:  "NVIDIA GeForce Experience Service"    .  
                        2015-11-25 09:22:09                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 09:22:09                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-25 09:22:11                                  Service Control Manager         7036:  "    "    .  
                        2015-11-25 09:22:12                                  Service Control Manager         7036:  "NVIDIA Network Service"    .  
                        2015-11-25 09:22:15                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-25 09:22:15                                  Service Control Manager         7036:  ""    .  
                        2015-11-25 09:22:15                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-25 09:22:15                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 09:22:15                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-25 09:22:15                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-25 09:22:15                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-25 09:22:15                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 09:22:15                                  Service Control Manager         7036:  ""    .  
                        2015-11-25 09:22:19                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-25 09:22:27                                  Service Control Manager         7036:  "NVIDIA Streamer Service"    .  
                        2015-11-25 09:22:27                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 09:22:27                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-25 09:22:27                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 09:22:27                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 09:22:27                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-25 09:22:27                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 09:22:27                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 09:22:27                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 09:22:27                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 09:22:28                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-25 09:22:29                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-25 09:22:31                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-25 09:22:31                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-25 09:22:31                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-25 09:22:33                                  Service Control Manager         7036:  "    "    .  
                        2015-11-25 09:22:33                           Microsoft-Windows-Application-Experience  201:       .  
                7005       2015-11-25 09:22:33                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-11-25 09:22:36                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-25 09:24:27                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v4.0.30319_X86"    .  
                        2015-11-25 09:24:27                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v4.0.30319_X86"    .  
                        2015-11-25 09:24:27                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 09:24:28                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 09:24:28                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-25 09:24:28                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 09:24:30                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-25 09:25:13                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-25 09:25:48                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-25 09:25:59                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-25 09:26:48                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-25 09:27:25                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 09:29:30                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 09:32:10                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-25 09:32:31                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 09:38:59                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-25 09:40:46  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-25 09:40:47                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 09:40:49                                  EventLog                        6006:    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "NVIDIA Network Service"    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "NVIDIA Display Driver Service"    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  ""    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "-"    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "NVIDIA Stereoscopic 3D Driver Service"    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "     "    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "NVIDIA Streamer Service"    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-25 09:40:49                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-25 09:40:49  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-25 09:40:49                           Microsoft-Windows-Winlogon      7002:           
                4          2015-11-25 09:40:49  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-25 09:40:49  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-25 09:40:49                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                        2015-11-25 09:40:50                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-25 09:40:50                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 09:40:50                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-25 09:40:50                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-25 09:40:50                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-25 09:40:50                                  Microsoft-Windows-Kernel-Power  109:      .  
                          2015-11-25 09:40:50                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-25 09:40:53                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-25 14:40:57                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-25 14:41:00                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-25 14:41:04                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-25 14:41:04                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                        2015-11-25 14:41:08                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-25 14:41:08                                  Service Control Manager         7036:  ""    .  
                        2015-11-25 14:41:08                                  Service Control Manager         7036:  "NVIDIA Display Driver Service"    .  
                        2015-11-25 14:41:08                                  Service Control Manager         7036:  "NVIDIA Stereoscopic 3D Driver Service"    .  
                        2015-11-25 14:41:08                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-25 14:41:08                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-25 14:41:09                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-25 14:41:10                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-25 14:41:10                                  EventLog                        6005:    .  
                        2015-11-25 14:41:10                                  EventLog                        6013:    12 .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  ""    .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  "    "    .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  "     "    .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-25 14:41:10                                  Service Control Manager         7036:  "    (EAP)"    .  
                4          2015-11-25 14:41:10  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-25 14:41:10  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-25 14:41:11                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-25 14:41:11                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 14:41:11                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                        2015-11-25 14:41:12                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 14:41:13                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 14:41:13                                  Service Control Manager         7036:  "-"    .  
                        2015-11-25 14:41:13                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 14:41:13                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-25 14:41:13                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 14:41:13                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 14:41:13                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 14:41:13                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 14:41:14                                  Service Control Manager         7036:  "NVIDIA GeForce Experience Service"    .  
                        2015-11-25 14:41:14                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 14:41:14                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                1101       2015-11-25 14:41:14                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-25 14:41:15                                  Service Control Manager         7036:  "    "    .  
                        2015-11-25 14:41:16                                  Service Control Manager         7036:  "NVIDIA Network Service"    .  
                        2015-11-25 14:41:17                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-25 14:41:17                                  Service Control Manager         7036:  ""    .  
                        2015-11-25 14:41:18                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-25 14:41:18                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-25 14:41:18                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 14:41:18                                  Service Control Manager         7036:  "NVIDIA Streamer Service"    .  
                        2015-11-25 14:41:18                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-25 14:41:18                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-25 14:41:19                                  Service Control Manager         7036:  ""    .  
                        2015-11-25 14:41:19                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 14:41:22                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-25 14:41:23                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-25 14:41:23                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 14:41:23                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 14:41:23                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 14:41:23                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 14:41:23                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 14:41:23                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 14:41:23                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-25 14:41:23                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 14:41:24                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-25 14:41:26                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-25 14:41:26                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-25 14:41:27                                  Service Control Manager         7036:  "Windows Search"    .  
                        2015-11-25 14:42:37                                  Service Control Manager         7036:  "    "    .  
                        2015-11-25 14:42:37                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-25 14:43:22                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v4.0.30319_X86"    .  
                        2015-11-25 14:43:22                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v4.0.30319_X86"    .  
                        2015-11-25 14:43:23                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-25 14:43:23                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 14:43:23                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 14:43:24                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-25 14:43:24                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 14:43:26                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-25 14:44:47                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-25 14:46:28                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-25 14:46:39                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-25 14:48:26                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 14:52:38                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 14:52:49                                  Service Control Manager         7036:  "   "    .  
                          2015-11-25 14:52:49                                  Disk                            51:     \Device\Harddisk2\DR2      .  
                          2015-11-25 14:52:50                                  Disk                            51:     \Device\Harddisk2\DR3      .  
                          2015-11-25 14:52:52                                  Disk                            51:     \Device\Harddisk2\DR4      .  
                          2015-11-25 14:52:54                                  Disk                            51:     \Device\Harddisk2\DR5      .  
                          2015-11-25 14:54:26                                  Disk                            51:     \Device\Harddisk2\DR7      .  
                        2015-11-25 14:55:10                                  Service Control Manager         7036:  "   "    .  
                          2015-11-25 14:56:38                                  Disk                            51:     \Device\Harddisk2\DR12      .  
                          2015-11-25 14:57:07                                  Disk                            51:     \Device\Harddisk2\DR14      .  
                          2015-11-25 14:57:11                                  Disk                            51:     \Device\Harddisk2\DR16      .  
                          2015-11-25 14:57:12                                  Disk                            51:     \Device\Harddisk2\DR17      .  
                          2015-11-25 14:57:14                                  Disk                            51:     \Device\Harddisk2\DR18      .  
                          2015-11-25 14:57:17                                  Disk                            51:     \Device\Harddisk2\DR19      .  
                          2015-11-25 14:57:18                                  Disk                            51:     \Device\Harddisk2\DR20      .  
                          2015-11-25 14:57:18                                  Disk                            51:     \Device\Harddisk2\DR21      .  
                          2015-11-25 14:57:21                                  Disk                            51:     \Device\Harddisk2\DR22      .  
                          2015-11-25 14:58:02                                  Disk                            51:     \Device\Harddisk2\DR24      .  
                          2015-11-25 14:58:04                                  Disk                            51:     \Device\Harddisk2\DR25      .  
                          2015-11-25 14:58:06                                  Disk                            51:     \Device\Harddisk2\DR26      .  
                          2015-11-25 14:58:07                                  Disk                            51:     \Device\Harddisk2\DR27      .  
                          2015-11-25 14:58:07                                  Disk                            51:     \Device\Harddisk2\DR28      .  
                          2015-11-25 14:58:09                                  Disk                            51:     \Device\Harddisk2\DR29      .  
                          2015-11-25 14:58:10                                  Disk                            51:     \Device\Harddisk2\DR30      .  
                          2015-11-25 14:58:15                                  Disk                            51:     \Device\Harddisk2\DR32      .  
                          2015-11-25 14:58:16                                  Disk                            51:     \Device\Harddisk2\DR33      .  
                          2015-11-25 14:58:18                                  Disk                            51:     \Device\Harddisk2\DR34      .  
                          2015-11-25 14:58:19                                  Disk                            51:     \Device\Harddisk2\DR35      .  
                          2015-11-25 14:58:20                                  Disk                            51:     \Device\Harddisk2\DR36      .  
                          2015-11-25 14:58:22                                  Disk                            51:     \Device\Harddisk2\DR37      .  
                          2015-11-25 14:58:22                                  Disk                            51:     \Device\Harddisk2\DR38      .  
                        2015-11-25 15:03:23                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 15:03:38  sima                            USER32                          1074:  Explorer.EXE   " "   VLADIMIR    vladimir\sima  :  ()     : 0x0     :      :   
                        2015-11-25 15:03:39                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 15:03:41                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-25 15:03:41  sima                            USER32                          1074:  C:\Windows\system32\winlogon.exe (VLADIMIR)   " "   VLADIMIR    vladimir\sima  :        : 0x500ff     :      :   
                1102       2015-11-25 15:03:41                           Microsoft-Windows-Winlogon      7002:           
                        2015-11-25 15:03:42                                  EventLog                        6006:    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "NVIDIA Network Service"    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "NVIDIA Display Driver Service"    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  ""    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "-"    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "NVIDIA Stereoscopic 3D Driver Service"    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "     "    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "  PNP-"    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "NVIDIA Streamer Service"    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-25 15:03:42                                  Service Control Manager         7036:  "Superfetch"    .  
                4          2015-11-25 15:03:42  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51047:   DHCPv6 .    : 1  
                4          2015-11-25 15:03:42  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50037:    DHCPv4.    : 1  
                7010       2015-11-25 15:03:42                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "false"      PlugPlay: "false"     
                          2015-11-25 15:03:42                           Microsoft-Windows-WLAN-AutoConfig  4001:      .    
                        2015-11-25 15:03:43                                  Service Control Manager         7036:  "Windows Search"    .  
                103        2015-11-25 15:03:43                                  Microsoft-Windows-Kernel-Power  109:      .  
                        2015-11-25 15:03:46                                  Microsoft-Windows-Kernel-General  13:  .  
                        2015-11-25 23:28:39                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-25 23:28:42                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                4          2015-11-25 23:28:47                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-25 23:28:47                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                        2015-11-25 23:28:50                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                7010       2015-11-25 23:28:50                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                        2015-11-25 23:28:51                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-25 23:28:51                                  EventLog                        6005:    .  
                        2015-11-25 23:28:51                                  EventLog                        6013:    12 .  
                        2015-11-25 23:28:51                                  Service Control Manager         7036:  ""    .  
                        2015-11-25 23:28:51                                  Service Control Manager         7036:  "NVIDIA Display Driver Service"    .  
                        2015-11-25 23:28:51                                  Service Control Manager         7036:  "NVIDIA Stereoscopic 3D Driver Service"    .  
                        2015-11-25 23:28:51                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-25 23:28:51                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-25 23:28:51                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-25 23:28:51                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-25 23:28:51                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                        2015-11-25 23:28:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 23:28:52                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-25 23:28:52                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-25 23:28:52                                  Service Control Manager         7036:  ""    .  
                        2015-11-25 23:28:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 23:28:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 23:28:52                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-25 23:28:52                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 23:28:52                                  Service Control Manager         7036:  "    "    .  
                        2015-11-25 23:28:52                                  Service Control Manager         7036:  "     "    .  
                        2015-11-25 23:28:52                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 23:28:52                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-25 23:28:52                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 23:28:52                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-25 23:28:53                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-25 23:28:53                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-25 23:28:53                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-25 23:28:53                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-25 23:28:53                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-25 23:28:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 23:28:53                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 23:28:53                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-25 23:28:53  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-25 23:28:53  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-25 23:28:55                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 23:28:55                                  Service Control Manager         7036:  "-"    .  
                        2015-11-25 23:28:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 23:28:55                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-25 23:28:55                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 23:28:55                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 23:28:55                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 23:28:55                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 23:28:55                                  Service Control Manager         7036:  "NVIDIA GeForce Experience Service"    .  
                        2015-11-25 23:28:55                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 23:28:55                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                1101       2015-11-25 23:28:55                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-25 23:28:57                                  Service Control Manager         7036:  "    "    .  
                        2015-11-25 23:28:57                                  Service Control Manager         7036:  "NVIDIA Network Service"    .  
                        2015-11-25 23:28:59                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-25 23:28:59                                  Service Control Manager         7036:  ""    .  
                        2015-11-25 23:28:59                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-25 23:28:59                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 23:28:59                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-25 23:28:59                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-25 23:29:00                                  Service Control Manager         7036:  "NVIDIA Streamer Service"    .  
                        2015-11-25 23:29:00                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-25 23:29:00                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 23:29:00                                  Service Control Manager         7036:  ""    .  
                        2015-11-25 23:29:03                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-25 23:29:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 23:29:03                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-25 23:29:03                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 23:29:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 23:29:03                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 23:29:04                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 23:29:04                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-25 23:29:04                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 23:29:04                                  Service Control Manager         7036:  "   "    .  
                        2015-11-25 23:29:05                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-25 23:29:06                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-25 23:29:06                                  Service Control Manager         7036:  "  PNP-"    .  
                7005       2015-11-25 23:29:08                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0000   : 0.  
                        2015-11-25 23:29:10                                  Service Control Manager         7036:  "Windows Search"    .  
                7005       2015-11-25 23:29:10                           Microsoft-Windows-UserPnp       20003:       tunnel      ROOT\*ISATAP\0001   : 0.  
                          2015-11-25 23:29:30                                  Disk                            51:     \Device\Harddisk2\DR4      .  
                          2015-11-25 23:29:32                                  Disk                            51:     \Device\Harddisk2\DR5      .  
                        2015-11-25 23:31:03                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v4.0.30319_X86"    .  
                        2015-11-25 23:31:03                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v4.0.30319_X86"    .  
                        2015-11-25 23:31:04                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-25 23:31:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 23:31:04                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-25 23:31:04                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 23:31:06                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-25 23:33:45                                  Service Control Manager         7036:  "    "    .  
                        2015-11-25 23:33:45                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-25 23:33:46                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-25 23:33:54                                  Service Control Manager         7036:  " "    .  
                        2015-11-25 23:33:58                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                          2015-11-25 23:34:16  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     api.accounts.firefox.com        DNS.  
                          2015-11-25 23:35:25                                  Disk                            51:     \Device\Harddisk2\DR8      .  
                          2015-11-25 23:35:27                                  Disk                            51:     \Device\Harddisk2\DR9      .  
                          2015-11-25 23:35:59                                  Disk                            51:     \Device\Harddisk2\DR12      .  
                          2015-11-25 23:36:00                                  Disk                            51:     \Device\Harddisk2\DR13      .  
                        2015-11-25 23:36:06                                  Service Control Manager         7036:  "  "    .  
                        2015-11-25 23:39:32                                  Service Control Manager         7036:  "   "    .  
                          2015-11-25 23:40:25  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     platform.twitter.com        DNS.  
                        2015-11-25 23:42:33                                  Service Control Manager         7036:  "  "    .  
                          2015-11-25 23:44:01  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     www.everestjs.net        DNS.  
                        2015-11-25 23:47:14                                  Service Control Manager         7036:  "   "    .  
                          2015-11-25 23:49:02  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     counter.yadro.ru        DNS.  
                        2015-11-26 07:15:37                           Microsoft-Windows-Kernel-General  12:   .  
                        2015-11-26 07:15:40                           Microsoft-Windows-FilterManager  6:    "FileInfo" ( 6.1, 2009-07-14T08:21:51.000000000Z)       .  
                63         2015-11-26 07:15:44                           Microsoft-Windows-Kernel-Power  41:  ,    .      ,    ,   ,    .  
                4          2015-11-26 07:15:46                           Microsoft-Windows-Kernel-Processor-Power  26:  0   0   :  :     1,  :   0,   :   0  
                4          2015-11-26 07:15:46                           Microsoft-Windows-Kernel-Processor-Power  26:  1   0   :  :     1,  :   0,   :   0  
                        2015-11-26 07:15:50                                  Service Control Manager         7036:  "Plug-and-Play"    .  
                        2015-11-26 07:15:50                                  Service Control Manager         7036:  ""    .  
                        2015-11-26 07:15:50                                  Service Control Manager         7036:  "NVIDIA Display Driver Service"    .  
                        2015-11-26 07:15:50                                  Service Control Manager         7036:  "NVIDIA Stereoscopic 3D Driver Service"    .  
                        2015-11-26 07:15:50                           Microsoft-Windows-FilterManager  6:    "luafv" ( 6.1, 2009-07-14T08:15:44.000000000Z)       .  
                7010       2015-11-26 07:15:50                           Microsoft-Windows-UserPnp       20010:      (Plug and Play).        PlugPlay: "true"      PlugPlay: "true"     
                            2015-11-26 07:15:51                                  EventLog                        6008:      23:48:45  ?25.?11.?2015  .  
                        2015-11-26 07:15:51                                  EventLog                        6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free.  
                        2015-11-26 07:15:51                                  EventLog                        6005:    .  
                        2015-11-26 07:15:51                                  EventLog                        6013:    13 .  
                        2015-11-26 07:15:51                                  Service Control Manager         7036:  "   DCOM-"    .  
                        2015-11-26 07:15:51                                  Service Control Manager         7036:  "   RPC"    .  
                        2015-11-26 07:15:51                                  Service Control Manager         7036:  "   (RPC)"    .  
                        2015-11-26 07:15:51                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-26 07:15:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-26 07:15:52                                  Service Control Manager         7036:  "    Windows Audio"    .  
                        2015-11-26 07:15:52                                  Service Control Manager         7036:  "Windows Audio"    .  
                        2015-11-26 07:15:52                                  Service Control Manager         7036:  ""    .  
                        2015-11-26 07:15:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-26 07:15:52                                  Service Control Manager         7036:  "  "    .  
                        2015-11-26 07:15:52                                  Service Control Manager         7036:  " "    .  
                        2015-11-26 07:15:52                                  Service Control Manager         7036:  "  COM+"    .  
                        2015-11-26 07:15:52                                  Service Control Manager         7036:  "    "    .  
                        2015-11-26 07:15:52                                  Service Control Manager         7036:  "     "    .  
                        2015-11-26 07:15:52                                  Service Control Manager         7036:  "   "    .  
                        2015-11-26 07:15:53                                  Service Control Manager         7036:  "Windows Driver Foundation - User-mode Driver Framework"    .  
                        2015-11-26 07:15:53                                  Service Control Manager         7036:  "   "    .  
                        2015-11-26 07:15:53                                  Service Control Manager         7036:  "  CNG"    .  
                        2015-11-26 07:15:53                                  Service Control Manager         7036:  "  NetBIOS  TCP/IP"    .  
                        2015-11-26 07:15:53                                  Service Control Manager         7036:  "DHCP-"    .  
                        2015-11-26 07:15:53                                  Service Control Manager         7036:  "    (EAP)"    .  
                        2015-11-26 07:15:53                                  Service Control Manager         7036:  "DNS-"    .  
                        2015-11-26 07:15:53                                  Service Control Manager         7036:  "  WLAN"    .  
                        2015-11-26 07:15:53                                  Service Control Manager         7036:  "  "    .  
                        2015-11-26 07:15:53                           Microsoft-Windows-WLAN-AutoConfig  4000:      .    
                4          2015-11-26 07:15:53  LOCAL SERVICE                   Microsoft-Windows-Dhcp-Client   50036:   DHCPv4   
                4          2015-11-26 07:15:53  LOCAL SERVICE                   Microsoft-Windows-DHCPv6-Client  51046:   DHCPv6   
                        2015-11-26 07:15:54                                  Service Control Manager         7036:  " "    .  
                        2015-11-26 07:15:55                                  Service Control Manager         7036:  " "    .  
                        2015-11-26 07:15:55                                  Service Control Manager         7036:  "-"    .  
                1101       2015-11-26 07:15:55                           Microsoft-Windows-Winlogon      7001:           
                        2015-11-26 07:15:56                                  Service Control Manager         7036:  "  "    .  
                        2015-11-26 07:15:56                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-26 07:15:56                                  Service Control Manager         7036:  " "    .  
                        2015-11-26 07:15:56                                  Service Control Manager         7036:  " "    .  
                        2015-11-26 07:15:56                                  Service Control Manager         7036:  "  "    .  
                        2015-11-26 07:15:56                                  Service Control Manager         7036:  " "    .  
                        2015-11-26 07:15:56                                  Service Control Manager         7036:  "NVIDIA GeForce Experience Service"    .  
                        2015-11-26 07:15:56                                  Service Control Manager         7036:  " "    .  
                        2015-11-26 07:15:56                                  Service Control Manager         7036:  "  IPsec        IP   "    .  
                        2015-11-26 07:15:56                                  Service Control Manager         7036:  "    "    .  
                        2015-11-26 07:15:57                                  Service Control Manager         7036:  "NVIDIA Network Service"    .  
                        2015-11-26 07:15:59                                  Service Control Manager         7036:  " SSTP"    .  
                        2015-11-26 07:15:59                                  Service Control Manager         7036:  "Superfetch"    .  
                        2015-11-26 07:15:59                                  Service Control Manager         7036:  ""    .  
                        2015-11-26 07:15:59                                  Service Control Manager         7036:  "   "    .  
                        2015-11-26 07:15:59                                  Service Control Manager         7036:  "   Windows (WIA)"    .  
                        2015-11-26 07:15:59                                  Service Control Manager         7036:  "  Windows"    .  
                        2015-11-26 07:16:00                                  Service Control Manager         7036:  "NVIDIA Streamer Service"    .  
                        2015-11-26 07:16:00                                  Service Control Manager         7036:  "  IP"    .  
                        2015-11-26 07:16:01                                  Service Control Manager         7036:  ""    .  
                        2015-11-26 07:16:01                                  Service Control Manager         7036:  "   "    .  
                        2015-11-26 07:16:15                                  Service Control Manager         7036:  "      (ICS)"    .  
                        2015-11-26 07:16:15                                  Service Control Manager         7036:  "  "    .  
                        2015-11-26 07:16:15                                  Service Control Manager         7036:  "Office Software Protection Platform"    .  
                        2015-11-26 07:16:15                                  Service Control Manager         7036:  "  "    .  
                        2015-11-26 07:16:15                                  Service Control Manager         7036:  " "    .  
                        2015-11-26 07:16:15                                  Service Control Manager         7036:  "  HID-"    .  
                        2015-11-26 07:16:15                                  Service Control Manager         7036:  "   "    .  
                        2015-11-26 07:16:15                                  Service Control Manager         7036:  "   "    .  
                        2015-11-26 07:16:15                                  Service Control Manager         7036:  "   "    .  
                        2015-11-26 07:16:15                                  Service Control Manager         7036:  "  "    .  
                        2015-11-26 07:16:16                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-26 07:16:16                                  Service Control Manager         7036:  "  IPsec"    .  
                        2015-11-26 07:16:18                                  Service Control Manager         7036:  " SSDP"    .  
                        2015-11-26 07:16:18                                  Service Control Manager         7036:  "  PNP-"    .  
                7005       2015-11-26 07:16:20                           Microsoft-Windows-UserPnp       20003:       usbccgp      USB\VID_1E4E&PID_0109\5&9965632&0&2   : 0.  
                7005       2015-11-26 07:16:20                           Microsoft-Windows-UserPnp       20001:       FileRepository\usb.inf_x86_neutral_2620fd493cad7d41\usb.inf      USB\VID_1E4E&PID_0109\5&9965632&0&2   : 0x0.  
                        2015-11-26 07:16:21                                  Service Control Manager         7036:  "Windows Search"    .  
                7005       2015-11-26 07:16:22                           Microsoft-Windows-UserPnp       20003:       usbvideo      USB\VID_1E4E&PID_0109&MI_00\6&284F17B0&0&0000   : 0.  
                7005       2015-11-26 07:16:22                           Microsoft-Windows-UserPnp       20001:       FileRepository\usbvideo.inf_x86_neutral_8fe3504355514e0c\usbvideo.inf      USB\VID_1E4E&PID_0109&MI_00\6&284F17B0&0&0000   : 0x0.  
                7005       2015-11-26 07:16:24                           Microsoft-Windows-UserPnp       20003:       usbaudio      USB\VID_1E4E&PID_0109&MI_02\6&284F17B0&0&0002   : 0.  
                7005       2015-11-26 07:16:24                           Microsoft-Windows-UserPnp       20001:       FileRepository\wdma_usb.inf_x86_neutral_a721e4f3907a2769\wdma_usb.inf      USB\VID_1E4E&PID_0109&MI_02\6&284F17B0&0&0002   : 0x0.  
                        2015-11-26 07:17:05                                  Service Control Manager         7036:  "    "    .  
                        2015-11-26 07:17:05                           Microsoft-Windows-Application-Experience  201:       .  
                        2015-11-26 07:17:07                                  Service Control Manager         7036:  "   Windows"    .  
                            2015-11-26 07:17:57                                  ipnathlp                        
                        2015-11-26 07:17:58                                  Service Control Manager         7036:  "   - WinHTTP"    .  
                        2015-11-26 07:18:15                                  Service Control Manager         7036:  "   "    .  
                        2015-11-26 07:18:16                                  Service Control Manager         7036:  "   Windows"    .  
                        2015-11-26 07:18:16                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v4.0.30319_X86"    .  
                        2015-11-26 07:18:16                                  Service Control Manager         7036:  "Microsoft .NET Framework NGEN v4.0.30319_X86"    .  
                        2015-11-26 07:18:28                                  Service Control Manager         7036:  "  "    .  
                        2015-11-26 07:18:47                                  Service Control Manager         7036:  " Windows"    .  
                        2015-11-26 07:18:47                                  Service Control Manager         7036:  "  "    .  
                        2015-11-26 07:18:49                                  Service Control Manager         7036:  "  Windows"    .  
                          2015-11-26 07:20:06  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     counter.yadro.ru        DNS.  
                        2015-11-26 07:20:36                           Microsoft-Windows-Application-Experience  206:          .  
                        2015-11-26 07:20:44                                  Service Control Manager         7036:  " "    .  
                        2015-11-26 07:21:06                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-26 07:22:21                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-26 07:22:31                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-26 07:23:21                                  Service Control Manager         7036:  "  Windows Media Center"    .  
                        2015-11-26 07:23:49                                  Service Control Manager         7036:  "  "    .  
                        2015-11-26 07:26:05                                  Service Control Manager         7036:  "  "    .  
                        2015-11-26 07:26:20                                  Service Control Manager         7036:  "   "    .  
                        2015-11-26 07:28:20                                  Service Control Manager         7036:  "   "    .  
                        2015-11-26 07:29:25                                  Service Control Manager         7036:  "   "    .  
                        2015-11-26 07:29:25  sima                            Service Control Manager         7045:    .     :  cpuz138    :  C:\Users\sima\AppData\Local\Temp\\cpuz138\cpuz138_x32.sys   :        :      :    
                        2015-11-26 07:29:27                                  Service Control Manager         7036:  " PNRP"    .  
                        2015-11-26 07:29:28  sima                            Service Control Manager         7045:    .     :  speccy    :  C:\Users\sima\AppData\Local\Temp\d34add37-9146-4198-8537-8d8fb281b8bc   :        :      :    
                        2015-11-26 07:29:32                                  Service Control Manager         7036:  "WMI Performance Adapter"    .  
                        2015-11-26 07:31:15  sima                            Service Control Manager         7045:    .     :  Lavalys EVEREST Kernel Driver    :  C:\my_programs\setup\system ytilit\EVEREST Ultimate Edition\kerneld.wnt   :        :      :    
                        2015-11-26 07:31:34                                  Service Control Manager         7036:  "  "    .  
                        2015-11-26 07:31:38                                  Service Control Manager         7036:  "WMI Performance Adapter"    .  
                        2015-11-26 07:31:39                                  Service Control Manager         7036:  "WMI Performance Adapter"    .  
                        2015-11-26 07:32:02                                  Service Control Manager         7036:  "  "    .  
                          2015-11-26 07:34:30  NETWORK SERVICE                 Microsoft-Windows-DNS-Client    1014:     mc.yandex.ru        DNS.  
                        2015-11-26 07:34:49                                  Service Control Manager         7036:  "   Windows"    .  


--------[   ]-------------------------------------------------------------------------------------------------------

      :
      Borland Database Engine                           -
      Borland InterBase Client                          -
      Easysoft ODBC-InterBase 6                         -
      Easysoft ODBC-InterBase 7                         -
      Firebird Client                                   -
      Jet Engine                                        4.00.9756.0
      MDAC                                              6.1.7601.17514 (win7sp1_rtm.101119-1850)
      ODBC                                              6.1.7601.17514 (win7sp1_rtm.101119-1850)
      MySQL Connector/ODBC                              -
      Oracle Client                                     -
      PsqlODBC                                          -
      Sybase ASE ODBC                                   -

     :
      Borland InterBase Server                          -
      Firebird Server                                   -
      Microsoft SQL Server                              -
      Microsoft SQL Server Compact Edition              -
      Microsoft SQL Server Express Edition              -
      MySQL Server                                      -
      Oracle Server                                     -
      PostgreSQL Server                                 -
      Sybase SQL Server                                 -


--------[  ODBC ]-----------------------------------------------------------------------------------------------

    Driver da Microsoft para arquivos texto (*.txt; *.csv)      odbcjt32.dll                              *.,*.asc,*.csv,*.tab,*.txt,*.csv
    Driver do Microsoft Access (*.mdb)                          odbcjt32.dll                              *.mdb
    Driver do Microsoft dBase (*.dbf)                           odbcjt32.dll                              *.dbf,*.ndx,*.mdx
    Driver do Microsoft Excel(*.xls)                            odbcjt32.dll                              *.xls
    Driver do Microsoft Paradox (*.db )                         odbcjt32.dll                              *.db
    Driver para o Microsoft Visual FoxPro                       vfpodbc.dll                               *.dbf,*.cdx,*.idx,*.fpt
    Microsoft Access dBASE Driver (*.dbf, *.ndx, *.mdx)         aceodbc.dll         14.0.4760.1000        *.dbf, *.ndx, *.mdx
    Microsoft Access Driver (*.mdb)                             odbcjt32.dll                              *.mdb
    Microsoft Access Driver (*.mdb, *.accdb)                    aceodbc.dll         14.0.4760.1000        *.mdb,*.accdb
    Microsoft Access Text Driver (*.txt, *.csv)                 aceodbc.dll         14.0.4760.1000        *.txt, *.csv
    Microsoft Access-Treiber (*.mdb)                            odbcjt32.dll                              *.mdb
    Microsoft dBase Driver (*.dbf)                              odbcjt32.dll                              *.dbf,*.ndx,*.mdx
    Microsoft dBase VFP Driver (*.dbf)                          vfpodbc.dll                               *.dbf,*.cdx,*.idx,*.fpt
    Microsoft dBase-Treiber (*.dbf)                             odbcjt32.dll                              *.dbf,*.ndx,*.mdx
    Microsoft Excel Driver (*.xls)                              odbcjt32.dll                              *.xls
    Microsoft Excel Driver (*.xls, *.xlsx, *.xlsm, *.xlsb)      aceodbc.dll         14.0.4760.1000        *.xls,*.xlsx, *.xlsb
    Microsoft Excel-Treiber (*.xls)                             odbcjt32.dll                              *.xls
    Microsoft FoxPro VFP Driver (*.dbf)                         vfpodbc.dll                               *.dbf,*.cdx,*.idx,*.fpt
    Microsoft ODBC for Oracle                                   msorcl32.dll                              
    Microsoft Paradox Driver (*.db )                            odbcjt32.dll                              *.db
    Microsoft Paradox-Treiber (*.db )                           odbcjt32.dll                              *.db
    Microsoft Text Driver (*.txt; *.csv)                        odbcjt32.dll                              *.,*.asc,*.csv,*.tab,*.txt,*.csv
    Microsoft Text-Treiber (*.txt; *.csv)                       odbcjt32.dll                              *.,*.asc,*.csv,*.tab,*.txt,*.csv
    Microsoft Visual FoxPro Driver                              vfpodbc.dll                               *.dbf,*.cdx,*.idx,*.fpt
    Microsoft Visual FoxPro-Treiber                             vfpodbc.dll                               *.dbf,*.cdx,*.idx,*.fpt
    SQL Server                                                  sqlsrv32.dll                              


--------[   ODBC ]---------------------------------------------------------------------------------------

    dBASE Files                   Microsoft Access dBASE Driver (*.dbf, *.ndx, *.mdx)           aceodbc.dll
    Excel Files                   Microsoft Excel Driver (*.xls, *.xlsx, *.xlsm, *.xlsb)        aceodbc.dll
    MS Access Database            Microsoft Access Driver (*.mdb, *.accdb)                      aceodbc.dll


--------[    ]--------------------------------------------------------------------------------------------

    Core i7 Extreme 965     3333   Asus P6T Deluxe                                                         X58                   Triple DDR3-1333      9-9-9-24 CR1            14045 /
    Athlon64 X2 Black 6400+    3200   MSI K9N SLI Platinum                                                    nForce570SLI          Dual DDR2-800         4-4-4-11 CR1             8889 /
    Pentium EE 955          3466   Intel D955XBK                                                           i955X                 Dual DDR2-667         4-4-4-11                 8025 /
    P4EE                    3733   Intel SE7230NH1LX                                                       iE7230                Dual DDR2-667         5-5-5-15                 7895 /
    Phenom II X4 Black 940    3000   Asus M3N78-EM                                                           GeForce8300 Int.      Ganged Dual DDR2-800  5-5-5-18 CR2             7667 /
    Core 2 Extreme QX9650    3000   Gigabyte GA-EP35C-DS3R                                                  P35                   Dual DDR3-1066        8-8-8-20 CR2             7174 /
    Core 2 Duo E6700        2666   Abit AB9                                                                P965                  Dual DDR2-800         5-5-5-18 CR2             6924 /
    Core 2 Extreme QX6700    2666   Intel D975XBX2                                                          i975X                 Dual DDR2-667         5-5-5-15                 6717 /
    Athlon64 X2 4000+       2100   ASRock ALiveNF7G-HDready                                                nForce7050-630a Int.  Dual DDR2-700         5-5-5-18 CR2             6264 /
    Core 2 Duo E6550        2333   MSI P965 Neo2 (MS-7235 v2)                                              P965                  Dual DDR2-667         5-4-4-12 CR2             6059 /
    Athlon64 3200+          2000   ASRock 939S56-M                                                         SiS756                Dual DDR400           2.5-3-3-8 CR2             5987 /
    Core 2 Duo P8400        2266   MSI MegaBook PR201                                                      GM45 Int.             Dual DDR2-667         5-5-5-15                 5850 /
    Opteron 2378            2400   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1             5029 /
    Phenom X4 9500          2200   Asus M3A                                                                AMD770                Ganged Dual DDR2-800  5-5-5-18 CR2             5019 /
    Celeron 420             1600   Intel DQ965CO                                                           Q965 Int.             Dual DDR2-667         5-5-5-15                 4960 /
    Core 2 Duo T5600        1833   Asus F3000Jc Notebook                                                   i945PM                Dual DDR2-667         5-5-5-15                 4594 /
    Xeon                    3400   Intel SE7320SP2                                                         iE7320                Dual DDR333R          2.5-3-3-7                4585 /
    P4EE                    3466   ASRock 775Dual-880Pro                                                   PT880Pro              Dual DDR2-400         3-3-3-8 CR2              4352 /
    Celeron D 326           2533   ASRock 775Twins-HDTV                                                    RC410 Ext.            DDR2-533 SDRAM        4-4-4-11                 4012 /
    Core Duo T2500          2000   Asus N4L-VM DH                                                          i945GT Int.           Dual DDR2-667         5-5-5-15                 3976 /
    Opteron 248             2200   MSI K8T Master1-FAR                                                     K8T800                Dual DDR266R          2-3-3-6 CR1              3938 /
    Xeon                    3066   Asus PCH-DL                                                             i875P + PAT           Dual DDR333           2-2-2-5                  3806 /
    Pentium M 730           1600   AOpen i915Ga-HFS                                                        i915G Int.            Dual DDR2-533         4-4-4-12                 3654 /
    Atom 230                1600   Intel D945GCLF                                                          i945GC                DDR2-533 SDRAM        4-4-4-12                 3540 /
    Xeon E5462              2800   Intel S5400SF                                                           i5400                 Quad DDR2-640FB       5-5-5-15                 3540 /
    Opteron 240             1400   MSI K8D Master3-133 FS                                                  AMD8100               Dual DDR400R          3-4-4-8 CR1              3529 /
    Nano L2200              1600   VIA VB8001                                                              CN896 Int.            DDR2-667 SDRAM        5-5-5-12 CR2             3515 /
    P4                      2400   Abit SI7                                                                SiSR658               Dual PC1066 RDRAM     -                        3408 /
    Xeon 5140               2333   Intel S5000VSA                                                          i5000V                Dual DDR2-667FB       5-5-5-15                 3348 /
    Xeon L5320              1866   Intel S5000VCL                                                          i5000V                Dual DDR2-533FB       4-4-4-12                 3155 /
    P4                      2800   MSI 848P Neo-S                                                          i848P                 DDR400 SDRAM          2.5-3-3-8                2983 /
    Sempron 2600+           1600   ASRock K8NF4G-SATA2                                                     GeForce6100 Int.      DDR400 SDRAM          2.5-3-3-8 CR2             2832 /
    Celeron                 2000   Gigabyte GA-8TRS350MT                                                   RS350 Int.            Dual DDR400           2-2-4-6 CR1              2769 /
    P4                      1600   Abit TH7II                                                              i850                  Dual PC800 RDRAM      -                        2754 /
    Opteron HE 2344         1700   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1             2737 /
    Celeron 215             1333   Intel D201GLY                                                           SiS662 Int.           DDR2-533              5-4-4-12                 2693 /
    Celeron M 320           1300   DFI 855GME-MGF                                                          i855GME Int.          DDR333 SDRAM          2.5-3-3-7                2435 /
    Duron                   1600   Biostar M7VIQ                                                           KM266 Int.            DDR266 SDRAM          2.5-2-2-6 CR2             1601 /
    Efficeon 8600           1000   ECS 532 Notebook                                                        Efficeon              DDR266 SDRAM                                   1540 /
    Athlon                  1400   PCChips M817LMR                                                         MAGiK1                DDR266 SDRAM          2-3-3-7                  1302 /
    Duron                    600   Abit KG7-Lite                                                           AMD-760               DDR200R SDRAM         2-2-2-5                  1134 /
    C7                      1500   VIA EPIA EN                                                             CN700 Int.            DDR2-533 SDRAM        4-4-4-12 CR2             1061 /
    Celeron                 1700   Asus P4B                                                                i845                  PC133 SDRAM           3-3-3-6                  1051 /
    PIII-E                   733   Tyan Thunder 2500                                                       ServerSet3HE          PC133R SDRAM          3-3-3-6                  1046 /
    PIII-S                  1266   MSI Pro266TD Master-LR                                                  ApolloPro266TD        DDR266 SDRAM          2-3-3-6 CR2              1041 /
    AthlonXP 1600+          1400   Acorp 7KMM1                                                             KM133A Int.           PC133 SDRAM           3-3-3-6                   954 /
    Crusoe 5800             1000   ECS A530 DeskNote                                                       Crusoe                DDR266 SDRAM                                    841 /
    Athlon                   750   Epox EP-7KXA                                                            KX133                 PC133 SDRAM           3-3-3-6                   767 /
    C3                      1333   VIA EPIA SP                                                             CN400 Int.            DDR400 SDRAM          3-3-3-8 CR2               690 /
    C3                       800   VIA EPIA                                                                PLE133 Int.           PC133 SDRAM           3-3-3-6                   635 /
    PIII                     500   Epox KP6-BS                                                             i440BX                PC100R SDRAM          3-3-3-?                   620 /
    PIII                     450   Asus P3C-S                                                              i820                  PC600 RDRAM           -                         524 /
    PII                      333   Intel DK440LX                                                           i440LX                PC66 SDRAM            3-2-2-?                   371 /
    Celeron                  266   Epox P2-100B                                                            ApolloPro             PC66 SDRAM            3-2-2-5                   360 /
    K6-III                   400   Epox EP-MVP3G-M                                                         MVP3                  PC100 SDRAM           2-2-2-5                   262 /
    PentiumPro               200   Compaq ProLiant 800                                                     i440FX                Dual EDO              -                         258 /
    Pentium                  166   Asus TX97-X                                                             i430TX                PC66 SDRAM            2-2-3-4                   228 /
    MediaGXm                 233   ALD NPC6836                                                             Cx5520                PC60 SDRAM            3-3-3-6                   222 /
    PentiumMMX               200   Gigabyte GA-586DX                                                       i430HX                Dual EDO              -                         188 /
    K5 PR166                 116   Asus P5A                                                                ALADDiN5              PC66 SDRAM            2-2-2-6                   167 /
    K6-2                     333   Amptron PM-9100LMR                                                      SiS5597 Ext.          PC66 SDRAM            3-3-3-6                   150 /
    Celeron                  700   PCChips M758LT                                                          SiS630ET Int.         PC100 SDRAM           3-3-3-6                   117 /


--------[    ]---------------------------------------------------------------------------------------------

    Core i7 Extreme 965     3333   Asus P6T Deluxe                                                         X58                   Triple DDR3-1333      9-9-9-24 CR1            12038 /
    Athlon64 X2 Black 6400+    3200   MSI K9N SLI Platinum                                                    nForce570SLI          Dual DDR2-800         4-4-4-11 CR1             8814 /
    Core 2 Extreme QX9650    3000   Gigabyte GA-EP35C-DS3R                                                  P35                   Dual DDR3-1066        8-8-8-20 CR2             7086 /
    Xeon E5462              2800   Intel S5400SF                                                           i5400                 Quad DDR2-640FB       5-5-5-15                 6712 /
    Core 2 Duo E6550        2333   MSI P965 Neo2 (MS-7235 v2)                                              P965                  Dual DDR2-667         5-4-4-12 CR2             5971 /
    Phenom II X4 Black 940    3000   Asus M3N78-EM                                                           GeForce8300 Int.      Ganged Dual DDR2-800  5-5-5-18 CR2             5915 /
    Pentium EE 955          3466   Intel D955XBK                                                           i955X                 Dual DDR2-667         4-4-4-11                 5636 /
    P4EE                    3733   Intel SE7230NH1LX                                                       iE7230                Dual DDR2-667         5-5-5-15                 5618 /
    Core 2 Duo P8400        2266   MSI MegaBook PR201                                                      GM45 Int.             Dual DDR2-667         5-5-5-15                 5522 /
    Athlon64 X2 4000+       2100   ASRock ALiveNF7G-HDready                                                nForce7050-630a Int.  Dual DDR2-700         5-5-5-18 CR2             5484 /
    P4EE                    3466   ASRock 775Dual-880Pro                                                   PT880Pro              Dual DDR2-400         3-3-3-8 CR2              5378 /
    Core 2 Extreme QX6700    2666   Intel D975XBX2                                                          i975X                 Dual DDR2-667         5-5-5-15                 4853 /
    Core 2 Duo E6700        2666   Abit AB9                                                                P965                  Dual DDR2-800         5-5-5-18 CR2             4842 /
    Xeon                    3400   Intel SE7320SP2                                                         iE7320                Dual DDR333R          2.5-3-3-7                4199 /
    Athlon64 3200+          2000   ASRock 939S56-M                                                         SiS756                Dual DDR400           2.5-3-3-8 CR2             4083 /
    Opteron 2378            2400   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1             3940 /
    Phenom X4 9500          2200   Asus M3A                                                                AMD770                Ganged Dual DDR2-800  5-5-5-18 CR2             3861 /
    Opteron 248             2200   MSI K8T Master1-FAR                                                     K8T800                Dual DDR266R          2-3-3-6 CR1              3824 /
    Celeron 420             1600   Intel DQ965CO                                                           Q965 Int.             Dual DDR2-667         5-5-5-15                 3584 /
    Core Duo T2500          2000   Asus N4L-VM DH                                                          i945GT Int.           Dual DDR2-667         5-5-5-15                 3410 /
    Nano L2200              1600   VIA VB8001                                                              CN896 Int.            DDR2-667 SDRAM        5-5-5-12 CR2             3160 /
    P4                      2800   MSI 848P Neo-S                                                          i848P                 DDR400 SDRAM          2.5-3-3-8                3112 /
    Core 2 Duo T5600        1833   Asus F3000Jc Notebook                                                   i945PM                Dual DDR2-667         5-5-5-15                 3007 /
    Xeon                    3066   Asus PCH-DL                                                             i875P + PAT           Dual DDR333           2-2-2-5                  2840 /
    P4                      2400   Abit SI7                                                                SiSR658               Dual PC1066 RDRAM     -                        2838 /
    Pentium M 730           1600   AOpen i915Ga-HFS                                                        i915G Int.            Dual DDR2-533         4-4-4-12                 2834 /
    Atom 230                1600   Intel D945GCLF                                                          i945GC                DDR2-533 SDRAM        4-4-4-12                 2832 /
    Celeron D 326           2533   ASRock 775Twins-HDTV                                                    RC410 Ext.            DDR2-533 SDRAM        4-4-4-11                 2785 /
    Xeon 5140               2333   Intel S5000VSA                                                          i5000V                Dual DDR2-667FB       5-5-5-15                 2487 /
    Xeon L5320              1866   Intel S5000VCL                                                          i5000V                Dual DDR2-533FB       4-4-4-12                 2315 /
    Opteron 240             1400   MSI K8D Master3-133 FS                                                  AMD8100               Dual DDR400R          3-4-4-8 CR1              2287 /
    Sempron 2600+           1600   ASRock K8NF4G-SATA2                                                     GeForce6100 Int.      DDR400 SDRAM          2.5-3-3-8 CR2             2267 /
    Opteron HE 2344         1700   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1             2208 /
    Celeron                 2000   Gigabyte GA-8TRS350MT                                                   RS350 Int.            Dual DDR400           2-2-4-6 CR1              2148 /
    Celeron M 320           1300   DFI 855GME-MGF                                                          i855GME Int.          DDR333 SDRAM          2.5-3-3-7                2128 /
    P4                      1600   Abit TH7II                                                              i850                  Dual PC800 RDRAM      -                        2127 /
    C7                      1500   VIA EPIA EN                                                             CN700 Int.            DDR2-533 SDRAM        4-4-4-12 CR2             2067 /
    Celeron 215             1333   Intel D201GLY                                                           SiS662 Int.           DDR2-533              5-4-4-12                 1876 /
    Duron                   1600   Biostar M7VIQ                                                           KM266 Int.            DDR266 SDRAM          2.5-2-2-6 CR2             1571 /
    Athlon                  1400   PCChips M817LMR                                                         MAGiK1                DDR266 SDRAM          2-3-3-7                  1332 /
    Duron                    600   Abit KG7-Lite                                                           AMD-760               DDR200R SDRAM         2-2-2-5                  1204 /
    C3                      1333   VIA EPIA SP                                                             CN400 Int.            DDR400 SDRAM          3-3-3-8 CR2              1057 /
    PIII-S                  1266   MSI Pro266TD Master-LR                                                  ApolloPro266TD        DDR266 SDRAM          2-3-3-6 CR2              1054 /
    Celeron                 1700   Asus P4B                                                                i845                  PC133 SDRAM           3-3-3-6                  1049 /
    Athlon                   750   Epox EP-7KXA                                                            KX133                 PC133 SDRAM           3-3-3-6                  1034 /
    AthlonXP 1600+          1400   Acorp 7KMM1                                                             KM133A Int.           PC133 SDRAM           3-3-3-6                   952 /
    PIII-E                   733   Tyan Thunder 2500                                                       ServerSet3HE          PC133R SDRAM          3-3-3-6                   848 /
    PIII                     500   Epox KP6-BS                                                             i440BX                PC100R SDRAM          3-3-3-?                   781 /
    PIII                     450   Asus P3C-S                                                              i820                  PC600 RDRAM           -                         761 /
    Pentium                  166   Asus TX97-X                                                             i430TX                PC66 SDRAM            2-2-3-4                   692 /
    PentiumMMX               200   Gigabyte GA-586DX                                                       i430HX                Dual EDO              -                         690 /
    MediaGXm                 233   ALD NPC6836                                                             Cx5520                PC60 SDRAM            3-3-3-6                   588 /
    Efficeon 8600           1000   ECS 532 Notebook                                                        Efficeon              DDR266 SDRAM                                    549 /
    K5 PR166                 116   Asus P5A                                                                ALADDiN5              PC66 SDRAM            2-2-2-6                   500 /
    Crusoe 5800             1000   ECS A530 DeskNote                                                       Crusoe                DDR266 SDRAM                                    355 /
    C3                       800   VIA EPIA                                                                PLE133 Int.           PC133 SDRAM           3-3-3-6                   250 /
    PII                      333   Intel DK440LX                                                           i440LX                PC66 SDRAM            3-2-2-?                   177 /
    Celeron                  700   PCChips M758LT                                                          SiS630ET Int.         PC100 SDRAM           3-3-3-6                   171 /
    Celeron                  266   Epox P2-100B                                                            ApolloPro             PC66 SDRAM            3-2-2-5                   139 /
    K6-III                   400   Epox EP-MVP3G-M                                                         MVP3                  PC100 SDRAM           2-2-2-5                   128 /
    PentiumPro               200   Compaq ProLiant 800                                                     i440FX                Dual EDO              -                          87 /
    K6-2                     333   Amptron PM-9100LMR                                                      SiS5597 Ext.          PC66 SDRAM            3-3-3-6                    77 /


--------[    ]----------------------------------------------------------------------------------------

    Core i7 Extreme 965     3333   Asus P6T Deluxe                                                         X58                   Triple DDR3-1333      9-9-9-24 CR1            14153 /
    Phenom II X4 Black 940    3000   Asus M3N78-EM                                                           GeForce8300 Int.      Ganged Dual DDR2-800  5-5-5-18 CR2             8444 /
    Athlon64 X2 Black 6400+    3200   MSI K9N SLI Platinum                                                    nForce570SLI          Dual DDR2-800         4-4-4-11 CR1             7241 /
    Opteron 2378            2400   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1             6833 /
    Athlon64 X2 4000+       2100   ASRock ALiveNF7G-HDready                                                nForce7050-630a Int.  Dual DDR2-700         5-5-5-18 CR2             6567 /
    Core 2 Extreme QX9650    3000   Gigabyte GA-EP35C-DS3R                                                  P35                   Dual DDR3-1066        8-8-8-20 CR2             6225 /
    Pentium EE 955          3466   Intel D955XBK                                                           i955X                 Dual DDR2-667         4-4-4-11                 6206 /
    P4EE                    3733   Intel SE7230NH1LX                                                       iE7230                Dual DDR2-667         5-5-5-15                 6135 /
    Xeon E5462              2800   Intel S5400SF                                                           i5400                 Quad DDR2-640FB       5-5-5-15                 5470 /
    Phenom X4 9500          2200   Asus M3A                                                                AMD770                Ganged Dual DDR2-800  5-5-5-18 CR2             5429 /
    Core 2 Duo E6700        2666   Abit AB9                                                                P965                  Dual DDR2-800         5-5-5-18 CR2             5362 /
    Core 2 Duo E6550        2333   MSI P965 Neo2 (MS-7235 v2)                                              P965                  Dual DDR2-667         5-4-4-12 CR2             5179 /
    Core 2 Duo P8400        2266   MSI MegaBook PR201                                                      GM45 Int.             Dual DDR2-667         5-5-5-15                 5146 /
    Athlon64 3200+          2000   ASRock 939S56-M                                                         SiS756                Dual DDR400           2.5-3-3-8 CR2             4653 /
    Core 2 Extreme QX6700    2666   Intel D975XBX2                                                          i975X                 Dual DDR2-667         5-5-5-15                 4627 /
    Xeon                    3400   Intel SE7320SP2                                                         iE7320                Dual DDR333R          2.5-3-3-7                4149 /
    Celeron 420             1600   Intel DQ965CO                                                           Q965 Int.             Dual DDR2-667         5-5-5-15                 4018 /
    Opteron 248             2200   MSI K8T Master1-FAR                                                     K8T800                Dual DDR266R          2-3-3-6 CR1              3714 /
    Opteron HE 2344         1700   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1             3373 /
    P4EE                    3466   ASRock 775Dual-880Pro                                                   PT880Pro              Dual DDR2-400         3-3-3-8 CR2              3179 /
    Core 2 Duo T5600        1833   Asus F3000Jc Notebook                                                   i945PM                Dual DDR2-667         5-5-5-15                 3172 /
    Xeon                    3066   Asus PCH-DL                                                             i875P + PAT           Dual DDR333           2-2-2-5                  3161 /
    Celeron D 326           2533   ASRock 775Twins-HDTV                                                    RC410 Ext.            DDR2-533 SDRAM        4-4-4-11                 3144 /
    Core Duo T2500          2000   Asus N4L-VM DH                                                          i945GT Int.           Dual DDR2-667         5-5-5-15                 3103 /
    Xeon 5140               2333   Intel S5000VSA                                                          i5000V                Dual DDR2-667FB       5-5-5-15                 3000 /
    Xeon L5320              1866   Intel S5000VCL                                                          i5000V                Dual DDR2-533FB       4-4-4-12                 2905 /
    Nano L2200              1600   VIA VB8001                                                              CN896 Int.            DDR2-667 SDRAM        5-5-5-12 CR2             2850 /
    P4                      2800   MSI 848P Neo-S                                                          i848P                 DDR400 SDRAM          2.5-3-3-8                2645 /
    P4                      2400   Abit SI7                                                                SiSR658               Dual PC1066 RDRAM     -                        2542 /
    Sempron 2600+           1600   ASRock K8NF4G-SATA2                                                     GeForce6100 Int.      DDR400 SDRAM          2.5-3-3-8 CR2             2511 /
    Pentium M 730           1600   AOpen i915Ga-HFS                                                        i915G Int.            Dual DDR2-533         4-4-4-12                 2459 /
    Atom 230                1600   Intel D945GCLF                                                          i945GC                DDR2-533 SDRAM        4-4-4-12                 2397 /
    Opteron 240             1400   MSI K8D Master3-133 FS                                                  AMD8100               Dual DDR400R          3-4-4-8 CR1              2386 /
    P4                      1600   Abit TH7II                                                              i850                  Dual PC800 RDRAM      -                        2211 /
    Celeron                 2000   Gigabyte GA-8TRS350MT                                                   RS350 Int.            Dual DDR400           2-2-4-6 CR1              2023 /
    Celeron 215             1333   Intel D201GLY                                                           SiS662 Int.           DDR2-533              5-4-4-12                 1963 /
    Celeron M 320           1300   DFI 855GME-MGF                                                          i855GME Int.          DDR333 SDRAM          2.5-3-3-7                1729 /
    Duron                   1600   Biostar M7VIQ                                                           KM266 Int.            DDR266 SDRAM          2.5-2-2-6 CR2             1571 /
    C7                      1500   VIA EPIA EN                                                             CN700 Int.            DDR2-533 SDRAM        4-4-4-12 CR2             1394 /
    Athlon                  1400   PCChips M817LMR                                                         MAGiK1                DDR266 SDRAM          2-3-3-7                  1255 /
    Duron                    600   Abit KG7-Lite                                                           AMD-760               DDR200R SDRAM         2-2-2-5                  1184 /
    AthlonXP 1600+          1400   Acorp 7KMM1                                                             KM133A Int.           PC133 SDRAM           3-3-3-6                   950 /
    PIII-S                  1266   MSI Pro266TD Master-LR                                                  ApolloPro266TD        DDR266 SDRAM          2-3-3-6 CR2               907 /
    Celeron                 1700   Asus P4B                                                                i845                  PC133 SDRAM           3-3-3-6                   886 /
    PIII-E                   733   Tyan Thunder 2500                                                       ServerSet3HE          PC133R SDRAM          3-3-3-6                   865 /
    C3                      1333   VIA EPIA SP                                                             CN400 Int.            DDR400 SDRAM          3-3-3-8 CR2               784 /
    Efficeon 8600           1000   ECS 532 Notebook                                                        Efficeon              DDR266 SDRAM                                    623 /
    Athlon                   750   Epox EP-7KXA                                                            KX133                 PC133 SDRAM           3-3-3-6                   574 /
    PIII                     500   Epox KP6-BS                                                             i440BX                PC100R SDRAM          3-3-3-?                   526 /
    PIII                     450   Asus P3C-S                                                              i820                  PC600 RDRAM           -                         504 /
    Crusoe 5800             1000   ECS A530 DeskNote                                                       Crusoe                DDR266 SDRAM                                    476 /
    C3                       800   VIA EPIA                                                                PLE133 Int.           PC133 SDRAM           3-3-3-6                   311 /
    PII                      333   Intel DK440LX                                                           i440LX                PC66 SDRAM            3-2-2-?                   245 /
    Pentium                  166   Asus TX97-X                                                             i430TX                PC66 SDRAM            2-2-3-4                   182 /
    PentiumMMX               200   Gigabyte GA-586DX                                                       i430HX                Dual EDO              -                         181 /
    K6-III                   400   Epox EP-MVP3G-M                                                         MVP3                  PC100 SDRAM           2-2-2-5                   164 /
    Celeron                  266   Epox P2-100B                                                            ApolloPro             PC66 SDRAM            3-2-2-5                   142 /
    Celeron                  700   PCChips M758LT                                                          SiS630ET Int.         PC100 SDRAM           3-3-3-6                   133 /
    PentiumPro               200   Compaq ProLiant 800                                                     i440FX                Dual EDO              -                         111 /
    K6-2                     333   Amptron PM-9100LMR                                                      SiS5597 Ext.          PC66 SDRAM            3-3-3-6                   100 /
    MediaGXm                 233   ALD NPC6836                                                             Cx5520                PC60 SDRAM            3-3-3-6                    83 /
    K5 PR166                 116   Asus P5A                                                                ALADDiN5              PC66 SDRAM            2-2-2-6                    81 /


--------[   ]---------------------------------------------------------------------------------------------

    Athlon64 X2 Black 6400+    3200   MSI K9N SLI Platinum                                                    nForce570SLI          Dual DDR2-800         4-4-4-11 CR1       47.2 ns
    Athlon64 3200+          2000   ASRock 939S56-M                                                         SiS756                Dual DDR400           2.5-3-3-8 CR2       55.2 ns
    Core i7 Extreme 965     3333   Asus P6T Deluxe                                                         X58                   Triple DDR3-1333      9-9-9-24 CR1       59.3 ns
    Sempron 2600+           1600   ASRock K8NF4G-SATA2                                                     GeForce6100 Int.      DDR400 SDRAM          2.5-3-3-8 CR2       59.8 ns
    Phenom II X4 Black 940    3000   Asus M3N78-EM                                                           GeForce8300 Int.      Ganged Dual DDR2-800  5-5-5-18 CR2       61.3 ns
    Athlon64 X2 4000+       2100   ASRock ALiveNF7G-HDready                                                nForce7050-630a Int.  Dual DDR2-700         5-5-5-18 CR2       62.1 ns
    Core 2 Duo E6700        2666   Abit AB9                                                                P965                  Dual DDR2-800         5-5-5-18 CR2       69.3 ns
    Core 2 Extreme QX6700    2666   Intel D975XBX2                                                          i975X                 Dual DDR2-667         5-5-5-15           70.9 ns
    Core 2 Extreme QX9650    3000   Gigabyte GA-EP35C-DS3R                                                  P35                   Dual DDR3-1066        8-8-8-20 CR2       74.7 ns
    Pentium EE 955          3466   Intel D955XBK                                                           i955X                 Dual DDR2-667         4-4-4-11           80.3 ns
    Opteron 248             2200   MSI K8T Master1-FAR                                                     K8T800                Dual DDR266R          2-3-3-6 CR1        80.4 ns
    Core 2 Duo E6550        2333   MSI P965 Neo2 (MS-7235 v2)                                              P965                  Dual DDR2-667         5-4-4-12 CR2       82.3 ns
    Core 2 Duo P8400        2266   MSI MegaBook PR201                                                      GM45 Int.             Dual DDR2-667         5-5-5-15           85.0 ns
    P4EE                    3733   Intel SE7230NH1LX                                                       iE7230                Dual DDR2-667         5-5-5-15           85.3 ns
    Pentium M 730           1600   AOpen i915Ga-HFS                                                        i915G Int.            Dual DDR2-533         4-4-4-12           90.1 ns
    Celeron 420             1600   Intel DQ965CO                                                           Q965 Int.             Dual DDR2-667         5-5-5-15           91.8 ns
    Opteron 2378            2400   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1       95.3 ns
    Celeron M 320           1300   DFI 855GME-MGF                                                          i855GME Int.          DDR333 SDRAM          2.5-3-3-7          95.8 ns
    Opteron 240             1400   MSI K8D Master3-133 FS                                                  AMD8100               Dual DDR400R          3-4-4-8 CR1        97.9 ns
    Core Duo T2500          2000   Asus N4L-VM DH                                                          i945GT Int.           Dual DDR2-667         5-5-5-15           99.6 ns
    Atom 230                1600   Intel D945GCLF                                                          i945GC                DDR2-533 SDRAM        4-4-4-12          103.5 ns
    Xeon                    3066   Asus PCH-DL                                                             i875P + PAT           Dual DDR333           2-2-2-5           106.0 ns
    PIII-S                  1266   MSI Pro266TD Master-LR                                                  ApolloPro266TD        DDR266 SDRAM          2-3-3-6 CR2       108.1 ns
    Xeon 5140               2333   Intel S5000VSA                                                          i5000V                Dual DDR2-667FB       5-5-5-15          109.0 ns
    Xeon E5462              2800   Intel S5400SF                                                           i5400                 Quad DDR2-640FB       5-5-5-15          110.6 ns
    Phenom X4 9500          2200   Asus M3A                                                                AMD770                Ganged Dual DDR2-800  5-5-5-18 CR2      112.6 ns
    P4                      2800   MSI 848P Neo-S                                                          i848P                 DDR400 SDRAM          2.5-3-3-8         112.8 ns
    Nano L2200              1600   VIA VB8001                                                              CN896 Int.            DDR2-667 SDRAM        5-5-5-12 CR2      113.4 ns
    Core 2 Duo T5600        1833   Asus F3000Jc Notebook                                                   i945PM                Dual DDR2-667         5-5-5-15          113.7 ns
    PIII-E                   733   Tyan Thunder 2500                                                       ServerSet3HE          PC133R SDRAM          3-3-3-6           117.7 ns
    P4EE                    3466   ASRock 775Dual-880Pro                                                   PT880Pro              Dual DDR2-400         3-3-3-8 CR2       124.8 ns
    Crusoe 5800             1000   ECS A530 DeskNote                                                       Crusoe                DDR266 SDRAM                            125.5 ns
    Xeon L5320              1866   Intel S5000VCL                                                          i5000V                Dual DDR2-533FB       4-4-4-12          126.1 ns
    K6-III                   400   Epox EP-MVP3G-M                                                         MVP3                  PC100 SDRAM           2-2-2-5           139.2 ns
    Xeon                    3400   Intel SE7320SP2                                                         iE7320                Dual DDR333R          2.5-3-3-7         145.2 ns
    P4                      2400   Abit SI7                                                                SiSR658               Dual PC1066 RDRAM     -                 147.1 ns
    C7                      1500   VIA EPIA EN                                                             CN700 Int.            DDR2-533 SDRAM        4-4-4-12 CR2      147.2 ns
    Celeron D 326           2533   ASRock 775Twins-HDTV                                                    RC410 Ext.            DDR2-533 SDRAM        4-4-4-11          147.8 ns
    C3                       800   VIA EPIA                                                                PLE133 Int.           PC133 SDRAM           3-3-3-6           154.8 ns
    C3                      1333   VIA EPIA SP                                                             CN400 Int.            DDR400 SDRAM          3-3-3-8 CR2       156.0 ns
    Celeron                 1700   Asus P4B                                                                i845                  PC133 SDRAM           3-3-3-6           159.7 ns
    Celeron                 2000   Gigabyte GA-8TRS350MT                                                   RS350 Int.            Dual DDR400           2-2-4-6 CR1       161.4 ns
    MediaGXm                 233   ALD NPC6836                                                             Cx5520                PC60 SDRAM            3-3-3-6           162.2 ns
    P4                      1600   Abit TH7II                                                              i850                  Dual PC800 RDRAM      -                 162.9 ns
    Efficeon 8600           1000   ECS 532 Notebook                                                        Efficeon              DDR266 SDRAM                            163.2 ns
    Duron                   1600   Biostar M7VIQ                                                           KM266 Int.            DDR266 SDRAM          2.5-2-2-6 CR2      163.8 ns
    Celeron 215             1333   Intel D201GLY                                                           SiS662 Int.           DDR2-533              5-4-4-12          166.2 ns
    PIII                     500   Epox KP6-BS                                                             i440BX                PC100R SDRAM          3-3-3-?           166.3 ns
    PentiumMMX               200   Gigabyte GA-586DX                                                       i430HX                Dual EDO              -                 167.2 ns
    AthlonXP 1600+          1400   Acorp 7KMM1                                                             KM133A Int.           PC133 SDRAM           3-3-3-6           170.6 ns
    Athlon                  1400   PCChips M817LMR                                                         MAGiK1                DDR266 SDRAM          2-3-3-7           175.7 ns
    Duron                    600   Abit KG7-Lite                                                           AMD-760               DDR200R SDRAM         2-2-2-5           183.8 ns
    K6-2                     333   Amptron PM-9100LMR                                                      SiS5597 Ext.          PC66 SDRAM            3-3-3-6           201.8 ns
    Opteron HE 2344         1700   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1      205.3 ns
    Athlon                   750   Epox EP-7KXA                                                            KX133                 PC133 SDRAM           3-3-3-6           207.1 ns
    PIII                     450   Asus P3C-S                                                              i820                  PC600 RDRAM           -                 215.2 ns
    PentiumPro               200   Compaq ProLiant 800                                                     i440FX                Dual EDO              -                 233.6 ns
    Pentium                  166   Asus TX97-X                                                             i430TX                PC66 SDRAM            2-2-3-4           234.9 ns
    PII                      333   Intel DK440LX                                                           i440LX                PC66 SDRAM            3-2-2-?           248.9 ns
    K5 PR166                 116   Asus P5A                                                                ALADDiN5              PC66 SDRAM            2-2-2-6           266.1 ns
    Celeron                  700   PCChips M758LT                                                          SiS630ET Int.         PC100 SDRAM           3-3-3-6           275.6 ns
    Celeron                  266   Epox P2-100B                                                            ApolloPro             PC66 SDRAM            3-2-2-5           317.4 ns


--------[ CPU Queen ]---------------------------------------------------------------------------------------------------

    4x Core i7 Extreme 965 HT    3333   Asus P6T Deluxe                                                         X58                   Triple DDR3-1333      9-9-9-24 CR1         30786
    8x Xeon E5462           2800   Intel S5400SF                                                           i5400                 Quad DDR2-640FB       5-5-5-15             30472
    8x Opteron 2378         2400   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1         22769
    4x Core 2 Extreme QX9650    3000   Gigabyte GA-EP35C-DS3R                                                  P35                   Dual DDR3-1066        8-8-8-20 CR2         21421
    8x Xeon L5320           1866   Intel S5000VCL                                                          i5000V                Dual DDR2-533FB       4-4-4-12             20452
    4x Core 2 Extreme QX6700    2666   Intel D975XBX2                                                          i975X                 Dual DDR2-667         5-5-5-15             19166
    4x Phenom II X4 Black 940    3000   Asus M3N78-EM                                                           GeForce8300 Int.      Ganged Dual DDR2-800  5-5-5-18 CR2         18636
    4x Xeon 5140            2333   Intel S5000VSA                                                          i5000V                Dual DDR2-667FB       5-5-5-15             16729
    8x Opteron HE 2344      1700   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1         16146
    4x Phenom X4 9500       2200   Asus M3A                                                                AMD770                Ganged Dual DDR2-800  5-5-5-18 CR2         13693
    2x Core 2 Duo E6700     2666   Abit AB9                                                                P965                  Dual DDR2-800         5-5-5-18 CR2         11406
    2x Athlon64 X2 Black 6400+    3200   MSI K9N SLI Platinum                                                    nForce570SLI          Dual DDR2-800         4-4-4-11 CR1         11169
    2x Core 2 Duo E6550     2333   MSI P965 Neo2 (MS-7235 v2)                                              P965                  Dual DDR2-667         5-4-4-12 CR2          9908
    2x Core 2 Duo P8400     2266   MSI MegaBook PR201                                                      GM45 Int.             Dual DDR2-667         5-5-5-15              9578
    2x Core Duo T2500       2000   Asus N4L-VM DH                                                          i945GT Int.           Dual DDR2-667         5-5-5-15              7793
    2x Core 2 Duo T5600     1833   Asus F3000Jc Notebook                                                   i945PM                Dual DDR2-667         5-5-5-15              7717
    2x Athlon64 X2 4000+    2100   ASRock ALiveNF7G-HDready                                                nForce7050-630a Int.  Dual DDR2-700         5-5-5-18 CR2          7280
    2x Pentium EE 955 HT    3466   Intel D955XBK                                                           i955X                 Dual DDR2-667         4-4-4-11              7098
    2x Xeon HT              3400   Intel SE7320SP2                                                         iE7320                Dual DDR333R          2.5-3-3-7             6953
    2x Xeon                 3066   Asus PCH-DL                                                             i875P + PAT           Dual DDR333           2-2-2-5               6188
    2x Opteron 240          1400   MSI K8D Master3-133 FS                                                  AMD8100               Dual DDR400R          3-4-4-8 CR1           4863
    2x PIII-S               1266   MSI Pro266TD Master-LR                                                  ApolloPro266TD        DDR266 SDRAM          2-3-3-6 CR2           4857
    P4EE HT                 3733   Intel SE7230NH1LX                                                       iE7230                Dual DDR2-667         5-5-5-15              4210
    Opteron 248             2200   MSI K8T Master1-FAR                                                     K8T800                Dual DDR266R          2-3-3-6 CR1           3851
    Atom 230 HT             1600   Intel D945GCLF                                                          i945GC                DDR2-533 SDRAM        4-4-4-12              3779
    P4EE                    3466   ASRock 775Dual-880Pro                                                   PT880Pro              Dual DDR2-400         3-3-3-8 CR2           3516
    Athlon64 3200+          2000   ASRock 939S56-M                                                         SiS756                Dual DDR400           2.5-3-3-8 CR2          3497
    Celeron 420             1600   Intel DQ965CO                                                           Q965 Int.             Dual DDR2-667         5-5-5-15              3375
    Pentium M 730           1600   AOpen i915Ga-HFS                                                        i915G Int.            Dual DDR2-533         4-4-4-12              3124
    2x PIII-E                733   Tyan Thunder 2500                                                       ServerSet3HE          PC133R SDRAM          3-3-3-6               2811
    Sempron 2600+           1600   ASRock K8NF4G-SATA2                                                     GeForce6100 Int.      DDR400 SDRAM          2.5-3-3-8 CR2          2808
    P4                      2800   MSI 848P Neo-S                                                          i848P                 DDR400 SDRAM          2.5-3-3-8             2804
    Celeron 215             1333   Intel D201GLY                                                           SiS662 Int.           DDR2-533              5-4-4-12              2607
    Nano L2200              1600   VIA VB8001                                                              CN896 Int.            DDR2-667 SDRAM        5-5-5-12 CR2          2583
    Celeron M 320           1300   DFI 855GME-MGF                                                          i855GME Int.          DDR333 SDRAM          2.5-3-3-7             2544
    Duron                   1600   Biostar M7VIQ                                                           KM266 Int.            DDR266 SDRAM          2.5-2-2-6 CR2          2537
    P4                      2400   Abit SI7                                                                SiSR658               Dual PC1066 RDRAM     -                     2434
    Athlon                  1400   PCChips M817LMR                                                         MAGiK1                DDR266 SDRAM          2-3-3-7               2218
    AthlonXP 1600+          1400   Acorp 7KMM1                                                             KM133A Int.           PC133 SDRAM           3-3-3-6               2210
    Celeron                 2000   Gigabyte GA-8TRS350MT                                                   RS350 Int.            Dual DDR400           2-2-4-6 CR1           2031
    2x PIII                  500   Epox KP6-BS                                                             i440BX                PC100R SDRAM          3-3-3-?               1927
    Celeron D 326           2533   ASRock 775Twins-HDTV                                                    RC410 Ext.            DDR2-533 SDRAM        4-4-4-11              1900
    Celeron                 1700   Asus P4B                                                                i845                  PC133 SDRAM           3-3-3-6               1723
    P4                      1600   Abit TH7II                                                              i850                  Dual PC800 RDRAM      -                     1624
    C7                      1500   VIA EPIA EN                                                             CN700 Int.            DDR2-533 SDRAM        4-4-4-12 CR2          1560
    Efficeon 8600           1000   ECS 532 Notebook                                                        Efficeon              DDR266 SDRAM                                1461
    Celeron                  700   PCChips M758LT                                                          SiS630ET Int.         PC100 SDRAM           3-3-3-6               1349
    Athlon                   750   Epox EP-7KXA                                                            KX133                 PC133 SDRAM           3-3-3-6               1188
    2x PII                   333   Intel DK440LX                                                           i440LX                PC66 SDRAM            3-2-2-?               1145
    C3                      1333   VIA EPIA SP                                                             CN400 Int.            DDR400 SDRAM          3-3-3-8 CR2           1099
    Duron                    600   Abit KG7-Lite                                                           AMD-760               DDR200R SDRAM         2-2-2-5                953
    Crusoe 5800             1000   ECS A530 DeskNote                                                       Crusoe                DDR266 SDRAM                                 885
    PIII                     450   Asus P3C-S                                                              i820                  PC600 RDRAM           -                      873
    K6-III                   400   Epox EP-MVP3G-M                                                         MVP3                  PC100 SDRAM           2-2-2-5                814
    K6-2                     333   Amptron PM-9100LMR                                                      SiS5597 Ext.          PC66 SDRAM            3-3-3-6                696
    2x PentiumMMX            200   Gigabyte GA-586DX                                                       i430HX                Dual EDO              -                      664
    C3                       800   VIA EPIA                                                                PLE133 Int.           PC133 SDRAM           3-3-3-6                575
    2x PentiumPro            200   Compaq ProLiant 800                                                     i440FX                Dual EDO              -                      534
    Celeron                  266   Epox P2-100B                                                            ApolloPro             PC66 SDRAM            3-2-2-5                459
    Pentium                  166   Asus TX97-X                                                             i430TX                PC66 SDRAM            2-2-3-4                232
    K5 PR166                 116   Asus P5A                                                                ALADDiN5              PC66 SDRAM            2-2-2-6                200
    MediaGXm                 233   ALD NPC6836                                                             Cx5520                PC60 SDRAM            3-3-3-6                185


--------[ CPU PhotoWorxx ]----------------------------------------------------------------------------------------------

    4x Core i7 Extreme 965 HT    3333   Asus P6T Deluxe                                                         X58                   Triple DDR3-1333      9-9-9-24 CR1                 35393
    8x Xeon E5462           2800   Intel S5400SF                                                           i5400                 Quad DDR2-640FB       5-5-5-15                     25575
    4x Phenom II X4 Black 940    3000   Asus M3N78-EM                                                           GeForce8300 Int.      Ganged Dual DDR2-800  5-5-5-18 CR2                 19168
    4x Core 2 Extreme QX9650    3000   Gigabyte GA-EP35C-DS3R                                                  P35                   Dual DDR3-1066        8-8-8-20 CR2                 17431
    8x Opteron 2378         2400   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1                 15896
    2x Core 2 Duo E6700     2666   Abit AB9                                                                P965                  Dual DDR2-800         5-5-5-18 CR2                 11922
    4x Core 2 Extreme QX6700    2666   Intel D975XBX2                                                          i975X                 Dual DDR2-667         5-5-5-15                     11706
    2x Core 2 Duo E6550     2333   MSI P965 Neo2 (MS-7235 v2)                                              P965                  Dual DDR2-667         5-4-4-12 CR2                 11026
    8x Xeon L5320           1866   Intel S5000VCL                                                          i5000V                Dual DDR2-533FB       4-4-4-12                      9621
    4x Xeon 5140            2333   Intel S5000VSA                                                          i5000V                Dual DDR2-667FB       5-5-5-15                      8626
    2x Athlon64 X2 Black 6400+    3200   MSI K9N SLI Platinum                                                    nForce570SLI          Dual DDR2-800         4-4-4-11 CR1                  7653
    2x Core 2 Duo P8400     2266   MSI MegaBook PR201                                                      GM45 Int.             Dual DDR2-667         5-5-5-15                      7534
    8x Opteron HE 2344      1700   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1                  6622
    4x Phenom X4 9500       2200   Asus M3A                                                                AMD770                Ganged Dual DDR2-800  5-5-5-18 CR2                  6532
    2x Athlon64 X2 4000+    2100   ASRock ALiveNF7G-HDready                                                nForce7050-630a Int.  Dual DDR2-700         5-5-5-18 CR2                  6419
    2x Pentium EE 955 HT    3466   Intel D955XBK                                                           i955X                 Dual DDR2-667         4-4-4-11                      6058
    2x Opteron 240          1400   MSI K8D Master3-133 FS                                                  AMD8100               Dual DDR400R          3-4-4-8 CR1                   5645
    2x Core Duo T2500       2000   Asus N4L-VM DH                                                          i945GT Int.           Dual DDR2-667         5-5-5-15                      5053
    2x Core 2 Duo T5600     1833   Asus F3000Jc Notebook                                                   i945PM                Dual DDR2-667         5-5-5-15                      5027
    P4EE HT                 3733   Intel SE7230NH1LX                                                       iE7230                Dual DDR2-667         5-5-5-15                      4621
    2x Xeon HT              3400   Intel SE7320SP2                                                         iE7320                Dual DDR333R          2.5-3-3-7                     4031
    Celeron 420             1600   Intel DQ965CO                                                           Q965 Int.             Dual DDR2-667         5-5-5-15                      3844
    Athlon64 3200+          2000   ASRock 939S56-M                                                         SiS756                Dual DDR400           2.5-3-3-8 CR2                  3724
    Opteron 248             2200   MSI K8T Master1-FAR                                                     K8T800                Dual DDR266R          2-3-3-6 CR1                   3406
    2x Xeon                 3066   Asus PCH-DL                                                             i875P + PAT           Dual DDR333           2-2-2-5                       3339
    Pentium M 730           1600   AOpen i915Ga-HFS                                                        i915G Int.            Dual DDR2-533         4-4-4-12                      2801
    Sempron 2600+           1600   ASRock K8NF4G-SATA2                                                     GeForce6100 Int.      DDR400 SDRAM          2.5-3-3-8 CR2                  2780
    P4EE                    3466   ASRock 775Dual-880Pro                                                   PT880Pro              Dual DDR2-400         3-3-3-8 CR2                   2424
    Celeron D 326           2533   ASRock 775Twins-HDTV                                                    RC410 Ext.            DDR2-533 SDRAM        4-4-4-11                      2262
    Celeron 215             1333   Intel D201GLY                                                           SiS662 Int.           DDR2-533              5-4-4-12                      2198
    Atom 230 HT             1600   Intel D945GCLF                                                          i945GC                DDR2-533 SDRAM        4-4-4-12                      2163
    Nano L2200              1600   VIA VB8001                                                              CN896 Int.            DDR2-667 SDRAM        5-5-5-12 CR2                  1975
    P4                      2800   MSI 848P Neo-S                                                          i848P                 DDR400 SDRAM          2.5-3-3-8                     1967
    P4                      2400   Abit SI7                                                                SiSR658               Dual PC1066 RDRAM     -                             1883
    Celeron M 320           1300   DFI 855GME-MGF                                                          i855GME Int.          DDR333 SDRAM          2.5-3-3-7                     1854
    Celeron                 2000   Gigabyte GA-8TRS350MT                                                   RS350 Int.            Dual DDR400           2-2-4-6 CR1                   1599
    Duron                   1600   Biostar M7VIQ                                                           KM266 Int.            DDR266 SDRAM          2.5-2-2-6 CR2                  1413
    P4                      1600   Abit TH7II                                                              i850                  Dual PC800 RDRAM      -                             1385
    2x PIII-S               1266   MSI Pro266TD Master-LR                                                  ApolloPro266TD        DDR266 SDRAM          2-3-3-6 CR2                   1299
    C7                      1500   VIA EPIA EN                                                             CN700 Int.            DDR2-533 SDRAM        4-4-4-12 CR2                  1219
    2x PIII-E                733   Tyan Thunder 2500                                                       ServerSet3HE          PC133R SDRAM          3-3-3-6                       1138
    Efficeon 8600           1000   ECS 532 Notebook                                                        Efficeon              DDR266 SDRAM                                        1119
    Celeron                 1700   Asus P4B                                                                i845                  PC133 SDRAM           3-3-3-6                       1070
    AthlonXP 1600+          1400   Acorp 7KMM1                                                             KM133A Int.           PC133 SDRAM           3-3-3-6                        959
    Athlon                  1400   PCChips M817LMR                                                         MAGiK1                DDR266 SDRAM          2-3-3-7                        853
    2x PIII                  500   Epox KP6-BS                                                             i440BX                PC100R SDRAM          3-3-3-?                        839
    C3                      1333   VIA EPIA SP                                                             CN400 Int.            DDR400 SDRAM          3-3-3-8 CR2                    670
    Duron                    600   Abit KG7-Lite                                                           AMD-760               DDR200R SDRAM         2-2-2-5                        667
    Athlon                   750   Epox EP-7KXA                                                            KX133                 PC133 SDRAM           3-3-3-6                        598
    Crusoe 5800             1000   ECS A530 DeskNote                                                       Crusoe                DDR266 SDRAM                                         536
    2x PII                   333   Intel DK440LX                                                           i440LX                PC66 SDRAM            3-2-2-?                        531
    PIII                     450   Asus P3C-S                                                              i820                  PC600 RDRAM           -                              530
    K6-III                   400   Epox EP-MVP3G-M                                                         MVP3                  PC100 SDRAM           2-2-2-5                        357
    C3                       800   VIA EPIA                                                                PLE133 Int.           PC133 SDRAM           3-3-3-6                        353
    2x PentiumPro            200   Compaq ProLiant 800                                                     i440FX                Dual EDO              -                              327
    Celeron                  266   Epox P2-100B                                                            ApolloPro             PC66 SDRAM            3-2-2-5                        297
    Celeron                  700   PCChips M758LT                                                          SiS630ET Int.         PC100 SDRAM           3-3-3-6                        270
    K6-2                     333   Amptron PM-9100LMR                                                      SiS5597 Ext.          PC66 SDRAM            3-3-3-6                        254
    K5 PR166                 116   Asus P5A                                                                ALADDiN5              PC66 SDRAM            2-2-2-6                        173
    Pentium                  166   Asus TX97-X                                                             i430TX                PC66 SDRAM            2-2-3-4                        148
    MediaGXm                 233   ALD NPC6836                                                             Cx5520                PC60 SDRAM            3-3-3-6                        147
    2x PentiumMMX            200   Gigabyte GA-586DX                                                       i430HX                Dual EDO              -                              142


--------[ CPU ZLib ]----------------------------------------------------------------------------------------------------

    8x Xeon E5462           2800   Intel S5400SF                                                           i5400                 Quad DDR2-640FB       5-5-5-15               139481 /
    4x Core i7 Extreme 965 HT    3333   Asus P6T Deluxe                                                         X58                   Triple DDR3-1333      9-9-9-24 CR1           112330 /
    8x Opteron 2378         2400   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1           104213 /
    8x Xeon L5320           1866   Intel S5000VCL                                                          i5000V                Dual DDR2-533FB       4-4-4-12                95887 /
    8x Opteron HE 2344      1700   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1            88845 /
    4x Phenom II X4 Black 940    3000   Asus M3N78-EM                                                           GeForce8300 Int.      Ganged Dual DDR2-800  5-5-5-18 CR2            80081 /
    4x Core 2 Extreme QX9650    3000   Gigabyte GA-EP35C-DS3R                                                  P35                   Dual DDR3-1066        8-8-8-20 CR2            77167 /
    4x Core 2 Extreme QX6700    2666   Intel D975XBX2                                                          i975X                 Dual DDR2-667         5-5-5-15                69756 /
    4x Xeon 5140            2333   Intel S5000VSA                                                          i5000V                Dual DDR2-667FB       5-5-5-15                60995 /
    4x Phenom X4 9500       2200   Asus M3A                                                                AMD770                Ganged Dual DDR2-800  5-5-5-18 CR2            58396 /
    2x Athlon64 X2 Black 6400+    3200   MSI K9N SLI Platinum                                                    nForce570SLI          Dual DDR2-800         4-4-4-11 CR1            38059 /
    2x Core 2 Duo E6700     2666   Abit AB9                                                                P965                  Dual DDR2-800         5-5-5-18 CR2            35355 /
    2x Core 2 Duo E6550     2333   MSI P965 Neo2 (MS-7235 v2)                                              P965                  Dual DDR2-667         5-4-4-12 CR2            30436 /
    2x Pentium EE 955 HT    3466   Intel D955XBK                                                           i955X                 Dual DDR2-667         4-4-4-11                29844 /
    2x Core 2 Duo P8400     2266   MSI MegaBook PR201                                                      GM45 Int.             Dual DDR2-667         5-5-5-15                29223 /
    2x Xeon HT              3400   Intel SE7320SP2                                                         iE7320                Dual DDR333R          2.5-3-3-7               29177 /
    2x Xeon                 3066   Asus PCH-DL                                                             i875P + PAT           Dual DDR333           2-2-2-5                 25040 /
    2x Core 2 Duo T5600     1833   Asus F3000Jc Notebook                                                   i945PM                Dual DDR2-667         5-5-5-15                23969 /
    2x Athlon64 X2 4000+    2100   ASRock ALiveNF7G-HDready                                                nForce7050-630a Int.  Dual DDR2-700         5-5-5-18 CR2            23852 /
    2x Core Duo T2500       2000   Asus N4L-VM DH                                                          i945GT Int.           Dual DDR2-667         5-5-5-15                23789 /
    P4EE HT                 3733   Intel SE7230NH1LX                                                       iE7230                Dual DDR2-667         5-5-5-15                16146 /
    2x Opteron 240          1400   MSI K8D Master3-133 FS                                                  AMD8100               Dual DDR400R          3-4-4-8 CR1             15860 /
    2x PIII-S               1266   MSI Pro266TD Master-LR                                                  ApolloPro266TD        DDR266 SDRAM          2-3-3-6 CR2             14669 /
    P4EE                    3466   ASRock 775Dual-880Pro                                                   PT880Pro              Dual DDR2-400         3-3-3-8 CR2             14095 /
    Opteron 248             2200   MSI K8T Master1-FAR                                                     K8T800                Dual DDR266R          2-3-3-6 CR1             12635 /
    Athlon64 3200+          2000   ASRock 939S56-M                                                         SiS756                Dual DDR400           2.5-3-3-8 CR2            11824 /
    P4                      2800   MSI 848P Neo-S                                                          i848P                 DDR400 SDRAM          2.5-3-3-8               11343 /
    Celeron 420             1600   Intel DQ965CO                                                           Q965 Int.             Dual DDR2-667         5-5-5-15                10485 /
    Pentium M 730           1600   AOpen i915Ga-HFS                                                        i915G Int.            Dual DDR2-533         4-4-4-12                 9871 /
    P4                      2400   Abit SI7                                                                SiSR658               Dual PC1066 RDRAM     -                        9775 /
    Celeron D 326           2533   ASRock 775Twins-HDTV                                                    RC410 Ext.            DDR2-533 SDRAM        4-4-4-11                 9261 /
    Atom 230 HT             1600   Intel D945GCLF                                                          i945GC                DDR2-533 SDRAM        4-4-4-12                 8404 /
    Sempron 2600+           1600   ASRock K8NF4G-SATA2                                                     GeForce6100 Int.      DDR400 SDRAM          2.5-3-3-8 CR2             8152 /
    Celeron M 320           1300   DFI 855GME-MGF                                                          i855GME Int.          DDR333 SDRAM          2.5-3-3-7                8110 /
    Celeron 215             1333   Intel D201GLY                                                           SiS662 Int.           DDR2-533              5-4-4-12                 7935 /
    Nano L2200              1600   VIA VB8001                                                              CN896 Int.            DDR2-667 SDRAM        5-5-5-12 CR2             7799 /
    AthlonXP 1600+          1400   Acorp 7KMM1                                                             KM133A Int.           PC133 SDRAM           3-3-3-6                  7435 /
    2x PIII-E                733   Tyan Thunder 2500                                                       ServerSet3HE          PC133R SDRAM          3-3-3-6                  7379 /
    Athlon                  1400   PCChips M817LMR                                                         MAGiK1                DDR266 SDRAM          2-3-3-7                  7343 /
    P4                      1600   Abit TH7II                                                              i850                  Dual PC800 RDRAM      -                        6339 /
    Efficeon 8600           1000   ECS 532 Notebook                                                        Efficeon              DDR266 SDRAM                                   5321 /
    2x PIII                  500   Epox KP6-BS                                                             i440BX                PC100R SDRAM          3-3-3-?                  4826 /
    Celeron                 2000   Gigabyte GA-8TRS350MT                                                   RS350 Int.            Dual DDR400           2-2-4-6 CR1              4407 /
    C7                      1500   VIA EPIA EN                                                             CN700 Int.            DDR2-533 SDRAM        4-4-4-12 CR2             4140 /
    Crusoe 5800             1000   ECS A530 DeskNote                                                       Crusoe                DDR266 SDRAM                                   4002 /
    Duron                   1600   Biostar M7VIQ                                                           KM266 Int.            DDR266 SDRAM          2.5-2-2-6 CR2             3786 /
    Athlon                   750   Epox EP-7KXA                                                            KX133                 PC133 SDRAM           3-3-3-6                  3586 /
    Celeron                 1700   Asus P4B                                                                i845                  PC133 SDRAM           3-3-3-6                  3484 /
    2x PII                   333   Intel DK440LX                                                           i440LX                PC66 SDRAM            3-2-2-?                  3070 /
    Duron                    600   Abit KG7-Lite                                                           AMD-760               DDR200R SDRAM         2-2-2-5                  2288 /
    C3                      1333   VIA EPIA SP                                                             CN400 Int.            DDR400 SDRAM          3-3-3-8 CR2              2280 /
    PIII                     450   Asus P3C-S                                                              i820                  PC600 RDRAM           -                        2195 /
    2x PentiumPro            200   Compaq ProLiant 800                                                     i440FX                Dual EDO              -                        2102 /
    K6-III                   400   Epox EP-MVP3G-M                                                         MVP3                  PC100 SDRAM           2-2-2-5                  1986 /
    C3                       800   VIA EPIA                                                                PLE133 Int.           PC133 SDRAM           3-3-3-6                  1465 /
    Celeron                  700   PCChips M758LT                                                          SiS630ET Int.         PC100 SDRAM           3-3-3-6                  1299 /
    2x PentiumMMX            200   Gigabyte GA-586DX                                                       i430HX                Dual EDO              -                        1054 /
    K6-2                     333   Amptron PM-9100LMR                                                      SiS5597 Ext.          PC66 SDRAM            3-3-3-6                   774 /
    Celeron                  266   Epox P2-100B                                                            ApolloPro             PC66 SDRAM            3-2-2-5                   656 /
    Pentium                  166   Asus TX97-X                                                             i430TX                PC66 SDRAM            2-2-3-4                   497 /
    K5 PR166                 116   Asus P5A                                                                ALADDiN5              PC66 SDRAM            2-2-2-6                   474 /
    MediaGXm                 233   ALD NPC6836                                                             Cx5520                PC60 SDRAM            3-3-3-6                   412 /


--------[ CPU AES ]-----------------------------------------------------------------------------------------------------

    Nano L2200              1600   VIA VB8001                                                              CN896 Int.            DDR2-667 SDRAM        5-5-5-12 CR2         42295
    8x Xeon E5462           2800   Intel S5400SF                                                           i5400                 Quad DDR2-640FB       5-5-5-15             41625
    8x Opteron 2378         2400   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1         32424
    8x Xeon L5320           1866   Intel S5000VCL                                                          i5000V                Dual DDR2-533FB       4-4-4-12             27698
    4x Core i7 Extreme 965 HT    3333   Asus P6T Deluxe                                                         X58                   Triple DDR3-1333      9-9-9-24 CR1         26703
    8x Opteron HE 2344      1700   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1         22599
    4x Core 2 Extreme QX9650    3000   Gigabyte GA-EP35C-DS3R                                                  P35                   Dual DDR3-1066        8-8-8-20 CR2         22435
    4x Phenom II X4 Black 940    3000   Asus M3N78-EM                                                           GeForce8300 Int.      Ganged Dual DDR2-800  5-5-5-18 CR2         21658
    4x Core 2 Extreme QX6700    2666   Intel D975XBX2                                                          i975X                 Dual DDR2-667         5-5-5-15             19896
    C7                      1500   VIA EPIA EN                                                             CN700 Int.            DDR2-533 SDRAM        4-4-4-12 CR2         17358
    4x Xeon 5140            2333   Intel S5000VSA                                                          i5000V                Dual DDR2-667FB       5-5-5-15             17320
    4x Phenom X4 9500       2200   Asus M3A                                                                AMD770                Ganged Dual DDR2-800  5-5-5-18 CR2         14802
    2x Core 2 Duo E6700     2666   Abit AB9                                                                P965                  Dual DDR2-800         5-5-5-18 CR2          9969
    2x Pentium EE 955 HT    3466   Intel D955XBK                                                           i955X                 Dual DDR2-667         4-4-4-11              8970
    2x Xeon HT              3400   Intel SE7320SP2                                                         iE7320                Dual DDR333R          2.5-3-3-7             8740
    2x Core 2 Duo E6550     2333   MSI P965 Neo2 (MS-7235 v2)                                              P965                  Dual DDR2-667         5-4-4-12 CR2          8637
    2x Core 2 Duo P8400     2266   MSI MegaBook PR201                                                      GM45 Int.             Dual DDR2-667         5-5-5-15              8443
    2x Athlon64 X2 Black 6400+    3200   MSI K9N SLI Platinum                                                    nForce570SLI          Dual DDR2-800         4-4-4-11 CR1          8339
    2x Core Duo T2500       2000   Asus N4L-VM DH                                                          i945GT Int.           Dual DDR2-667         5-5-5-15              7109
    2x Core 2 Duo T5600     1833   Asus F3000Jc Notebook                                                   i945PM                Dual DDR2-667         5-5-5-15              6778
    C3                      1333   VIA EPIA SP                                                             CN400 Int.            DDR400 SDRAM          3-3-3-8 CR2           6771
    2x Xeon                 3066   Asus PCH-DL                                                             i875P + PAT           Dual DDR333           2-2-2-5               6366
    2x Athlon64 X2 4000+    2100   ASRock ALiveNF7G-HDready                                                nForce7050-630a Int.  Dual DDR2-700         5-5-5-18 CR2          5444
    P4EE HT                 3733   Intel SE7230NH1LX                                                       iE7230                Dual DDR2-667         5-5-5-15              4811
    2x PIII-S               1266   MSI Pro266TD Master-LR                                                  ApolloPro266TD        DDR266 SDRAM          2-3-3-6 CR2           3985
    2x Opteron 240          1400   MSI K8D Master3-133 FS                                                  AMD8100               Dual DDR400R          3-4-4-8 CR1           3608
    P4EE                    3466   ASRock 775Dual-880Pro                                                   PT880Pro              Dual DDR2-400         3-3-3-8 CR2           3576
    Celeron 420             1600   Intel DQ965CO                                                           Q965 Int.             Dual DDR2-667         5-5-5-15              2935
    P4                      2800   MSI 848P Neo-S                                                          i848P                 DDR400 SDRAM          2.5-3-3-8             2906
    Opteron 248             2200   MSI K8T Master1-FAR                                                     K8T800                Dual DDR266R          2-3-3-6 CR1           2851
    Pentium M 730           1600   AOpen i915Ga-HFS                                                        i915G Int.            Dual DDR2-533         4-4-4-12              2842
    Athlon64 3200+          2000   ASRock 939S56-M                                                         SiS756                Dual DDR400           2.5-3-3-8 CR2          2603
    Celeron 215             1333   Intel D201GLY                                                           SiS662 Int.           DDR2-533              5-4-4-12              2378
    Celeron M 320           1300   DFI 855GME-MGF                                                          i855GME Int.          DDR333 SDRAM          2.5-3-3-7             2291
    P4                      2400   Abit SI7                                                                SiSR658               Dual PC1066 RDRAM     -                     2284
    Celeron D 326           2533   ASRock 775Twins-HDTV                                                    RC410 Ext.            DDR2-533 SDRAM        4-4-4-11              2114
    2x PIII-E                733   Tyan Thunder 2500                                                       ServerSet3HE          PC133R SDRAM          3-3-3-6               2105
    Sempron 2600+           1600   ASRock K8NF4G-SATA2                                                     GeForce6100 Int.      DDR400 SDRAM          2.5-3-3-8 CR2          2089
    Duron                   1600   Biostar M7VIQ                                                           KM266 Int.            DDR266 SDRAM          2.5-2-2-6 CR2          2031
    Celeron                 2000   Gigabyte GA-8TRS350MT                                                   RS350 Int.            Dual DDR400           2-2-4-6 CR1           1920
    Atom 230 HT             1600   Intel D945GCLF                                                          i945GC                DDR2-533 SDRAM        4-4-4-12              1845
    AthlonXP 1600+          1400   Acorp 7KMM1                                                             KM133A Int.           PC133 SDRAM           3-3-3-6               1770
    Efficeon 8600           1000   ECS 532 Notebook                                                        Efficeon              DDR266 SDRAM                                1762
    Celeron                 1700   Asus P4B                                                                i845                  PC133 SDRAM           3-3-3-6               1579
    Athlon                  1400   PCChips M817LMR                                                         MAGiK1                DDR266 SDRAM          2-3-3-7               1539
    P4                      1600   Abit TH7II                                                              i850                  Dual PC800 RDRAM      -                     1475
    2x PIII                  500   Epox KP6-BS                                                             i440BX                PC100R SDRAM          3-3-3-?               1466
    Crusoe 5800             1000   ECS A530 DeskNote                                                       Crusoe                DDR266 SDRAM                                1177
    2x PII                   333   Intel DK440LX                                                           i440LX                PC66 SDRAM            3-2-2-?                984
    Celeron                  700   PCChips M758LT                                                          SiS630ET Int.         PC100 SDRAM           3-3-3-6                909
    Athlon                   750   Epox EP-7KXA                                                            KX133                 PC133 SDRAM           3-3-3-6                857
    Duron                    600   Abit KG7-Lite                                                           AMD-760               DDR200R SDRAM         2-2-2-5                727
    PIII                     450   Asus P3C-S                                                              i820                  PC600 RDRAM           -                      682
    2x PentiumPro            200   Compaq ProLiant 800                                                     i440FX                Dual EDO              -                      599
    K6-III                   400   Epox EP-MVP3G-M                                                         MVP3                  PC100 SDRAM           2-2-2-5                447
    Celeron                  266   Epox P2-100B                                                            ApolloPro             PC66 SDRAM            3-2-2-5                401
    C3                       800   VIA EPIA                                                                PLE133 Int.           PC133 SDRAM           3-3-3-6                393
    K6-2                     333   Amptron PM-9100LMR                                                      SiS5597 Ext.          PC66 SDRAM            3-3-3-6                348
    2x PentiumMMX            200   Gigabyte GA-586DX                                                       i430HX                Dual EDO              -                      313
    K5 PR166                 116   Asus P5A                                                                ALADDiN5              PC66 SDRAM            2-2-2-6                171
    MediaGXm                 233   ALD NPC6836                                                             Cx5520                PC60 SDRAM            3-3-3-6                112
    Pentium                  166   Asus TX97-X                                                             i430TX                PC66 SDRAM            2-2-3-4                107


--------[ FPU Julia ]---------------------------------------------------------------------------------------------------

    8x Xeon E5462           2800   Intel S5400SF                                                           i5400                 Quad DDR2-640FB       5-5-5-15             19454
    4x Core i7 Extreme 965 HT    3333   Asus P6T Deluxe                                                         X58                   Triple DDR3-1333      9-9-9-24 CR1         14403
    8x Xeon L5320           1866   Intel S5000VCL                                                          i5000V                Dual DDR2-533FB       4-4-4-12             13144
    8x Opteron 2378         2400   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1         12276
    4x Core 2 Extreme QX9650    3000   Gigabyte GA-EP35C-DS3R                                                  P35                   Dual DDR3-1066        8-8-8-20 CR2         10970
    4x Core 2 Extreme QX6700    2666   Intel D975XBX2                                                          i975X                 Dual DDR2-667         5-5-5-15              9820
    4x Xeon 5140            2333   Intel S5000VSA                                                          i5000V                Dual DDR2-667FB       5-5-5-15              8584
    4x Phenom II X4 Black 940    3000   Asus M3N78-EM                                                           GeForce8300 Int.      Ganged Dual DDR2-800  5-5-5-18 CR2          8046
    8x Opteron HE 2344      1700   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1          7904
    4x Phenom X4 9500       2200   Asus M3A                                                                AMD770                Ganged Dual DDR2-800  5-5-5-18 CR2          5329
    2x Core 2 Duo E6700     2666   Abit AB9                                                                P965                  Dual DDR2-800         5-5-5-18 CR2          5005
    2x Core 2 Duo E6550     2333   MSI P965 Neo2 (MS-7235 v2)                                              P965                  Dual DDR2-667         5-4-4-12 CR2          4326
    2x Core 2 Duo P8400     2266   MSI MegaBook PR201                                                      GM45 Int.             Dual DDR2-667         5-5-5-15              4188
    2x Core 2 Duo T5600     1833   Asus F3000Jc Notebook                                                   i945PM                Dual DDR2-667         5-5-5-15              3403
    2x Pentium EE 955 HT    3466   Intel D955XBK                                                           i955X                 Dual DDR2-667         4-4-4-11              2709
    2x Xeon HT              3400   Intel SE7320SP2                                                         iE7320                Dual DDR333R          2.5-3-3-7             2640
    2x Athlon64 X2 Black 6400+    3200   MSI K9N SLI Platinum                                                    nForce570SLI          Dual DDR2-800         4-4-4-11 CR1          2586
    2x Xeon                 3066   Asus PCH-DL                                                             i875P + PAT           Dual DDR333           2-2-2-5               2063
    2x Athlon64 X2 4000+    2100   ASRock ALiveNF7G-HDready                                                nForce7050-630a Int.  Dual DDR2-700         5-5-5-18 CR2          1776
    2x Core Duo T2500       2000   Asus N4L-VM DH                                                          i945GT Int.           Dual DDR2-667         5-5-5-15              1635
    P4EE HT                 3733   Intel SE7230NH1LX                                                       iE7230                Dual DDR2-667         5-5-5-15              1461
    Celeron 420             1600   Intel DQ965CO                                                           Q965 Int.             Dual DDR2-667         5-5-5-15              1395
    P4EE                    3466   ASRock 775Dual-880Pro                                                   PT880Pro              Dual DDR2-400         3-3-3-8 CR2           1242
    2x Opteron 240          1400   MSI K8D Master3-133 FS                                                  AMD8100               Dual DDR400R          3-4-4-8 CR1           1104
    Nano L2200              1600   VIA VB8001                                                              CN896 Int.            DDR2-667 SDRAM        5-5-5-12 CR2           990
    P4                      2800   MSI 848P Neo-S                                                          i848P                 DDR400 SDRAM          2.5-3-3-8              922
    Opteron 248             2200   MSI K8T Master1-FAR                                                     K8T800                Dual DDR266R          2-3-3-6 CR1            900
    Athlon64 3200+          2000   ASRock 939S56-M                                                         SiS756                Dual DDR400           2.5-3-3-8 CR2           854
    Celeron D 326           2533   ASRock 775Twins-HDTV                                                    RC410 Ext.            DDR2-533 SDRAM        4-4-4-11               823
    Atom 230 HT             1600   Intel D945GCLF                                                          i945GC                DDR2-533 SDRAM        4-4-4-12               785
    P4                      2400   Abit SI7                                                                SiSR658               Dual PC1066 RDRAM     -                      779
    Sempron 2600+           1600   ASRock K8NF4G-SATA2                                                     GeForce6100 Int.      DDR400 SDRAM          2.5-3-3-8 CR2           683
    Celeron                 2000   Gigabyte GA-8TRS350MT                                                   RS350 Int.            Dual DDR400           2-2-4-6 CR1            648
    Pentium M 730           1600   AOpen i915Ga-HFS                                                        i915G Int.            Dual DDR2-533         4-4-4-12               645
    2x PIII-S               1266   MSI Pro266TD Master-LR                                                  ApolloPro266TD        DDR266 SDRAM          2-3-3-6 CR2            617
    Celeron 215             1333   Intel D201GLY                                                           SiS662 Int.           DDR2-533              5-4-4-12               538
    Duron                   1600   Biostar M7VIQ                                                           KM266 Int.            DDR266 SDRAM          2.5-2-2-6 CR2           534
    P4                      1600   Abit TH7II                                                              i850                  Dual PC800 RDRAM      -                      514
    Celeron                 1700   Asus P4B                                                                i845                  PC133 SDRAM           3-3-3-6                495
    Celeron M 320           1300   DFI 855GME-MGF                                                          i855GME Int.          DDR333 SDRAM          2.5-3-3-7              474
    AthlonXP 1600+          1400   Acorp 7KMM1                                                             KM133A Int.           PC133 SDRAM           3-3-3-6                440
    Athlon                  1400   PCChips M817LMR                                                         MAGiK1                DDR266 SDRAM          2-3-3-7                398
    2x PIII-E                733   Tyan Thunder 2500                                                       ServerSet3HE          PC133R SDRAM          3-3-3-6                363
    Efficeon 8600           1000   ECS 532 Notebook                                                        Efficeon              DDR266 SDRAM                                 309
    C7                      1500   VIA EPIA EN                                                             CN700 Int.            DDR2-533 SDRAM        4-4-4-12 CR2           273
    2x PIII                  500   Epox KP6-BS                                                             i440BX                PC100R SDRAM          3-3-3-?                261
    Athlon                   750   Epox EP-7KXA                                                            KX133                 PC133 SDRAM           3-3-3-6                227
    Duron                    600   Abit KG7-Lite                                                           AMD-760               DDR200R SDRAM         2-2-2-5                193
    C3                      1333   VIA EPIA SP                                                             CN400 Int.            DDR400 SDRAM          3-3-3-8 CR2            168
    PIII                     450   Asus P3C-S                                                              i820                  PC600 RDRAM           -                      121
    Celeron                  700   PCChips M758LT                                                          SiS630ET Int.         PC100 SDRAM           3-3-3-6                110
    2x PII                   333   Intel DK440LX                                                           i440LX                PC66 SDRAM            3-2-2-?                100
    C3                       800   VIA EPIA                                                                PLE133 Int.           PC133 SDRAM           3-3-3-6                 78
    Crusoe 5800             1000   ECS A530 DeskNote                                                       Crusoe                DDR266 SDRAM                                  73
    K6-III                   400   Epox EP-MVP3G-M                                                         MVP3                  PC100 SDRAM           2-2-2-5                 62
    2x PentiumPro            200   Compaq ProLiant 800                                                     i440FX                Dual EDO              -                       56
    K6-2                     333   Amptron PM-9100LMR                                                      SiS5597 Ext.          PC66 SDRAM            3-3-3-6                 47
    2x PentiumMMX            200   Gigabyte GA-586DX                                                       i430HX                Dual EDO              -                       39
    Celeron                  266   Epox P2-100B                                                            ApolloPro             PC66 SDRAM            3-2-2-5                 39
    Pentium                  166   Asus TX97-X                                                             i430TX                PC66 SDRAM            2-2-3-4                 16
    K5 PR166                 116   Asus P5A                                                                ALADDiN5              PC66 SDRAM            2-2-2-6                 11
    MediaGXm                 233   ALD NPC6836                                                             Cx5520                PC60 SDRAM            3-3-3-6                  6


--------[ FPU Mandel ]--------------------------------------------------------------------------------------------------

    8x Xeon E5462           2800   Intel S5400SF                                                           i5400                 Quad DDR2-640FB       5-5-5-15              9771
    4x Core i7 Extreme 965 HT    3333   Asus P6T Deluxe                                                         X58                   Triple DDR3-1333      9-9-9-24 CR1          7825
    8x Opteron 2378         2400   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1          7655
    8x Xeon L5320           1866   Intel S5000VCL                                                          i5000V                Dual DDR2-533FB       4-4-4-12              6449
    4x Core 2 Extreme QX9650    3000   Gigabyte GA-EP35C-DS3R                                                  P35                   Dual DDR3-1066        8-8-8-20 CR2          5567
    8x Opteron HE 2344      1700   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1          5494
    4x Phenom II X4 Black 940    3000   Asus M3N78-EM                                                           GeForce8300 Int.      Ganged Dual DDR2-800  5-5-5-18 CR2          5051
    4x Core 2 Extreme QX6700    2666   Intel D975XBX2                                                          i975X                 Dual DDR2-667         5-5-5-15              4870
    4x Xeon 5140            2333   Intel S5000VSA                                                          i5000V                Dual DDR2-667FB       5-5-5-15              4254
    4x Phenom X4 9500       2200   Asus M3A                                                                AMD770                Ganged Dual DDR2-800  5-5-5-18 CR2          3749
    2x Core 2 Duo E6700     2666   Abit AB9                                                                P965                  Dual DDR2-800         5-5-5-18 CR2          2492
    2x Core 2 Duo E6550     2333   MSI P965 Neo2 (MS-7235 v2)                                              P965                  Dual DDR2-667         5-4-4-12 CR2          2159
    2x Core 2 Duo P8400     2266   MSI MegaBook PR201                                                      GM45 Int.             Dual DDR2-667         5-5-5-15              2150
    2x Pentium EE 955 HT    3466   Intel D955XBK                                                           i955X                 Dual DDR2-667         4-4-4-11              1771
    2x Xeon HT              3400   Intel SE7320SP2                                                         iE7320                Dual DDR333R          2.5-3-3-7             1739
    2x Core 2 Duo T5600     1833   Asus F3000Jc Notebook                                                   i945PM                Dual DDR2-667         5-5-5-15              1698
    2x Athlon64 X2 Black 6400+    3200   MSI K9N SLI Platinum                                                    nForce570SLI          Dual DDR2-800         4-4-4-11 CR1          1544
    2x Xeon                 3066   Asus PCH-DL                                                             i875P + PAT           Dual DDR333           2-2-2-5               1489
    2x Athlon64 X2 4000+    2100   ASRock ALiveNF7G-HDready                                                nForce7050-630a Int.  Dual DDR2-700         5-5-5-18 CR2          1005
    P4EE HT                 3733   Intel SE7230NH1LX                                                       iE7230                Dual DDR2-667         5-5-5-15               970
    P4EE                    3466   ASRock 775Dual-880Pro                                                   PT880Pro              Dual DDR2-400         3-3-3-8 CR2            847
    2x Core Duo T2500       2000   Asus N4L-VM DH                                                          i945GT Int.           Dual DDR2-667         5-5-5-15               764
    Celeron 420             1600   Intel DQ965CO                                                           Q965 Int.             Dual DDR2-667         5-5-5-15               745
    P4                      2800   MSI 848P Neo-S                                                          i848P                 DDR400 SDRAM          2.5-3-3-8              683
    2x Opteron 240          1400   MSI K8D Master3-133 FS                                                  AMD8100               Dual DDR400R          3-4-4-8 CR1            674
    Celeron D 326           2533   ASRock 775Twins-HDTV                                                    RC410 Ext.            DDR2-533 SDRAM        4-4-4-11               636
    Nano L2200              1600   VIA VB8001                                                              CN896 Int.            DDR2-667 SDRAM        5-5-5-12 CR2           607
    P4                      2400   Abit SI7                                                                SiSR658               Dual PC1066 RDRAM     -                      590
    Opteron 248             2200   MSI K8T Master1-FAR                                                     K8T800                Dual DDR266R          2-3-3-6 CR1            526
    Celeron                 2000   Gigabyte GA-8TRS350MT                                                   RS350 Int.            Dual DDR400           2-2-4-6 CR1            494
    Athlon64 3200+          2000   ASRock 939S56-M                                                         SiS756                Dual DDR400           2.5-3-3-8 CR2           486
    Celeron                 1700   Asus P4B                                                                i845                  PC133 SDRAM           3-3-3-6                412
    Sempron 2600+           1600   ASRock K8NF4G-SATA2                                                     GeForce6100 Int.      DDR400 SDRAM          2.5-3-3-8 CR2           389
    P4                      1600   Abit TH7II                                                              i850                  Dual PC800 RDRAM      -                      388
    2x PIII-S               1266   MSI Pro266TD Master-LR                                                  ApolloPro266TD        DDR266 SDRAM          2-3-3-6 CR2            340
    Pentium M 730           1600   AOpen i915Ga-HFS                                                        i915G Int.            Dual DDR2-533         4-4-4-12               300
    Celeron 215             1333   Intel D201GLY                                                           SiS662 Int.           DDR2-533              5-4-4-12               257
    Celeron M 320           1300   DFI 855GME-MGF                                                          i855GME Int.          DDR333 SDRAM          2.5-3-3-7              252
    Duron                   1600   Biostar M7VIQ                                                           KM266 Int.            DDR266 SDRAM          2.5-2-2-6 CR2           222
    2x PIII-E                733   Tyan Thunder 2500                                                       ServerSet3HE          PC133R SDRAM          3-3-3-6                197
    Efficeon 8600           1000   ECS 532 Notebook                                                        Efficeon              DDR266 SDRAM                                 194
    AthlonXP 1600+          1400   Acorp 7KMM1                                                             KM133A Int.           PC133 SDRAM           3-3-3-6                192
    Athlon                  1400   PCChips M817LMR                                                         MAGiK1                DDR266 SDRAM          2-3-3-7                191
    C7                      1500   VIA EPIA EN                                                             CN700 Int.            DDR2-533 SDRAM        4-4-4-12 CR2           145
    Atom 230 HT             1600   Intel D945GCLF                                                          i945GC                DDR2-533 SDRAM        4-4-4-12               143
    2x PIII                  500   Epox KP6-BS                                                             i440BX                PC100R SDRAM          3-3-3-?                135
    Athlon                   750   Epox EP-7KXA                                                            KX133                 PC133 SDRAM           3-3-3-6                105
    2x PII                   333   Intel DK440LX                                                           i440LX                PC66 SDRAM            3-2-2-?                 91
    Celeron                  700   PCChips M758LT                                                          SiS630ET Int.         PC100 SDRAM           3-3-3-6                 87
    Duron                    600   Abit KG7-Lite                                                           AMD-760               DDR200R SDRAM         2-2-2-5                 85
    C3                      1333   VIA EPIA SP                                                             CN400 Int.            DDR400 SDRAM          3-3-3-8 CR2             80
    Crusoe 5800             1000   ECS A530 DeskNote                                                       Crusoe                DDR266 SDRAM                                  71
    PIII                     450   Asus P3C-S                                                              i820                  PC600 RDRAM           -                       61
    2x PentiumPro            200   Compaq ProLiant 800                                                     i440FX                Dual EDO              -                       53
    2x PentiumMMX            200   Gigabyte GA-586DX                                                       i430HX                Dual EDO              -                       45
    Celeron                  266   Epox P2-100B                                                            ApolloPro             PC66 SDRAM            3-2-2-5                 37
    C3                       800   VIA EPIA                                                                PLE133 Int.           PC133 SDRAM           3-3-3-6                 31
    K6-III                   400   Epox EP-MVP3G-M                                                         MVP3                  PC100 SDRAM           2-2-2-5                 28
    K6-2                     333   Amptron PM-9100LMR                                                      SiS5597 Ext.          PC66 SDRAM            3-3-3-6                 23
    Pentium                  166   Asus TX97-X                                                             i430TX                PC66 SDRAM            2-2-3-4                 19
    K5 PR166                 116   Asus P5A                                                                ALADDiN5              PC66 SDRAM            2-2-2-6                  9
    MediaGXm                 233   ALD NPC6836                                                             Cx5520                PC60 SDRAM            3-3-3-6                  6


--------[ FPU SinJulia ]------------------------------------------------------------------------------------------------

    4x Core i7 Extreme 965 HT    3333   Asus P6T Deluxe                                                         X58                   Triple DDR3-1333      9-9-9-24 CR1          6254
    8x Xeon E5462           2800   Intel S5400SF                                                           i5400                 Quad DDR2-640FB       5-5-5-15              5546
    8x Opteron 2378         2400   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1          4237
    8x Xeon L5320           1866   Intel S5000VCL                                                          i5000V                Dual DDR2-533FB       4-4-4-12              3484
    4x Core 2 Extreme QX9650    3000   Gigabyte GA-EP35C-DS3R                                                  P35                   Dual DDR3-1066        8-8-8-20 CR2          2981
    8x Opteron HE 2344      1700   Tyan Thunder n3600R                                                     nForcePro-3600        Unganged Dual DDR2-667R  5-5-5-15 CR1          2970
    4x Phenom II X4 Black 940    3000   Asus M3N78-EM                                                           GeForce8300 Int.      Ganged Dual DDR2-800  5-5-5-18 CR2          2619
    4x Core 2 Extreme QX6700    2666   Intel D975XBX2                                                          i975X                 Dual DDR2-667         5-5-5-15              2497
    4x Xeon 5140            2333   Intel S5000VSA                                                          i5000V                Dual DDR2-667FB       5-5-5-15              2178
    4x Phenom X4 9500       2200   Asus M3A                                                                AMD770                Ganged Dual DDR2-800  5-5-5-18 CR2          1922
    2x Athlon64 X2 Black 6400+    3200   MSI K9N SLI Platinum                                                    nForce570SLI          Dual DDR2-800         4-4-4-11 CR1          1429
    2x Pentium EE 955 HT    3466   Intel D955XBK                                                           i955X                 Dual DDR2-667         4-4-4-11              1289
    2x Xeon HT              3400   Intel SE7320SP2                                                         iE7320                Dual DDR333R          2.5-3-3-7             1264
    2x Core 2 Duo E6700     2666   Abit AB9                                                                P965                  Dual DDR2-800         5-5-5-18 CR2          1248
    2x Core 2 Duo P8400     2266   MSI MegaBook PR201                                                      GM45 Int.             Dual DDR2-667         5-5-5-15              1122
    2x Core 2 Duo E6550     2333   MSI P965 Neo2 (MS-7235 v2)                                              P965                  Dual DDR2-667         5-4-4-12 CR2          1073
    2x Athlon64 X2 4000+    2100   ASRock ALiveNF7G-HDready                                                nForce7050-630a Int.  Dual DDR2-700         5-5-5-18 CR2           934
    2x Core Duo T2500       2000   Asus N4L-VM DH                                                          i945GT Int.           Dual DDR2-667         5-5-5-15               911
    2x Xeon                 3066   Asus PCH-DL                                                             i875P + PAT           Dual DDR333           2-2-2-5                867
    2x Core 2 Duo T5600     1833   Asus F3000Jc Notebook                                                   i945PM                Dual DDR2-667         5-5-5-15               848
    P4EE HT                 3733   Intel SE7230NH1LX                                                       iE7230                Dual DDR2-667         5-5-5-15               693
    2x Opteron 240          1400   MSI K8D Master3-133 FS                                                  AMD8100               Dual DDR400R          3-4-4-8 CR1            623
    2x PIII-S               1266   MSI Pro266TD Master-LR                                                  ApolloPro266TD        DDR266 SDRAM          2-3-3-6 CR2            586
    Opteron 248             2200   MSI K8T Master1-FAR                                                     K8T800                Dual DDR266R          2-3-3-6 CR1            492
    P4EE                    3466   ASRock 775Dual-880Pro                                                   PT880Pro              Dual DDR2-400         3-3-3-8 CR2            487
    Athlon64 3200+          2000   ASRock 939S56-M                                                         SiS756                Dual DDR400           2.5-3-3-8 CR2           447
    P4                      2800   MSI 848P Neo-S                                                          i848P                 DDR400 SDRAM          2.5-3-3-8              394
    Celeron 420             1600   Intel DQ965CO                                                           Q965 Int.             Dual DDR2-667         5-5-5-15               369
    Pentium M 730           1600   AOpen i915Ga-HFS                                                        i915G Int.            Dual DDR2-533         4-4-4-12               362
    Sempron 2600+           1600   ASRock K8NF4G-SATA2                                                     GeForce6100 Int.      DDR400 SDRAM          2.5-3-3-8 CR2           358
    Duron                   1600   Biostar M7VIQ                                                           KM266 Int.            DDR266 SDRAM          2.5-2-2-6 CR2           353
    P4                      2400   Abit SI7                                                                SiSR658               Dual PC1066 RDRAM     -                      340
    2x PIII-E                733   Tyan Thunder 2500                                                       ServerSet3HE          PC133R SDRAM          3-3-3-6                325
    AthlonXP 1600+          1400   Acorp 7KMM1                                                             KM133A Int.           PC133 SDRAM           3-3-3-6                308
    Athlon                  1400   PCChips M817LMR                                                         MAGiK1                DDR266 SDRAM          2-3-3-7                304
    Celeron 215             1333   Intel D201GLY                                                           SiS662 Int.           DDR2-533              5-4-4-12               304
    Celeron M 320           1300   DFI 855GME-MGF                                                          i855GME Int.          DDR333 SDRAM          2.5-3-3-7              297
    Atom 230 HT             1600   Intel D945GCLF                                                          i945GC                DDR2-533 SDRAM        4-4-4-12               285
    Celeron                 2000   Gigabyte GA-8TRS350MT                                                   RS350 Int.            Dual DDR400           2-2-4-6 CR1            284
    Celeron D 326           2533   ASRock 775Twins-HDTV                                                    RC410 Ext.            DDR2-533 SDRAM        4-4-4-11               270
    Celeron                 1700   Asus P4B                                                                i845                  PC133 SDRAM           3-3-3-6                247
    P4                      1600   Abit TH7II                                                              i850                  Dual PC800 RDRAM      -                      231
    2x PIII                  500   Epox KP6-BS                                                             i440BX                PC100R SDRAM          3-3-3-?                227
    Nano L2200              1600   VIA VB8001                                                              CN896 Int.            DDR2-667 SDRAM        5-5-5-12 CR2           185
    Athlon                   750   Epox EP-7KXA                                                            KX133                 PC133 SDRAM           3-3-3-6                163
    Celeron                  700   PCChips M758LT                                                          SiS630ET Int.         PC100 SDRAM           3-3-3-6                155
    2x PII                   333   Intel DK440LX                                                           i440LX                PC66 SDRAM            3-2-2-?                151
    Efficeon 8600           1000   ECS 532 Notebook                                                        Efficeon              DDR266 SDRAM                                 140
    Duron                    600   Abit KG7-Lite                                                           AMD-760               DDR200R SDRAM         2-2-2-5                131
    PIII                     450   Asus P3C-S                                                              i820                  PC600 RDRAM           -                      103
    2x PentiumPro            200   Compaq ProLiant 800                                                     i440FX                Dual EDO              -                       91
    2x PentiumMMX            200   Gigabyte GA-586DX                                                       i430HX                Dual EDO              -                       90
    Crusoe 5800             1000   ECS A530 DeskNote                                                       Crusoe                DDR266 SDRAM                                  77
    K6-III                   400   Epox EP-MVP3G-M                                                         MVP3                  PC100 SDRAM           2-2-2-5                 68
    C7                      1500   VIA EPIA EN                                                             CN700 Int.            DDR2-533 SDRAM        4-4-4-12 CR2            64
    Celeron                  266   Epox P2-100B                                                            ApolloPro             PC66 SDRAM            3-2-2-5                 61
    K6-2                     333   Amptron PM-9100LMR                                                      SiS5597 Ext.          PC66 SDRAM            3-3-3-6                 56
    C3                      1333   VIA EPIA SP                                                             CN400 Int.            DDR400 SDRAM          3-3-3-8 CR2             49
    Pentium                  166   Asus TX97-X                                                             i430TX                PC66 SDRAM            2-2-3-4                 37
    C3                       800   VIA EPIA                                                                PLE133 Int.           PC133 SDRAM           3-3-3-6                 30
    MediaGXm                 233   ALD NPC6836                                                             Cx5520                PC60 SDRAM            3-3-3-6                 24
    K5 PR166                 116   Asus P5A                                                                ALADDiN5              PC66 SDRAM            2-2-2-6                  8


--------[ Debug - PCI ]-------------------------------------------------------------------------------------------------

    B00 D00 F00:  Intel G965/P965 Chipset - Memory Controller Hub [C-2]
                  
      Offset 000:  86 80 A0 29  06 00 90 20  02 00 00 06  00 00 00 00 
      Offset 010:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 020:  00 00 00 00  00 00 00 00  00 00 00 00  62 14 35 72 
      Offset 030:  00 00 00 00  E0 00 00 00  00 00 00 00  00 00 00 00 
      Offset 040:  01 90 D1 FE  00 00 00 00  01 40 D1 FE  00 00 00 00 
      Offset 050:  00 00 02 00  03 00 00 00  00 00 00 00  00 00 00 00 
      Offset 060:  01 00 00 E0  00 00 00 00  01 80 D1 FE  00 00 00 00 
      Offset 070:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 080:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 090:  10 11 11 00  00 33 33 00  4C 00 57 00  00 1A 38 00 
      Offset 0A0:  4C 00 00 16  00 00 00 D0  00 00 00 00  00 00 00 D0 
      Offset 0B0:  00 D0 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0C0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  00 00 00 00  00 00 00 00  49 00 00 00  00 00 00 13 
      Offset 0E0:  09 00 09 01  6E C3 FF 89  86 0C 00 00  00 00 00 00 
      Offset 0F0:  02 00 00 00  00 00 00 00  90 0F 04 00  00 00 00 00 

    B00 D01 F00:  Intel G965/P965 Chipset - PCI Express Root Port [C-2]
                  
      Offset 000:  86 80 A1 29  07 05 10 00  02 00 04 06  08 00 01 00 
      Offset 010:  00 00 00 00  00 00 00 00  00 01 01 00  C0 C0 00 00 
      Offset 020:  00 FA 90 FE  01 D0 F1 DF  00 00 00 00  00 00 00 00 
      Offset 030:  00 00 00 00  88 00 00 00  00 00 00 00  00 01 1A 00 
      Offset 040:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 050:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 060:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 070:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 02 
      Offset 080:  01 90 03 C8  08 00 00 00  0D 80 00 00  86 80 00 00 
      Offset 090:  05 A0 01 00  0C 30 E0 FE  B0 49 00 00  00 00 00 00 
      Offset 0A0:  10 00 41 01  00 80 00 00  00 00 00 00  01 2D 01 02 
      Offset 0B0:  40 00 01 11  80 25 00 00  C0 01 48 00  08 00 00 00 
      Offset 0C0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0E0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0F0:  00 00 01 00  03 E1 3F 00  90 0F 04 00  00 00 00 00 

    B00 D1A F00:  Intel 82801HB ICH8 - USB Universal Host Controller [B-0]
                  
      Offset 000:  86 80 34 28  05 00 80 02  02 00 03 0C  00 00 80 00 
      Offset 010:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 020:  01 BC 00 00  00 00 00 00  00 00 00 00  62 14 35 72 
      Offset 030:  00 00 00 00  00 00 00 00  00 00 00 00  10 01 00 00 
      Offset 040:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 050:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 060:  10 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 070:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 080:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 090:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0A0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0B0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0C0:  00 2F 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0E0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0F0:  00 00 00 00  00 00 00 00  86 0F 03 00  00 00 00 00 

    B00 D1A F01:  Intel 82801HB ICH8 - USB Universal Host Controller [B-0]
                  
      Offset 000:  86 80 35 28  05 00 80 02  02 00 03 0C  00 00 00 00 
      Offset 010:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 020:  81 B8 00 00  00 00 00 00  00 00 00 00  62 14 35 72 
      Offset 030:  00 00 00 00  00 00 00 00  00 00 00 00  15 02 00 00 
      Offset 040:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 050:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 060:  10 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 070:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 080:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 090:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0A0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0B0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0C0:  00 2F 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0E0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0F0:  00 00 00 00  00 00 00 00  86 0F 03 00  00 00 00 00 

    B00 D1A F07:  Intel 82801HB ICH8 - USB2 Enhanced Host Controller [B-0]
                  
      Offset 000:  86 80 3A 28  06 00 90 02  02 20 03 0C  00 00 00 00 
      Offset 010:  00 FC FF F9  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 020:  00 00 00 00  00 00 00 00  00 00 00 00  62 14 35 72 
      Offset 030:  00 00 00 00  50 00 00 00  00 00 00 00  12 03 00 00 
      Offset 040:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 050:  01 58 C2 C9  00 00 00 00  0A 00 A0 20  00 00 00 00 
      Offset 060:  20 20 FF 01  00 00 00 00  01 00 00 00  00 00 00 C0 
      Offset 070:  00 00 C7 03  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 080:  00 00 00 00  01 00 00 00  00 00 00 00  00 00 00 00 
      Offset 090:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0A0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0B0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0C0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  00 00 00 00  00 AA FF 00  00 00 00 00  00 00 00 00 
      Offset 0E0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0F0:  00 00 00 00  88 85 40 00  86 0F 03 00  06 17 02 20 

    B00 D1B F00:  Intel 82801HB ICH8 - High Definition Audio Controller [B-0]
                  
      Offset 000:  86 80 4B 28  06 00 10 00  02 00 03 04  08 00 00 00 
      Offset 010:  04 80 FF F9  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 020:  00 00 00 00  00 00 00 00  00 00 00 00  62 14 35 72 
      Offset 030:  00 00 00 00  50 00 00 00  00 00 00 00  16 01 00 00 
      Offset 040:  01 00 00 03  07 00 00 00  00 00 00 00  00 80 00 00 
      Offset 050:  01 60 42 C8  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 060:  05 70 80 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 070:  10 00 91 00  00 00 00 00  00 00 10 00  00 00 00 00 
      Offset 080:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 090:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0A0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0B0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0C0:  00 00 00 01  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0E0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0F0:  00 00 00 00  00 00 00 00  86 0F 03 00  00 00 00 00 

    B00 D1C F00:  Intel 82801HB ICH8 - PCI Express Root Port 1 [B-0]
                  
      Offset 000:  86 80 3F 28  04 05 10 00  02 00 04 06  08 00 81 00 
      Offset 010:  00 00 00 00  00 00 00 00  00 02 02 00  F0 00 00 20 
      Offset 020:  F0 FF 00 00  F1 FF 01 00  00 00 00 00  00 00 00 00 
      Offset 030:  00 00 00 00  40 00 00 00  00 00 00 00  00 01 02 00 
      Offset 040:  10 80 41 01  C0 8F 00 00  00 00 10 00  41 4C 11 01 
      Offset 050:  00 00 01 10  60 05 00 00  3A 10 00 00  08 00 00 00 
      Offset 060:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 070:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 080:  05 90 01 00  0C 30 E0 FE  90 49 00 00  00 00 00 00 
      Offset 090:  0D A0 00 00  62 14 35 72  00 00 00 00  00 00 00 00 
      Offset 0A0:  01 00 02 C8  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0B0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0C0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  00 00 00 00  00 00 00 00  00 00 11 08  00 00 00 00 
      Offset 0E0:  00 00 C7 00  06 07 08 00  30 00 00 00  00 00 00 00 
      Offset 0F0:  00 00 00 00  00 00 00 00  86 0F 03 00  00 00 00 00 

    B00 D1C F05:  Intel 82801HB ICH8 - PCI Express Root Port 6 [B-0]
                  
      Offset 000:  86 80 49 28  07 05 10 00  02 00 04 06  08 00 81 00 
      Offset 010:  00 00 00 00  00 00 00 00  00 03 03 00  D0 D0 00 00 
      Offset 020:  A0 FE A0 FE  F1 FF 01 00  00 00 00 00  00 00 00 00 
      Offset 030:  00 00 00 00  40 00 00 00  00 00 00 00  00 02 02 00 
      Offset 040:  10 80 41 01  C0 8F 00 00  00 00 11 00  11 2C 11 06 
      Offset 050:  40 00 11 30  60 05 00 00  3A 10 40 00  08 00 00 00 
      Offset 060:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 070:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 080:  05 90 01 00  0C 30 E0 FE  A0 49 00 00  00 00 00 00 
      Offset 090:  0D A0 00 00  62 14 35 72  00 00 00 00  00 00 00 00 
      Offset 0A0:  01 00 02 C8  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0B0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0C0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  00 00 00 00  00 00 00 00  00 00 11 08  00 00 00 00 
      Offset 0E0:  00 00 C7 00  06 07 08 00  30 00 00 00  00 00 00 00 
      Offset 0F0:  00 00 00 00  00 00 00 00  86 0F 03 00  00 00 00 00 

    B00 D1D F00:  Intel 82801HB ICH8 - USB Universal Host Controller [B-0]
                  
      Offset 000:  86 80 30 28  05 00 80 02  02 00 03 0C  00 00 80 00 
      Offset 010:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 020:  01 B8 00 00  00 00 00 00  00 00 00 00  62 14 35 72 
      Offset 030:  00 00 00 00  00 00 00 00  00 00 00 00  17 01 00 00 
      Offset 040:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 050:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 060:  10 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 070:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 080:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 090:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0A0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0B0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0C0:  00 2F 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0E0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0F0:  00 00 00 00  00 00 00 00  86 0F 03 00  00 00 00 00 

    B00 D1D F01:  Intel 82801HB ICH8 - USB Universal Host Controller [B-0]
                  
      Offset 000:  86 80 31 28  05 00 80 02  02 00 03 0C  00 00 00 00 
      Offset 010:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 020:  81 B4 00 00  00 00 00 00  00 00 00 00  62 14 35 72 
      Offset 030:  00 00 00 00  00 00 00 00  00 00 00 00  13 02 00 00 
      Offset 040:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 050:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 060:  10 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 070:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 080:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 090:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0A0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0B0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0C0:  00 2F 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0E0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0F0:  00 00 00 00  00 00 00 00  86 0F 03 00  00 00 00 00 

    B00 D1D F02:  Intel 82801HB ICH8 - USB Universal Host Controller [B-0]
                  
      Offset 000:  86 80 32 28  05 00 80 02  02 00 03 0C  00 00 00 00 
      Offset 010:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 020:  01 B4 00 00  00 00 00 00  00 00 00 00  62 14 35 72 
      Offset 030:  00 00 00 00  00 00 00 00  00 00 00 00  12 03 00 00 
      Offset 040:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 050:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 060:  10 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 070:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 080:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 090:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0A0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0B0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0C0:  00 2F 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0E0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0F0:  00 00 00 00  00 00 00 00  86 0F 03 00  00 00 00 00 

    B00 D1D F07:  Intel 82801HB ICH8 - USB2 Enhanced Host Controller [B-0]
                  
      Offset 000:  86 80 36 28  06 00 90 02  02 20 03 0C  00 00 00 00 
      Offset 010:  00 F8 FF F9  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 020:  00 00 00 00  00 00 00 00  00 00 00 00  62 14 35 72 
      Offset 030:  00 00 00 00  50 00 00 00  00 00 00 00  17 01 00 00 
      Offset 040:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 050:  01 58 C2 C9  00 00 00 00  0A 00 A0 20  00 00 00 00 
      Offset 060:  20 20 FF 01  00 00 00 00  01 00 00 00  00 00 00 C0 
      Offset 070:  00 00 DD 3F  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 080:  00 00 00 00  01 00 00 00  00 00 00 00  00 00 00 00 
      Offset 090:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0A0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0B0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0C0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  00 00 00 00  00 AA FF 00  00 00 00 00  00 00 00 00 
      Offset 0E0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0F0:  00 00 00 00  88 85 40 00  86 0F 03 00  06 17 02 20 

    B00 D1E F00:  Intel 82801HB I/O Controller Hub 8 (ICH8) [B-0]
                  
      Offset 000:  86 80 4E 24  07 01 10 00  F2 01 04 06  00 00 01 00 
      Offset 010:  00 00 00 00  00 00 00 00  00 04 04 20  E0 E0 80 22 
      Offset 020:  B0 FE B0 FE  F1 FF 01 00  00 00 00 00  00 00 00 00 
      Offset 030:  00 00 00 00  50 00 00 00  00 00 00 00  FF 00 02 00 
      Offset 040:  00 00 00 00  00 00 00 00  00 00 00 00  00 12 00 00 
      Offset 050:  0D 00 00 00  62 14 35 72  00 00 00 00  00 00 00 00 
      Offset 060:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 070:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 080:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 090:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0A0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0B0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0C0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0E0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0F0:  00 00 00 00  00 00 00 00  86 0F 03 00  00 00 00 00 

    B00 D1F F00:  Intel 82801HB ICH8 - LPC Bridge [B-0]
                  
      Offset 000:  86 80 10 28  07 00 10 02  02 00 01 06  00 00 80 00 
      Offset 010:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 020:  00 00 00 00  00 00 00 00  00 00 00 00  62 14 35 72 
      Offset 030:  00 00 00 00  E0 00 00 00  00 00 00 00  00 00 00 00 
      Offset 040:  01 08 00 00  80 00 00 00  81 04 00 00  10 00 00 00 
      Offset 050:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 060:  8A 8B 8E 85  D0 00 00 00  8B 8F 83 8A  00 00 00 00 
      Offset 070:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 080:  00 00 0D 24  01 0A FC 00  00 00 00 00  00 00 00 00 
      Offset 090:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0A0:  20 06 00 00  38 00 00 00  13 00 00 00  00 03 00 00 
      Offset 0B0:  00 00 F0 00  00 00 00 00  00 00 02 00  00 00 00 00 
      Offset 0C0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  33 22 11 00  67 45 00 00  C0 C0 00 00  00 00 00 00 
      Offset 0E0:  09 00 0C 10  21 00 04 CA  60 00 00 00  00 00 00 00 
      Offset 0F0:  01 C0 D1 FE  45 29 37 00  86 0F 03 00  00 00 00 00 

    B00 D1F F02:  Intel 82801HB ICH8 - 4-port SATA Controller [B-0]
                  
      Offset 000:  86 80 20 28  05 00 B0 02  02 8F 01 01  00 00 00 00 
      Offset 010:  81 B0 00 00  01 B0 00 00  01 AC 00 00  81 A8 00 00 
      Offset 020:  01 A8 00 00  81 A4 00 00  00 00 00 00  62 14 35 72 
      Offset 030:  00 00 00 00  70 00 00 00  00 00 00 00  13 02 00 00 
      Offset 040:  00 80 07 E3  00 00 00 00  04 00 00 01  00 00 00 00 
      Offset 050:  00 00 00 00  C0 40 00 00  00 00 00 00  00 00 00 00 
      Offset 060:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 070:  01 00 03 40  08 00 00 00  00 00 00 00  00 00 00 00 
      Offset 080:  05 70 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 090:  00 00 03 82  80 01 00 00  00 00 00 00  01 00 00 00 
      Offset 0A0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0B0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0C0:  00 00 00 00  05 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0E0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0F0:  00 00 00 00  00 00 00 00  86 0F 03 00  00 00 00 00 

    B00 D1F F03:  Intel 82801HB ICH8 - SMBus Controller [B-0]
                  
      Offset 000:  86 80 3E 28  03 00 80 02  02 00 05 0C  00 00 00 00 
      Offset 010:  00 F4 FF F9  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 020:  01 04 00 00  00 00 00 00  00 00 00 00  62 14 35 72 
      Offset 030:  00 00 00 00  00 00 00 00  00 00 00 00  05 03 00 00 
      Offset 040:  01 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 050:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 060:  03 04 04 00  00 00 08 08  00 00 00 00  00 00 00 00 
      Offset 070:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 080:  04 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 090:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0A0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0B0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0C0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0E0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0F0:  00 00 00 00  00 00 00 00  86 0F 03 00  00 00 00 00 

    B00 D1F F05:  Intel 82801HB ICH8 - 2-port SATA Controller [B-0]
                  
      Offset 000:  86 80 25 28  05 00 B0 02  02 85 01 01  00 00 00 00 
      Offset 010:  81 A0 00 00  01 A0 00 00  01 9C 00 00  81 98 00 00 
      Offset 020:  01 98 00 00  81 94 00 00  00 00 00 00  62 14 35 72 
      Offset 030:  00 00 00 00  70 00 00 00  00 00 00 00  13 02 00 00 
      Offset 040:  07 E3 03 E3  00 00 00 00  05 00 01 01  00 00 00 00 
      Offset 050:  00 00 00 00  F0 50 00 00  00 00 00 00  00 00 00 00 
      Offset 060:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 070:  01 00 03 40  08 00 00 00  00 00 00 00  00 00 00 00 
      Offset 080:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 090:  00 00 03 03  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0A0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0B0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0C0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0E0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0F0:  00 00 00 00  00 00 00 00  86 0F 03 00  00 00 00 00 

    B01 D00 F00:  nVIDIA GeForce 9800 GTX+ Video Adapter
                  
      Offset 000:  DE 10 13 06  07 00 10 00  A2 00 00 03  08 00 00 00 
      Offset 010:  00 00 00 FD  0C 00 00 D0  00 00 00 00  04 00 00 FA 
      Offset 020:  00 00 00 00  01 CC 00 00  00 00 00 00  00 00 00 00 
      Offset 030:  00 00 00 00  60 00 00 00  00 00 00 00  10 01 00 00 
      Offset 040:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 050:  01 00 00 00  01 00 00 00  CE D6 23 00  00 00 00 00 
      Offset 060:  01 68 03 00  08 00 00 00  05 78 80 00  00 00 00 00 
      Offset 070:  00 00 00 00  00 00 00 00  10 00 02 00  E0 84 2C 01 
      Offset 080:  10 29 00 00  01 3D 00 00  40 00 01 11  00 00 00 00 
      Offset 090:  00 00 00 00  00 00 00 00  00 00 00 00  10 00 00 00 
      Offset 0A0:  00 00 00 00  00 00 00 00  01 00 00 00  00 00 00 00 
      Offset 0B0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0C0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0E0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0F0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 

    B03 D00 F00:  Marvell 88SE6121 Serial ATA II Host Controller
                  
      Offset 000:  AB 11 21 61  07 00 10 00  B1 8F 01 01  08 00 00 00 
      Offset 010:  01 DC 00 00  81 D8 00 00  01 D8 00 00  81 D4 00 00 
      Offset 020:  01 D4 00 00  00 FC AF FE  00 00 00 00  AB 11 21 61 
      Offset 030:  00 00 00 00  48 00 00 00  00 00 00 00  11 01 00 00 
      Offset 040:  24 C9 C0 00  1F 80 00 00  01 50 02 5A  00 20 00 13 
      Offset 050:  05 E0 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 060:  50 C4 21 40  B0 00 00 00  00 00 00 00  00 00 00 00 
      Offset 070:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 080:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 090:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0A0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0B0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0C0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0E0:  10 00 11 00  C0 0F 0C 00  07 24 00 00  11 A4 03 00 
      Offset 0F0:  40 00 11 10  00 00 00 00  00 00 00 00  00 00 00 00 

    B04 D02 F00:  Realtek RTL8169/8110 Gigabit Ethernet Adapter
                  
      Offset 000:  EC 10 67 81  17 00 B0 02  10 00 00 02  08 40 00 00 
      Offset 010:  01 E8 00 00  00 FC BF FE  00 00 00 00  00 00 00 00 
      Offset 020:  00 00 00 00  00 00 00 00  00 00 00 00  62 14 5C 23 
      Offset 030:  00 00 00 00  DC 00 00 00  00 00 00 00  15 01 20 40 
      Offset 040:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 050:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 060:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 070:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 080:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 090:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0A0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0B0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0C0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  00 00 00 00  00 00 00 00  00 00 00 00  01 00 C2 F7 
      Offset 0E0:  00 01 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0F0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 

    B04 D03 F00:  VIA VT6306/6307 Fire II IEEE1394 Host Controller
                  
      Offset 000:  06 11 44 30  17 00 10 02  C0 10 00 0C  08 40 00 00 
      Offset 010:  00 F0 BF FE  01 EC 00 00  00 00 00 00  00 00 00 00 
      Offset 020:  00 00 00 00  00 00 00 00  00 00 00 00  62 14 5D 23 
      Offset 030:  00 00 00 00  50 00 00 00  00 00 00 00  14 01 00 20 
      Offset 040:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 050:  01 00 02 E4  00 00 00 00  00 00 00 00  62 14 00 03 
      Offset 060:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 070:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 080:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 090:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0A0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0B0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0C0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0D0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0E0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 0F0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 

    PCI-8086-29A0:  Intel i946/965 MCHBAR
                  
      Offset 200:  10 00 20 00  28 00 28 00  86 86 02 00  00 00 00 00 
      Offset 210:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 220:  00 00 00 00  02 01 08 04  00 00 00 00  04 02 01 08 
      Offset 230:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 02 08 
      Offset 240:  00 10 01 00  10 23 15 00  00 0D 04 08  00 11 01 00 
      Offset 250:  11 63 22 8A  86 02 68 44  46 55 04 22  0A 00 F5 15 
      Offset 260:  90 0D 76 0B  FF 00 0E 13  00 20 C8 CF  31 18 02 00 
      Offset 270:  00 1E 55 01  00 A9 08 00  82 10 23 08  31 01 00 00 
      Offset 280:  00 00 00 00  00 00 00 00  00 02 04 08  10 20 40 FF 
      Offset 290:  1C 09 F2 04  00 00 00 00  35 14 B0 10  00 22 34 00 

    PCI-8086-29A0:  Intel i946/965 MCHBAR
                  
      Offset 600:  10 00 20 00  24 00 24 00  86 86 03 00  00 00 00 00 
      Offset 610:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset 620:  00 00 00 00  02 01 08 04  00 00 00 00  04 02 01 08 
      Offset 630:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 02 08 
      Offset 640:  00 10 01 00  10 23 35 00  00 0D 04 08  00 11 01 00 
      Offset 650:  11 63 22 8A  86 02 68 44  46 55 04 22  0A 00 F5 15 
      Offset 660:  90 0D 76 0B  FF 00 0E 13  00 20 C8 CF  31 18 02 00 
      Offset 670:  00 1E 55 01  00 A9 08 00  82 10 23 08  31 01 00 00 
      Offset 680:  00 00 00 00  00 00 00 00  00 02 04 08  10 20 40 FF 
      Offset 690:  1C 09 F2 04  00 00 00 00  35 14 B0 10  00 22 34 00 

    PCI-8086-29A0:  Intel i946/965 MCHBAR
                  
      Offset C00:  10 04 00 40  0F 0F 0F 0F  80 00 00 00  00 00 00 00 
      Offset C10:  00 00 00 00  00 00 00 00  00 00 00 00  00 80 00 00 
      Offset C20:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset C30:  01 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset C40:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset C50:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset C60:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset C70:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset C80:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset C90:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset CA0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset CB0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset CC0:  00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00 
      Offset CD0:  01 01 01 01  00 00 00 00  01 00 00 FF  00 00 00 00 
      Offset CE0:  00 00 00 00  00 00 80 00  00 00 00 00  00 00 00 00 
      Offset CF0:  00 00 00 00  03 00 00 00  00 00 00 00  00 00 00 00 


--------[ Debug - Video BIOS ]------------------------------------------------------------------------------------------

    C000:0000  U.i.K7400.L.w.VIDEO ..........IBM VGA Compatible......(.12/19/08
    C000:0040  ..................4........o..........."..2.g..n.PMIDl.o.......
    C000:0080  .....3b.M...|.......;.......................-.....s...@.@...1...
    C000:00C0  ....Q......`....".......................HWEANVIDIA GeForce 9800 
    C000:0100  GTX+ VGA BIOS................................................Ver
    C000:0140  sion 62.92.6D.00.N1 ...Copyright (C) 1996-2008 NVIDIA Corp......
    C000:0180  ...C....G92 Board - 03920051...............Chip Rev   ..........
    C000:01C0  ................................................PCIR............
    C000:0200  i.......HYB$..BIT......E2.....B.....C.....D.....A.....I.....L...
    C000:0240  ..M.....N.....P.....S.....T.....U.....V.....c.....x...#.d...'.i.
    C000:0280  (.)...Q....... ..........m.b..................\\............$..L
    C000:02C0  ..........0.6.N...L.0...p...~....V.e.9...............m.......B.
    C000:0300  .....P=..W.(.....#..#.....J...............m.b.......*...11/10/08
    C000:0340  ..........8.................Z.S.............b..... .........Z.S.
    C000:0380  ........,.......1.......5...........G.....L...Z...Q...Z....... .
    C000:03C0  ..................a.....u.f...............n.....q.....t.m.6...x.


--------[ Debug - Unknown ]---------------------------------------------------------------------------------------------

    Optical         HL-DT-ST DVD-RAM GH82N ATA Device


------------------------------------------------------------------------------------------------------------------------

The names of actual companies and products mentioned herein may be the trademarks of their respective owners.
