------[ EVEREST Ultimate Edition ]------Version EVEREST v5.01.1700 Benchmark Module 2.4.258.0 Homepage http://www.lavalys.com/ Report Type Report Wizard EMOVHICRN Generator Vic Tiangco Operating Ultima te 6.1.7601 Date 2013-08-19 Time 23:24

------[ Summary ]------Computer: Computer Type ACPI x86-based PC (Mobi le) Operating System 7 Ulti mate OS Service Pack Service Pack 1 8.0.7601.17514 DirectX DirectX 10.1 Computer Name EMOVHICRN User Name Vic Tiangco Logon Domain emovhicRN Date / Time 2013-08-19 / 23:24 Motherboard: CPU Type Mobile Intel Pentium M 7 70, 2133 MHz (16 x 133) Motherboard Name Hewlett-Packard HP 510 N otebook PC (RU964AA#ABU) Motherboard Chipset Mobile Intel Alviso-G i9 15GM System Memory 1015 MB (DDR2-800 DDR2 SDRAM) DIMM1: Nanya M2N1G64TUH8D5F-AC 1 GB DDR2-800 DDR2 SDRAM (5-5-5-18 @ 400 MHz) (4-4-4-12 @ 266 MHz) (3-3-3-9 @ 200 MHz) BIOS Type Compaq (10/31/06) Communication Port Printer Port (LPT1) Display: Video Adapter Mobile Intel(R) 915GM/GM S,910GML Express Chipset Family (128 MB) Video Adapter Mobile Intel(R) 915GM/GM S,910GML Express Chipset Family (128 MB) 3D Accelerator Intel GMA 900 Monitor Chi Mei N154I2-L02 [15. 4" LCD] Monitor Chi Mei N154I2-L02 [15. 4" LCD] Monitor Chi Mei N154I2-L02 [15. 4" LCD] Multimedia: Audio Adapter Conexant Cx20468 @ Intel 82801FBM ICH6-M - AC'97 Audio Controller [B-1] Storage: IDE Controller Intel(R) 82801FB/FBM Ult ra ATA Storage Controllers - 266F Disk Drive ST950032 5AS USB Device (500 GB, 5400 RPM, SATA-II) Disk Drive WDC WD600UE-22KVT0 ATA D evice (55 GB, IDE) Optical Drive DTSOFT Virtual CdRom Dev ice Optical Drive HL-DT-ST DVDRAM GSA-T10N ATA Device (DVD+R9:4x, DVD-R9:4x, DVD+RW:8x/8x, DVD-RW:8x/6x, DVD-RAM:5x, DVD- ROM:8x, CD:24x/24x/24x DVD+RW/DVD-RW/DVD-RAM) SMART Hard Disks Status OK Partitions: C: (NTFS) 27129 MB (9847 MB free) D: (NTFS) 29998 MB (29758 MB free) G: (NTFS) 465.8 GB (104.2 GB free) Total Size 521.5 GB (142.9 GB free) Input: Keyboard HID Keyboard Device Keyboard Standard PS/2 Keyboard Mouse HID-compliant mouse Mouse PS/2 Compatible Mouse Network: Primary IP Address 192.168.43.3 Primary MAC Address 00-16-6F-C7-55-78 Network Adapter Intel(R) PRO/100 VE Netw ork Connection Network Adapter Intel(R) PRO/Wireless 22 00BG Network Connection (192.168.43.3) Modem Motorola SM56 Data Fax M odem Peripherals: Printer Canon MP250 series Print er Printer Fax Printer Microsoft XPS Document W riter Printer Universal Document Conve rter USB1 Controller Intel 82801FBM ICH6-M - USB Universal Host Controller [B-1] USB2 Controller Intel 82801FBM ICH6-M - Enhanced USB2 Controller [B-1] USB Device Generic USB Hub USB Device Generic USB Hub USB Device Unknown Device USB Device USB Input Device USB Device USB Mass Storage Device Battery Microsoft AC Adapter Battery Microsoft ACPI-Compliant Control Method Battery Battery Microsoft Composite Batt ery DMI: DMI BIOS Vendor Hewlett-Packard DMI BIOS Version 68DTV Ver. F.05 DMI System Manufacturer Hewlett-Packard DMI System Product HP 510 Notebook PC (RU96 4AA#ABU) DMI System Version F.05 DMI System Serial Number CND7062SWD DMI System UUID 5505F427-A3BADB11-599866 99-0E0E3529 DMI Motherboard Manufacturer Hewlett-Packard DMI Motherboard Product 30C4 DMI Motherboard Version KBC Version 77.16 DMI Motherboard Serial Number DMI Chassis Manufacturer Hewlett-Packard DMI Chassis Version DMI Chassis Serial Number CND7062SWD DMI Chassis Asset Tag DMI Chassis Type Notebook

------[ Computer Name ]------Computer Comment Logical NetBIOS Name Logical EMOVHICRN DNS Host Name Logical emovhicRN DNS Domain Name Logical Fully Qualified DNS Name Logical emovhicRN NetBIOS Name Physical EMOVHICRN DNS Host Name Physical emovhicRN DNS Domain Name Physical Fully Qualified DNS Name Physical emovhicRN

------[ DMI ]------[ BIOS ] BIOS Properties: Vendor Hewlett-Packard Version 68DTV Ver. F.05 Release Date 10/31/2006 Size 576 KB Boot Devices Floppy Disk, Hard Disk, CD-ROM, LS-120 Capabilities Flash BIOS, Shadow BIOS, Selectable Boot, EDD, BBS, Smart Battery Supported Standards DMI, ACPI, PnP Expansion Capabilities PCI, PCMCIA, USB [ System ] System Properties: Manufacturer Hewlett-Packard Product HP 510 Notebook PC (RU96 4AA#ABU) Version F.05 Serial Number CND7062SWD Universal Unique ID 5505F427-A3BADB11-599866 99-0E0E3529 Wake-Up Type Power Switch [ Motherboard ] Motherboard Properties: Manufacturer Hewlett-Packard Product 30C4 Version KBC Version 77.16 [ Chassis ] Chassis Properties: Manufacturer Hewlett-Packard Serial Number CND7062SWD Chassis Type Notebook [ Processors / Intel(R) Pentium(R) M processor 2.13GHz ] Processor Properties: Manufacturer Intel(R) Version Intel(R) Pentium(R) M pr ocessor 2.13GHz External Clock 133 MHz Maximum Clock 2133 MHz Current Clock 2133 MHz Type Central Processor Voltage 1.1 V Status Enabled Upgrade None Socket Designation JP12 [ Caches / Internal L1 Cache ] Cache Properties: Type Internal Status Enabled Operational Mode Write-Back Associativity 4-way Set-Associative Maximum Size 64 KB Installed Size 64 KB Supported SRAM Type Burst Current SRAM Type Burst Socket Designation Internal L1 Cache [ Caches / Internal L2 Cache ] Cache Properties: Type External Status Enabled Operational Mode Write-Back Associativity 4-way Set-Associative Maximum Size 2048 KB Installed Size 2048 KB Supported SRAM Type Burst Current SRAM Type Burst Error Correction None Socket Designation Internal L2 Cache [ Memory Devices / DIMM #1 ] Memory Device Properties: Form Factor SODIMM Type DDR2 Type Detail Synchronous Size 1024 MB Speed 975 MHz Total Width 64-bit Data Width 64-bit Device Locator DIMM #1 Manufacturer 7F7F7F0B00000000 Serial Number C4013857 Part Number M2N1G64TUH8D5F-AC [ System Slots / PC CARD-Slot 0 ] System Slot Properties: Slot Designation PC CARD-Slot 0 Type PC Card (PCMCIA) Usage Empty Data Bus Width 32-bit Length Short [ On-Board Devices / 8 ] On-Board Device Properties: Description 8 Type Video Status Enabled [ Miscellaneous ] Miscellaneous: OEM String www.hp.com OEM String ABS 70/71 79 7A 7B 7C

------[ Overclock ]------CPU Properties: CPU Type Mobile Intel Pentium M 7 70 CPU Alias Dothan CPU Stepping C0 Engineering Sample No CPUID CPU Name Intel(R) Pentium(R) M pr ocessor 2.13GHz CPUID Revision 000006D8h CPU VID 1.3560 V CPU Speed: CPU Clock 2128.0 MHz (original: 2 133 MHz) CPU Multiplier 16x CPU FSB 133.0 MHz (original: 13 3 MHz) Memory Bus 266.0 MHz DRAM:FSB Ratio 8:4 CPU Cache: L1 Code Cache 32 KB L1 Data Cache 32 KB L2 Cache 2 MB (On-Die, ECC, Full -Speed) Motherboard Properties: Motherboard ID Motherboard Name Hewlett-Packard HP 510 N otebook PC (RU964AA#ABU) Chipset Properties: Motherboard Chipset Mobile Intel Alviso-G i9 15GM Memory Timings 4-4-4-12 (CL-RCD-RP-RAS ) DIMM1: Nanya M2N1G64TUH8D5F-AC 1 GB DDR2-800 DDR2 SDRAM (5-5-5-18 @ 400 MHz) (4-4-4-12 @ 266 MHz) (3-3-3-9 @ 200 MHz) BIOS Properties: System BIOS Date 10/31/06 Video BIOS Date Unknown DMI BIOS Version 68DTV Ver. F.05 Graphics Processor Properties: Video Adapter Intel 82915GM Graphics C ontroller 0 GPU Code Name Alviso-GM (Integrated 8 086 / 2592, Rev 03)

------[ Power Management ]------Power Management Properties: Current Power Source AC Line Battery Status No Battery Full Battery Lifetime Unknown Remaining Battery Lifetime Unknown

------[ Portable Computer ]------Centrino (Carmel) Platform Compliancy: CPU: Intel Pentium M (Banias/Dothan) Yes (Mobile Intel Penti um M 770) Chipset: Intel i855GM/PM No (Mobile Intel Alviso -G i915GM) WLAN: Intel PRO/Wireless Yes System: Centrino Compliant No Centrino (Sonoma) Platform Compliancy: CPU: Intel Pentium M (Dothan) Yes (Mobile Intel Penti um M 770) Chipset: Intel i915GM/PM Yes (Mobile Intel Alvis o-G i915GM) WLAN: Intel PRO/Wireless Yes System: Centrino Compliant Yes Centrino (Napa) Platform Compliancy: CPU: Intel Core (Yonah) / Core 2 (Merom) No (Mobile Intel Pentiu m M 770) Chipset: Intel i945GM/PM No (Mobile Intel Alviso -G i915GM) WLAN: Intel PRO/Wireless 3945 No System: Centrino Compliant No Centrino (Santa Rosa) Platform Compliancy: CPU: Intel Core 2 (Merom/Penryn) No (Mobile Intel Pentiu m M 770) Chipset: Intel GM965/PM965 No (Mobile Intel Alviso -G i915GM) WLAN: Intel Wireless WiFi Link 4965 No System: Centrino Compliant No Centrino (Montevina) Platform Compliancy: CPU: Intel Core 2 (Penryn) No (Mobile Intel Pentiu m M 770) Chipset: Intel GM45/GM47/GS45/PM45 No (Mobile Intel Alviso -G i915GM) WLAN: Intel WiFi Link 5000 Series No System: Centrino Compliant No

------[ Sensor ]------Sensor Properties: Sensor Type CPU, HDD, ACPI Temperatures: CPU 50 °C (122 °F) WDC WD600UE-22KVT0 43 °C (109 °F) Seagate ST9500325AS 31 °C (88 °F) Voltage Values: CPU Core 1.36 V

------[ CPU ]------CPU Properties: CPU Type Mobile Intel Pentium M 7 70, 2133 MHz (16 x 133) CPU Alias Dothan CPU Stepping C0 Instruction Set x86, MMX, SSE, SSE2 Original Clock 2133 MHz Min / Max CPU Multiplier 6x / 16x Engineering Sample No L1 Code Cache 32 KB L1 Data Cache 32 KB L2 Cache 2 MB (On-Die, ECC, Full -Speed) CPU Physical Info: Package Type 479 Ball uFCBGA / 478 Pi n uFCPGA Package Size 3.5 cm x 3.5 cm Transistors 140 million Process Technology 7M, 90 nm, CMOS, Cu, Low -K Inter-Layer, High-K Gate, Strained Si Die Size 88 mm2 Core Voltage 0.988 - 1.356 V I/O Voltage 0.988 - 1.356 V Typical Power 3.0 - 21.0 W (depending on clock speed) Maximum Power 3.3 - 28.1 W (depending on clock speed) CPU Manufacturer: Company Name Intel Corporation Product Information http://www.intel.com/pro ducts/processor CPU Utilization: CPU #1 33 %

------[ CPUID ]------CPUID Properties: CPUID Manufacturer GenuineIntel CPUID CPU Name Intel(R) Pentium(R) M pr ocessor 2.13GHz CPUID Revision 000006D8h IA Brand ID 16h (Intel Pentium M) Platform ID 05h / MC 20h (Mobile uP GA2) Microcode Update Revision 20 HTT / CMP Units 0 / 0 Instruction Set: 64-bit x86 Extension (AMD64, Intel64) Not Supported AMD 3DNow! Not Supported AMD 3DNow! Professional Not Supported AMD 3DNowPrefetch Not Supported AMD Enhanced 3DNow! Not Supported AMD Extended MMX Not Supported AMD MisAligned SSE Not Supported AMD SSE4A Not Supported AMD SSE5 Not Supported Cyrix Extended MMX Not Supported IA-64 Not Supported IA MMX Supported IA SSE Supported IA SSE 2 Supported IA SSE 3 Not Supported IA Supplemental SSE 3 Not Supported IA SSE 4.1 Not Supported IA SSE 4.2 Not Supported IA AVX Not Supported IA FMA Not Supported IA AES Extensions Not Supported VIA Alternate Instruction Set Not Supported CLFLUSH Instruction Supported CMPXCHG8B Instruction Supported CMPXCHG16B Instruction Not Supported Conditional Move Instruction Supported LZCNT Instruction Not Supported MONITOR / MWAIT Instruction Not Supported MOVBE Instruction Not Supported PCLMULQDQ Instruction Not Supported POPCNT Instruction Not Supported RDTSCP Instruction Not Supported SYSCALL / SYSRET Instruction Not Supported SYSENTER / SYSEXIT Instruction Supported VIA FEMMS Instruction Not Supported Security Features: Advanced Cryptography Engine (ACE) Not Supported Advanced Cryptography Engine 2 (ACE2) Not Supported Data Execution Prevention (DEP, NX, EDB) Supported Hardware Random Number Generator (RNG) Not Supported PadLock Hash Engine (PHE) Not Supported PadLock Montgomery Multiplier (PMM) Not Supported Processor Serial Number (PSN) Not Supported Power Management Features: Automatic Clock Control Supported Digital Thermometer Not Supported Dynamic FSB Frequency Switching Not Supported Enhanced Halt State (C1E) Not Supported Enhanced SpeedStep Technology (EIST, ESS) Supported, Enabled Frequency ID Control Not Supported Hardware P-State Control Not Supported LongRun Not Supported LongRun Table Interface Not Supported PowerSaver 1.0 Not Supported PowerSaver 2.0 Not Supported PowerSaver 3.0 Not Supported Processor Duty Cycle Control Supported Software Thermal Control Not Supported Temperature Sensing Diode Not Supported Thermal Monitor 1 Supported Thermal Monitor 2 Supported Thermal Monitoring Not Supported Thermal Trip Not Supported Voltage ID Control Not Supported CPUID Features: 1 GB Page Size Not Supported 36-bit Page Size Extension Not Supported Address Region Registers (ARR) Not Supported CPL Qualified Debug Store Not Supported Debug Trace Store Supported Debugging Extension Supported Direct Cache Access Not Supported Dynamic Acceleration Technology (IDA) Not Supported Fast Save & Restore Supported Hyper-Threading Technology (HTT) Not Supported Invariant Time Stamp Counter Not Supported L1 Context ID Not Supported Local APIC On Chip Supported Machine Check Architecture (MCA) Supported Machine Check Exception (MCE) Supported Memory Configuration Registers (MCR) Not Supported Memory Type Range Registers (MTRR) Supported Model Specific Registers (MSR) Supported Nested Paging Not Supported Page Attribute Table (PAT) Supported Page Global Extension Supported Page Size Extension (PSE) Supported Pending Break Event Supported Physical Address Extension (PAE) Supported Safer Mode Extensions (SMX) Not Supported Secure Virtual Machine Extensions (Pacifica) Not Supported Self-Snoop Supported Time Stamp Counter (TSC) Supported Turbo Boost Not Supported Virtual Machine Extensions (Vanderpool) Not Supported Virtual Mode Extension Supported x2APIC Not Supported XSAVE / XRSTOR Extended States Not Supported CPUID Registers (CPU #1): CPUID 00000000 00000002-756E6547-6C6574 6E-49656E69 CPUID 00000001 000006D8-00000816-000001 80-AFE9FBFF CPUID 00000002 02B3B001-000000F0-000000 00-2C04307D CPUID 80000000 80000008-00000000-000000 00-00000000 CPUID 80000001 00000000-00000000-000000 00-00100000 CPUID 80000002 20202020-20202020-65746E 49-2952286C CPUID 80000003 6E655020-6D756974-202952 28-7270204D CPUID 80000004 7365636F-20726F73-33312E 32-007A4847 CPUID 80000005 00000000-00000000-000000 00-00000000 CPUID 80000006 00000000-00000000-080060 40-00000000 CPUID 80000007 00000000-00000000-000000 00-00000000 CPUID 80000008 00002020-00000000-000000 00-00000000 MSR Registers: MSR 00000017 0014-0000-D024-8829 [Pla tID = 5] MSR 0000001B 0000-0000-FEC0-1900 MSR 0000002A 0000-0000-4408-0000 MSR 0000008B 0000-0020-0000-0000 MSR 000000CD 0000-0000-0000-0311 MSR 000000CE 2912-1000-0000-0311 MSR 0000011E 0000-0000-0034-272B MSR 00000198 0612-1029-0600-1029 MSR 00000199 0000-0000-0000-1029 MSR 0000019A 0000-0000-0000-0002 MSR 0000019B 0000-0000-0000-0000 MSR 0000019C 0000-0000-0000-0000 MSR 0000019D 0000-0000-0001-0612 MSR 000001A0 0000-0000-0011-1488

------[ Motherboard ]------Motherboard Properties: Motherboard ID Motherboard Name Hewlett-Packard HP 510 N otebook PC (RU964AA#ABU) Front Side Bus Properties: Bus Type Intel AGTL+ Bus Width 64-bit Real Clock 133 MHz (QDR) Effective Clock 533 MHz Bandwidth 4266 MB/s Memory Bus Properties: Bus Type DDR2 SDRAM Bus Width 64-bit DRAM:FSB Ratio 8:4 Real Clock 267 MHz (DDR) Effective Clock 533 MHz Bandwidth 4266 MB/s Chipset Bus Properties: Bus Type Intel Direct Media Inter face

------[ Memory ]------Physical Memory: Total 1015 MB Used 754 MB Free 261 MB Utilization 74 % Swap Space: Total 4015 MB Used 1050 MB Free 2964 MB Utilization 26 % Virtual Memory: Total 5030 MB Used 1805 MB Free 3225 MB Utilization 36 % Paging File: Paging File C:\pagefile.sys Initial / Maximum Size 3000 MB / 3000 MB Current Size 3000 MB Current / Peak Usage 272 MB / 352 MB Utilization 9 % Physical Address Extension (PAE): Supported by Operating System Yes Supported by CPU Yes Active Yes

------[ SPD ]------[ DIMM1: Nanya M2N1G64TUH8D5F-AC ] Memory Module Properties: Module Name Nanya M2N1G64TUH8D5F-AC Serial Number C4013857h (1463288260) Manufacture Date Week 18 / 2009 Module Size 1 GB (2 ranks, 8 banks) Module Type SO-DIMM Memory Type DDR2 SDRAM Memory Speed DDR2-800 (400 MHz) Module Width 64 bit Module Voltage SSTL 1.8 Error Detection Method None Refresh Rate Reduced (7.8 us), Self-R efresh Memory Timings: @ 400 MHz 5-5-5-18 (CL-RCD-RP-RAS ) / 23-51-4-6-3-3 (RC-RFC-RRD-WR-WTR-RTP) @ 266 MHz 4-4-4-12 (CL-RCD-RP-RAS ) / 16-34-3-4-2-2 (RC-RFC-RRD-WR-WTR-RTP) @ 200 MHz 3-3-3-9 (CL-RCD-RP-RAS) / 12-26-2-3-2-2 (RC-RFC-RRD-WR-WTR-RTP) Memory Module Features: Analysis Probe Not Present FET Switch External Disabled Weak Driver Supported Memory Module Manufacturer: Company Name Nanya Technology Corp. Product Information http://www.nanya.com/ind ex.aspx

------[ Chipset ]------[ North Bridge: Mobile Intel Alviso-G i915GM ] North Bridge Properties: North Bridge Mobile Intel Alviso-G i9 15GM Intel Platform Sonoma Supported FSB Speeds FSB400, FSB533 Supported Memory Types DDR-333 SDRAM, DDR2-400 SDRAM, DDR2-533 SDRAM Maximum Memory Amount 2 GB Revision / Stepping 03 / B1 Package Type 1257 Pin FC-BGA Package Size 3.75 cm x 4.00 cm Core Voltage 1.5 V In-Order Queue Depth 12 Memory Controller: Type Dual Channel (128-bit) Active Mode Single Channel (64-bit) Memory Timings: CAS Latency (CL) 4T RAS To CAS Delay (tRCD) 4T RAS Precharge (tRP) 4T RAS Active Time (tRAS) 12T Refresh Period (tREF) 7.8 us Error Correction: ECC Not Supported ChipKill ECC Not Supported RAID Not Supported ECC Scrubbing Not Supported Memory Slots: DRAM Slot #1 1 GB (DDR2-800 DDR2 SDR AM) Integrated Graphics Controller: Graphics Controller Type Intel GMA 900 Graphics Controller Status Enabled Graphics Frame Buffer Size 8 MB Chipset Manufacturer: Company Name Intel Corporation Product Information http://www.intel.com/pro ducts/chipsets Driver Download http://support.intel.com /support/chipsets BIOS Upgrades http://www.esupport.com/ biosagent/index.cfm?refererid=40 Driver Update http://driveragent.com?r ef=59 [ South Bridge: Intel 82801FBM ICH6-M ] South Bridge Properties: South Bridge Intel 82801FBM ICH6-M Intel Platform Sonoma Revision / Stepping D3 / B1 Package Type 609 Pin mBGA Package Size 3.1 cm x 3.1 cm Core Voltage 1.5 V AC'97 Audio Controller: Audio Controller Type Intel ICH6 Codec Name Conexant Cx20468 Codec ID 43585430h S/PDIF Output Supported MC'97 Modem Controller: Modem Controller Type Intel ICH6 Codec Name Unknown Codec ID FFFFFFFFh Chipset Manufacturer: Company Name Intel Corporation Product Information http://www.intel.com/pro ducts/chipsets Driver Download http://support.intel.com /support/chipsets BIOS Upgrades http://www.esupport.com/ biosagent/index.cfm?refererid=40 Driver Update http://driveragent.com?r ef=59

------[ BIOS ]------BIOS Properties: BIOS Type Compaq BIOS Version 68DTV Ver. F.05 Compaq BIOS Ownership Tag Unknown Compaq BIOS UUID Unknown System BIOS Date 10/31/06 Video BIOS Date Unknown BIOS Manufacturer: Company Name Hewlett-Packard Company Product Information http://www.compaq.com BIOS Upgrades http://www.esupport.com/ biosagent/index.cfm?refererid=40

------[ ACPI ]------[ APIC: Multiple APIC Description Table ] ACPI Table Properties: ACPI Signature APIC Table Description Multiple APIC Descriptio n Table Memory Address 3F7EFCB8h Table Length 90 bytes OEM ID HP OEM Table ID 30C4 OEM Revision 00000001h Creator ID HP Creator Revision 00000001h Local APIC Address FEC01000h [ DSDT: Differentiated System Description Table ] ACPI Table Properties: ACPI Signature DSDT Table Description Differentiated System De scription Table Memory Address 3F7EFD50h Table Length 26952 bytes OEM ID HP OEM Table ID DAU00 OEM Revision 00010000h Creator ID MSFT Creator Revision 0100000Eh [ FACP: Fixed ACPI Description Table ] ACPI Table Properties: ACPI Signature FACP Table Description Fixed ACPI Description T able Memory Address 3F7EFC00h Table Length 132 bytes OEM ID HP OEM Table ID 30C4 OEM Revision 00000002h Creator ID HP Creator Revision 00000001h SMI Command Port 000000B2h PM Timer 00001008h [ FACS: Firmware ACPI Control Structure ] ACPI Table Properties: ACPI Signature FACS Table Description Firmware ACPI Control St ructure Memory Address 3F7FAE80h Table Length 64 bytes [ MCFG: Memory Mapped Configuration Space Base Address Description Table ] ACPI Table Properties: ACPI Signature MCFG Table Description Memory Mapped Configurat ion Space Base Address Description Table Memory Address 3F7EFD14h Table Length 60 bytes OEM ID HP OEM Table ID 30C4 OEM Revision 00000001h Creator ID HP Creator Revision 00000001h [ RSD PTR: Root System Description Pointer ] ACPI Table Properties: ACPI Signature RSD PTR Table Description Root System Description Pointer Memory Address 000FE270h Table Length 36 bytes OEM ID HP [ RSDT: Root System Description Table ] ACPI Table Properties: ACPI Signature RSDT Table Description Root System Description Table Memory Address 3F7EFC84h Table Length 52 bytes OEM ID HP OEM Table ID 30C4 OEM Revision 31100620h Creator ID HP Creator Revision 00000001h [ SLIC: Software Licensing Description Table (Emulated) ] ACPI Table Properties: ACPI Signature SLIC Table Description Software Licensing Descr iption Table Memory Address Emulated Table Length 374 bytes OEM ID HPQOEM OEM Table ID SLIC-WKS Creator ID HPQ [ SSDT: Secondary System Description Table ] ACPI Table Properties: ACPI Signature SSDT Table Description Secondary System Descrip tion Table Memory Address 3F7F6698h Table Length 881 bytes OEM ID HP OEM Table ID HPQPpc OEM Revision 00001001h Creator ID MSFT Creator Revision 0100000Eh

------[ Operating System ]------Operating System Properties: OS Name Microsoft Windows 7 Ulti mate OS Language English (United States) OS Kernel Type Multiprocessor Free (32- bit) OS Version 6.1.7601 OS Service Pack Service Pack 1 OS Installation Date 8/19/2013 OS Root C:\Windows License Information: Registered Owner Vic Tiangco Registered Organization Product ID 00426-OEM-8992662-00010 Product Key MHFPT-8C8M2-V9488-FGM44- 2C9T3 Product Activation (WPA) Not Required Current Session: Computer Name EMOVHICRN User Name Vic Tiangco Logon Domain emovhicRN UpTime 20363 sec (0 days, 5 hou rs, 39 min, 23 sec) Components Version: Common Controls 6.16 .0.7601.17514 Windows Mail 6.1.7600.16385 (win7_rtm .090713-1255) Player 12.0.7600.16385 (win7_rt m.090713-1255) Windows Messenger - MSN Messenger - Internet Information Services (IIS) - .NET Framework 4.0.30319.17929 built by : FX45RTMREL Novell Client - DirectX DirectX 10.1 OpenGL 6.1.7600.16385 (win7_rtm .090713-1255) ASPI - Operating System Features: Debug Version No DBCS Version No Domain Controller No Security Present No Network Present Yes Remote Session No Safe Mode No Slow Processor No Services Yes

------[ Processes ]------DTShellHlp.exe C:\Program Files\DAEMON Tools Pro\DTShellHlp.exe 32-bit 3148 KB 2720 KB Dwm.exe C:\Windows\system32\Dwm.exe 32-bit 608 KB 940 KB everest.exe C:\Program Files\Lavalys\EVEREST Ultimate Edition\e verest.exe 32-bit 34156 KB 28008 KB Explorer.EXE C:\Windows\Explorer.EXE 32-bit 47988 KB 48680 KB firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe 32-bit 296 MB 308 MB FlashPlayerPlugin_11_8_800_115.exe C:\Windows\system32\Macromed\Flash\Flash PlayerPlugin_11_8_800_115.exe 32-bit 3912 KB 4524 KB FlashPlayerPlugin_11_8_800_115.exe C:\Windows\system32\Macromed\Flash\Flash PlayerPlugin_11_8_800_115.exe 32-bit 12648 KB 14612 KB IDMan.exe C:\Program Files\Internet Download Manager\IDMan.ex e 32-bit 13476 KB 7528 KB IEMonitor.exe C:\Program Files\Internet Download Manager\IEMonito r.exe 32-bit 3328 KB 1152 KB plugin-container.exe C:\Program Files\Mozilla Firefox\plugin-container.e xe 32-bit 3928 KB 12044 KB taskhost.exe C:\Windows\system32\taskhost.exe 32-bit 3644 KB 6832 KB taskhost.exe C:\Windows\system32\taskhost.exe 32-bit 1356 KB 2596 KB vlc.exe C:\Program Files\VideoLAN\VLC\vlc.exe 32-bit 21744 KB 27228 KB

------[ System Drivers ]------1394ohci 1394 OHCI Compliant Host Controller 1394ohci.sys 6.1.7601.17514 Kernel Driver Stopped ACPI Microsoft ACPI Driver ACPI.sys 6.1.7601.17514 Kernel Driver Running AcpiPmi ACPI Power Meter Driver acpipmi.sys 6.1.7601.17514 Kernel Driver Stopped adp94xx adp94xx adp94xx.sys 1.6.6.4 Kernel Driver Stopped adpahci adpahci adpahci.sys 1.6.6.1 Kernel Driver Stopped adpu320 adpu320 adpu320.sys 7.2.0.0 Kernel Driver Stopped AFD Ancillary Function Driver for afd.sys 6.1.7601.17514 Kernel Driver Running agp440 Intel AGP Bus Filter agp440.sys 6.1.7600.16385 Kernel Driver Stopped aic78xx aic78xx djsvs.sys 6.0.0.0 Kernel Driver Stopped aliide aliide aliide.sys 1.2.0.0 Kernel Driver Stopped amdagp AMD AGP Bus Filter Driver amdagp.sys 6.1.7600.16385 Kernel Driver Stopped amdide amdide amdide.sys 6.1.7600.16385 Kernel Driver Stopped AmdK8 AMD K8 Processor Driver amdk8.sys 6.1.7600.16385 Kernel Driver Stopped AmdPPM AMD Processor Driver amdppm.sys 6.1.7600.16385 Kernel Driver Stopped amdsata amdsata amdsata.sys 1.1.2.5 Kernel Driver Stopped amdsbs amdsbs amdsbs.sys 3.6.1540.127 Kernel Driver Stopped amdxata amdxata amdxata.sys 1.1.2.5 Kernel Driver Running AppID AppID Driver appid.sys 6.1.7601.17514 Kernel Driver Stopped arc arc arc.sys 5.2.0.10384 Kernel Driver Stopped arcsas arcsas arcsas.sys 5.2.0.16119 Kernel Driver Stopped AsyncMac RAS Asynchronous Media Driver asyncmac.sys 6.1.7600.16385 Kernel Driver Running atapi IDE Channel atapi.sys 6.1.7600.16385 Kernel Driver Running b06bdrv Broadcom NetXtreme II VBD bxvbdx.sys 4.8.2.0 Kernel Driver Stopped b57nd60x Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0 b57nd60x.sys 10.100.4.0 Kernel Driver Stopped Beep Beep Kernel Driver Running blbdrive blbdrive blbdrive.sys 6.1.7600.16385 Kernel Driver Running bowser Browser Support Driver bowser.sys 6.1.7600.16385 File System Driver Running BrFiltLo Brother USB Mass-Storage Lower Filter Driver BrFiltLo.sys 1.10.0.2 Kernel Driver Stopped BrFiltUp Brother USB Mass-Storage Upper Filter Driver BrFiltUp.sys 1.4.0.1 Kernel Driver Stopped Brserid Brother MFC Serial Port Interface Driver (WDM) Brserid.sys 1.0.1.6 Kernel Driver Stopped BrSerWdm Brother WDM Serial driver BrSerWdm.sys 1.0.0.20 Kernel Driver Stopped BrUsbMdm Brother MFC USB Fax Only Modem BrUsbMdm.sys 1.0.0.12 Kernel Driver Stopped BrUsbSer Brother MFC USB Serial WDM Driver BrUsbSer.sys 1.0.1.3 Kernel Driver Stopped BTHMODEM Bluetooth Serial Communications Driver bthmodem.sys 6.1.7600.16385 Kernel Driver Stopped CAMCAUD Conexant AMC Audio camc6aud.sys 6.14.10.675 Kernel Driver Running CAMCHALA CAMCHALA camc6hal.sys 6.14.10.675 Kernel Driver Running cdfs CD/DVD File System Reader cdfs.sys 6.1.7600.16385 File System Driver Running cdrom CD-ROM Driver cdrom.sys 6.1.7601.17514 Kernel Driver Running circlass Consumer IR Devices circlass.sys 6.1.7600.16385 Kernel Driver Stopped CLFS Common Log (CLFS) CLFS.sys 6.1.7600.16385 Kernel Driver Running CmBatt Microsoft ACPI Control Method Battery Driver CmBatt.sys 6.1.7600.16385 Kernel Driver Running cmdide cmdide cmdide.sys 2.0.7.0 Kernel Driver Stopped CNG CNG cng.sys 6.1.7600.16385 Kernel Driver Running Compbatt Microsoft Composite Battery Driver compbatt.sys 6.1.7600.16385 Kernel Driver Running CompositeBus Composite Bus Enumerator Driver CompositeBus.sys 6.1.7601.17514 Kernel Driver Running crcdisk Crcdisk Filter Driver crcdisk.sys 6.1.7600.16385 Kernel Driver Stopped CSC Offline Files Driver csc.sys 6.1.7601.17514 Kernel Driver Running DeepFrz DeepFrz Kernel Driver Running DfsC DFS Namespace Client Driver dfsc.sys 6.1.7601.17514 File System Driver Running discache System Attribute Cache discache.sys 6.1.7600.16385 Kernel Driver Running Disk Disk Driver disk.sys 6.1.7600.16385 Kernel Driver Running dmvsc dmvsc dmvsc.sys 6.1.7601.17514 Kernel Driver Stopped drmkaud Microsoft Trusted Audio Drivers drmkaud.sys 6.1.7600.16385 Kernel Driver Stopped dtsoftbus01 DAEMON Tools Virtual Bus Driver dtsoftbus01.sys 5.0.1.282 Kernel Driver Running DXGKrnl LDDM Graphics Subsystem dxgkrnl.sys 6.1.7601.17514 Kernel Driver Stopped E100B Intel(R) PRO Adapter Driver e100b325.sys 8.0.47.0 Kernel Driver Running ebdrv Broadcom NetXtreme II 10 GigE VBD evbdx.sys 4.8.13.0 Kernel Driver Stopped elxstor elxstor elxstor.sys 5.2.10.211 Kernel Driver Stopped ErrDev Microsoft Hardware Error errdev.sys 6.1.7600.16385 Kernel Driver Stopped EverestDriver Lavalys EVEREST Kernel Driver kerneld.wnt Kernel Driver Running exfat exFAT File System Driver File System Driver Stopped fastfat FAT12/16/32 File System Driver File System Driver Stopped fdc Floppy Disk Controller Driver fdc.sys 6.1.7600.16385 Kernel Driver Stopped FileInfo File Information FS MiniFilter fileinfo.sys 6.1.7600.16385 File System Driver Running Filetrace Filetrace filetrace.sys 6.1.7600.16385 File System Driver Stopped flpydisk Floppy Disk Driver flpydisk.sys 6.1.7600.16385 Kernel Driver Stopped FltMgr FltMgr fltmgr.sys 6.1.7600.16385 File System Driver Running FsDepends File System Dependency Minifilter FsDepends.sys 6.1.7600.16385 File System Driver Stopped fvevol Bitlocker Drive Encryption Filter Driver fvevol.sys 6.1.7601.17514 Kernel Driver Running gagp30kx Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms gagp30kx.sys 6.1.7600.16385 Kernel Driver Stopped HBtnKey HP Hotkey Device cpqbttn.sys 7.0.3.1 Kernel Driver Running hcw85cir Hauppauge Consumer Infrared Receiver hcw85cir.sys 1.31.27127.0 Kernel Driver Stopped HDAudBus Microsoft UAA Bus Driver for High Definition Audio HDAudBus.sys 6.1.7601.17514 Kernel Driver Stopped HidBatt HID UPS Battery Driver HidBatt.sys 6.1.7600.16385 Kernel Driver Stopped HidBth Microsoft Bluetooth HID Miniport hidbth.sys 6.1.7600.16385 Kernel Driver Stopped HidIr Microsoft Infrared HID Driver hidir.sys 6.1.7600.16385 Kernel Driver Stopped HidUsb Microsoft HID Class Driver hidusb.sys 6.1.7601.17514 Kernel Driver Running HpSAMD HpSAMD HpSAMD.sys 6.12.4.32 Kernel Driver Stopped HTTP HTTP HTTP.sys 6.1.7601.17514 Kernel Driver Running hwpolicy Hardware Policy Driver hwpolicy.sys 6.1.7601.17514 Kernel Driver Running i8042prt i8042 Keyboard and PS/2 Mouse Port Driver i8042prt.sys 6.1.7600.16385 Kernel Driver Running ialm ialm igxpmp32.sys 6.14.10.4704 Kernel Driver Running iaStorV iaStorV iaStorV.sys 8.6.2.1014 Kernel Driver Stopped IDMWFP IDMWFP idmwfp.sys 6.15.14.37 Kernel Driver Running iirsp iirsp iirsp.sys 5.4.22.0 Kernel Driver Stopped intelide intelide intelide.sys 6.1.7600.16385 Kernel Driver Running intelppm Intel Processor Driver intelppm.sys 6.1.7600.16385 Kernel Driver Running IpFilterDriver IP Traffic Filter Driver ipfltdrv.sys 6.1.7600.16385 Kernel Driver Stopped IPMIDRV IPMIDRV IPMIDrv.sys 6.1.7601.17514 Kernel Driver Stopped IPNAT IP Network Address Translator ipnat.sys 6.1.7600.16385 Kernel Driver Stopped IRENUM IR Bus Enumerator irenum.sys 6.1.7600.16385 Kernel Driver Stopped isapnp isapnp isapnp.sys 6.1.7600.16385 Kernel Driver Stopped iScsiPrt iScsiPort Driver msiscsi.sys 6.1.7601.17514 Kernel Driver Stopped iusb3hcs Intel(R) USB 3.0 Host Controller Switch Driver iusb3hcs.sys 1.0.7.248 Kernel Driver Running kbdclass Keyboard Class Driver kbdclass.sys 6.1.7600.16385 Kernel Driver Running kbdhid Keyboard HID Driver kbdhid.sys 6.1.7601.17514 Kernel Driver Running KSecDD KSecDD ksecdd.sys 6.1.7601.17514 Kernel Driver Running KSecPkg KSecPkg ksecpkg.sys 6.1.7600.16385 Kernel Driver Running lltdio Link-Layer Topology Discovery Mapper I/O Driver lltdio.sys 6.1.7600.16385 Kernel Driver Running LSI_FC LSI_FC lsi_fc.sys 1.28.3.52 Kernel Driver Stopped LSI_SAS LSI_SAS lsi_sas.sys 1.28.3.52 Kernel Driver Stopped LSI_SAS2 LSI_SAS2 lsi_sas2.sys 2.0.2.71 Kernel Driver Stopped LSI_SCSI LSI_SCSI lsi_scsi.sys 1.28.3.67 Kernel Driver Stopped luafv UAC File Virtualization luafv.sys 6.1.7600.16385 File System Driver Running megasas megasas megasas.sys 4.5.1.32 Kernel Driver Stopped MegaSR MegaSR MegaSR.sys 13.5.409.2009 Kernel Driver Stopped Modem Modem modem.sys 6.1.7600.16385 Kernel Driver Running monitor Microsoft Monitor Class Function Driver Service monitor.sys 6.1.7600.16385 Kernel Driver Running mouclass Mouse Class Driver mouclass.sys 6.1.7600.16385 Kernel Driver Running mouhid Mouse HID Driver mouhid.sys 6.1.7600.16385 Kernel Driver Running mountmgr Mount Point Manager mountmgr.sys 6.1.7601.17514 Kernel Driver Running mpio mpio mpio.sys 6.1.7601.17514 Kernel Driver Stopped mpsdrv Windows Firewall Authorization Driver mpsdrv.sys 6.1.7600.16385 Kernel Driver Running MRxDAV WebDav Client Redirector Driver mrxdav.sys 6.1.7601.17514 File System Driver Stopped mrxsmb SMB MiniRedirector Wrapper and Engine mrxsmb.sys 6.1.7601.17514 File System Driver Running mrxsmb10 SMB 1.x MiniRedirector mrxsmb10.sys 6.1.7601.17514 File System Driver Running mrxsmb20 SMB 2.0 MiniRedirector mrxsmb20.sys 6.1.7601.17514 File System Driver Running msahci msahci msahci.sys 6.1.7601.17514 Kernel Driver Stopped msdsm msdsm msdsm.sys 6.1.7601.17514 Kernel Driver Stopped Msfs Msfs File System Driver Running mshidkmdf Pass-through HID to KMDF Filter Driver mshidkmdf.sys 6.1.7600.16385 Kernel Driver Stopped msisadrv msisadrv msisadrv.sys 6.1.7600.16385 Kernel Driver Running MSKSSRV Microsoft Streaming Service Proxy MSKSSRV.sys 6.1.7600.16385 Kernel Driver Stopped MSPCLOCK Microsoft Streaming Clock Proxy MSPCLOCK.sys 6.1.7600.16385 Kernel Driver Stopped MSPQM Microsoft Streaming Quality Manager Proxy MSPQM.sys 6.1.7600.16385 Kernel Driver Stopped MsRPC MsRPC Kernel Driver Stopped mssmbios Microsoft System Management BIOS Driver mssmbios.sys 6.1.7600.16385 Kernel Driver Running MSTEE Microsoft Streaming Tee/Sink-to-Sink Converter MSTEE.sys 6.1.7600.16385 Kernel Driver Stopped MTConfig Microsoft Input Configuration Driver MTConfig.sys 6.1.7600.16385 Kernel Driver Stopped Mup Mup mup.sys 6.1.7600.16385 File System Driver Running NativeWifiP NativeWiFi Filter nwifi.sys 6.1.7600.16385 Kernel Driver Running NDIS NDIS System Driver ndis.sys 6.1.7601.17514 Kernel Driver Running NdisCap NDIS Capture LightWeight Filter ndiscap.sys 6.1.7600.16385 Kernel Driver Stopped NdisTapi Remote Access NDIS TAPI Driver ndistapi.sys 6.1.7600.16385 Kernel Driver Running Ndisuio NDIS Usermode I/O Protocol ndisuio.sys 6.1.7601.17514 Kernel Driver Running NdisWan Remote Access NDIS WAN Driver ndiswan.sys 6.1.7601.17514 Kernel Driver Running NDProxy NDIS Proxy Kernel Driver Running NetBIOS NetBIOS Interface netbios.sys 6.1.7600.16385 File System Driver Running NetBT NetBT netbt.sys 6.1.7601.17514 Kernel Driver Running nfrd960 nfrd960 nfrd960.sys 7.10.0.0 Kernel Driver Stopped Npfs Npfs File System Driver Running nsiproxy NSI proxy service driver. nsiproxy.sys 6.1.7600.16385 Kernel Driver Running Ntfs Ntfs File System Driver Running Null Null Kernel Driver Running nv_agp NVIDIA nForce AGP Bus Filter nv_agp.sys 6.1.7600.16385 Kernel Driver Stopped nvraid nvraid nvraid.sys 10.6.0.18 Kernel Driver Stopped nvstor nvstor nvstor.sys 10.6.0.18 Kernel Driver Stopped ohci1394 1394 OHCI Compliant Host Controller (Legacy) ohci1394.sys 6.1.7600.16385 Kernel Driver Stopped Parport Parallel port driver parport.sys 6.1.7600.16385 Kernel Driver Running partmgr Partition Manager partmgr.sys 6.1.7601.17514 Kernel Driver Running Parvdm Parvdm parvdm.sys 6.1.7600.16385 Kernel Driver Running pci PCI Bus Driver pci.sys 6.1.7601.17514 Kernel Driver Running pciide pciide pciide.sys 6.1.7600.16385 Kernel Driver Stopped pcmcia pcmcia pcmcia.sys 6.1.7600.16385 Kernel Driver Running pcw Performance Counters for Windows Driver pcw.sys 6.1.7600.16385 Kernel Driver Running PEAUTH PEAUTH peauth.sys 6.1.7600.16385 Kernel Driver Running PptpMiniport WAN Miniport (PPTP) raspptp.sys 6.1.7600.16385 Kernel Driver Running Processor Processor Driver processr.sys 6.1.7600.16385 Kernel Driver Stopped Psched QoS Packet Scheduler pacer.sys 6.1.7600.16385 Kernel Driver Running ql2300 ql2300 ql2300.sys 9.1.8.6 Kernel Driver Stopped ql40xx ql40xx ql40xx.sys 2.1.3.20 Kernel Driver Stopped QWAVEdrv QWAVE driver qwavedrv.sys 6.1.7600.16385 Kernel Driver Stopped RasAcd Remote Access Auto Connection Driver rasacd.sys 6.1.7600.16385 Kernel Driver Stopped RasAgileVpn WAN Miniport (IKEv2) AgileVpn.sys 6.1.7600.16385 Kernel Driver Running Rasl2tp WAN Miniport (L2TP) rasl2tp.sys 6.1.7600.16385 Kernel Driver Running RasPppoe Remote Access PPPOE Driver raspppoe.sys 6.1.7600.16385 Kernel Driver Running RasSstp WAN Miniport (SSTP) rassstp.sys 6.1.7600.16385 Kernel Driver Running rdbss Redirected Buffering Sub Sysytem rdbss.sys 6.1.7601.17514 File System Driver Running rdpbus Remote Desktop Device Redirector Bus Driver rdpbus.sys 6.1.7600.16385 Kernel Driver Running RDPCDD RDPCDD RDPCDD.sys 6.1.7601.17514 Kernel Driver Running RDPDR Terminal Server Device Redirector Driver rdpdr.sys 6.1.7601.17514 Kernel Driver Stopped RDPENCDD RDP Encoder Mirror Driver rdpencdd.sys 6.1.7600.16385 Kernel Driver Running RDPREFMP Reflector Display Driver used to gain access to graphics da ta rdprefmp.sys 6.1.7600.16385 Kernel Driver Running RdpVideoMiniport Remote Desktop Video Miniport Driver rdpvideominiport.sys 6.1.7601.17514 Kernel Driver Stopped RDPWD RDP Winstation Driver Kernel Driver Stopped rdyboost ReadyBoost rdyboost.sys 6.1.7601.17514 Kernel Driver Running rspndr Link-Layer Topology Discovery Responder rspndr.sys 6.1.7600.16385 Kernel Driver Running s3cap s3cap vms3cap.sys 6.1.7601.17514 Kernel Driver Stopped sbp2port sbp2port sbp2port.sys 6.1.7601.17514 Kernel Driver Stopped scfilter Smart card PnP Class Filter Driver scfilter.sys 6.1.7601.17514 Kernel Driver Stopped secdrv Security Driver Kernel Driver Running Serenum Serenum Filter Driver serenum.sys 6.1.7600.16385 Kernel Driver Stopped Serial Serial Port Driver serial.sys 6.1.7600.16385 Kernel Driver Stopped sermouse Serial Mouse Driver sermouse.sys 6.1.7600.16385 Kernel Driver Stopped sffdisk SFF Storage Class Driver sffdisk.sys 6.1.7600.16385 Kernel Driver Stopped sffp_mmc SFF Storage Protocol Driver for MMC sffp_mmc.sys 6.1.7600.16385 Kernel Driver Stopped sffp_sd SFF Storage Protocol Driver for SDBus sffp_sd.sys 6.1.7601.17514 Kernel Driver Stopped sfloppy High-Capacity Floppy Disk Drive sfloppy.sys 6.1.7600.16385 Kernel Driver Stopped sisagp SIS AGP Bus Filter sisagp.sys 6.1.7600.16385 Kernel Driver Stopped SiSRaid2 SiSRaid2 SiSRaid2.sys 5.1.1039.2600 Kernel Driver Stopped SiSRaid4 SiSRaid4 sisraid4.sys 5.1.1039.3600 Kernel Driver Stopped Smb Message-oriented TCP/IP and TCP/IPv6 Protocol (SMB session) smb.sys 6.1.7600.16385 Kernel Driver Stopped smserial smserial smserial.sys 6.12.25.4 Kernel Driver Running spldr Security Processor Loader Driver Kernel Driver Running srv Server SMB 1.xxx Driver srv.sys 6.1.7601.17514 File System Driver Running srv2 Server SMB 2.xxx Driver srv2.sys 6.1.7601.17514 File System Driver Running srvnet srvnet srvnet.sys 6.1.7601.17514 File System Driver Running stexstor stexstor stexstor.sys 5.0.1.1 Kernel Driver Stopped storflt Disk Virtual Machine Bus Acceleration Filter Driver vmstorfl.sys 6.1.7601.17514 Kernel Driver Running storvsc storvsc storvsc.sys 6.1.7601.17514 Kernel Driver Stopped swenum Software Bus Driver swenum.sys 6.1.7600.16385 Kernel Driver Running Synth3dVsc Synth3dVsc synth3dvsc.sys 6.1.7601.17514 Kernel Driver Stopped Tcpip TCP/IP Protocol Driver tcpip.sys 6.1.7601.17514 Kernel Driver Running TCPIP6 Microsoft IPv6 Protocol Driver tcpip.sys 6.1.7601.17514 Kernel Driver Stopped tcpipreg TCP/IP Registry Compatibility tcpipreg.sys 6.1.7601.17514 Kernel Driver Running TDPIPE TDPIPE tdpipe.sys 6.1.7601.17514 Kernel Driver Stopped TDTCP TDTCP tdtcp.sys 6.1.7601.17514 Kernel Driver Stopped tdx NetIO Legacy TDI Support Driver tdx.sys 6.1.7601.17514 Kernel Driver Running TermDD Terminal Device Driver termdd.sys 6.1.7601.17514 Kernel Driver Running terminpt Microsoft Remote Desktop Input Driver terminpt.sys 6.1.7601.17514 Kernel Driver Stopped tssecsrv Remote Desktop Services Security Filter Driver tssecsrv.sys 6.1.7601.17514 Kernel Driver Stopped TsUsbFlt TsUsbFlt tsusbflt.sys 6.1.7601.17514 Kernel Driver Stopped TsUsbGD Remote Desktop Generic USB Device TsUsbGD.sys 6.1.7601.17514 Kernel Driver Stopped tsusbhub tsusbhub tsusbhub.sys 6.1.7601.17514 Kernel Driver Stopped tunnel Microsoft Tunnel Miniport Adapter Driver tunnel.sys 6.1.7601.17514 Kernel Driver Running uagp35 Microsoft AGPv3.5 Filter uagp35.sys 6.1.7600.16385 Kernel Driver Stopped udfs udfs udfs.sys 6.1.7601.17514 File System Driver Stopped uliagpkx Uli AGP Bus Filter uliagpkx.sys 6.1.7600.16385 Kernel Driver Stopped umbus UMBus Enumerator Driver umbus.sys 6.1.7601.17514 Kernel Driver Running UmPass Microsoft UMPass Driver umpass.sys 6.1.7600.16385 Kernel Driver Stopped usbccgp Microsoft USB Generic Parent Driver usbccgp.sys 6.1.7601.17514 Kernel Driver Stopped usbcir eHome Infrared Receiver (USBCIR) usbcir.sys 6.1.7600.16385 Kernel Driver Stopped usbehci Microsoft USB 2.0 Enhanced Host Controller Miniport Driver usbehci.sys 6.1.7601.17514 Kernel Driver Running usbhub Microsoft USB Standard Hub Driver usbhub.sys 6.1.7601.17514 Kernel Driver Running usbohci Microsoft USB Open Host Controller Miniport Driver usbohci.sys 6.1.7600.16385 Kernel Driver Stopped usbprint Microsoft USB PRINTER Class usbprint.sys 6.1.7600.16385 Kernel Driver Stopped USBSTOR USB Mass Storage Driver USBSTOR.SYS 6.1.7601.17514 Kernel Driver Running usbuhci Microsoft USB Universal Host Controller Miniport Driver usbuhci.sys 6.1.7600.16385 Kernel Driver Running vdrvroot Microsoft Virtual Drive Enumerator Driver vdrvroot.sys 6.1.7600.16385 Kernel Driver Running vga vga vgapnp.sys 6.1.7600.16385 Kernel Driver Stopped VgaSave VgaSave vga.sys 6.1.7600.16385 Kernel Driver Running VGPU VGPU rdvgkmd.sys Kernel Driver Stopped vhdmp vhdmp vhdmp.sys 6.1.7601.17514 Kernel Driver Stopped viaagp VIA AGP Bus Filter viaagp.sys 6.1.7600.16385 Kernel Driver Stopped ViaC7 VIA C7 Processor Driver viac7.sys 6.1.7600.16385 Kernel Driver Stopped viaide viaide viaide.sys 6.0.6000.170 Kernel Driver Stopped vmbus vmbus vmbus.sys 6.1.7601.17514 Kernel Driver Stopped VMBusHID VMBusHID VMBusHID.sys 6.1.7601.17514 Kernel Driver Stopped volmgr Volume Manager Driver volmgr.sys 6.1.7601.17514 Kernel Driver Running volmgrx Dynamic Volume Manager volmgrx.sys 6.1.7600.16385 Kernel Driver Running volsnap Storage volumes volsnap.sys 6.1.7601.17514 Kernel Driver Running vsmraid vsmraid vsmraid.sys 6.0.6000.6210 Kernel Driver Stopped vwifibus Virtual WiFi Bus Driver vwifibus.sys 6.1.7600.16385 Kernel Driver Stopped w29n51 Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows XP w29n51.sys 9.0.4.39 Kernel Driver Running WacomPen Wacom Serial Pen HID Driver wacompen.sys 6.1.7600.16385 Kernel Driver Stopped WANARP Remote Access IP ARP Driver wanarp.sys 6.1.7601.17514 Kernel Driver Stopped Wanarpv6 Remote Access IPv6 ARP Driver wanarp.sys 6.1.7601.17514 Kernel Driver Running Wd Wd wd.sys 6.1.7600.16385 Kernel Driver Stopped Wdf01000 Kernel Mode Driver Frameworks service Wdf01000.sys 1.9.7600.16385 Kernel Driver Running WfpLwf WFP Lightweight Filter wfplwf.sys 6.1.7600.16385 Kernel Driver Running WIMMount WIMMount wimmount.sys 6.1.7600.16385 File System Driver Stopped WinRing0_1_2_0 WinRing0_1_2_0 WinRing0.sys 1.2.0.5 File System Driver Stopped WmiAcpi Microsoft Windows Management Interface for ACPI wmiacpi.sys 6.1.7600.16385 Kernel Driver Running ws2ifsl Winsock IFS Driver ws2ifsl.sys 6.1.7600.16385 Kernel Driver Stopped WudfPf User Mode Driver Frameworks Platform Driver WudfPf.sys 6.1.7601.17514 Kernel Driver Stopped

------[ Services ]------AeLookupSvc Application Experience svchost.exe 6.1.7600.16385 Share Proc ess Running localSystem ALG Application Layer Gateway Service alg.exe 6.1.7600.16385 Own Proces s Stopped NT AUTHORITY\LocalService AppIDSvc Application Identity svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT Authority\LocalService Appinfo Application Information svchost.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem AppMgmt Application Management svchost.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem aspnet_state ASP.NET State Service aspnet_state.exe 4.0.30319.17929 Own Proces s Stopped NT AUTHORITY\NetworkService AudioEndpointBuilder Windows Audio Endpoint Builder svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem Audiosrv Windows Audio svchost.exe 6.1.7600.16385 Share Proc ess Running NT AUTHORITY\LocalService AxInstSV ActiveX Installer (AxInstSV) svchost.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem BDESVC BitLocker Drive Encryption Service svchost.exe 6.1.7600.16385 Share Proc ess Stopped localSystem BFE Base Filtering Engine svchost.exe 6.1.7600.16385 Share Proc ess Running NT AUTHORITY\LocalService BITS Background Intelligent Transfer Service svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem Browser Computer Browser svchost.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem bthserv Bluetooth Support Service svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService CertPropSvc Certificate Propagation svchost.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem clr_optimization_v2.0.50727_32 Microsoft .NET Framework NGEN v2.0.50727_ X86 mscorsvw.exe 2.0.50727.4927 Own Proces s Stopped LocalSystem clr_optimization_v4.0.30319_32 Microsoft .NET Framework NGEN v4.0.30319_ X86 mscorsvw.exe 4.0.30319.17929 Own Proces s Stopped LocalSystem COMSysApp COM+ System Application dllhost.exe 6.1.7600.16385 Own Proces s Stopped LocalSystem CryptSvc Cryptographic Services svchost.exe 6.1.7600.16385 Share Proc ess Running NT Authority\NetworkService CscService Offline Files svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem DcomLaunch DCOM Server Process Launcher svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem defragsvc Disk Defragmenter svchost.exe 6.1.7600.16385 Own Proces s Stopped localSystem DFServ DFServ DFServ.exe 6.61.20.2822 Own Proces s Running LocalSystem Dhcp DHCP Client svchost.exe 6.1.7600.16385 Share Proc ess Running NT Authority\LocalService Dnscache DNS Client svchost.exe 6.1.7600.16385 Share Proc ess Running NT AUTHORITY\NetworkService dot3svc Wired AutoConfig svchost.exe 6.1.7600.16385 Share Proc ess Stopped localSystem DPS Diagnostic Policy Service svchost.exe 6.1.7600.16385 Share Proc ess Running NT AUTHORITY\LocalService EapHost Extensible Authentication Protocol svchost.exe 6.1.7600.16385 Share Proc ess Running localSystem EFS Encrypting File System (EFS) lsass.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem ehRecvr Receiver Service ehRecvr.exe 6.1.7601.17514 Own Proces s Stopped NT AUTHORITY\networkService ehSched Windows Media Center Scheduler Service ehsched.exe 6.1.7600.16385 Own Proces s Stopped NT AUTHORITY\networkService eventlog Windows Event Log svchost.exe 6.1.7600.16385 Share Proc ess Running NT AUTHORITY\LocalService EventSystem COM+ Event System svchost.exe 6.1.7600.16385 Share Proc ess Running NT AUTHORITY\LocalService Fax Fax fxssvc.exe 6.1.7601.17514 Own Proces s Stopped NT AUTHORITY\NetworkService fdPHost Function Discovery Provider Host svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService FDResPub Function Discovery Resource Publication svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService FontCache Windows Font Cache Service svchost.exe 6.1.7600.16385 Share Proc ess Running NT AUTHORITY\LocalService FontCache3.0.0.0 Windows Presentation Foundation Font Cach e 3.0.0.0 PresentationFontCache.exe 3.0.6920.4902 Own P rocess Stopped NT Authority\LocalService gpsvc Group Policy Client svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem hidserv Human Interface Device Access svchost.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem hkmsvc Health Key and Certificate Management svchost.exe 6.1.7600.16385 Share Proc ess Stopped localSystem HomeGroupListener HomeGroup Listener svchost.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem HomeGroupProvider HomeGroup Provider svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService idsvc Windows CardSpace infocard.exe 3.0.4506.5420 Share Proc ess Stopped LocalSystem IJPLMSVC Canon Inkjet Printer/Scanner/Fax Extended Survey Program IJPLMSVC.EXE 3.0.0.101 Own Proces s Stopped LocalSystem IKEEXT IKE and AuthIP IPsec Keying Modules svchost.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem IPBusEnum PnP-X IP Bus Enumerator svchost.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem iphlpsvc IP Helper svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem KeyIso CNG Key Isolation lsass.exe 6.1.7600.16385 Share Proc ess Running LocalSystem KtmRm KtmRm for Distributed Transaction Coordin ator svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\NetworkService LanmanServer Server svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem LanmanWorkstation Workstation svchost.exe 6.1.7600.16385 Share Proc ess Running NT AUTHORITY\NetworkService lltdsvc Link-Layer Topology Discovery Mapper svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService lmhosts TCP/IP NetBIOS Helper svchost.exe 6.1.7600.16385 Share Proc ess Running NT AUTHORITY\LocalService Mcx2Svc Media Center Extender Service svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT Authority\LocalService MMCSS Multimedia Class Scheduler svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem MpsSvc Windows Firewall svchost.exe 6.1.7600.16385 Share Proc ess Running NT Authority\LocalService MSDTC Distributed Transaction Coordinator msdtc.exe 2001.12.8530.16385 Own Pro cess Stopped NT AUTHORITY\NetworkService MSiSCSI Microsoft iSCSI Initiator Service svchost.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem msiserver msiexec.exe 5.0.7601.17514 Own Proces s Stopped LocalSystem napagent Network Access Protection Agent svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\NetworkService Netlogon Netlogon lsass.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem Netman Network Connections svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem NetMsmqActivator Net.Msmq Listener Adapter SMSvcHost.exe 4.0.30319.17929 Share Proc ess Stopped NT AUTHORITY\NetworkService NetPipeActivator Net.Pipe Listener Adapter SMSvcHost.exe 4.0.30319.17929 Share Proc ess Stopped NT AUTHORITY\LocalService netprofm Network List Service svchost.exe 6.1.7600.16385 Share Proc ess Running NT AUTHORITY\LocalService NetTcpActivator Net.Tcp Listener Adapter SMSvcHost.exe 4.0.30319.17929 Share Proc ess Stopped NT AUTHORITY\LocalService NetTcpPortSharing Net.Tcp Port Sharing Service SMSvcHost.exe 4.0.30319.17929 Share Proc ess Stopped NT AUTHORITY\LocalService NlaSvc Network Location Awareness svchost.exe 6.1.7600.16385 Share Proc ess Running NT AUTHORITY\NetworkService nsi Network Store Interface Service svchost.exe 6.1.7600.16385 Share Proc ess Running NT Authority\LocalService ose Office Source Engine OSE.EXE 14.0.4730.1010 Own Proces s Stopped LocalSystem osppsvc Office Software Protection Platform OSPPSVC.EXE 14.0.370.400 Own Proces s Running NT AUTHORITY\NetworkService p2pimsvc Peer Networking Identity Manager svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService p2psvc Peer Networking Grouping svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService PcaSvc Program Compatibility Assistant Service svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem PeerDistSvc BranchCache svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\NetworkService pla Performance Logs & Alerts svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService PlugPlay Plug and Play svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem PNRPAutoReg PNRP Machine Name Publication Service svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService PNRPsvc Peer Name Resolution Protocol svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService PolicyAgent IPsec Policy Agent svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT Authority\NetworkService Power Power svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem ProfSvc User Profile Service svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem ProtectedStorage Protected Storage lsass.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem QWAVE Quality Windows Audio Video Experience svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService RasAuto Remote Access Auto Connection Manager svchost.exe 6.1.7600.16385 Share Proc ess Stopped localSystem RasMan Remote Access Connection Manager svchost.exe 6.1.7600.16385 Share Proc ess Stopped localSystem RemoteAccess Routing and Remote Access svchost.exe 6.1.7600.16385 Share Proc ess Stopped localSystem RemoteRegistry Remote Registry svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService RpcEptMapper RPC Endpoint Mapper svchost.exe 6.1.7600.16385 Share Proc ess Running NT AUTHORITY\NetworkService RpcLocator Remote Procedure Call (RPC) Locator locator.exe 6.1.7600.16385 Own Proces s Stopped NT AUTHORITY\NetworkService RpcSs Remote Procedure Call (RPC) svchost.exe 6.1.7600.16385 Share Proc ess Running NT AUTHORITY\NetworkService SamSs Security Accounts Manager lsass.exe 6.1.7600.16385 Share Proc ess Running LocalSystem SCardSvr Smart Card svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService Schedule Task Scheduler svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem SCPolicySvc Smart Card Removal Policy svchost.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem ScsiAccess ScsiAccess ScsiAccess.exe Own Proces s Running LocalSystem SDRSVC Windows Backup svchost.exe 6.1.7600.16385 Own Proces s Stopped localSystem seclogon Secondary Logon svchost.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem SENS System Event Notification Service svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem SensrSvc Adaptive Brightness svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService SessionEnv Remote Desktop Configuration svchost.exe 6.1.7600.16385 Share Proc ess Stopped localSystem SharedAccess Internet Connection Sharing (ICS) svchost.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem ShellHWDetection Shell Hardware Detection svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem SkypeUpdate Skype Updater Updater.exe 5.10.1.44067 Own Proces s Stopped LocalSystem SNMPTRAP SNMP Trap snmptrap.exe 6.1.7600.16385 Own Proces s Stopped NT AUTHORITY\LocalService Spooler Print Spooler spoolsv.exe 6.1.7601.17514 Own Proces s Running LocalSystem sppsvc Software Protection sppsvc.exe 6.1.7601.17514 Own Proces s Running NT AUTHORITY\NetworkService sppuinotify SPP Notification Service svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService SSDPSRV SSDP Discovery svchost.exe 6.1.7600.16385 Share Proc ess Running NT AUTHORITY\LocalService SstpSvc Secure Socket Tunneling Protocol Service svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT Authority\LocalService StiSvc Windows Image Acquisition (WIA) svchost.exe 6.1.7600.16385 Own Proces s Stopped NT Authority\LocalService swprv Microsoft Software Provider svchost.exe 6.1.7600.16385 Own Proces s Stopped LocalSystem SysMain Superfetch svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem TabletInputService Tablet PC Input Service svchost.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem TapiSrv Telephony svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\NetworkService TBS TPM Base Services svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService TeamViewer8 TeamViewer 8 TeamViewer_Service.exe 8.0.17396.0 Own Proc ess Running LocalSystem TermService Remote Desktop Services svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT Authority\NetworkService Themes Themes svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem THREADORDER Thread Ordering Server svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService TrkWks Distributed Link Tracking Client svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem TrustedInstaller Windows Modules Installer TrustedInstaller.exe 6.1.7601.17514 Own Proces s Stopped localSystem UI0Detect Interactive Services Detection UI0Detect.exe 6.1.7600.16385 Own Proces s Stopped LocalSystem UmRdpService Remote Desktop Services UserMode Port Red irector svchost.exe 6.1.7600.16385 Share Proc ess Stopped localSystem upnphost UPnP Device Host svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService UxSms Session Manager svchost.exe 6.1.7600.16385 Share Proc ess Running localSystem VaultSvc Credential Manager lsass.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem vds Virtual Disk vds.exe 6.1.7601.17514 Own Proces s Stopped LocalSystem VSS Volume Shadow Copy vssvc.exe 6.1.7601.17514 Own Proces s Stopped LocalSystem W32Time Windows Time svchost.exe 6.1.7600.16385 Share Proc ess Running NT AUTHORITY\LocalService wbengine Block Level Backup Engine Service wbengine.exe 6.1.7601.17514 Own Proces s Stopped localSystem WbioSrvc Windows Biometric Service svchost.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem wcncsvc Windows Connect Now - Config Registrar svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService WcsPlugInService svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService WdiServiceHost Diagnostic Service Host svchost.exe 6.1.7600.16385 Share Proc ess Running NT AUTHORITY\LocalService WdiSystemHost Diagnostic System Host svchost.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem WebClient WebClient svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService Wecsvc Windows Event Collector svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\NetworkService wercplsupport Problem Reports and Solutions Control Pan el Support svchost.exe 6.1.7600.16385 Share Proc ess Stopped localSystem WerSvc Service svchost.exe 6.1.7600.16385 Share Proc ess Stopped localSystem WinDefend Windows Defender svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem WinHttpAutoProxySvc WinHTTP Web Proxy Auto-Discovery Service svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\LocalService Winmgmt Windows Management Instrumentation svchost.exe 6.1.7600.16385 Share Proc ess Running localSystem WinRM Windows Remote Management (WS-Management) svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT AUTHORITY\NetworkService Wlansvc WLAN AutoConfig svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem wmiApSrv WMI Performance Adapter WmiApSrv.exe 6.1.7600.16385 Own Proces s Stopped localSystem WMPNetworkSvc Network Sharing Serv ice wmpnetwk.exe 12.0.7601.17514 Own Proces s Stopped NT AUTHORITY\NetworkService WPCSvc Parental Controls svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT Authority\LocalService WPDBusEnum Portable Device Enumerator Service svchost.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem wscsvc Security Center svchost.exe 6.1.7600.16385 Share Proc ess Running NT AUTHORITY\LocalService WSearch Windows Search SearchIndexer.exe 7.0.7600.16385 Own Proces s Running LocalSystem wuauserv Windows Update svchost.exe 6.1.7600.16385 Share Proc ess Running LocalSystem wudfsvc Windows Driver Foundation - User-mode Dri ver Framework svchost.exe 6.1.7600.16385 Share Proc ess Stopped LocalSystem WwanSvc WWAN AutoConfig svchost.exe 6.1.7600.16385 Share Proc ess Stopped NT Authority\LocalService

------[ AX Files ]------bdaplgin.ax 6.1.7600.16385 Microsoft BDA Device Control Plug-in for MPEG2 based networks. g711codc.ax 6.1.7601.17514 Intel G711 CODEC iac25_32.ax 2.0.5.53 Indeo® audio software ir41_32.ax 4.51.16.3 Intel Indeo® Video 4.5 ivfsrc.ax 5.10.2.51 Intel Indeo® video IVF Source Filter 5.10 ksproxy.ax 6.1.7601.17514 WDM Streaming ActiveM ovie Proxy kstvtune.ax 6.1.7601.17514 WDM Streaming TvTuner kswdmcap.ax 6.1.7601.17514 WDM Streaming Video C apture ksxbar.ax 6.1.7601.17514 WDM Streaming Crossba r mpeg2data.ax 6.6.7601.17514 Microsoft MPEG-2 Sect ion and Table Acquisition Module mpg2splt.ax 6.6.7601.17514 DirectShow MPEG-2 Spl itter. msdvbnp.ax 6.6.7601.17514 Microsoft Network Pro vider for MPEG2 based networks. msnp.ax 6.6.7601.17514 Microsoft Network Pro vider for MPEG2 based networks. psisrndr.ax 6.6.7601.17514 Microsoft Transport I nformation Filter for MPEG2 based networks. vbicodec.ax 6.6.7601.17514 Microsoft VBI Codec vbisurf.ax 6.1.7601.17514 VBI Surface Allocator Filter vidcap.ax 6.1.7600.16385 Video Capture Interfa ce Server wstpager.ax 6.6.7601.17514 Microsoft Teletext Se rver

------[ DLL Files ]------aaclient.dll 6.1.7601.17514 Anywhere access clien t accessibilitycpl.dll 6.1.7601.17514 Ease of access contr ol panel acctres.dll 6.1.7600.16385 Microsoft Internet Ac count Manager Resources acledit.dll 6.1.7600.16385 Access Control List E ditor aclui.dll 6.1.7600.16385 Security Descriptor E ditor acppage.dll 6.1.7601.17514 Compatibility Tab She ll Extension acproxy.dll 6.1.7600.16385 Autochk Proxy DLL actioncenter.dll 6.1.7601.17514 Action Center actioncentercpl.dll 6.1.7601.17514 Action Center Control Panel actionqueue.dll 6.1.7601.17514 Unattend Action Queue Generator / Executor activeds.dll 6.1.7601.17514 ADs Router Layer DLL actxprxy.dll 6.1.7601.17514 ActiveX Interface Mar shaling Library admparse.dll 8.0.7600.16385 IEAK Global Policy Te mplate Parser admtmpl.dll 6.1.7601.17514 Administrative Templa tes Extension adprovider.dll 6.1.7600.16385 adprovider DLL adsldp.dll 6.1.7601.17514 ADs LDAP Provider DLL adsldpc.dll 6.1.7600.16385 ADs LDAP Provider C D LL adsmsext.dll 6.1.7600.16385 ADs LDAP Provider DLL adsnt.dll 6.1.7600.16385 ADs Windows NT Provid er DLL adtschema.dll 6.1.7600.16385 Security Audit Schema DLL advapi32.dll 6.1.7601.17514 Advanced Windows 32 B ase API advpack.dll 8.0.7600.16385 ADVPACK aecache.dll 6.1.7600.16385 AECache Sysprep Plugi n aeevts.dll 6.1.7600.16385 Application Experienc e Event Resources aeinv.dll 6.1.7601.17514 Application Experienc e Program Inventory Component aelupsvc.dll 6.1.7600.16385 Application Experienc e Service aepdu.dll 6.1.7601.17514 Program Compatibility Data Updater aepic.dll 6.1.7600.16385 Application Experienc e Program Cache alttab.dll 6.1.7600.16385 Windows Shell Alt Tab amstream.dll 6.6.7601.17514 DirectShow Runtime. amxread.dll 6.1.7600.16385 API Tracing Manifest Read Library apds.dll 6.1.7600.16385 Microsoft® Help Data Se rvices Module apilogen.dll 6.1.7600.16385 API Tracing Log Engin e -ms-win-core-console-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-datetime-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-debug-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DL L api-ms-win-core-delayload-l1-1-0.dll 6.1.7600.16385 ApiSet Stu b DLL api-ms-win-core-errorhandling-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-fibers-l1-1-0.dll 6.1.7600.16385 ApiSet Stub D LL api-ms-win-core-file-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-handle-l1-1-0.dll 6.1.7600.16385 ApiSet Stub D LL api-ms-win-core-heap-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-interlocked-l1-1-0.dll 6.1.7600.16385 ApiSet S tub DLL api-ms-win-core-io-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-libraryloader-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-localization-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-localregistry-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-memory-l1-1-0.dll 6.1.7600.16385 ApiSet Stub D LL api-ms-win-core-misc-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-namedpipe-l1-1-0.dll 6.1.7600.16385 ApiSet Stu b DLL api-ms-win-core-processenvironment-l1-1-0.dll 6.1.7600.16385 A piSet Stub DLL api-ms-win-core-processthreads-l1-1-0.dll 6.1.7600.16385 ApiSe t Stub DLL api-ms-win-core-profile-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-rtlsupport-l1-1-0.dll 6.1.7600.16385 ApiSet St ub DLL api-ms-win-core-string-l1-1-0.dll 6.1.7600.16385 ApiSet Stub D LL api-ms-win-core-synch-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DL L api-ms-win-core-sysinfo-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-threadpool-l1-1-0.dll 6.1.7600.16385 ApiSet St ub DLL api-ms-win-core-util-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-xstate-l1-1-0.dll 6.1.7600.16385 ApiSet Stub D LL api-ms-win-security-base-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-security-lsalookup-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-security-sddl-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-service-core-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-service-management-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-service-management-l2-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-service-winsvc-l1-1-0.dll 6.1.7600.16385 ApiSet Stu b DLL apircl.dll 6.1.7600.16385 Microsoft® InfoTech IR Local DLL apisetschema.dll 6.1.7600.16385 ApiSet Schema DLL apphelp.dll 6.1.7601.17514 Application Compatibi lity Client Library apphlpdm.dll 6.1.7600.16385 Application Compatibi lity Help Module appidapi.dll 6.1.7600.16385 Application Identity Dll appidpolicyengineapi.dll 6.1.7600.16385 AppId Policy Engine A PI Module appidsvc.dll 6.1.7600.16385 Application Identity Service appinfo.dll 6.1.7601.17514 Application Informati on Service appmgmts.dll 6.1.7600.16385 Software installation Service appmgr.dll 6.1.7601.17514 Software Installation Snapin Extenstion apss.dll 6.1.7600.16385 Microsoft® InfoTech Sto rage System Library asferror.dll 12.0.7600.16385 ASF Error Definitions aspnet_counters.dll 4.0.30319.17929 Microsoft ASP.NET Per formance Counter Shim DLL asycfilt.dll 6.1.7601.17514 atl.dll 3.5.2284.0 ATL Module for Window s XP () atmfd.dll 5.1.2.230 Windows NT OpenType/T ype 1 Font Driver atmlib.dll 5.1.2.230 Windows NT OpenType/T ype 1 API Library. audiodev.dll 6.1.7601.17514 Portable Media Device s Shell Extension audioeng.dll 6.1.7600.16385 Audio Engine audiokse.dll 6.1.7600.16385 Audio Ks Endpoint audioses.dll 6.1.7601.17514 Audio Session audiosrv.dll 6.1.7601.17514 Windows Audio Service auditcse.dll 6.1.7600.16385 Windows Audit Setting s CSE auditnativesnapin.dll 6.1.7600.16385 Audit Policy Group Po licy Editor Extension auditpolicygpinterop.dll 6.1.7600.16385 Audit Policy GP Modul e auditpolmsg.dll 6.1.7600.16385 Audit Policy MMC Snap In Messages authfwcfg.dll 6.1.7600.16385 Windows Firewall with Advanced Security Configuration Helper authfwgp.dll 6.1.7600.16385 Windows Firewall with Advanced Security Group Policy Editor Extension authfwsnapin.dll 6.1.7601.17514 Microsoft.WindowsFire wall.SnapIn authfwwizfwk.dll 6.1.7600.16385 Wizard Framework authui.dll 6.1.7601.17514 Windows Authenticatio n UI authz.dll 6.1.7600.16385 Authorization Framewo rk autoplay.dll 6.1.7601.17514 AutoPlay Control Pane l auxiliarydisplayapi.dll 6.1.7600.16385 Microsoft Windows Sid eShow API auxiliarydisplayclassinstaller.dll 6.1.7600.16385 Class instal ler for Microsoft Windows SideShow-compatible devices auxiliarydisplaycpl.dll 6.1.7601.17514 Microsoft Windows Sid eShow Control Panel auxiliarydisplaydriverlib.dll 6.1.7600.16385 Microsoft Windows SideShow class extension component auxiliarydisplayservices.dll 6.1.7601.17514 Microsoft Windows SideShow services avicap.dll 1.15.0.1 AVI Capture DLL avicap32.dll 6.1.7600.16385 AVI Capture window cl ass avifil32.dll 6.1.7601.17514 Microsoft AVI File su pport library avifile.dll 4.90.0.3000 Microsoft AVI File su pport library avrt.dll 6.1.7600.16385 Multimedia Realtime R untime axinstsv.dll 6.1.7601.17514 ActiveX Installer Ser vice azroles.dll 6.1.7601.17514 azroles Module azroleui.dll 6.1.7601.17514 Authorization Manager azsqlext.dll 6.1.7601.17514 AzMan Sql Audit Exten ded Stored Procedures Dll basecsp.dll 6.1.7601.17514 Microsoft Base Smart Card Crypto Provider basesrv.dll 6.1.7601.17514 Windows NT BASE API S erver DLL batmeter.dll 6.1.7601.17514 Battery Meter Helper DLL batt.dll 6.1.7600.16385 Battery Class Install er bcdprov.dll 6.1.7600.16385 Boot Configuration Da ta WMI Provider bcdsrv.dll 6.1.7601.17514 Boot Configuration Da ta COM Server bcrypt.dll 6.1.7600.16385 Windows Cryptographic Primitives Library bcryptprimitives.dll 6.1.7600.16385 Windows Cryptographic Primitives Library bdehdcfglib.dll 6.1.7600.16385 Windows BitLocker Dri ve Preparation Tool bderepair.dll 6.1.7600.16385 BitLocker Drive Encry ption: Drive Repair Tool bdesvc.dll 6.1.7600.16385 BDE Service bdeui.dll 6.1.7600.16385 Windows BitLocker Dri ve Encryption User Interface bfe.dll 6.1.7601.17514 Base Filtering Engine bidispl.dll 6.1.7600.16385 Bidispl DLL biocpl.dll 6.1.7601.17514 Biometrics Control Pa nel biocredprov.dll 6.1.7600.16385 WinBio Credential Pro vider bitsigd.dll 7.5.7600.16385 Background Intelligen t Transfer Service IGD Support bitsperf.dll 7.5.7601.17514 Perfmon Counter Acces s bitsprx2.dll 7.5.7600.16385 Background Intelligen t Transfer Service Proxy bitsprx3.dll 7.5.7600.16385 Background Intelligen t Transfer Service 2.0 Proxy bitsprx4.dll 7.5.7600.16385 Background Intelligen t Transfer Service 2.5 Proxy bitsprx5.dll 7.5.7600.16385 Background Intelligen t Transfer Service 3.0 Proxy bitsprx6.dll 7.5.7600.16385 Background Intelligen t Transfer Service 4.0 Proxy blackbox.dll 11.0.7601.17514 BlackBox DLL blb_ps.dll 6.1.7600.16385 Microsoft® Block Level Backup proxy/stub blbevents.dll 6.1.7601.17514 Blb Publisher blbres.dll 6.1.7600.16385 Microsoft® Block Level Backup Engine Service Resources bootres.dll 6.1.7601.17514 Boot Resource Library bootstr.dll 6.1.7600.16385 Boot String Resource Library bootvid.dll 6.1.7600.16385 VGA Boot Driver brcoinst.dll 1.0.0.20 Brother Multi Functio n CoInstaller brdgcfg.dll 6.1.7600.16385 NWLink IPX Notify Obj ect bridgeres.dll 6.1.7600.16385 Bridge Resources browcli.dll 6.1.7601.17514 Browser Service Clien t DLL browser.dll 6.1.7601.17514 Computer Browser Serv ice DLL browseui.dll 6.1.7601.17514 Shell Browser UI Libr ary bthci.dll 6.1.7600.16385 Bluetooth Class Insta ller bthmtpcontexthandler.dll 6.1.7600.16385 Bluetooth MTP Context Menu Handler bthpanapi.dll 6.1.7600.16385 bthpanapi bthpancontexthandler.dll 1.0.0.1 Bthpan Context Handle r bthserv.dll 6.1.7600.16385 Bluetooth Support Ser vice btpanui.dll 6.1.7600.16385 Bluetooth PAN User In terface bwcontexthandler.dll 1.0.0.1 ContextH Application bwunpairelevated.dll 6.1.7600.16385 BWUnpairElevated Prox y Dll c_g18030.dll 6.1.7600.16385 GB18030 DBCS-Unicode Conversion DLL c_is2022.dll 6.1.7600.16385 ISO-2022 Code Page Tr anslation DLL c_iscii.dll 6.1.7601.17514 ISCII Code Page Trans lation DLL cabinet.dll 6.1.7601.17514 Microsoft® Cabinet File API cabview.dll 6.1.7601.17514 Cabinet File Viewer S hell Extension capiprovider.dll 6.1.7600.16385 capiprovider DLL capisp.dll 6.1.7600.16385 Sysprep cleanup dll f or CAPI cardgames.dll 1.0.0.1 CardGames Resources catsrv.dll 2001.12.8530.16385 COM+ Configuration Ca talog Server catsrvps.dll 2001.12.8530.16385 COM+ Configuration Ca talog Server Proxy/Stub catsrvut.dll 2001.12.8530.16385 COM+ Configuration Ca talog Server Utilities cca.dll 6.6.7601.17514 CCA DirectShow Filter . cdd.dll 6.1.7601.17514 Canonical Display Dri ver cdosys.dll 6.6.7601.17514 Microsoft CDO for Win dows Library certcli.dll 6.1.7601.17514 Microsoft® Active Direc tory Certificate Services Client certcredprovider.dll 6.1.7600.16385 Cert Credential Provi der certenc.dll 6.1.7600.16385 Active Directory Cert ificate Services Encoding certenroll.dll 6.1.7601.17514 Microsoft® Active Direc tory Certificate Services Enrollment Client certenrollui.dll 6.1.7600.16385 X509 Certificate Enro llment UI certmgr.dll 6.1.7601.17514 Certificates snap-in certpoleng.dll 6.1.7601.17514 Certificate Policy En gine certprop.dll 6.1.7601.17514 Microsoft Smartcard C ertificate Propagation Service cewmdm.dll 12.0.7600.16385 Windows CE WMDM Servi ce Provider cfgbkend.dll 6.1.7600.16385 Configuration Backend Interface cfgmgr32.dll 6.1.7601.17514 Configuration Manager DLL chkwudrv.dll 6.1.7600.16385 Search Windows Update for Drivers chsbrkr.dll 6.1.7600.16385 Simplified Chinese Wo rd Breaker chtbrkr.dll 6.1.7600.16385 Chinese Traditional W ord Breaker chxreadingstringime.dll 6.1.7600.16385 CHxReadingStringIME ci.dll 6.1.7601.17514 Code Integrity Module cic.dll 6.1.7600.16385 CIC - MMC controls fo r Taskpad circoinst.dll 6.1.7600.16385 USB Consumer IR Drive r coinstaller for eHome clb.dll 6.1.7600.16385 Column List Box clbcatq.dll 2001.12.8530.16385 COM+ Configuration Ca talog clfsw32.dll 6.1.7600.16385 Common Log Marshallin g Win32 DLL cliconfg.dll 6.1.7600.16385 SQL Client Configurat ion Utility DLL clusapi.dll 6.1.7601.17514 Cluster API Library cmcfg32.dll 7.2.7600.16385 Microsoft Connection Manager Configuration Dll cmdial32.dll 7.2.7600.16385 Microsoft Connection Manager cmicryptinstall.dll 6.1.7600.16385 Installers for crypto graphic elements of CMI objects cmifw.dll 6.1.7600.16385 Windows Firewall rule configuration plug-in cmipnpinstall.dll 6.1.7600.16385 PNP plugin installer for CMI cmlua.dll 7.2.7600.16385 Connection Manager Ad min API Helper cmnclim.dll 6.1.7600.16385 Common Client Library cmpbk32.dll 7.2.7600.16385 Microsoft Connection Manager Phonebook cmstplua.dll 7.2.7600.16385 Connection Manager Ad min API Helper for Setup cmutil.dll 7.2.7600.16385 Microsoft Connection Manager Utility Lib cngaudit.dll 6.1.7600.16385 Windows Cryptographic Next Generation audit library cngprovider.dll 6.1.7600.16385 cngprovider DLL cnmiu9w.dll 1.6.0.110 Canon IJ Driver Insta ller cnmlm9w.dll 0.3.0.1 IJ Language Monitor cnvfat.dll 6.1.7600.16385 FAT File System Conve rsion Utility DLL cofiredm.dll 6.1.7600.16385 Corrupted File Recove ry Diagnostic Module colbact.dll 2001.12.8530.16385 COM+ colorcnv.dll 6.1.7600.16385 Windows Media Color C onversion colorui.dll 6.1.7600.16385 Microsoft Color Contr ol Panel comcat.dll 6.1.7600.16385 Microsoft Component C ategory Manager Library comctl32.dll 5.82.7601.17514 User Experience Contr ols Library comdlg32.dll 6.1.7601.17514 Common Dialogs DLL commdlg.dll 3.10.0.103 Common Dialogs librar ies compobj.dll 2.10.35.35 OLE 2.1 16/32 Interop erability Library compstui.dll 6.1.7600.16385 Common Property Sheet User Interface DLL comrepl.dll 2001.12.8530.16385 COM+ comres.dll 2001.12.8530.16385 COM+ Resources comsnap.dll 2001.12.8530.16385 COM+ Explorer MMC Sna pin comsvcs.dll 2001.12.8530.16385 COM+ Services comuid.dll 2001.12.8530.16385 COM+ Explorer UI connect.dll 6.1.7600.16385 Get Connected Wizards console.dll 6.1.7600.16385 Control Panel Console Applet corpol.dll 8.0.7600.16385 Microsoft COM Runtime Execution Engine correngine.dll 6.1.7600.16385 Correlation Engine cpfilters.dll 6.6.7601.17514 PTFilter & Encypter/ Decrypter Tagger Filters. credssp.dll 6.1.7601.17514 Credential Delegation Security Package credui.dll 6.1.7601.17514 Credential Manager Us er Interface crppresentation.dll 6.1.7600.16385 Conference Room Proje ctor : Presentation crtdll.dll 4.0.1183.1 Microsoft C Runtime L ibrary crypt32.dll 6.1.7601.17514 Crypto API32 cryptbase.dll 6.1.7600.16385 Base cryptographic AP I DLL cryptdlg.dll 6.1.7600.16385 Microsoft Common Cert ificate Dialogs cryptdll.dll 6.1.7600.16385 Cryptography Manager cryptext.dll 6.1.7600.16385 Crypto Shell Extensio ns cryptnet.dll 6.1.7600.16385 Crypto Network Relate d API cryptsp.dll 6.1.7600.16385 Cryptographic Service Provider API cryptsvc.dll 6.1.7601.17514 Cryptographic Service s cryptui.dll 6.1.7601.17514 Microsoft Trust UI Pr ovider cryptxml.dll 6.1.7600.16385 XML DigSig API cscapi.dll 6.1.7601.17514 Offline Files Win32 A PI cscdll.dll 6.1.7601.17514 Offline Files Tempora ry Shim cscmig.dll 6.1.7601.17514 Microsoft Offline Fil es Migration Plugin cscobj.dll 6.1.7601.17514 In-proc COM object us ed by clients of CSC API cscsvc.dll 6.1.7601.17514 CSC Service DLL cscui.dll 6.1.7601.17514 Client Side Caching U I csrsrv.dll 6.1.7600.16385 Client Server Runtime Process ctl3d32.dll 2.31.0.0 Ctl3D 3D Windows Cont rols ctl3dv2.dll 2.99.0.0 Ctl3D 3D Windows NT(W OW) Controls d2d1.dll 6.1.7601.17514 Microsoft D2D Library d3d10.dll 6.1.7600.16385 10 Runtime d3d10_1.dll 6.1.7600.16385 Direct3D 10.1 Runtime d3d10_1core.dll 6.1.7601.17514 Direct3D 10.1 Runtime d3d10core.dll 6.1.7600.16385 Direct3D 10 Runtime d3d10level9.dll 6.1.7601.17514 Direct3D 10 to Direct 3D9 Translation Runtime d3d10warp.dll 6.1.7601.17514 Direct3D 10 Rasterize r d3d11.dll 6.1.7601.17514 Direct3D 11 Runtime d3d8.dll 6.1.7600.16385 Microsoft Direct3D d3d8thk.dll 6.1.7600.16385 Microsoft Direct3D OS Thunk Layer d3d9.dll 6.1.7601.17514 Direct3D 9 Runtime d3dcompiler_33.dll 9.18.904.15 Microsoft Direct3D d3dcompiler_34.dll 9.19.949.46 Microsoft Direct3D d3dcompiler_35.dll 9.19.949.1104 Microsoft Direct3D d3dcompiler_36.dll 9.19.949.2111 Microsoft Direct3D d3dcompiler_37.dll 9.22.949.2248 Microsoft Direct3D d3dcompiler_38.dll 9.23.949.2378 Microsoft Direct3D d3dcompiler_39.dll 9.24.949.2307 Microsoft Direct3D d3dcompiler_40.dll 9.24.950.2656 Direct3D HLSL Compile r d3dcompiler_41.dll 9.26.952.2844 Direct3D HLSL Compile r d3dcompiler_42.dll 9.27.952.3022 Direct3D HLSL Compile r d3dcompiler_43.dll 9.29.952.3111 Direct3D HLSL Compile r d3dcsx_42.dll 9.27.952.3022 Direct3D 10.1 Extensi ons d3dcsx_43.dll 9.29.952.3111 Direct3D 10.1 Extensi ons d3dim.dll 6.1.7600.16385 Microsoft Direct3D d3dim700.dll 6.1.7600.16385 Microsoft Direct3D d3dramp.dll 6.1.7600.16385 Microsoft Direct3D d3dx10.dll 9.16.843.0 Microsoft Direct3D d3dx10_33.dll 9.18.904.21 Microsoft Direct3D d3dx10_34.dll 9.19.949.46 Microsoft Direct3D d3dx10_35.dll 9.19.949.1104 Microsoft Direct3D d3dx10_36.dll 9.19.949.2009 Microsoft Direct3D d3dx10_37.dll 9.19.949.2187 Microsoft Direct3D d3dx10_38.dll 9.23.949.2378 Microsoft Direct3D d3dx10_39.dll 9.24.949.2307 Microsoft Direct3D d3dx10_40.dll 9.24.950.2656 Direct3D 10.1 Extensi ons d3dx10_41.dll 9.26.952.2844 Direct3D 10.1 Extensi ons d3dx10_42.dll 9.27.952.3001 Direct3D 10.1 Extensi ons d3dx10_43.dll 9.29.952.3111 Direct3D 10.1 Extensi ons d3dx11_42.dll 9.27.952.3022 Direct3D 10.1 Extensi ons d3dx11_43.dll 9.29.952.3111 Direct3D 10.1 Extensi ons d3dx9_24.dll 9.5.132.0 Microsoft® DirectX for Windows® d3dx9_25.dll 9.6.168.0 Microsoft® DirectX for Windows® d3dx9_26.dll 9.7.239.0 Microsoft® DirectX for Windows® d3dx9_27.dll 9.8.299.0 Microsoft® DirectX for Windows® d3dx9_28.dll 9.10.455.0 Microsoft® DirectX for Windows® d3dx9_29.dll 9.11.519.0 Microsoft® DirectX for Windows® d3dx9_30.dll 9.12.589.0 Microsoft® DirectX for Windows® d3dx9_31.dll 9.15.779.0 Microsoft® DirectX for Windows® d3dx9_32.dll 9.16.843.0 Microsoft® DirectX for Windows® d3dx9_33.dll 9.18.904.15 Microsoft® DirectX for Windows® d3dx9_34.dll 9.19.949.46 Microsoft® DirectX for Windows® d3dx9_35.dll 9.19.949.1104 Microsoft® DirectX for Windows® d3dx9_36.dll 9.19.949.2111 Microsoft® DirectX for Windows® d3dx9_37.dll 9.22.949.2248 Microsoft® DirectX for Windows® d3dx9_38.dll 9.23.949.2378 Microsoft® DirectX for Windows® d3dx9_39.dll 9.24.949.2307 Microsoft® DirectX for Windows® d3dx9_40.dll 9.24.950.2656 Direct3D 9 Extensions d3dx9_41.dll 9.26.952.2844 Direct3D 9 Extensions d3dx9_42.dll 9.27.952.3001 Direct3D 9 Extensions d3dx9_43.dll 9.29.952.3111 Direct3D 9 Extensions d3dxof.dll 6.1.7600.16385 DirectX Files DLL dataclen.dll 6.1.7600.16385 Disk Space Cleaner fo r Windows davclnt.dll 6.1.7601.17514 Web DAV Client DLL davhlpr.dll 6.1.7600.16385 DAV Helper DLL dbgeng.dll 6.1.7601.17514 Windows Symbolic Debu gger Engine dbghelp.dll 6.1.7601.17514 Windows Image Helper dbnetlib.dll 6.1.7600.16385 Winsock Oriented Net DLL for SQL Clients dbnmpntw.dll 6.1.7600.16385 Named Pipes Net DLL f or SQL Clients dciman32.dll 6.1.7600.16385 DCI Manager ddaclsys.dll 6.1.7600.16385 SysPrep module for Re seting Data Drive ACL ddeml.dll 3.50.0.103 DDE Management librar y ddoiproxy.dll 6.1.7600.16385 DDOI Interface Proxy ddores.dll 6.1.7600.16385 Device Category infor mation and resources ddraw.dll 6.1.7600.16385 Microsoft DirectDraw ddrawex.dll 6.1.7600.16385 Direct Draw Ex defaultlocationcpl.dll 6.1.7601.17514 Default Location Cont rol Panel defragproxy.dll 6.1.7600.16385 Microsoft® Disk Defragm enter Proxy Library defragsvc.dll 6.1.7600.16385 Microsoft\Disk Defrag menter deployjava1.dll 10.25.2.17 Java(TM) Platform SE binary deskadp.dll 6.1.7600.16385 Advanced display adap ter properties deskmon.dll 6.1.7600.16385 Advanced display moni tor properties deskperf.dll 6.1.7600.16385 Advanced display perf ormance properties devenum.dll 6.6.7600.16385 Device enumeration. devicecenter.dll 6.1.7601.17514 Device Center devicedisplaystatusmanager.dll 6.1.7600.16385 Device Display S tatus Manager devicemetadataparsers.dll 6.1.7600.16385 Common Device Metadat a parsers devicepairing.dll 6.1.7600.16385 Shell extensions for Device Pairing devicepairingfolder.dll 6.1.7601.17514 Device Pairing Folder devicepairinghandler.dll 6.1.7600.16385 Device Pairing Handle r Dll devicepairingproxy.dll 6.1.7600.16385 Device Pairing Proxy Dll deviceuxres.dll 6.1.7600.16385 Windows Device User E xperience Resource File devmgr.dll 6.1.7600.16385 Device Manager MMC Sn apin devobj.dll 6.1.7600.16385 Device Information Se t DLL devrtl.dll 6.1.7600.16385 Device Management Run Time Library dfdts.dll 6.1.7600.16385 Windows Disk Failure Diagnostic Module dfscli.dll 6.1.7600.16385 Windows NT Distribute d File System Client DLL dfshim.dll 4.0.40305.0 ClickOnce Application Deployment Support Library dfsshlex.dll 6.1.7600.16385 Distributed File Syst em shell extension dhcpcmonitor.dll 6.1.7600.16385 DHCP Client Monitor D ll dhcpcore.dll 6.1.7601.17514 DHCP Client Service dhcpcore6.dll 6.1.7600.16385 DHCPv6 Client dhcpcsvc.dll 6.1.7600.16385 DHCP Client Service dhcpcsvc6.dll 6.1.7600.16385 DHCPv6 Client dhcpqec.dll 6.1.7600.16385 Microsoft DHCP NAP En forcement Client dhcpsapi.dll 6.1.7600.16385 DHCP Server API Stub DLL diagcpl.dll 6.1.7601.17514 Troubleshooting Contr ol Panel diagperf.dll 6.1.7601.17514 Microsoft Performance Diagnostics difx32.dll 2.1.0.0 Driver Install Framew orks for API library module difxapi.dll 2.1.0.0 Driver Install Framew orks for API library module dimsjob.dll 6.1.7600.16385 DIMS Job DLL dimsroam.dll 6.1.7600.16385 Key Roaming DIMS Prov ider DLL dinput.dll 6.1.7600.16385 Microsoft DirectInput dinput8.dll 6.1.7600.16385 Microsoft DirectInput directdb.dll 6.1.7600.16385 Microsoft Direct Data base API diskcopy.dll 6.1.7600.16385 Windows DiskCopy dispci.dll 6.1.7600.16385 Microsoft Display Cla ss Installer dispex.dll 5.8.7600.16385 Microsoft ® DispEx display.dll 6.1.7601.17514 Display Control Panel dmband.dll 6.1.7600.16385 Microsoft DirectMusic Band dmcompos.dll 6.1.7600.16385 Microsoft DirectMusic Composer dmdlgs.dll 6.1.7600.16385 Disk Management Snap- in Dialogs dmdskmgr.dll 6.1.7600.16385 Disk Management Snap- in Support Library dmdskres.dll 6.1.7600.16385 Disk Management Snap- in Resources dmdskres2.dll 6.1.7600.16385 Disk Management Snap- in Resources dmime.dll 6.1.7600.16385 Microsoft DirectMusic Interactive Engine dmintf.dll 6.1.7600.16385 Disk Management DCOM Interface Stub dmloader.dll 6.1.7600.16385 Microsoft DirectMusic Loader dmocx.dll 6.1.7600.16385 TreeView OCX dmrc.dll 6.1.7600.16385 Windows MRC dmscript.dll 6.1.7600.16385 Microsoft DirectMusic Scripting dmstyle.dll 6.1.7600.16385 Microsoft DirectMusic Style Engline dmsynth.dll 6.1.7600.16385 Microsoft DirectMusic dmusic.dll 6.1.7600.16385 Microsoft DirectMusic Core Services dmutil.dll 6.1.7600.16385 Logical Disk Manager Utility Library dmvdsitf.dll 6.1.7600.16385 Disk Management Snap- in Support Library dmvscres.dll 6.1.7601.17514 Virtual Machine Dynam ic Memory Resource DLL dnsapi.dll 6.1.7601.17514 DNS Client API DLL dnscmmc.dll 6.1.7601.17514 DNS Client MMC Snap-i n DLL dnsext.dll 6.1.7600.16385 DNS extension DLL dnshc.dll 6.1.7600.16385 DNS Helper Class dnsrslvr.dll 6.1.7601.17514 DNS Caching Resolver Service docprop.dll 6.1.7600.16385 OLE DocFile Property Page documentperformanceevents.dll 6.1.7600.16385 Documents and Pri nting Performance Events dot3api.dll 6.1.7601.17514 802.3 Autoconfigurati on API dot3cfg.dll 6.1.7601.17514 802.3 Netsh Helper dot3dlg.dll 6.1.7600.16385 802.3 UI Helper dot3gpclnt.dll 6.1.7600.16385 802.3 Group Policy Cl ient dot3gpui.dll 6.1.7600.16385 802.3 Network Policy Management Snap-in dot3hc.dll 6.1.7600.16385 Dot3 Helper Class dot3msm.dll 6.1.7601.17514 802.3 Media Specific Module dot3svc.dll 6.1.7601.17514 Wired AutoConfig Serv ice dot3ui.dll 6.1.7601.17514 802.3 Advanced UI dpapiprovider.dll 6.1.7600.16385 dpapiprovider DLL dplayx.dll 6.1.7600.16385 Microsoft DirectPlay dpmodemx.dll 6.1.7600.16385 Modem and Serial Conn ection For DirectPlay dpnaddr.dll 6.1.7601.17514 Microsoft DirectPlay8 Address dpnathlp.dll 6.1.7600.16385 Microsoft DirectPlay NAT Helper UPnP dpnet.dll 6.1.7600.16385 Microsoft DirectPlay dpnhpast.dll 6.1.7600.16385 Microsoft DirectPlay NAT Helper PAST dpnhupnp.dll 6.1.7600.16385 Microsoft DirectPlay NAT Helper UPNP dpnlobby.dll 6.1.7600.16385 Microsoft DirectPlay8 Lobby dps.dll 6.1.7601.17514 WDI Diagnostic Policy Service dpwsockx.dll 6.1.7600.16385 Internet TCP/IP and I PX Connection For DirectPlay dpx.dll 6.1.7601.17514 Microsoft(R) Delta Pa ckage Expander drmmgrtn.dll 11.0.7601.17514 DRM Migration DLL drmv2clt.dll 11.0.7600.16385 DRMv2 Client DLL drprov.dll 6.1.7600.16385 Microsoft Remote Desk top Session Host Server Network Provider drt.dll 6.1.7600.16385 Distributed Routing T able drtprov.dll 6.1.7600.16385 Distributed Routing T able Providers drttransport.dll 6.1.7600.16385 Distributed Routing T able Transport Provider drvstore.dll 6.1.7601.17514 Driver Store API ds16gt.dll 3.510.3711.0 Microsoft ODBC Driver Setup Generic Thunk ds32gt.dll 6.1.7600.16385 ODBC Driver Setup Gen eric Thunk dsauth.dll 6.1.7601.17514 DS Authorization for Services dsdmo.dll 6.1.7600.16385 DirectSound Effects dshowrdpfilter.dll 1.0.0.0 RDP Renderer Filter ( redirector) dskquota.dll 6.1.7600.16385 Windows Shell Disk Qu ota Support DLL dskquoui.dll 6.1.7601.17514 Windows Shell Disk Qu ota UI DLL dsound.dll 6.1.7600.16385 DirectSound dsprop.dll 6.1.7600.16385 Windows Active Direct ory Property Pages dsquery.dll 6.1.7600.16385 Directory Service Fin d dsrole.dll 6.1.7600.16385 DS Role Client DLL dssec.dll 6.1.7600.16385 Directory Service Sec urity UI dssenh.dll 6.1.7600.16385 Microsoft Enhanced DS S and Diffie-Hellman Cryptographic Provider dsuiext.dll 6.1.7601.17514 Directory Service Com mon UI dswave.dll 6.1.7600.16385 Microsoft DirectMusic Wave dtsh.dll 6.1.7600.16385 Detection and Sharing Status API dui70.dll 6.1.7600.16385 Windows DirectUI Engi ne duser.dll 6.1.7600.16385 Windows DirectUser En gine dwmapi.dll 6.1.7600.16385 Microsoft Desktop Win dow Manager API dwmcore.dll 6.1.7601.17514 Microsoft DWM Core Li brary dwmredir.dll 6.1.7601.17514 Microsoft Desktop Win dow Manager Redirection Component dwrite.dll 6.1.7601.17514 Microsoft DirectX Typ ography Services dxdiagn.dll 6.1.7601.17514 Microsoft DirectX Dia gnostic Tool dxgi.dll 6.1.7601.17514 DirectX Graphics Infr astructure dxmasf.dll 12.0.7601.17514 Microsoft Windows Med ia Component Removal File. dxp.dll 6.1.7601.17514 Device Stage Shell Ex tension dxpps.dll 6.1.7600.16385 Device Experience Pla tform Proxy\Stub DLL dxptaskringtone.dll 6.1.7601.17514 Microsoft Ringtone Ed itor dxptasksync.dll 6.1.7601.17514 Microsoft Windows DXP Sync. dxtmsft.dll 8.0.7600.16385 DirectX Media -- Imag e DirectX Transforms dxtrans.dll 8.0.7600.16385 DirectX Media -- Dire ctX Transform Core dxva2.dll 6.1.7600.16385 DirectX Video Acceler ation 2.0 DLL eapp3hst.dll 6.1.7601.17514 Microsoft ThirdPartyE apDispatcher eappcfg.dll 6.1.7600.16385 Eap Peer Config eappgnui.dll 6.1.7601.17514 EAP Generic UI eapphost.dll 6.1.7601.17514 Microsoft EAPHost Pee r service eappprxy.dll 6.1.7600.16385 Microsoft EAPHost Pee r Client DLL eapqec.dll 6.1.7600.16385 Microsoft EAP NAP Enf orcement Client eapsvc.dll 6.1.7600.16385 Microsoft EAPHost ser vice efsadu.dll 6.1.7600.16385 File Encryption Utili ty efscore.dll 6.1.7601.17514 EFS Core Library efslsaext.dll 6.1.7600.16385 LSA extension for EFS efssvc.dll 6.1.7600.16385 EFS Service efsutil.dll 6.1.7600.16385 EFS Utility Library ehstorapi.dll 6.1.7601.17514 Windows Enhanced Stor age API ehstorpwdmgr.dll 6.1.7600.16385 Windows Enhanced Stor age Password Manager ehstorshell.dll 6.1.7600.16385 Windows Enhanced Stor age Shell Extension DLL els.dll 6.1.7600.16385 Snapin elscore.dll 6.1.7600.16385 Els Core Platform DLL elslad.dll 6.1.7600.16385 ELS Language Detectio n elstrans.dll 6.1.7601.17514 ELS Transliteration S ervice encapi.dll 6.1.7600.16385 Encoder API encdec.dll 6.6.7601.17514 XDSCodec & Encypter/ Decrypter Tagger Filters. encdump.dll 5.0.1.1 Cras h Dump Encryption DLL energy.dll 6.1.7600.16385 Power Efficiency Diag nostics eqossnap.dll 6.1.7600.16385 EQoS Snapin extension es.dll 2001.12.8530.16385 COM+ esent.dll 6.1.7601.17514 Extensible Storage En gine for Microsoft(R) Windows(R) esentprf.dll 6.1.7600.16385 Extensible Storage En gine Performance Monitoring Library for Microsoft(R) Windows(R) eventcls.dll 6.1.7600.16385 Microsoft® Volume Shado w Copy Service event class evr.dll 6.1.7601.17514 Enhanced Video Render er DLL explorerframe.dll 6.1.7601.17514 ExplorerFrame expsrv.dll 6.0.72.9589 Visual Basic for Appl ications Runtime - Expression Service f3ahvoas.dll 6.1.7600.16385 JP Japanese for Fujitsu FMV oyayubi-shift keyboard faultrep.dll 6.1.7601.17514 Windows User Mode Cra sh Reporting DLL fdbth.dll 6.1.7600.16385 Function Discovery Bl uetooth Provider Dll fdbthproxy.dll 6.1.7600.16385 Bluetooth Provider Pr oxy Dll fde.dll 6.1.7601.17514 Folder Redirection Sn apin Extension fdeploy.dll 6.1.7601.17514 Folder Redirection Gr oup Policy Extension fdphost.dll 6.1.7600.16385 Function Discovery Pr ovider host service fdpnp.dll 6.1.7600.16385 Pnp Provider Dll fdprint.dll 6.1.7600.16385 Function Discovery Pr int Provider Dll fdproxy.dll 6.1.7600.16385 Function Discovery Pr oxy Dll fdrespub.dll 6.1.7600.16385 Function Discovery Re source Publication Service fdssdp.dll 6.1.7600.16385 Function Discovery SS DP Provider Dll fdwcn.dll 6.1.7600.16385 Windows Connect Now - Config Function Discovery Provider DLL fdwnet.dll 6.1.7600.16385 Function Discovery WN et Provider Dll fdwsd.dll 6.1.7600.16385 Function Discovery WS Discovery Provider Dll feclient.dll 6.1.7600.16385 Windows NT File Encry ption Client Interfaces ff_vfw.dll filemgmt.dll 6.1.7600.16385 Services and Shared F olders findnetprinters.dll 6.1.7600.16385 Find Network Printers COM Component firewallapi.dll 6.1.7600.16385 Windows Firewall API firewallcontrolpanel.dll 6.1.7601.17514 Windows Firewall Cont rol Panel fltlib.dll 6.1.7600.16385 Filter Library fm20.dll 14.0.4730.1010 Microsoft® Forms DLL fm20enu.dll 14.0.4730.1010 Microsoft® Forms Intern ational DLL fmifs.dll 6.1.7600.16385 FM IFS Utility DLL fms.dll 1.1.6000.16384 Font Management Servi ces fntcache.dll 6.1.7601.17514 Windows Font Cache Se rvice fontext.dll 6.1.7601.17514 Windows Font Folder fontsub.dll 6.1.7601.17514 Font Subsetting DLL fphc.dll 6.1.7601.17514 Filtering Platform He lper Class framebuf.dll 6.1.7600.16385 Framebuffer Display D river framedyn.dll 6.1.7601.17514 WMI SDK Provider Fram ework framedynos.dll 6.1.7601.17514 WMI SDK Provider Fram ework fthsvc.dll 6.1.7600.16385 Microsoft Windows Fau lt Tolerant Heap Diagnostic Module fundisc.dll 6.1.7600.16385 Function Discovery Dl l fveapi.dll 6.1.7601.17514 Windows BitLocker Dri ve Encryption API fveapibase.dll 6.1.7600.16385 Windows BitLocker Dri ve Encryption Base API fvecerts.dll 6.1.7600.16385 BitLocker Certificate s Library fvecpl.dll 6.1.7601.17514 BitLocker Drive Encry ption control panel fverecover.dll 6.1.7600.16385 Windows BitLocker Dri ve Encryption User Interface fveui.dll 6.1.7600.16385 BitLocker Drive Encry ption UI fvewiz.dll 6.1.7600.16385 BitLocker Drive Encry ption Wizard fwcfg.dll 6.1.7600.16385 Windows Firewall Conf iguration Helper fwpuclnt.dll 6.1.7601.17514 FWP/IPsec User-Mode A PI fwremotesvr.dll 6.1.7600.16385 Windows Firewall Remo te APIs Server fxsapi.dll 6.1.7600.16385 Microsoft Fax API Su pport DLL fxscom.dll 6.1.7600.16385 Microsoft Fax Server COM Client Interface fxscomex.dll 6.1.7600.16385 Microsoft Fax Server Extended COM Client Interface fxscompose.dll 6.1.7600.16385 Compose Form fxscomposeres.dll 6.1.7600.16385 Fax Compose fxsevent.dll 6.1.7600.16385 Microsoft Fax EventL og Support DLL fxsext32.dll 6.1.7600.16385 Microsoft Fax Exchan ge Command Extension fxsmon.dll 6.1.7601.17514 Microsoft Fax Print Monitor fxsresm.dll 6.1.7600.16385 Microsoft Fax Resour ce DLL fxsroute.dll 6.1.7600.16385 Microsoft Fax Routin g DLL fxsst.dll 6.1.7600.16385 Fax Service fxst30.dll 6.1.7600.16385 Microsoft Fax T30 Pr otocol Service Provider fxstiff.dll 6.1.7601.17514 Microsoft Fax TIFF l ibrary fxsutility.dll 6.1.7600.16385 Fax Utility DLL fxsxp32.dll 6.1.7600.16385 Microsoft Fax Transp ort Provider gacinstall.dll 6.1.7600.16385 Installers for CLR an d other managed code gameux.dll 6.1.7601.17514 Games Explorer gameuxlegacygdfs.dll 1.0.0.1 Legacy GDF resource D LL gcdef.dll 6.1.7600.16385 Game Controllers Defa ult Sheets gdi32.dll 6.1.7601.17514 GDI Client DLL getuname.dll 6.1.7600.16385 Unicode name Dll for UCE glmf32.dll 6.1.7600.16385 OpenGL Metafiling DLL glu32.dll 6.1.7600.16385 OpenGL Utility Librar y DLL gpapi.dll 6.1.7600.16385 Group Policy Client A PI gpedit.dll 6.1.7600.16385 GPEdit gpprefcl.dll 6.1.7601.17514 Group Policy Preferen ce Client gpprnext.dll 6.1.7600.16385 Group Policy Printer Extension gpscript.dll 6.1.7600.16385 Script Client Side Ex tension gpsvc.dll 6.1.7601.17514 Group Policy Client gptext.dll 6.1.7600.16385 GPTExt groupinghc.dll 6.1.7600.16385 Grouping Helper Class hal.dll 6.1.7601.17514 Hardware Abstraction Layer DLL halacpi.dll 6.1.7601.17514 Hardware Abstraction Layer DLL halmacpi.dll 6.1.7601.17514 Hardware Abstraction Layer DLL hbaapi.dll 6.1.7601.17514 HBA API data interfac e dll for HBA_API_Rev_2-18_2002MAR1.doc hccutils.dll 3.0.0.4704 hccutils Module hcproviders.dll 6.1.7600.16385 Action Center Provide rs helppaneproxy.dll 6.1.7600.16385 Microsoft® Help Proxy hgcpl.dll 6.1.7601.17514 HomeGroup Control Pan el hgprint.dll 6.1.7601.17514 HomeGroup Printing Su pport hhsetup.dll 6.1.7600.16385 Microsoft® HTML Help hid.dll 6.1.7600.16385 Hid User Library hidserv.dll 6.1.7600.16385 HID Service hlink.dll 6.1.7600.16385 2000 component hnetcfg.dll 6.1.7600.16385 Home Networking Confi guration Manager hnetmon.dll 6.1.7600.16385 Home Networking Monit or DLL hotplug.dll 6.1.7600.16385 Safely Remove Hardwar e applet hotstartuseragent.dll 6.1.7601.17514 Microsoft Windows Hot Start User Agent httpapi.dll 6.1.7601.17514 HTTP Protocol Stack A PI htui.dll 6.1.7600.16385 Common halftone Color Adjustment Dialogs ias.dll 6.1.7600.16385 Network Policy Server iasacct.dll 6.1.7601.17514 NPS Accounting Provid er iasads.dll 6.1.7600.16385 NPS Active Directory Data Store iasdatastore.dll 6.1.7600.16385 NPS Datastore server iashlpr.dll 6.1.7600.16385 NPS Surrogate Compone nt iasmigplugin.dll 6.1.7600.16385 NPS Migration DLL iasnap.dll 6.1.7600.16385 NPS NAP Provider iaspolcy.dll 6.1.7600.16385 NPS Pipeline iasrad.dll 6.1.7601.17514 NPS RADIUS Protocol C omponent iasrecst.dll 6.1.7601.17514 NPS XML Datastore Acc ess iassam.dll 6.1.7600.16385 NPS NT SAM Provider iassdo.dll 6.1.7600.16385 NPS SDO Component iassvcs.dll 6.1.7600.16385 NPS Services Componen t icaapi.dll 6.1.7601.17514 DLL Interface to Term DD Device Driver icardie.dll 8.0.7600.16385 Microsoft Information Card IE Helper icardres.dll 3.0.4506.4926 Windows CardSpace iccoinstall.dll 6.1.7601.17514 Hyper-V Integration C omponents Coinstaller iccvid.dll 1.10.0.13 Cinepak® Codec icfupgd.dll 6.1.7600.16385 Windows Firewal ICF S ettings Upgrade icm32.dll 6.1.7600.16385 Microsoft Color Manag ement Module (CMM) icmp.dll 6.1.7600.16385 ICMP DLL icmui.dll 6.1.7600.16385 Microsoft Color Match ing System User Interface DLL iconcodecservice.dll 6.1.7600.16385 Converts a PNG part o f the icon to a legacy bmp icon icsigd.dll 6.1.7600.16385 Internet Gateway Devi ce properties idlisten.dll 6.1.7600.16385 Identity Listener idndl.dll 6.1.7600.16385 Downlevel DLL idstore.dll 6.1.7600.16385 Identity Store ieakeng.dll 8.0.7600.16385 Internet Explorer Adm inistration Kit Engine Library ieaksie.dll 8.0.7600.16385 Internet Explorer Sna p-in Extension to Group Policy ieakui.dll 8.0.7600.16385 Microsoft IEAK Shared UI DLL ieapfltr.dll 8.0.6001.18669 Microsoft SmartScreen Filter iedkcs32.dll 18.0.7601.17514 IEAK branding ieframe.dll 8.0.7601.17514 Internet Browser iepeers.dll 8.0.7601.17514 Internet Explorer Pee r Objects iernonce.dll 8.0.7600.16385 Extended RunOnce proc essing with UI iertutil.dll 8.0.7601.17514 Run time utility for Internet Explorer iesetup.dll 8.0.7600.16385 IOD Version Map iesysprep.dll 8.0.7601.17514 IE Sysprep Provider ieui.dll 8.0.7600.16385 Internet Explorer UI Engine ifmon.dll 6.1.7600.16385 IF Monitor DLL ifsutil.dll 6.1.7601.17514 IFS Utility DLL ifsutilx.dll 6.1.7600.16385 IFS Utility Extension DLL igddiag.dll 6.1.7600.16385 IGD Helper Class igfxcoin_v4704.dll igfxdev.dll 3.0.0.4704 igfxdev Module igfxdo.dll 3.0.0.4704 igfxdo Module igfxexps.dll 3.0.0.4704 igfxext Module igfxpph.dll 3.0.0.4704 igfxpph Module igfxres.dll 3.0.0.4704 igfxres Module igfxress.dll 3.0.0.4704 igfxress Module igfxsrvc.dll 3.0.0.4704 igfxsrvc Module igldev32.dll 6.14.10.4704 OpenGL(R) Device Driv er for Intel(R) Graphics Accelerator iglicd32.dll 6.14.10.4704 OpenGL(R) Driver for Intel(R) Graphics Accelerator igxpdv32.dll 6.14.10.4704 Component GHAL Driver igxpdx32.dll 6.14.10.4704 DirectDraw(R) Driver for Intel(R) Graphics Technology igxpgd32.dll 6.14.10.4704 Intel Graphics 2D Dri ver igxprd32.dll 6.14.10.4704 Intel Graphics 2D Rot ation Driver ikeext.dll 6.1.7601.17514 IKE extension imagehlp.dll 6.1.7601.17514 Windows NT Image Help er imageres.dll 6.1.7600.16385 Windows Image Resourc e imagesp1.dll 6.1.7600.16385 Windows SP1 Image Res ource imagx7.dll 7.0.74.0 ImagX7 Dynamic Link L ibrary imagxpr7.dll 7.0.74.0 ImagXpr7 Module imagxr7.dll 7.0.495.0 ImagXR7 Dynamic Link Library imagxra7.dll 7.0.495.0 ImagXRA7 Dynamic Link Library imapi.dll 6.1.7600.16385 Image Mastering API imapi2.dll 6.1.7601.17514 Image Mastering API v 2 imapi2fs.dll 6.1.7601.17514 Image Mastering File System Imaging API v2 imgutil.dll 8.0.7601.17514 IE plugin image decod er support DLL imjp10k.dll 10.1.7600.16385 Microsoft IME imm32.dll 6.1.7601.17514 Multi-User Windows IM M32 API Client DLL inetcomm.dll 6.1.7601.17514 Microsoft Internet Me ssaging API Resources inetmib1.dll 6.1.7601.17514 Microsoft MIB-II suba gent inetpp.dll 6.1.7601.17514 Internet Print Provid er DLL inetppui.dll 6.1.7600.16385 Internet Print Client DLL inetres.dll 6.1.7600.16385 Microsoft Internet Me ssaging API Resources infocardapi.dll 3.0.4506.4926 Microsoft InfoCards inked.dll 6.1.7600.16385 Microsoft Tablet PC I nkEdit Control input.dll 6.1.7601.17514 InputSetting DLL inseng.dll 8.0.7601.17514 Install engine iologmsg.dll 6.1.7600.16385 IO Logging DLL ipbusenum.dll 6.1.7600.16385 PnP-X IP Bus Enumerat or DLL ipbusenumproxy.dll 6.1.7600.16385 Associated Device Pre sence Proxy Dll iphlpapi.dll 6.1.7601.17514 IP Helper API iphlpsvc.dll 6.1.7601.17514 Service that offers I Pv6 connectivity over an IPv4 network. ipnathlp.dll 6.1.7600.16385 Microsoft NAT Helper Components iprop.dll 6.1.7600.16385 OLE PropertySet Imple mentation iprtprio.dll 6.1.7600.16385 IP Routing Protocol P riority DLL iprtrmgr.dll 6.1.7601.17514 IP Router Manager ipsecsnp.dll 6.1.7600.16385 IP Security Policy Ma nagement Snap-in ipsecsvc.dll 6.1.7601.17514 Windows IPsec SPD Ser ver DLL ipsmsnap.dll 6.1.7601.17514 IP Security Monitor S nap-in ir32_32.dll 3.24.15.3 Intel Indeo(R) Video R3.2 32-bit Driver ir41_qc.dll 4.30.62.2 Intel Indeo® Video Inte ractive Quick Compressor ir41_qcx.dll 4.30.62.2 Intel Indeo® Video Inte ractive Quick Compressor ir50_32.dll 5.2562.15.55 Intel Indeo® video 5.10 ir50_qc.dll 5.0.63.48 Intel Indeo® video 5.10 Quick Compressor ir50_qcx.dll 5.0.63.48 Intel Indeo® video 5.10 Quick Compressor irclass.dll 6.1.7600.16385 Infrared Class Coinst aller irmon.dll 6.1.7600.16385 Infrared Monitor iscsicpl.dll 5.2.3790.1830 iSCSI Initiator Contr ol Panel Applet iscsidsc.dll 6.1.7600.16385 iSCSI Discovery api iscsied.dll 6.1.7600.16385 iSCSI Extension DLL iscsiexe.dll 6.1.7600.16385 iSCSI Discovery servi ce iscsilog.dll 6.1.7600.16385 iSCSI Event Log DLL iscsium.dll 6.1.7601.17514 iSCSI Discovery api iscsiwmi.dll 6.1.7600.16385 MS iSCSI Initiator WM I Provider itircl.dll 6.1.7601.17514 Microsoft® InfoTech IR Local DLL itss.dll 6.1.7600.16385 Microsoft® InfoTech Sto rage System Library itvdata.dll 6.6.7601.17514 iTV Data Filters. iyuv_32.dll 6.1.7601.17514 Intel Indeo(R) Video YUV Codec jnwmon.dll 0.3.7600.16385 Windows Journal Port Monitor DLL .dll 5.8.7601.17514 Microsoft ® JScript jsproxy.dll 8.0.7600.16385 JScript Proxy Auto-Co nfiguration kbd101.dll 6.1.7600.16385 JP Japanese Keyboard Layout for 101 kbd101a.dll 6.1.7600.16385 KO Hangeul Keyboard L ayout for 101 (Type A) kbd101b.dll 6.1.7600.16385 KO Hangeul Keyboard L ayout for 101(Type B) kbd101c.dll 6.1.7600.16385 KO Hangeul Keyboard L ayout for 101(Type C) kbd103.dll 6.1.7600.16385 KO Hangeul Keyboard L ayout for 103 kbd106.dll 6.1.7600.16385 JP Japanese Keyboard Layout for 106 kbd106n.dll 6.1.7600.16385 JP Japanese Keyboard Layout for 106 kbda1.dll 6.1.7600.16385 Arabic_English_101 Ke yboard Layout kbda2.dll 6.1.7600.16385 Arabic_2 Keyboard Lay out kbda3.dll 6.1.7600.16385 Arabic_French_102 Key board Layout kbdal.dll 6.1.7600.16385 Albania Keyboard Layo ut kbdarme.dll 6.1.7600.16385 Eastern Armenian Keyb oard Layout kbdarmw.dll 6.1.7600.16385 Western Armenian Keyb oard Layout kbdax2.dll 6.1.7600.16385 JP Japanese Keyboard Layout for AX2 kbdaze.dll 6.1.7600.16385 Azerbaijan_Cyrillic K eyboard Layout kbdazel.dll 6.1.7600.16385 Azeri-Latin Keyboard Layout kbdbash.dll 6.1.7601.17514 Bashkir Keyboard Layo ut kbdbe.dll 6.1.7600.16385 Belgian Keyboard Layo ut kbdbene.dll 6.1.7600.16385 Belgian Dutch Keyboar d Layout kbdbgph.dll 6.1.7600.16385 Bulgarian Phonetic Ke yboard Layout kbdbgph1.dll 6.1.7600.16385 Bulgarian (Phonetic T raditional) Keyboard Layout kbdbhc.dll 6.1.7600.16385 Bosnian (Cyrillic) Ke yboard Layout kbdblr.dll 6.1.7601.17514 Belarusian Keyboard L ayout kbdbr.dll 6.1.7600.16385 Brazilian Keyboard La yout kbdbu.dll 6.1.7600.16385 Bulgarian ( ) Keyboard Layout kbdbulg.dll 6.1.7601.17514 Bulgarian Keyboard La yout kbdca.dll 6.1.7600.16385 Canadian Multilingual Keyboard Layout kbdcan.dll 6.1.7600.16385 Canadian Multilingual Standard Keyboard Layout kbdcr.dll 6.1.7600.16385 Croatian/Slovenian Ke yboard Layout kbdcz.dll 6.1.7600.16385 Czech Keyboard Layout kbdcz1.dll 6.1.7601.17514 Czech_101 Keyboard La yout kbdcz2.dll 6.1.7600.16385 Czech_Programmer's Ke yboard Layout kbdda.dll 6.1.7600.16385 Danish Keyboard Layou t kbddiv1.dll 6.1.7600.16385 Divehi Phonetic Keybo ard Layout kbddiv2.dll 6.1.7600.16385 Divehi Typewriter Key board Layout kbddv.dll 6.1.7600.16385 Dvorak US English Key board Layout kbdes.dll 6.1.7600.16385 Spanish Alernate Keyb oard Layout kbdest.dll 6.1.7600.16385 Estonia Keyboard Layo ut kbdfa.dll 6.1.7600.16385 Persian Keyboard Layo ut kbdfc.dll 6.1.7600.16385 Canadian French Keybo ard Layout kbdfi.dll 6.1.7600.16385 Finnish Keyboard Layo ut kbdfi1.dll 6.1.7600.16385 Finnish-Swedish with Sami Keyboard Layout kbdfo.dll 6.1.7600.16385 Færoese Keyboard Layout kbdfr.dll 6.1.7600.16385 French Keyboard Layou t kbdgae.dll 6.1.7600.16385 Gaelic Keyboard Layou t kbdgeo.dll 6.1.7601.17514 Georgian Keyboard Lay out kbdgeoer.dll 6.1.7600.16385 Georgian (Ergonomic) Keyboard Layout kbdgeoqw.dll 6.1.7600.16385 Georgian (QWERTY) Key board Layout kbdgkl.dll 6.1.7601.17514 Greek_Latin Keyboard Layout kbdgr.dll 6.1.7600.16385 German Keyboard Layou t kbdgr1.dll 6.1.7601.17514 German_IBM Keyboard L ayout kbdgrlnd.dll 6.1.7600.16385 Greenlandic Keyboard Layout kbdhau.dll 6.1.7600.16385 Hausa Keyboard Layout kbdhe.dll 6.1.7600.16385 Greek Keyboard Layout kbdhe220.dll 6.1.7600.16385 Greek IBM 220 Keyboar d Layout kbdhe319.dll 6.1.7600.16385 Greek IBM 319 Keyboar d Layout kbdheb.dll 6.1.7600.16385 KBDHEB Keyboard Layou t kbdhela2.dll 6.1.7600.16385 Greek IBM 220 Latin K eyboard Layout kbdhela3.dll 6.1.7600.16385 Greek IBM 319 Latin K eyboard Layout kbdhept.dll 6.1.7600.16385 Greek_Polytonic Keybo ard Layout kbdhu.dll 6.1.7600.16385 Hungarian Keyboard La yout kbdhu1.dll 6.1.7600.16385 Hungarian 101-key Key board Layout kbdibm02.dll 6.1.7600.16385 JP Japanese Keyboard Layout for IBM 5576-002/003 kbdibo.dll 6.1.7600.16385 Igbo Keyboard Layout kbdic.dll 6.1.7600.16385 Icelandic Keyboard La yout kbdinasa.dll 6.1.7600.16385 Assamese (Inscript) K eyboard Layout kbdinbe1.dll 6.1.7600.16385 Bengali - Inscript (L egacy) Keyboard Layout kbdinbe2.dll 6.1.7600.16385 Bengali (Inscript) Ke yboard Layout kbdinben.dll 6.1.7601.17514 Bengali Keyboard Layo ut kbdindev.dll 6.1.7600.16385 Keyboard L ayout kbdinguj.dll 6.1.7600.16385 Gujarati Keyboard Lay out kbdinhin.dll 6.1.7601.17514 Hindi Keyboard Layout kbdinkan.dll 6.1.7601.17514 Kannada Keyboard Layo ut kbdinmal.dll 6.1.7600.16385 Keyboard La yout Keyboard Layout kbdinmar.dll 6.1.7601.17514 Marathi Keyboard Layo ut kbdinori.dll 6.1.7601.17514 Oriya Keyboard Layout kbdinpun.dll 6.1.7600.16385 Punjabi/ Keyb oard Layout kbdintam.dll 6.1.7601.17514 Layout kbdintel.dll 6.1.7601.17514 Telugu Keyboard Layou t kbdinuk2.dll 6.1.7600.16385 Naqittaut K eyboard Layout kbdir.dll 6.1.7600.16385 Irish Keyboard Layout kbdit.dll 6.1.7600.16385 Italian Keyboard Layo ut kbdit142.dll 6.1.7600.16385 Italian 142 Keyboard Layout kbdiulat.dll 6.1.7600.16385 Inuktitut Latin Keybo ard Layout kbdjpn.dll 6.1.7600.16385 JP Japanese Keyboard Layout Stub driver kbdkaz.dll 6.1.7600.16385 Kazak_Cyrillic Keyboa rd Layout kbdkhmr.dll 6.1.7600.16385 Cambodian Standard Ke yboard Layout kbdkor.dll 6.1.7600.16385 KO Hangeul Keyboard L ayout Stub driver kbdkyr.dll 6.1.7600.16385 Kyrgyz Keyboard Layou t kbdla.dll 6.1.7600.16385 Latin-American Spanis h Keyboard Layout kbdlao.dll 6.1.7600.16385 Lao Standard Keyboard Layout kbdlk41a.dll 6.1.7601.17514 DEC LK411-AJ Keyboard Layout kbdlt.dll 6.1.7600.16385 Lithuania Keyboard La yout kbdlt1.dll 6.1.7601.17514 Lithuanian Keyboard L ayout kbdlt2.dll 6.1.7600.16385 Lithuanian Standard K eyboard Layout kbdlv.dll 6.1.7600.16385 Latvia Keyboard Layou t kbdlv1.dll 6.1.7600.16385 Latvia-QWERTY Keyboar d Layout kbdmac.dll 6.1.7600.16385 Macedonian (FYROM) Ke yboard Layout kbdmacst.dll 6.1.7600.16385 Macedonian (FYROM) - Standard Keyboard Layout kbdmaori.dll 6.1.7601.17514 Maori Keyboard Layout kbdmlt47.dll 6.1.7600.16385 Maltese 47-key Keyboa rd Layout kbdmlt48.dll 6.1.7600.16385 Maltese 48-key Keyboa rd Layout kbdmon.dll 6.1.7601.17514 Mongolian Keyboard La yout kbdmonmo.dll 6.1.7600.16385 Mongolian () Keyboard Layout kbdne.dll 6.1.7600.16385 Dutch Keyboard Layout kbdnec.dll 6.1.7600.16385 JP Japanese Keyboard Layout for (NEC PC-9800) kbdnec95.dll 6.1.7600.16385 JP Japanese Keyboard Layout for (NEC PC-9800 ) kbdnecat.dll 6.1.7600.16385 JP Japanese Keyboard Layout for (NEC PC-9800 on PC98-NX) kbdnecnt.dll 6.1.7600.16385 JP Japanese NEC PC-98 00 Keyboard Layout kbdnepr.dll 6.1.7601.17514 Nepali Keyboard Layou t kbdno.dll 6.1.7600.16385 Norwegian Keyboard La yout kbdno1.dll 6.1.7600.16385 Norwegian with Sami K eyboard Layout kbdnso.dll 6.1.7600.16385 Sesotho sa Leboa Keyb oard Layout kbdpash.dll 6.1.7600.16385 (Afghanistan) Keyboard Layout kbdpl.dll 6.1.7600.16385 Polish Keyboard Layou t kbdpl1.dll 6.1.7600.16385 Polish Programmer's K eyboard Layout kbdpo.dll 6.1.7601.17514 Portuguese Keyboard L ayout kbdro.dll 6.1.7600.16385 Romanian (Legacy) Key board Layout kbdropr.dll 6.1.7600.16385 Romanian (Programmers ) Keyboard Layout kbdrost.dll 6.1.7600.16385 Romanian (Standard) K eyboard Layout kbdru.dll 6.1.7600.16385 Russian Keyboard Layo ut kbdru1.dll 6.1.7600.16385 Russia(Typewriter) Ke yboard Layout kbdsf.dll 6.1.7601.17514 Swiss French Keyboard Layout kbdsg.dll 6.1.7601.17514 Swiss kbdsl.dll 6.1.7600.16385 Slovak Keyboard Layou t kbdsl1.dll 6.1.7600.16385 Slovak(QWERTY) Keyboa rd Layout kbdsmsfi.dll 6.1.7600.16385 Sami Extended Finland -Sweden Keyboard Layout kbdsmsno.dll 6.1.7600.16385 Sami Extended Norway Keyboard Layout kbdsn1.dll 6.1.7600.16385 Sinhala Keyboard Layo ut kbdsorex.dll 6.1.7600.16385 Sorbian Extended Keyb oard Layout kbdsors1.dll 6.1.7600.16385 Sorbian Standard Keyb oard Layout kbdsorst.dll 6.1.7600.16385 Sorbian Standard (Leg acy) Keyboard Layout kbdsp.dll 6.1.7600.16385 Spanish Keyboard Layo ut kbdsw.dll 6.1.7600.16385 Swedish Keyboard Layo ut kbdsw09.dll 6.1.7600.16385 Sinhala - Wij 9 Keybo ard Layout kbdsyr1.dll 6.1.7600.16385 Syriac Standard Keybo ard Layout kbdsyr2.dll 6.1.7600.16385 Syriac Phoenetic Keyb oard Layout kbdtajik.dll 6.1.7601.17514 Tajik Keyboard Layout kbdtat.dll 6.1.7600.16385 Tatar_Cyrillic Keyboa rd Layout kbdth0.dll 6.1.7600.16385 Thai Kedmanee Keyboar d Layout kbdth1.dll 6.1.7600.16385 Thai Pattachote Keybo ard Layout kbdth2.dll 6.1.7600.16385 Thai Kedmanee (non-Sh iftLock) Keyboard Layout kbdth3.dll 6.1.7600.16385 Thai Pattachote (non- ShiftLock) Keyboard Layout kbdtiprc.dll 6.1.7600.16385 Tibetan (PRC) Keyboar d Layout kbdtuf.dll 6.1.7601.17514 Turkish F Keyboard La yout kbdtuq.dll 6.1.7601.17514 Turkish Q Keyboard La yout kbdturme.dll 6.1.7601.17514 Turkmen Keyboard Layo ut kbdughr.dll 6.1.7600.16385 Uyghur (Legacy) Keybo ard Layout kbdughr1.dll 6.1.7601.17514 Uyghur Keyboard Layou t kbduk.dll 6.1.7600.16385 United Kingdom Keyboa rd Layout kbdukx.dll 6.1.7600.16385 United Kingdom Extend ed Keyboard Layout kbdur.dll 6.1.7600.16385 Ukrainian Keyboard La yout kbdur1.dll 6.1.7600.16385 Ukrainian (Enhanced) Keyboard Layout kbdurdu.dll 6.1.7600.16385 Keyboard Layout kbdus.dll 6.1.7601.17514 United States Keyboar d Layout kbdusa.dll 6.1.7600.16385 US IBM 238_L K eyboard Layout kbdusl.dll 6.1.7600.16385 Dvorak Left-Hand US E nglish Keyboard Layout kbdusr.dll 6.1.7600.16385 Dvorak Right-Hand US English Keyboard Layout kbdusx.dll 6.1.7600.16385 US Multinational Keyb oard Layout kbduzb.dll 6.1.7600.16385 Uzbek_Cyrillic Keyboa rd Layout kbdvntc.dll 6.1.7600.16385 Vietnamese Keyboard L ayout kbdwol.dll 6.1.7600.16385 Wolof Keyboard Layout kbdyak.dll 6.1.7600.16385 Yakut - Russia Keyboa rd Layout kbdyba.dll 6.1.7600.16385 Yoruba Keyboard Layou t kbdycc.dll 6.1.7600.16385 Serbian (Cyrillic) Ke yboard Layout kbdycl.dll 6.1.7600.16385 Serbian (Latin) Keybo ard Layout kd1394.dll 6.1.7600.16385 1394 Kernel Debugger kdcom.dll 6.1.7600.16385 Serial Kernel Debugge r kdusb.dll 6.1.7600.16385 USB 2.0 Kernel Debugg er kerberos.dll 6.1.7601.17514 Kerberos Security Pac kage kernel32.dll 6.1.7601.17514 Windows NT BASE API C lient DLL kernelbase.dll 6.1.7601.17514 Windows NT BASE API C lient DLL kernelceip.dll 6.1.7600.16385 Kernel Ceip Task keyiso.dll 6.1.7600.16385 CNG Key Isolation Ser vice keymgr.dll 6.1.7600.16385 Stored User Names and Passwords kmsvc.dll 6.1.7601.17514 Key Management Servic e korwbrkr.dll 6.1.7600.16385 korwbrkr ksuser.dll 6.1.7600.16385 User CSA Library ktmw32.dll 6.1.7600.16385 Windows KTM Win32 Cli ent DLL l2gpstore.dll 6.1.7600.16385 Policy Storage dll l2nacp.dll 6.1.7600.16385 Windows Onex Credenti al Provider l2sechc.dll 6.1.7600.16385 Layer 2 Security Diag nostics Helper Classes langcleanupsysprepaction.dll 6.1.7600.16385 Language cleanup S ysprep action laprxy.dll 12.0.7600.16385 Windows Media Logagen t Proxy licmgr10.dll 8.0.7601.17514 Microsoft® License Mana ger DLL linkinfo.dll 6.1.7600.16385 Windows Volume Tracki ng listsvc.dll 6.1.7601.17514 Windows HomeGroup lltdapi.dll 6.1.7600.16385 Link-Layer Topology M apper API lltdres.dll 6.1.7600.16385 Link-Layer Topology D iscovery Resources lltdsvc.dll 6.1.7600.16385 Link-Layer Topology M apper Service lmhsvc.dll 6.1.7600.16385 TCPIP NetBios Transpo rt Services DLL loadperf.dll 6.1.7600.16385 Load & Unload Perform ance Counters localsec.dll 6.1.7601.17514 Local Users and Group s MMC Snapin localspl.dll 6.1.7601.17514 Local Spooler DLL localui.dll 6.1.7600.16385 Local Monitor UI DLL locationapi.dll 6.1.7600.16385 Microsoft Windows Loc ation API loghours.dll 6.1.7600.16385 Schedule Dialog logoncli.dll 6.1.7601.17514 Net Logon Client DLL lpk.dll 6.1.7600.16385 Language Pack lpksetupproxyserv.dll 6.1.7600.16385 COM proxy server for lpksetup.exe lsasrv.dll 6.1.7601.17514 LSA Server DLL lscshostpolicy.dll 6.1.7601.17514 Microsoft Remote Desk top Virtual Graphics Session Licensing Host Policy lsmproxy.dll 6.1.7601.17514 LSM interfaces proxy Dll luainstall.dll 6.1.7601.17514 Lua manifest install lz32.dll 6.1.7600.16385 LZ Expand/Compress AP I DLL lzexpand.dll 3.10.0.103 Windows file expansio n library magnification.dll 6.1.7600.16385 Microsoft Magnificati on API mapi32.dll 1.0.2536.0 Extended MAPI 1.0 for Windows NT mapistub.dll 1.0.2536.0 Extended MAPI 1.0 for Windows NT mcewmdrmndbootstrap.dll 1.3.2302.0 Windows® Media Center W MDRM-ND Receiver Bridge Bootstrap DLL mciavi32.dll 6.1.7601.17514 MCI driver mcicda.dll 6.1.7600.16385 MCI driver for cdaudi o devices mciqtz32.dll 6.6.7601.17514 DirectShow MCI Driver mciseq.dll 6.1.7600.16385 MCI driver for MIDI s equencer mciwave.dll 6.1.7600.16385 MCI driver for wavefo rm audio mcmde.dll 12.0.7601.17514 MCMDE DLL mcsrchph.dll 1.0.0.1 Windows Media Center Search Protocol Handler mctres.dll 6.1.7600.16385 MCT resource DLL mcupdate_authenticamd.dll 6.1.7600.16385 AMD Microcode Update Library mcupdate_genuineintel.dll 6.1.7601.17514 Intel Microcode Updat e Library mcx2svc.dll 6.1.7601.17514 Media Center Extender Service mcxdriv.dll 6.1.7600.16385 Media Center Extender Resources mdminst.dll 6.1.7600.16385 Modem Class Installer mediametadatahandler.dll 6.1.7601.17514 Media Metadata Handle r memdiag.dll 6.1.7600.16385 Memory Tester Enhance ment mf.dll 12.0.7601.17514 Media Foundation DLL mf3216.dll 6.1.7600.16385 32-bit to 16-bit Meta file Conversion DLL mfaacenc.dll 6.1.7600.16385 Media Foundation AAC Encoder mfc40.dll 4.1.0.6151 MFCDLL Shared Library - Retail Version mfc40u.dll 4.1.0.6151 MFCDLL Shared Library - Retail Version mfc42.dll 6.6.8063.0 MFCDLL Shared Library - Retail Version mfc42u.dll 6.6.8063.0 MFCDLL Shared Library - Retail Version mfcsubs.dll 2001.12.8530.16385 COM+ mfds.dll 12.0.7601.17514 Media Foundation Dire ct Show wrapper DLL mfdvdec.dll 6.1.7600.16385 Media Foundation DV D ecoder mferror.dll 12.0.7600.16385 Media Foundation Erro r DLL mfh264enc.dll 6.1.7600.16385 Media Foundation H264 Encoder mfmjpegdec.dll 6.1.7600.16385 Media Foundation MJPE G Decoder mfplat.dll 12.0.7600.16385 Media Foundation Plat form DLL mfplay.dll 12.0.7601.17514 Media Foundation Play back API DLL mfps.dll 12.0.7600.16385 Media Foundation Prox y DLL mfreadwrite.dll 12.0.7601.17514 Media Foundation Read Write DLL mfvdsp.dll 6.1.7600.16385 Windows Media Foundat ion Video DSP Components mfwmaaec.dll 6.1.7600.16385 Windows Media Audio A EC for Media Foundation mgmtapi.dll 6.1.7600.16385 Microsoft SNMP Manage r API (uses WinSNMP) microsoft-windows-hal-events.dll 6.1.7600.16385 Microsoft-Wind ows-HAL-Events Resources microsoft-windows-kernel-power-events.dll 6.1.7600.16385 Micro soft-Windows-Kernel-Power-Events Resources microsoft-windows-kernel-processor-power-events.dll 6.1.7600.16385 Microsoft-Windows-Kernel-Processor-Power-Events Resources midimap.dll 6.1.7600.16385 Microsoft MIDI Mapper migisol.dll 6.1.7601.17514 Migration System Isol ation Layer miguiresource.dll 6.1.7600.16385 MIG wini32 resources mimefilt.dll 2008.0.7601.17514 MIME Filter mlang.dll 6.1.7600.16385 Multi Language Suppor t DLL mmcbase.dll 6.1.7600.16385 MMC Base DLL mmci.dll 6.1.7600.16385 Media class installer mmcico.dll 6.1.7600.16385 Media class co-instal ler mmcndmgr.dll 6.1.7601.17514 MMC Node Manager DLL mmcshext.dll 6.1.7600.16385 MMC Shell Extension D LL mmcss.dll 6.1.7600.16385 Multimedia Class Sche duler Service mmdevapi.dll 6.1.7601.17514 MMDevice API mmres.dll 6.1.7600.16385 General Audio Resourc es mmsystem.dll 3.10.0.103 System APIs for Multi media modemui.dll 6.1.7600.16385 Windows Modem Propert ies montr_ci.dll 6.1.7600.16385 Microsoft Monitor Cla ss Installer moricons.dll 6.1.7600.16385 Windows NT Setup Icon Resources Library mp3dmod.dll 6.1.7600.16385 Microsoft MP3 Decoder DMO mp43decd.dll 6.1.7600.16385 Windows Media MPEG-4 Video Decoder mp4sdecd.dll 6.1.7600.16385 Windows Media MPEG-4 S Video Decoder mpg4decd.dll 6.1.7600.16385 Windows Media MPEG-4 Video Decoder mpr.dll 6.1.7600.16385 Multiple Provider Rou ter DLL mprapi.dll 6.1.7601.17514 Windows NT MP Router Administration DLL mprddm.dll 6.1.7601.17514 Demand Dial Manager S upervisor mprdim.dll 6.1.7600.16385 Dynamic Interface Man ager mprmsg.dll 6.1.7600.16385 Multi-Protocol Router Service Messages DLL mpssvc.dll 6.1.7601.17514 Microsoft Protection Service msaatext.dll 2.0.10413.0 Active Accessibility text support msac3enc.dll 6.1.7601.17514 Microsoft AC-3 Encode r msacm.dll 3.50.0.9 Microsoft Audio Compr ession Manager msacm32.dll 6.1.7600.16385 Microsoft ACM Audio F ilter msadce.dll 6.1.7601.17514 OLE DB Cursor Engine msadcer.dll 6.1.7600.16385 OLE DB Cursor Engine Resources msadcf.dll 6.1.7601.17514 Remote Data Services Data Factory msadcfr.dll 6.1.7600.16385 Remote Data Services Data Factory Resources msadco.dll 6.1.7601.17514 Remote Data Services Data Control msadcor.dll 6.1.7600.16385 Remote Data Services Data Control Resources msadcs.dll 6.1.7601.17514 Remote Data Services ISAPI Library msadds.dll 6.1.7600.16385 OLE DB Data Shape Pro vider msaddsr.dll 6.1.7600.16385 OLE DB Data Shape Pr ovider Resources msader15.dll 6.1.7600.16385 ActiveX Data Objects Resources msado15.dll 6.1.7601.17514 ActiveX Data Objects msadomd.dll 6.1.7601.17514 ActiveX Data Objects (Multi-Dimensional) msador15.dll 6.1.7601.17514 Microsoft ActiveX Dat a Objects Recordset msadox.dll 6.1.7601.17514 ActiveX Data Objects Extensions msadrh15.dll 6.1.7600.16385 ActiveX Data Objects Rowset Helper msafd.dll 6.1.7600.16385 Microsoft Windows Soc kets 2.0 Service Provider msasn1.dll 6.1.7601.17514 ASN.1 Runtime APIs msaudite.dll 6.1.7600.16385 Security Audit Events DLL mscandui.dll 6.1.7600.16385 MSCANDUI Server DLL mscat32.dll 6.1.7600.16385 MSCAT32 Forwarder DLL msclmd.dll 6.1.7601.17514 Microsoft Class Mini- driver mscms.dll 6.1.7601.17514 Microsoft Color Match ing System DLL mscoree.dll 4.0.40305.0 Microsoft .NET Runtim e Execution Engine mscorier.dll 2.0.50727.5420 Microsoft .NET Runtim e IE resources mscories.dll 2.0.50727.5420 Microsoft .NET IE SEC URITY REGISTRATION mscpx32r.dll 6.1.7600.16385 ODBC Code Page Transl ator Resources mscpxl32.dll 6.1.7600.16385 ODBC Code Page Transl ator msctf.dll 6.1.7600.16385 MSCTF Server DLL msctfmonitor.dll 6.1.7600.16385 MsCtfMonitor DLL msctfp.dll 6.1.7600.16385 MSCTFP Server DLL msctfui.dll 6.1.7600.16385 MSCTFUI Server DLL msdadc.dll 6.1.7600.16385 OLE DB Data Conversio n Stub msdadiag.dll 6.1.7600.16385 Built-In Diagnostics msdaenum.dll 6.1.7600.16385 OLE DB Root Enumerato r Stub msdaer.dll 6.1.7600.16385 OLE DB Error Collecti on Stub msdaora.dll 6.1.7600.16385 OLE DB Provider for O racle msdaorar.dll 6.1.7600.16385 OLE DB Provider for O racle Resources msdaosp.dll 6.1.7601.17514 OLE DB Simple Provide r msdaprsr.dll 6.1.7600.16385 OLE DB Persistence Se rvices Resources msdaprst.dll 6.1.7600.16385 OLE DB Persistence Se rvices msdaps.dll 6.1.7600.16385 OLE DB Interface Prox ies/Stubs msdarem.dll 6.1.7601.17514 OLE DB Remote Provide r msdaremr.dll 6.1.7600.16385 OLE DB Remote Provide r Resources msdart.dll 6.1.7600.16385 OLE DB Runtime Routin es msdasc.dll 6.1.7600.16385 OLE DB Service Compon ents Stub msdasql.dll 6.1.7601.17514 OLE DB Provider for O DBC Drivers msdasqlr.dll 6.1.7600.16385 OLE DB Provider for O DBC Drivers Resources msdatl3.dll 6.1.7600.16385 OLE DB Implementation Support Routines msdatt.dll 6.1.7600.16385 OLE DB Temporary Tabl e Services msdaurl.dll 6.1.7600.16385 OLE DB RootBinder Stu b msdelta.dll 6.1.7600.16385 Microsoft Patch Engin e msdfmap.dll 6.1.7601.17514 Data Factory Handler msdmeng.dll 8.0.2039.0 Microsoft Data Mining Engine msdmine.dll 8.0.2039.0 Microsoft OLE DB Prov ider for Data Mining Services msdmo.dll 6.6.7601.17514 DMO Runtime msdri.dll 6.1.7601.17514 Microsoft Digital Rec eiver Interface Class Driver msdrm.dll 6.1.7601.17514 Windows Rights Manage ment client msdtckrm.dll 2001.12.8530.16385 Microsoft Distributed Transaction Coordinator OLE Transactions KTM Resource Manager DLL msdtclog.dll 2001.12.8530.16385 Microsoft Distributed Transaction Coordinator Log Manager DLL msdtcprx.dll 2001.12.8530.16385 Microsoft Distributed Transaction Coordinator OLE Transactions Interface Proxy DLL msdtctm.dll 2001.12.8531.17514 Microsoft Distributed Transaction Coordinator Transaction Manager DLL msdtcuiu.dll 2001.12.8530.16385 Microsoft Distributed Transaction Coordinator Administrative DLL msdtcvsp1res.dll 2001.12.8530.16385 Microsoft Distributed Transaction Coordinator Resources for Vista SP1 msexch40.dll 4.0.9756.0 Microsoft Jet Exchang e Isam msexcl40.dll 4.0.9756.0 Microsoft Jet Excel I sam msfeeds.dll 8.0.7601.17514 Microsoft Feeds Manag er msfeedsbs.dll 8.0.7601.17514 Microsoft Feeds Backg round Sync msftedit.dll 5.41.21.2510 Rich Text Edit Contro l, v4.1 mshtml.dll 8.0.7601.17514 Microsoft (R) HTML Vi ewer mshtmled.dll 8.0.7601.17514 Microsoft® HTML Editing Component mshtmler.dll 8.0.7600.16385 Microsoft® HTML Editing Component's Resource DLL msi.dll 5.0.7601.17514 Windows Installer msicofire.dll 6.1.7600.16385 Corrupted MSI File Re covery Diagnostic Module msidcrl30.dll 6.1.7600.16385 IDCRL Dynamic Link Li brary msident.dll 6.1.7600.16385 Microsoft Identity Ma nager msidle.dll 6.1.7600.16385 User Idle Monitor msidntld.dll 6.1.7600.16385 Microsoft Identity Ma nager msieftp.dll 6.1.7601.17514 Microsoft Internet Ex plorer FTP Folder Shell Extension msihnd.dll 5.0.7601.17514 Windows® installer msiltcfg.dll 5.0.7600.16385 Windows Installer Con figuration API Stub msimg32.dll 6.1.7600.16385 GDIEXT Client DLL msimsg.dll 5.0.7600.16385 Windows® Installer Inte rnational Messages msimtf.dll 6.1.7600.16385 Active IMM Server DLL msisip.dll 5.0.7600.16385 MSI Signature SIP Pro vider msjet40.dll 4.0.9756.0 Microsoft Jet Engine Library msjetoledb40.dll 4.0.9756.0 msjint40.dll 4.0.9756.0 Microsoft Jet Databas e Engine International DLL msjro.dll 6.1.7601.17514 Jet and Replication O bjects msjter40.dll 4.0.9756.0 Microsoft Jet Databas e Engine Error DLL msjtes40.dll 4.0.9756.0 Microsoft Jet Express ion Service msls31.dll 3.10.349.0 Microsoft Line Servic es library file msltus40.dll 4.0.9756.0 Microsoft Jet Lotus 1 -2-3 Isam msmdcb80.dll 8.0.2039.0 PivotTable Service dl l msmdgd80.dll 8.0.2039.0 Microsoft SQL Server Analysis Services driver msmdun80.dll 2000.80.2039.0 String Function .DLL for SQL Enterprise Components msmmsp.dll 6.1.7600.16385 Mount Point Manger Sy sprep Utility Library msmpeg2adec.dll 6.1.7140.0 Microsoft DTV-DVD Aud io Decoder msmpeg2enc.dll 6.1.7601.17514 Microsoft MPEG-2 Enco der msmpeg2vdec.dll 6.1.7140.0 Microsoft DTV-DVD Vid eo Decoder msnetobj.dll 11.0.7601.17514 DRM ActiveX Network O bject msobjs.dll 6.1.7600.16385 System object audit n ames msoeacct.dll 6.1.7600.16385 Microsoft Internet Ac count Manager msoert2.dll 6.1.7600.16385 Microsoft Windows Mai l RT Lib msolap80.dll 8.0.2216.0 Microsoft OLE DB Prov ider for Analysis Services 8.0 msolui80.dll 8.0.0.2039 Microsoft OLE DB prov ider for Analysis Services connection dialog 8.0 msorc32r.dll 6.1.7600.16385 ODBC Driver for Oracl e Resources msorcl32.dll 6.1.7601.17514 ODBC Driver for Oracl e mspatcha.dll 6.1.7600.16385 Microsoft File Patch Application API mspbda.dll 6.1.7601.17514 Microsoft Protected B roadcast Digital Architecture Class Driver mspbdacoinst.dll 6.1.7600.16385 Microsoft Protected B roadcast Digital Architecture Class Driver CoInstaller mspbde40.dll 4.0.9756.0 Microsoft Jet Paradox Isam msports.dll 6.1.7600.16385 Ports Class Installer msprivs.dll 6.1.7600.16385 Microsoft Privilege T ranslations msrahc.dll 6.1.7600.16385 Remote Assistance Dia gnostics Provider msrating.dll 8.0.7601.17514 Internet Ratings and Local User Management DLL msrd2x40.dll 4.0.9756.0 Microsoft (R) Red ISA M msrd3x40.dll 4.0.9756.0 Microsoft (R) Red ISA M msrdc.dll 6.1.7600.16385 Remote Differential C ompression COM server msrdpwebaccess.dll 6.1.7600.16385 Microsoft Remote Desk top Services Web Access Control msrepl40.dll 4.0.9756.0 Microsoft Replication Library msrle32.dll 6.1.7601.17514 Microsoft RLE Compres sor msscntrs.dll 7.0.7600.16385 msscntrs.dll msscp.dll 11.0.7601.17514 Windows Media Secure Content Provider mssha.dll 6.1.7600.16385 Windows Security Heal th Agent msshavmsg.dll 6.1.7600.16385 Windows Security Heal th Agent Validator Message msshooks.dll 7.0.7600.16385 MSSHooks.dll mssign32.dll 6.1.7600.16385 Microsoft Trust Signi ng APIs mssip32.dll 6.1.7600.16385 MSSIP32 Forwarder DLL mssitlb.dll 7.0.7600.16385 mssitlb mssph.dll 7.0.7600.16385 Microsoft Search Prot ocol Handler mssphtb.dll 7.0.7601.17514 Outlook MSSearch Conn ector mssprxy.dll 7.0.7600.16385 Microsoft Search Prox y mssrch.dll 7.0.7601.17514 mssrch.dll mssvp.dll 7.0.7601.17514 MSSearch Vista Platfo rm msswch.dll 6.1.7600.16385 msswch mstask.dll 6.1.7601.17514 Task Scheduler interf ace DLL mstext40.dll 4.0.9756.0 Microsoft Jet Text Is am mstime.dll 8.0.7601.17514 Microsoft (R) Timed I nteractive Multimedia Extensions to HTML mstscax.dll 6.1.7601.17514 Remote Desktop Servic es ActiveX Client msutb.dll 6.1.7601.17514 MSUTB Server DLL msv1_0.dll 6.1.7601.17514 Microsoft Authenticat ion Package v1.0 msvbvm60.dll 6.0.98.15 Visual Basic Virtual Machine msvcirt.dll 7.0.7600.16385 Windows NT IOStreams DLL msvcp110_clr0400.dll 11.0.50709.17929 Microsoft® C Runtime Li brary msvcp60.dll 7.0.7600.16385 Windows NT C++ Runtim e Library DLL msvcr100_clr0400.dll 11.0.50709.17929 Microsoft® .NET Framewo rk msvcr110_clr0400.dll 11.0.50709.17929 Microsoft® C Runtime Li brary msvcrt.dll 7.0.7600.16385 Windows NT CRT DLL msvcrt20.dll 2.12.0.0 Microsoft® C Runtime Li brary msvcrt40.dll 6.1.7600.16385 VC 4.x CRT DLL (Forwa rded to msvcrt.dll) msvfw32.dll 6.1.7601.17514 Microsoft Video for W indows DLL msvidc32.dll 6.1.7601.17514 Microsoft Video 1 Com pressor msvidctl.dll 6.5.7601.17514 ActiveX control for s treaming video msvideo.dll 1.15.0.1 Microsoft Video for W indows DLL mswdat10.dll 4.0.9756.0 Microsoft Jet Sort Ta bles mswmdm.dll 12.0.7600.16385 Windows Media Device Manager Core mswsock.dll 6.1.7601.17514 Microsoft Windows Soc kets 2.0 Service Provider mswstr10.dll 4.0.9756.0 Microsoft Jet Sort Li brary msxactps.dll 6.1.7600.16385 OLE DB Transaction Pr oxies/Stubs msxbde40.dll 4.0.9756.0 Microsoft Jet xBASE I sam msxml3.dll 8.110.7601.17514 MSXML 3.0 SP11 msxml3r.dll 8.110.7600.16385 XML Resources msxml6.dll 6.30.7601.17514 MSXML 6.0 SP3 msxml6r.dll 6.30.7600.16385 XML Resources msyuv.dll 6.1.7601.17514 Microsoft UYVY Video Decompressor mtxclu.dll 2001.12.8531.17514 Microsoft Distributed Transaction Coordinator Failover Clustering Support DLL mtxdm.dll 2001.12.8530.16385 COM+ mtxex.dll 2001.12.8530.16385 COM+ mtxlegih.dll 2001.12.8530.16385 COM+ mtxoci.dll 2001.12.8530.16385 Microsoft Distributed Transaction Coordinator Database Support DLL for Oracle muifontsetup.dll 6.1.7601.17514 MUI Callback for font registry settings muilanguagecleanup.dll 6.1.7600.16385 MUI Callback for Lang uage pack cleanup mycomput.dll 6.1.7600.16385 Computer Management mydocs.dll 6.1.7601.17514 My Documents Folder U I napcrypt.dll 6.1.7601.17514 NAP Cryptographic API helper napdsnap.dll 6.1.7601.17514 NAP GPEdit Extension naphlpr.dll 6.1.7601.17514 NAP client config API helper napinsp.dll 6.1.7600.16385 E-mail Naming Shim Pr ovider napipsec.dll 6.1.7600.16385 NAP IPSec Enforcement Client napmontr.dll 6.1.7600.16385 NAP Netsh Helper nativehooks.dll 6.1.7600.16385 Microsoft Narrator Na tive hook handler naturallanguage6.dll 6.1.7601.17514 Natural Language Deve lopment Platform 6 ncdprop.dll 6.1.7600.16385 Advanced network devi ce properties nci.dll 6.1.7601.17514 CoInstaller: NET ncobjapi.dll 6.1.7600.16385 Microsoft® Windows® Opera ting System ncrypt.dll 6.1.7600.16385 Windows cryptographic library ncryptui.dll 6.1.7601.17514 Windows cryptographic key protection UI library ncsi.dll 6.1.7601.17514 Network Connectivity Status Indicator nddeapi.dll 6.1.7600.16385 Network DDE Share Man agement APIs ndfapi.dll 6.1.7600.16385 Network Diagnostic Fr amework Client API ndfetw.dll 6.1.7600.16385 Network Diagnostic En gine Event Interface ndfhcdiscovery.dll 6.1.7600.16385 Network Diagnostic Fr amework HC Discovery API ndiscapcfg.dll 6.1.7600.16385 NdisCap Notify Object ndishc.dll 6.1.7600.16385 NDIS Helper Classes ndproxystub.dll 6.1.7600.16385 Network Diagnostic En gine Proxy/Stub negoexts.dll 6.1.7600.16385 NegoExtender Security Package netapi.dll 3.11.0.300 Microsoft Network Dyn amic Link Library for Microsoft Windows netapi32.dll 6.1.7601.17514 Net Win32 API DLL netbios.dll 6.1.7600.16385 NetBIOS Interface Lib rary netcenter.dll 6.1.7601.17514 Network Center contro l panel netcfgx.dll 6.1.7601.17514 Network Configuration Objects netcorehc.dll 6.1.7600.16385 Networking Core Diagn ostics Helper Classes netdiagfx.dll 6.1.7601.17514 Network Diagnostic Fr amework netevent.dll 6.1.7600.16385 Net Event Handler netfxperf.dll 4.0.40305.0 Extensible Performanc e Counter Shim neth.dll 6.1.7600.16385 Net Help Messages DLL netid.dll 6.1.7601.17514 System Control Panel Applet; Network ID Page netiohlp.dll 6.1.7601.17514 Netio Helper DLL netjoin.dll 6.1.7601.17514 Domain Join DLL netlogon.dll 6.1.7601.17514 Net Logon Services DL L netman.dll 6.1.7600.16385 Network Connections M anager netmsg.dll 6.1.7600.16385 Net Messages DLL netplwiz.dll 6.1.7601.17514 Map Network Drives/Ne twork Places Wizard netprof.dll 6.1.7600.16385 Network Profile Manag ement UI netprofm.dll 6.1.7600.16385 Network List Manager netprojw.dll 6.1.7600.16385 Connect to a Network Projector netshell.dll 6.1.7601.17514 Network Connections S hell nettrace.dll 6.1.7600.16385 Network Trace Helper netutils.dll 6.1.7601.17514 Net Win32 API Helpers DLL netw2c32.dll 9.0.4.95 Coinstaller and NCPA 32 bit DLL netw2r32.dll 9.0.4.95 Coinstaller and NCPA 32 bit DLL networkexplorer.dll 6.1.7601.17514 Network Explorer networkitemfactory.dll 6.1.7600.16385 NetworkItem Factory networkmap.dll 6.1.7601.17514 Network Map newdev.dll 6.0.5054.0 Add Hardware Device L ibrary nlaapi.dll 6.1.7601.17514 Network Location Awar eness 2 nlahc.dll 6.1.7600.16385 NLA Helper Classes nlasvc.dll 6.1.7601.17514 Network Location Awar eness 2 nlhtml.dll 2008.0.7600.16385 HTML filter nlmgp.dll 6.1.7600.16385 Network List Manager Snapin nlmsprep.dll 6.1.7600.16385 Network List Manager Sysprep Module nlsbres.dll 6.1.7601.17514 NLSBuild resource DLL nlsdata0000.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0001.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0002.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0003.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0007.dll 6.1.7600.16385 Microsoft German Natu ral Language Server Data and Code nlsdata0009.dll 6.1.7600.16385 Microsoft English Nat ural Language Server Data and Code nlsdata000a.dll 6.1.7600.16385 Microsoft Spanish Nat ural Language Server Data and Code nlsdata000c.dll 6.1.7600.16385 Microsoft French Natu ral Language Server Data and Code nlsdata000d.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata000f.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0010.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0011.dll 6.1.7600.16385 Microsoft Japanese Na tural Language Server Data and Code nlsdata0013.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0018.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0019.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata001a.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata001b.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata001d.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0020.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0021.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0022.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0024.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0026.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0027.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata002a.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0039.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata003e.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0045.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0046.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0047.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0049.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata004a.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata004b.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata004c.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata004e.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0414.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0416.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0816.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata081a.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdata0c1a.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsdl.dll 6.1.7600.16385 Nls Downlevel DLL nlslexicons0001.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0002.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0003.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0007.dll 6.1.7600.16385 Microsoft German Natu ral Language Server Data and Code nlslexicons0009.dll 6.1.7600.16385 Microsoft English Nat ural Language Server Data and Code nlslexicons000a.dll 6.1.7600.16385 Microsoft Spanish Nat ural Language Server Data and Code nlslexicons000c.dll 6.1.7600.16385 Microsoft French Natu ral Language Server Data and Code nlslexicons000d.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons000f.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0010.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0011.dll 6.1.7600.16385 Microsoft Japanese Na tural Language Server Data and Code nlslexicons0013.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0018.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0019.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons001a.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons001b.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons001d.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0020.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0021.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0022.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0024.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0026.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0027.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons002a.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0039.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons003e.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0045.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0046.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0047.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0049.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons004a.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons004b.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons004c.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons004e.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0414.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0416.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0816.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons081a.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlslexicons0c1a.dll 6.1.7600.16385 Microsoft Neutral Nat ural Language Server Data and Code nlsmodels0011.dll 6.1.7600.16385 Microsoft Japanese Na tural Language Server Data and Code normaliz.dll 6.1.7600.16385 Unicode Normalization DLL npdeployjava1.dll 10.25.2.17 NPRuntime Script Plug -in Library for Java(TM) Deploy npmproxy.dll 6.1.7600.16385 Network List Manager Proxy nrpsrv.dll 6.1.7601.17514 Name Resolution Proxy (NRP) RPC interface nshhttp.dll 6.1.7600.16385 HTTP netsh DLL nshipsec.dll 6.1.7601.17514 Net Shell IP Security helper DLL nshwfp.dll 6.1.7601.17514 Windows Filtering Pla tform Netsh Helper nsi.dll 6.1.7600.16385 NSI User-mode interfa ce DLL nsisvc.dll 6.1.7600.16385 Network Store Interfa ce RPC server ntdll.dll 6.1.7601.17514 NT Layer DLL ntdsapi.dll 6.1.7600.16385 Active Directory Doma in Services API ntlanman.dll 6.1.7601.17514 Microsoft® Lan Manager ntlanui2.dll 6.1.7600.16385 Network object shell UI ntmarta.dll 6.1.7600.16385 Windows NT MARTA prov ider ntprint.dll 6.1.7601.17514 Spooler Setup DLL ntshrui.dll 6.1.7601.17514 Shell extensions for sharing ntvdmd.dll 6.1.7600.16385 NTVDMD.DLL objsel.dll 6.1.7600.16385 Object Picker Dialog occache.dll 8.0.7601.17514 Object Control Viewer ocsetapi.dll 6.1.7601.17514 Windows Optional Comp onent Setup API odbc16gt.dll 3.510.3711.0 Microsoft ODBC Driver Generic Thunk odbc32.dll 6.1.7601.17514 ODBC Driver Manager odbc32gt.dll 6.1.7600.16385 ODBC Driver Generic T hunk odbcbcp.dll 6.1.7600.16385 BCP for ODBC odbcconf.dll 6.1.7601.17514 ODBC Driver Configura tion Program odbccp32.dll 6.1.7601.17514 ODBC Installer odbccr32.dll 6.1.7600.16385 ODBC Cursor Library odbccu32.dll 6.1.7600.16385 ODBC Cursor Library odbcint.dll 6.1.7600.16385 ODBC Resources odbcji32.dll 6.1.7600.16385 Microsoft ODBC Deskto p Driver Pack 3.5 odbcjt32.dll 6.1.7601.17514 Microsoft ODBC Deskto p Driver Pack 3.5 odbctrac.dll 6.1.7601.17514 ODBC Driver Manager T race oddbse32.dll 6.1.7600.16385 ODBC (3.0) driver for DBase odexl32.dll 6.1.7600.16385 ODBC (3.0) driver for Excel odfox32.dll 6.1.7600.16385 ODBC (3.0) driver for FoxPro odpdx32.dll 6.1.7600.16385 ODBC (3.0) driver for Paradox odtext32.dll 6.1.7600.16385 ODBC (3.0) driver for text files oemdspif.dll 3.0.0.4704 Oemdspif Module offfilt.dll 2008.0.7600.16385 OFFICE Filter ogldrv.dll 6.1.7600.16385 MSOGL ole2.dll 2.10.35.35 OLE 2.1 16/32 Interop erability Library ole2disp.dll 2.10.3050.1 OLE 2.1 16/32 Interop erability Library ole2nls.dll 2.10.3050.1 OLE 2.1 16/32 Interop erability Library ole32.dll 6.1.7601.17514 Microsoft OLE for Win dows oleacc.dll 7.0.0.0 Active Accessibility Core Component oleacchooks.dll 7.0.0.0 Active Accessibility Event Hooks Library oleaccrc.dll 7.0.0.0 Active Accessibility Resource DLL oleaut32.dll 6.1.7601.17514 olecli.dll 1.32.0.0 Object Linking and Em bedding Client Library olecli32.dll 6.1.7600.16385 Object Linking and Em bedding Client Library oledb32.dll 6.1.7601.17514 OLE DB Core Services oledb32r.dll 6.1.7600.16385 OLE DB Core Services Resources oledlg.dll 6.1.7600.16385 OLE User Interface Su pport oleprn.dll 6.1.7600.16385 Oleprn DLL olepro32.dll 6.1.7601.17514 oleres.dll 6.1.7600.16385 Ole resource dll olesvr.dll 1.11.0.0 Object Linking and Em bedding Server Library olesvr32.dll 6.1.7600.16385 Object Linking and Em bedding Server Library olethk32.dll 6.1.7601.17514 Microsoft OLE for Win dows onex.dll 6.1.7601.17514 IEEE 802.1X supplican t library onexui.dll 6.1.7601.17514 IEEE 802.1X supplican t UI library onlineidcpl.dll 6.1.7601.17514 Online IDs Control Pa nel oobefldr.dll 6.1.7601.17514 Getting Started opcservices.dll 6.1.7601.17514 Native Code OPC Servi ces Library opengl32.dll 6.1.7600.16385 OpenGL Client DLL osbaseln.dll 6.1.7600.16385 Service Reporting API osuninst.dll 6.1.7600.16385 Uninstall Interface p2p.dll 6.1.7600.16385 Peer-to-Peer Grouping p2pcollab.dll 6.1.7600.16385 Peer-to-Peer Collabor ation p2pgraph.dll 6.1.7600.16385 Peer-to-Peer Graphing p2pnetsh.dll 6.1.7600.16385 Peer-to-Peer NetSh He lper p2psvc.dll 6.1.7600.16385 Peer-to-Peer Services packager.dll 6.1.7600.16385 Object Packager2 panmap.dll 6.1.7600.16385 PANOSE(tm) Font Mappe r pautoenr.dll 6.1.7600.16385 Auto Enrollment DLL pcadm.dll 6.1.7600.16385 Program Compatibility Assistant Diagnostic Module pcaevts.dll 6.1.7600.16385 Program Compatibility Assistant Event Resources pcasvc.dll 6.1.7600.16385 Program Compatibility Assistant Service pcaui.dll 6.1.7600.16385 Program Compatibility Assistant User Interface Module pcwum.dll 6.1.7600.16385 Performance Counters for Windows Native DLL pcwutl.dll 6.1.7600.16385 Program Compatibility Troubleshooter Helper pdh.dll 6.1.7601.17514 Windows Performance D ata Helper DLL pdhui.dll 6.1.7601.17514 PDH UI peerdist.dll 6.1.7600.16385 BranchCache Client Li brary peerdisthttptrans.dll 6.1.7600.16385 BranchCache HTTP Tans port peerdistsh.dll 6.1.7600.16385 BranchCache Netshell Helper peerdistsvc.dll 6.1.7600.16385 BranchCache Service peerdistwsddiscoprov.dll 6.1.7600.16385 BranchCache WSD Disco very Provider perfcentercpl.dll 6.1.7601.17514 Performance Center perfctrs.dll 6.1.7600.16385 Performance Counters perfdisk.dll 6.1.7600.16385 Windows Disk Performa nce Objects DLL perfnet.dll 6.1.7600.16385 Windows Network Servi ce Performance Objects DLL perfos.dll 6.1.7600.16385 Windows System Perfor mance Objects DLL perfproc.dll 6.1.7600.16385 Windows System Proces s Performance Objects DLL perftrack.dll 6.1.7600.16385 Microsoft Performance PerfTrack perfts.dll 6.1.7601.17514 Windows Remote Deskto p Services Performance Objects photometadatahandler.dll 6.1.7600.16385 Photo Metadata Handle r photowiz.dll 6.1.7601.17514 Photo Printing Wizard pid.dll 6.1.7600.16385 Microsoft PID pidgenx.dll 6.1.7600.16385 Pid Generation pifmgr.dll 6.1.7601.17514 Windows NT PIF Manage r Icon Resources Library pku2u.dll 6.1.7600.16385 Pku2u Security Packag e pla.dll 6.1.7601.17514 Performance Logs & Al erts playsndsrv.dll 6.1.7600.16385 PlaySound Service pmcsnap.dll 6.1.7600.16385 pmcsnap dll pmspl.dll 2.10.0.1 Microsoft LAN Manager 2.1 Network Dynamic Link Library for Microsoft Windows pngfilt.dll 8.0.7600.16385 IE PNG plugin image d ecoder pnidui.dll 6.1.7601.17514 Network System Icon pnpsetup.dll 6.1.7600.16385 Pnp installer for CMI pnpts.dll 6.1.7600.16385 PlugPlay Troubleshoot er pnpui.dll 5.2.3668.0 Plug and Play User In terface DLL pnpxassoc.dll 6.1.7600.16385 PNPX Association Dll pnpxassocprx.dll 6.1.7600.16385 PNPX Association Dll pnrpauto.dll 6.1.7600.16385 PNRP Auto Service Dll pnrphc.dll 6.1.7600.16385 PNRP Helper Class pnrpnsp.dll 6.1.7600.16385 PNRP Name Space Provi der pnrpsvc.dll 6.1.7600.16385 PNRP Service Dll polstore.dll 6.1.7600.16385 Policy Storage dll portabledeviceapi.dll 6.1.7601.17514 Windows Portable Devi ce API Components portabledeviceclassextension.dll 6.1.7600.16385 Windows Portab le Device Class Extension Component portabledeviceconnectapi.dll 6.1.7600.16385 Portable Device Co nnection API Components portabledevicestatus.dll 6.1.7601.17514 Microsoft Windows Por table Device Status Provider portabledevicesyncprovider.dll 6.1.7601.17514 Microsoft Window s Portable Device Provider. portabledevicetypes.dll 6.1.7600.16385 Windows Portable Devi ce (Parameter) Types Component portabledevicewiacompat.dll 6.1.7600.16385 PortableDevice WIA Compatibility Driver portabledevicewmdrm.dll 6.1.7600.16385 Windows Portable Devi ce WMDRM Component pots.dll 6.1.7600.16385 Power Troubleshooter powercpl.dll 6.1.7601.17514 Power Options Control Panel powrprof.dll 6.1.7600.16385 Power Profile Helper DLL ppcsnap.dll 6.1.7600.16385 ppcsnap DLL presentationcffrasterizernative_v0300.dll 3.0.6920.4902 WinFX OpenType/CFF Rasterizer presentationhostproxy.dll 4.0.40305.0 Windows Presentation Foundation Host Proxy presentationnative_v0300.dll 3.0.6920.4902 PresentationNative _v0300.dll prflbmsg.dll 6.1.7600.16385 Perflib Event Message s printfilterpipelineprxy.dll 6.1.7600.16385 Print Filter Pipeli ne Proxy printisolationproxy.dll 6.1.7601.17514 Print Sandbox COM Pro xy Stub printui.dll 6.1.7601.17514 Printer Settings User Interface prncache.dll 6.1.7601.17514 Print UI Cache prnfldr.dll 6.1.7601.17514 prnfldr dll prnntfy.dll 6.1.7600.16385 prnntfy DLL prntvpt.dll 6.1.7601.17514 Print Ticket Services Module procinst.dll 6.1.7600.16385 Processor Class Insta ller profapi.dll 6.1.7600.16385 User Profile Basic AP I profprov.dll 6.1.7601.17514 User Profile WMI Prov ider profsvc.dll 6.1.7601.17514 ProfSvc propsys.dll 7.0.7601.17514 Microsoft Property Sy stem provsvc.dll 6.1.7601.17514 Windows HomeGroup provthrd.dll 6.1.7600.16385 WMI Provider Thread & Log Library psapi.dll 6.1.7600.16385 Process Status Helper psbase.dll 6.1.7600.16385 Protected Storage def ault provider pshed.dll 6.1.7600.16385 Platform Specific Har dware Error Driver psisdecd.dll 6.6.7600.16385 Microsoft SI/PSI pars er for MPEG2 based networks. pstorec.dll 6.1.7600.16385 Protected Storage COM interfaces pstorsvc.dll 6.1.7600.16385 Protected storage ser ver puiapi.dll 6.1.7600.16385 puiapi DLL puiobj.dll 6.1.7601.17514 PrintUI Objects DLL pwrshplugin.dll 6.1.7600.16385 pwrshplugin.dll qagent.dll 6.1.7601.17514 Quarantine Agent Prox y qagentrt.dll 6.1.7601.17514 Quarantine Agent Serv ice Run-Time qasf.dll 12.0.7601.17514 DirectShow ASF Suppor t qcap.dll 6.6.7601.17514 DirectShow Runtime. qcliprov.dll 6.1.7601.17514 Quarantine Client WMI Provider qdv.dll 6.6.7601.17514 DirectShow Runtime. qdvd.dll 6.6.7601.17514 DirectShow DVD PlayBa ck Runtime. qedit.dll 6.6.7601.17514 DirectShow Editing. qedwipes.dll 6.6.7600.16385 DirectShow Editing SM PTE Wipes qmgr.dll 7.5.7601.17514 Background Intelligen t Transfer Service qmgrprxy.dll 7.5.7600.16385 Background Intelligen t Transfer Service Proxy qshvhost.dll 6.1.7601.17514 Quarantine SHV Host qsvrmgmt.dll 6.1.7601.17514 Quarantine Server Man agement quartz.dll 6.6.7601.17514 DirectShow Runtime. query.dll 6.1.7601.17514 Content Index Utility DLL qutil.dll 6.1.7601.17514 Quarantine Utilities qwave.dll 6.1.7600.16385 Windows NT racengn.dll 6.1.7601.17514 Reliability analysis metrics calculation engine racpldlg.dll 6.1.7600.16385 Remote Assistance Con tact List radardt.dll 6.1.7600.16385 Microsoft Windows Res ource Exhaustion Detector radarrs.dll 6.1.7600.16385 Microsoft Windows Res ource Exhaustion Resolver rasadhlp.dll 6.1.7600.16385 Remote Access AutoDia l Helper rasapi32.dll 6.1.7600.16385 Remote Access API rasauto.dll 6.1.7600.16385 Remote Access AutoDia l Manager rascfg.dll 6.1.7600.16385 RAS Configuration Obj ects raschap.dll 6.1.7601.17514 Remote Access PPP CHA P rasctrs.dll 6.1.7600.16385 Windows NT Remote Acc ess Perfmon Counter dll rasdiag.dll 6.1.7600.16385 RAS Diagnostics Helpe r Classes rasdlg.dll 6.1.7600.16385 Remote Access Common Dialog API rasgcw.dll 6.1.7600.16385 RAS Wizard Pages rasman.dll 6.1.7600.16385 Remote Access Connect ion Manager rasmans.dll 6.1.7601.17514 Remote Access Connect ion Manager rasmbmgr.dll 6.1.7600.16385 Provides support for the switching of mobility enabled VPN connections if their underlying interface goes down. rasmm.dll 6.1.7600.16385 RAS Media Manager rasmontr.dll 6.1.7600.16385 RAS Monitor DLL rasmxs.dll 6.1.7600.16385 Remote Access Device DLL for modems, PADs and switches rasplap.dll 6.1.7600.16385 RAS PLAP Credential P rovider rasppp.dll 6.1.7601.17514 Remote Access PPP rasser.dll 6.1.7600.16385 Remote Access Media D LL for COM ports rastapi.dll 6.1.7601.17514 Remote Access TAPI Co mpliance Layer rastls.dll 6.1.7601.17514 Remote Access PPP EAP -TLS rdpcfgex.dll 6.1.7601.17514 Remote Desktop Sessio n Host Server Connection Configuration Extension for the RDP protocol rdpcore.dll 6.1.7601.17514 RDP Core DLL rdpcorekmts.dll 6.1.7601.17514 TS (KM) RDPCore DLL rdpcorets.dll 6.1.7601.17514 TS RDPCore DLL rdpd3d.dll 6.1.7601.17514 RDP Direct3D Remoting DLL rdpdd.dll 6.1.7601.17514 RDP Display Driver rdpencdd.dll 6.1.7601.17514 RDP Encoder Mirror Dr iver rdpencom.dll 6.1.7601.17514 RDPSRAPI COM Objects rdpendp.dll 6.1.7601.17514 RDP Audio Endpoint rdprefdd.dll 6.1.7601.17514 Microsoft RDP Reflect or Display Driver rdprefdrvapi.dll 6.1.7601.17514 Reflector Driver API rdpudd.dll 6.1.7601.17514 UMRDP Display Driver rdpwsx.dll 6.1.7601.17514 RDP Extension DLL reagent.dll 6.1.7601.17514 Microsoft Windows Rec overy Agent DLL recovery.dll 6.1.7601.17514 Recovery Control Pane l regapi.dll 6.1.7601.17514 Registry Configuratio n APIs regctrl.dll 6.1.7600.16385 RegCtrl regidle.dll 6.1.7600.16385 RegIdle Backup Task regsvc.dll 6.1.7600.16385 Remote Registry Servi ce remotepg.dll 6.1.7601.17514 Remote Sessions CPL E xtension resampledmo.dll 6.1.7600.16385 Windows Media Resampl er resutils.dll 6.1.7601.17514 Microsoft Cluster Res ource Utility DLL rgb9rast.dll 6.1.7600.16385 Microsoft® Windows® Opera ting System riched20.dll 5.31.23.1230 Rich Text Edit Contro l, v3.1 riched32.dll 6.1.7601.17514 Wrapper Dll for Riche dit 1.0 rnr20.dll 6.1.7600.16385 Windows Socket2 NameS pace DLL rpcdiag.dll 6.1.7600.16385 RPC Diagnostics rpcepmap.dll 6.1.7600.16385 RPC Endpoint Mapper rpchttp.dll 6.1.7601.17514 RPC HTTP DLL rpcndfp.dll 1.0.0.1 RPC NDF Helper Class rpcns4.dll 6.1.7600.16385 Remote Procedure Call Name Service Client rpcnsh.dll 6.1.7600.16385 RPC Netshell Helper rpcrt4.dll 6.1.7601.17514 Remote Procedure Call Runtime rpcrtremote.dll 6.1.7601.17514 Remote RPC Extension rpcss.dll 6.1.7601.17514 Distributed COM Servi ces rsaenh.dll 6.1.7600.16385 Microsoft Enhanced Cr yptographic Provider rshx32.dll 6.1.7600.16385 Security Shell Extens ion rstrtmgr.dll 6.1.7600.16385 Restart Manager rtffilt.dll 2008.0.7600.16385 RTF Filter rtm.dll 6.1.7600.16385 Routing Table Manager rtutils.dll 6.1.7601.17514 Routing Utilities samcli.dll 6.1.7601.17514 Security Accounts Man ager Client DLL samlib.dll 6.1.7600.16385 SAM Library DLL sampleres.dll 6.1.7600.16385 Microsoft Samples samsrv.dll 6.1.7601.17514 SAM Server DLL sas.dll 6.1.7600.16385 WinLogon Software SAS Library sbe.dll 6.6.7601.17514 DirectShow Stream Buf fer Filter. sbeio.dll 12.0.7600.16385 Stream Buffer IO DLL sberes.dll 6.6.7600.16385 DirectShow Stream Buf fer Filter Resouces. scansetting.dll 6.1.7601.17514 Microsoft® Windows(TM) ScanSettings Profile and Scanning implementation scarddlg.dll 6.1.7600.16385 SCardDlg - Smart Card Common Dialog scardsvr.dll 6.1.7600.16385 Smart Card Resource M anagement Server scavengeui.dll 6.1.7601.17514 Service Pack Cleanup sccls.dll 6.1.7600.16385 Class-Installer DLL f or Smart Cards scecli.dll 6.1.7601.17514 Windows Security Conf iguration Editor Client Engine scesrv.dll 6.1.7601.17514 Windows Security Conf iguration Editor Engine scext.dll 6.1.7600.16385 Service Control Manag er Extension DLL for non-minwin schannel.dll 6.1.7601.17514 TLS / SSL Security Pr ovider schedcli.dll 6.1.7601.17514 Scheduler Service Cli ent DLL schedsvc.dll 6.1.7601.17514 Task Scheduler Servic e scksp.dll 6.1.7600.16385 Microsoft Smart Card Key Storage Provider scripto.dll 6.6.7600.16385 Microsoft ScriptO scrobj.dll 5.8.7600.16385 Windows ® Script Compon ent Runtime scrptadm.dll 6.1.7601.17514 Script Adm Extension scrrun.dll 5.8.7600.16385 Microsoft ® Script Runt ime sdautoplay.dll 6.1.7600.16385 Microsoft® Windows Back up AutoPlay Integration Library sdcpl.dll 6.1.7601.17514 Windows Backup And Re store Control Panel sdengin2.dll 6.1.7601.17514 Microsoft® Windows Back up Engine sdhcinst.dll 6.1.7600.16385 Secure Digital Host C ontroller Class Installer sdiageng.dll 6.1.7600.16385 Scripted Diagnostics Execution Engine sdiagprv.dll 6.1.7600.16385 Windows Scripted Diag nostic Provider API sdiagschd.dll 6.1.7600.16385 Scripted Diagnostics Scheduled Task sdohlp.dll 6.1.7600.16385 NPS SDO Helper Compon ent sdrsvc.dll 6.1.7601.17514 Microsoft® Windows Back up Service sdshext.dll 6.1.7600.16385 Microsoft® Windows Back up Shell Extension searchfolder.dll 6.1.7601.17514 SearchFolder sechost.dll 6.1.7600.16385 Host for SCM/SDDL/LSA Lookup APIs seclogon.dll 6.1.7600.16385 Secondary Logon Servi ce DLL secproc.dll 6.1.7601.17514 Windows Rights Manage ment Desktop Security Processor secproc_isv.dll 6.1.7601.17514 Windows Rights Manage ment Desktop Security Processor secproc_ssp.dll 6.1.7601.17514 Windows Rights Manage ment Services Server Security Processor secproc_ssp_isv.dll 6.1.7601.17514 Windows Rights Manage ment Services Server Security Processor (Pre-production) secur32.dll 6.1.7601.17514 Security Support Prov ider Interface security.dll 6.1.7600.16385 Security Support Prov ider Interface sendmail.dll 6.1.7600.16385 Send Mail sens.dll 6.1.7600.16385 System Event Notifica tion Service (SENS) sensapi.dll 6.1.7600.16385 SENS Connectivity API DLL sensorsapi.dll 6.1.7600.16385 Sensor API sensorsclassextension.dll 6.1.7600.16385 Sensor Driver Class E xtension component sensorscpl.dll 6.1.7601.17514 Open Location and Oth er Sensors sensrsvc.dll 6.1.7600.16385 Microsoft Windows amb ient light service serialui.dll 6.1.7600.16385 Serial Port Property Pages serwvdrv.dll 6.1.7600.16385 Unimodem Serial Wave driver sessenv.dll 6.1.7601.17514 Remote Desktop Config uration service setbcdlocale.dll 6.1.7601.17514 MUI Callback for Bcd setupapi.dll 6.1.7601.17514 Windows Setup API setupcln.dll 6.1.7601.17514 Setup Files Cleanup setupetw.dll 6.1.7600.16385 Setup ETW Event Resou rces sfc.dll 6.1.7600.16385 Windows File Protecti on sfc_os.dll 6.1.7600.16385 Windows File Protecti on shacct.dll 6.1.7601.17514 Shell Accounts Classe s sharemediacpl.dll 6.1.7601.17514 Share Media Control P anel shdocvw.dll 6.1.7601.17514 Shell Doc Object and Control Library shell.dll 3.10.0.103 Windows Shell library shell32.dll 6.1.7601.17514 Windows Shell Common Dll shellstyle.dll 6.1.7600.16385 Windows Shell Style R esource Dll shfolder.dll 6.1.7600.16385 Shell Folder Service shgina.dll 6.1.7601.17514 Windows Shell User Lo gon shimeng.dll 6.1.7600.16385 Shim Engine DLL shimgvw.dll 6.1.7601.17514 Photo Gallery Viewer shlwapi.dll 6.1.7601.17514 Shell Light-weight Ut ility Library shpafact.dll 6.1.7600.16385 Windows Shell LUA/PA Elevation Factory Dll shsetup.dll 6.1.7601.17514 Shell setup helper shsvcs.dll 6.1.7601.17514 Windows Shell Service s Dll shunimpl.dll 6.1.7601.17514 Windows Shell Obsolet e APIs shwebsvc.dll 6.1.7601.17514 Windows Shell Web Ser vices signdrv.dll 6.1.7600.16385 WMI provider for Sign ed Drivers sisbkup.dll 6.1.7601.17514 Single-Instance Store Backup Support Functions slc.dll 6.1.7600.16385 Software Licensing Cl ient Dll slcext.dll 6.1.7600.16385 Software Licensing Cl ient Extension Dll slwga.dll 6.1.7601.17514 Software Licensing WG A API sm56co85.dll 6.12.25.4 SM56 Modem co-install er smartcardcredentialprovider.dll 6.1.7601.17514 Windows Smartca rd Credential Provider smbhelperclass.dll 1.0.0.1 SMB (File Sharing) He lper Class for Network Diagnostic Framework smiengine.dll 6.1.7601.17514 WMI Configuration Cor e sndvolsso.dll 6.1.7601.17514 SCA Volume snmpapi.dll 6.1.7600.16385 SNMP Utility Library sntsearch.dll 6.1.7600.16385 Sticky Notes Search D LL softkbd.dll 6.1.7600.16385 Soft Keyboard Server and Tip softpub.dll 6.1.7600.16385 Softpub Forwarder DLL sortserver2003compat.dll 6.1.7600.16385 Sort Version Server 2 003 sortwindows6compat.dll 6.1.7600.16385 Sort Version Windows 6.0 spbcd.dll 6.1.7601.17514 BCD Sysprep Plugin spcmsg.dll 6.1.7600.16385 SP Installer Msg Dll sperror.dll 6.1.7600.16385 SP Error spfileq.dll 6.1.7600.16385 Windows SPFILEQ spinf.dll 6.1.7600.16385 Windows SPINF spnet.dll 6.1.7600.16385 Net Sysprep Plugin spoolss.dll 6.1.7600.16385 Spooler SubSystem DLL spopk.dll 6.1.7601.17514 OPK Sysprep Plugin spp.dll 6.1.7601.17514 Microsoft® Windows Shar ed Protection Point Library sppc.dll 6.1.7601.17514 Software Licensing Cl ient Dll sppcc.dll 6.1.7600.16385 Software Licensing Co mmerce Client sppcext.dll 6.1.7600.16385 Software Protection P latform Client Extension Dll sppcomapi.dll 6.1.7601.17514 Software Licensing Li brary sppcommdlg.dll 6.1.7600.16385 Software Licensing UI API sppinst.dll 6.1.7601.17514 SPP CMI Installer Plu g-in DLL sppnp.dll 6.1.7601.17514 PnP module of SysPrep sppobjs.dll 6.1.7601.17514 Software Protection P latform Plugins sppuinotify.dll 6.1.7601.17514 SPP Notification Serv ice sppwinob.dll 6.1.7601.17514 Software Protection P latform Windows Plugin sppwmi.dll 6.1.7600.16385 Software Protection P latform WMI provider spwinsat.dll 6.1.7600.16385 WinSAT Sysprep Plugin spwizeng.dll 6.1.7601.17514 Setup Wizard Framewor k spwizimg.dll 6.1.7600.16385 Setup Wizard Framewor k Resources spwizres.dll 6.1.7601.17514 Setup Wizard Framewor k Resources spwizui.dll 6.1.7601.17514 SPC Wizard UI spwmp.dll 6.1.7601.17514 Windows Media Player System Preparation DLL sqlceoledb30.dll 3.0.7600.0 Microsoft SQL Mobile sqlceqp30.dll 3.0.7600.0 Microsoft SQL Mobile sqlcese30.dll 3.0.7601.0 Microsoft SQL Mobile sqloledb.dll 6.1.7601.17514 OLE DB Provider for S QL Server sqlsrv32.dll 6.1.7601.17514 SQL Server ODBC Drive r sqlunirl.dll 2000.80.728.0 String Function .DLL for SQL Enterprise Components sqlwid.dll 1999.10.20.0 Unicode Function .DLL for SQL Enterprise Components sqlwoa.dll 1999.10.20.0 Unicode/ANSI Function .DLL for SQL Enterprise Components sqlxmlx.dll 6.1.7600.16385 XML extensions for SQ L Server sqmapi.dll 6.1.7601.17514 SQM Client srchadmin.dll 7.0.7601.17514 Indexing Options srclient.dll 6.1.7600.16385 Microsoft® Windows Syst em Restore Client Library srcore.dll 6.1.7601.17514 Microsoft® Windows Syst em Restore Core Library srhelper.dll 6.1.7600.16385 Microsoft® Windows driv er and windows update enumeration library srpuxnativesnapin.dll 6.1.7600.16385 Application Control P olicies Group Policy Editor Extension srrstr.dll 6.1.7601.17514 Microsoft® Windows Syst em Protection Configuration Library srvcli.dll 6.1.7601.17514 Server Service Client DLL srvsvc.dll 6.1.7601.17514 Server Service DLL srwmi.dll 6.1.7600.16385 Microsoft® Windows Syst em Restore WMI Provider sscore.dll 6.1.7601.17514 Server Service Core D LL ssdpapi.dll 6.1.7600.16385 SSDP Client API DLL ssdpsrv.dll 6.1.7600.16385 SSDP Service DLL sspicli.dll 6.1.7601.17514 Security Support Prov ider Interface sspisrv.dll 6.1.7601.17514 LSA SSPI RPC interfac e DLL ssshim.dll 6.1.7600.16385 Windows Componentizat ion Platform Servicing API sstpsvc.dll 6.1.7600.16385 Provides the facility of using Secure Socket Tunneling Protocol (SSTP) to connect to remote (using VPN). stclient.dll 2001.12.8530.16385 COM+ Configuration Ca talog Client sti.dll 6.1.7600.16385 Still Image Devices c lient DLL sti_ci.dll 6.1.7600.16385 Still Image Class Ins taller stobject.dll 6.1.7601.17514 Systray shell service object storage.dll 2.10.35.35 OLE 2.1 16/32 Interop erability Library storagecontexthandler.dll 6.1.7600.16385 Device Center Storage Context Menu Handler storprop.dll 6.1.7600.16385 Property Pages for St orage Devices streamci.dll 6.1.7600.16385 Streaming Device Clas s Installer structuredquery.dll 7.0.7601.17514 Structured Query sud.dll 6.1.7601.17514 SUD Control Panel swprv.dll 6.1.7600.16385 Microsoft® Volume Shado w Copy Service software provider sxproxy.dll 6.1.7600.16385 Microsoft® Windows Syst em Protection Proxy Library sxs.dll 6.1.7601.17514 Fusion 2.5 sxshared.dll 6.1.7600.16385 Microsoft® Windows SX S hared Library sxssrv.dll 6.1.7600.16385 Windows SxS Server DL L sxsstore.dll 6.1.7600.16385 Sxs Store DLL synccenter.dll 6.1.7601.17514 Microsoft Sync Center synceng.dll 6.1.7600.16385 Windows Briefcase Eng ine synchostps.dll 6.1.7600.16385 Proxystub for sync ho st syncinfrastructure.dll 6.1.7600.16385 Microsoft Windows Syn c Infrastructure. syncinfrastructureps.dll 6.1.7600.16385 Microsoft Windows syn c infrastructure proxy stub. syncreg.dll 2007.94.7600.16385 Microsoft Synchroniza tion Framework Registration syncui.dll 6.1.7601.17514 Windows Briefcase sysclass.dll 6.1.7601.17514 System Class Installe r Library sysmain.dll 6.1.7601.17514 Superfetch Service Ho st sysntfy.dll 6.1.7600.16385 Windows Notifications Dynamic Link Library sysprepmce.dll 6.1.7600.16385 Windows Media Center SysPrep DLL syssetup.dll 6.1.7601.17514 Windows NT System Set up systemcpl.dll 6.1.7601.17514 My System CPL t2embed.dll 6.1.7601.17514 Microsoft T2Embed Fon t Embedding tabbtn.dll 6.1.7600.16385 Microsoft Tablet PC B uttons Component tabbtnex.dll 6.1.7600.16385 Microsoft Tablet PC E xtended Buttons Component tabsvc.dll 6.1.7601.17514 Microsoft Tablet PC I nput Service tapi.dll 3.10.0.103 Microsoft® Windows(TM) Telephony Server16 tapi3.dll 6.1.7600.16385 Microsoft TAPI3 tapi32.dll 6.1.7600.16385 Microsoft® Windows(TM) Telephony API Client DLL tapilua.dll 6.1.7600.16385 Microsoft® Windows(TM) Phone And Modem Lua Elevation Dll tapimigplugin.dll 6.1.7600.16385 Microsoft® Windows(TM) TAPI Migration Plugin Dll tapiperf.dll 6.1.7600.16385 Microsoft® Windows(TM) Telephony Performance Monitor tapisrv.dll 6.1.7601.17514 Microsoft® Windows(TM) Telephony Server tapisysprep.dll 6.1.7600.16385 Microsoft® Windows(TM) Telephony Sysprep Work tapiui.dll 6.1.7600.16385 Microsoft® Windows(TM) Telephony API UI DLL taskbarcpl.dll 6.1.7601.17514 Taskbar Control Panel taskcomp.dll 6.1.7601.17514 Task Scheduler Backwa rd Compatibility Plug-in taskschd.dll 6.1.7601.17514 Task Scheduler COM AP I taskschdps.dll 6.1.7600.16385 Task Scheduler Interf aces Proxy tbs.dll 6.1.7600.16385 TBS tbssvc.dll 6.1.7600.16385 TBS Service tcpipcfg.dll 6.1.7601.17514 Network Configuration Objects tcpmib.dll 6.1.7600.16385 Standard TCP/IP Port Monitor Helper DLL tcpmon.dll 6.1.7600.16385 Standard TCP/IP Port Monitor DLL tcpmonui.dll 6.1.7600.16385 Standard TCP/IP Port Monitor UI DLL tdh.dll 6.1.7600.16385 Event Trace Helper Li brary termmgr.dll 6.1.7601.17514 Microsoft TAPI3 Termi nal Manager termsrv.dll 6.1.7601.17514 Remote Desktop Sessio n Host Server Remote Connections Manager thawbrkr.dll 6.1.7600.16385 Thai Word Breaker themecpl.dll 6.1.7601.17514 Personalization CPL themeservice.dll 6.1.7600.16385 Windows Shell Theme S ervice Dll themeui.dll 6.1.7601.17514 Windows Theme API thumbcache.dll 6.1.7601.17514 Microsoft Thumbnail C ache timedatemuicallback.dll 6.1.7600.16385 Time Date Control UI Language Change plugin tlscsp.dll 6.1.7601.17514 Microsoft® Remote Deskt op Services Cryptographic Utility toolhelp.dll 3.10.0.103 Windows Debug/Tool he lper library tpmcompc.dll 6.1.7600.16385 Computer Chooser Dial og tquery.dll 7.0.7601.17514 tquery.dll traffic.dll 6.1.7600.16385 Microsoft Traffic Con trol 1.0 DLL trapi.dll 6.1.7601.17514 Microsoft Narrator Te xt Renderer trkwks.dll 6.1.7600.16385 Distributed Link Trac king Client tsbyuv.dll 6.1.7601.17514 Toshiba Video Codec tscfgwmi.dll 6.1.7601.17514 Remote Desktop Sessio n Host Server Configuration WMI provider tschannel.dll 6.1.7600.16385 Task Scheduler Proxy tsddd.dll 6.1.7600.16385 Framebuffer Display D river tserrredir.dll 6.1.7600.16385 Remote Desktop Servic es Logon Error Redirector tsgqec.dll 6.1.7601.17514 RD Gateway QEC tsmf.dll 6.1.7601.17514 RDP MF Plugin tspkg.dll 6.1.7601.17514 Web Service Security Package tspnprdrcoinstaller.dll 6.1.7600.16385 Remote Desktop PnP Re directed Device Co-Installer tspubwmi.dll 6.1.7601.17514 Remote Desktop Progra ms WMI provider tssrvlic.dll 6.1.7601.17514 RD Server Licensing P olicy Module tsusbgdcoinstaller.dll 6.1.7601.17514 Remote Desktop Generi c USB Driver Coinstaller tsusbredirectiongrouppolicyextension.dll 6.1.7601.17514 Remote Desktop USB Redirection GP Extension tsworkspace.dll 6.1.7601.17514 RemoteApp and Desktop Connection Component tvratings.dll 6.6.7600.16385 Module for managing T V ratings twext.dll 6.1.7601.17514 Previous Versions pro perty page twnlib4.dll 4.0.19.0 TwnLib4 txflog.dll 2001.12.8530.16385 COM+ txfw32.dll 6.1.7600.16385 TxF Win32 DLL typelib.dll 2.10.3029.1 OLE 2.1 16/32 Interop erability Library tzres.dll 6.1.7601.17514 Time Zones resource D LL ubpm.dll 6.1.7600.16385 Unified Background Pr ocess Manager DLL uci32108.dll 2.0.0.8 Conexant Unified x86 Device CoInstaller ucmhc.dll 6.1.7600.16385 UCM Helper Class udcpm.dll 0.3.5.3 Universal Document Co nverter Port Monitor udhisapi.dll 6.1.7600.16385 UPnP Device Host ISAP I Extension udwm.dll 6.1.7600.16385 Microsoft Desktop Win dow Manager uexfat.dll 6.1.7600.16385 eXfat Utility DLL ufat.dll 6.1.7600.16385 FAT Utility DLL uianimation.dll 6.1.7600.16385 Windows Animation Man ager uiautomationcore.dll 7.0.0.0 Microsoft UI Automati on Core uicom.dll 6.1.7600.16385 Add/Remove Modems uihub.dll 6.1.7600.16385 Microsoft Tablet PC F licks and Pen Feedback Component uiribbon.dll 6.1.7601.17514 Windows Ribbon Framew ork uiribbonres.dll 6.1.7601.17514 Windows Ribbon Framew ork Resources ulib.dll 6.1.7600.16385 File Utilities Suppor t DLL umb.dll 6.1.7601.17514 User Mode Bus Driver Interface Dll umdmxfrm.dll 6.1.7600.16385 Unimodem Tranform Mod ule umpnpmgr.dll 6.1.7601.17514 User-mode Plug-and-Pl ay Service umpo.dll 6.1.7601.17514 User-mode Power Servi ce umrdp.dll 6.1.7601.17514 Remote Desktop Servic es Device Redirector Service unattend.dll 6.1.7601.17514 Unattend Library unimdmat.dll 6.1.7601.17514 Unimodem Service Prov ider AT Mini Driver uniplat.dll 6.1.7600.16385 Unimodem AT Mini Driv er Platform Driver for Windows NT untfs.dll 6.1.7601.17514 NTFS Utility DLL upnp.dll 6.1.7601.17514 UPnP Control Point AP I upnphost.dll 6.1.7600.16385 UPnP Device Host ureg.dll 6.1.7600.16385 Registry Utility DLL url.dll 8.0.7600.16385 Internet Shortcut She ll Extension DLL urlmon.dll 8.0.7601.17514 OLE32 Extensions for Win32 usbceip.dll 6.1.7600.16385 USBCEIP Task usbmon.dll 6.1.7600.16385 Standard Dynamic Prin ting Port Monitor DLL usbperf.dll 6.1.7600.16385 USB Performance Objec ts DLL usbui.dll 6.1.7600.16385 USB UI Dll user32.dll 6.1.7601.17514 Multi-User Windows US ER API Client DLL useraccountcontrolsettings.dll 6.1.7601.17514 UserAccountContr olSettings usercpl.dll 6.1.7601.17514 User control panel userenv.dll 6.1.7601.17514 Userenv usp10.dll 1.626.7601.17514 Unicode scr ipt processor utildll.dll 6.1.7601.17514 WinStation utility su pport DLL uudf.dll 6.1.7600.16385 UDF Utility DLL uxinit.dll 6.1.7600.16385 Windows User Experien ce Session Initialization Dll uxlib.dll 6.1.7601.17514 Setup Wizard Framewor k uxlibres.dll 6.1.7600.16385 UXLib Resources uxsms.dll 6.1.7600.16385 Microsoft User Experi ence Session Management Service uxtheme.dll 6.1.7600.16385 Microsoft UxTheme Lib rary van.dll 6.1.7601.17514 View Available Networ ks vault.dll 6.1.7601.17514 Windows vault Control Panel vaultcli.dll 6.1.7600.16385 Credential Vault Clie nt Library vaultcredprovider.dll 6.1.7600.16385 Vault Credential Prov ider vaultsvc.dll 6.1.7601.17514 Credential Manager Se rvice vbajet32.dll 6.0.1.9431 Visual Basic for Appl ications Development Environment - Expression Service Loader .dll 5.8.7601.17514 Microsoft ® VBScript vdmdbg.dll 6.1.7600.16385 VDMDBG.DLL vdmredir.dll 6.1.7600.16385 Virtual Dos Machine N etwork Interface Library vds_ps.dll 6.1.7600.16385 Microsoft® Virtual Disk Service proxy/stub vdsbas.dll 6.1.7601.17514 Virtual Disk Service Basic Provider vdsdyn.dll 6.1.7600.16385 VDS Dynamic Volume Pr ovider, Version 2.1.0.1 vdsutil.dll 6.1.7601.17514 Virtual Disk Service Utility Library vdsvd.dll 6.1.7600.16385 VDS Virtual Disk Prov ider, Version 1.0 ver.dll 3.10.0.103 Version Checking and File Installation Libraries verifier.dll 6.1.7600.16385 Standard application verifier provider dll version.dll 6.1.7600.16385 Version Checking and File Installation Libraries vfpodbc.dll 1.0.2.0 vfpodbc vfwwdm32.dll 6.1.7601.17514 VfW MM Driver for WDM Video Capture Devices vga.dll 6.1.7600.16385 VGA 16 Colour Display Driver vga256.dll 6.1.7600.16385 256 Color VGA\SVGA Di splay Driver vga64k.dll 6.1.7600.16385 32K/64K color VGA\SVG A Display Driver vidreszr.dll 6.1.7600.16385 Windows Media Resizer virtdisk.dll 6.1.7600.16385 Virtual Disk API DLL vmbuscoinstaller.dll 6.1.7601.17514 Hyper-V VMBUS Coinsta ller vmbuspipe.dll 6.1.7601.17514 VmBus User Mode Pipe DLL vmbusres.dll 6.1.7601.17514 Virtual Machine Bus R esource DLL vmdcoinstall.dll 6.1.7601.17514 Hyper-V Integration C omponents Coinstaller vmicres.dll 6.1.7601.17514 Virtual Machine Integ ration Component Service Resource DLL vmictimeprovider.dll 6.1.7601.17514 Virtual Machine Integ ration Component Time Sync Provider Library vmstorfltres.dll 6.1.7601.17514 Virtual Machine Stora ge Filter Resource DLL vpnike.dll 6.1.7601.17514 VPNIKE Protocol Engin e - Test dll vpnikeapi.dll 6.1.7601.17514 VPN IKE API's vss_ps.dll 6.1.7600.16385 Microsoft® Volume Shado w Copy Service proxy/stub vssapi.dll 6.1.7601.17514 Microsoft® Volume Shado w Copy Requestor/Writer Services API DLL vsstrace.dll 6.1.7600.16385 Microsoft® Volume Shado w Copy Service Tracing Library w32time.dll 6.1.7600.16385 Windows Time Service w32topl.dll 6.1.7600.16385 Windows NT Topology M aintenance Tool wab32.dll 6.1.7600.16385 Microsoft (R) Contact s DLL wab32res.dll 6.1.7600.16385 Microsoft (R) Contact s DLL wabsyncprovider.dll 6.1.7600.16385 Microsoft Windows Con tacts Sync Provider wavdest.dll 6.1.7601.17514 Windows Sound Recorde r wavemsp.dll 6.1.7601.17514 Microsoft Wave MSP wbemcomn.dll 6.1.7601.17514 WMI wbiosrvc.dll 6.1.7600.16385 Windows Biometric Ser vice wcnapi.dll 6.1.7600.16385 Windows Connect Now - API Helper DLL wcncsvc.dll 6.1.7601.17514 Windows Connect Now - Config Registrar Service wcneapauthproxy.dll 6.1.7600.16385 Windows Connect Now - WCN EAP Authenticator Proxy wcneappeerproxy.dll 6.1.7600.16385 Windows Connect Now - WCN EAP PEER Proxy wcnnetsh.dll 6.1.7600.16385 WCN Netsh Helper DLL wcnwiz.dll 6.1.7600.16385 Windows Connect Now W izards wcspluginservice.dll 6.1.7600.16385 WcsPlugInService DLL wdc.dll 6.1.7601.17514 Performance Monitor wdfcoinstaller01009.dll 1.9.7600.16385 WDF Coinstaller wdi.dll 6.1.7600.16385 Windows Diagnostic In frastructure wdiasqmmodule.dll 6.1.7601.17514 Adaptive SQM WDI Plug in wdigest.dll 6.1.7600.16385 Microsoft Digest Acce ss wdscore.dll 6.1.7601.17514 Panther Engine Module webcheck.dll 8.0.7601.17514 Web Site Monitor webclnt.dll 6.1.7601.17514 Web DAV Service DLL webio.dll 6.1.7601.17514 Web Transfer Protocol s API webservices.dll 6.1.7601.17514 Windows Web Services Runtime wecapi.dll 6.1.7600.16385 Event Collector Confi guration API wecsvc.dll 6.1.7600.16385 Event Collector Servi ce wer.dll 6.1.7601.17514 Windows Error Reporti ng DLL werconcpl.dll 6.1.7601.17514 PRS CPL wercplsupport.dll 6.1.7600.16385 Problem Reports and S olutions werdiagcontroller.dll 6.1.7600.16385 WER Diagnostic Contro ller wersvc.dll 6.1.7600.16385 Windows Error Reporti ng Service werui.dll 6.1.7600.16385 Windows Error Reporti ng UI DLL wevtapi.dll 6.1.7600.16385 Eventing Consumption and Configuration API wevtfwd.dll 6.1.7600.16385 WS-Management Event F orwarding Plug-in wevtsvc.dll 6.1.7601.17514 Event Logging Service wfapigp.dll 6.1.7600.16385 Windows Firewall GPO Helper dll wfhc.dll 6.1.7600.16385 Windows Firewall Hel per Class wfsr.dll 6.1.7600.16385 Windows Fax and Scan Resources whealogr.dll 6.1.7600.16385 WHEA Troubleshooter whhelper.dll 6.1.7600.16385 Net shell helper DLL for winHttp wiaaut.dll 6.1.7600.16385 WIA Automation Layer wiadefui.dll 6.1.7601.17514 WIA Scanner Default U I wiadss.dll 6.1.7600.16385 WIA TWAIN compatibili ty layer wiarpc.dll 6.1.7601.17514 Windows Image Acquisi tion RPC client DLL wiascanprofiles.dll 6.1.7600.16385 Microsoft Windows Sca nProfiles wiaservc.dll 6.1.7601.17514 Still Image Devices S ervice wiashext.dll 6.1.7600.16385 Imaging Devices Shell Folder UI wiatrace.dll 6.1.7600.16385 WIA Tracing wiavideo.dll 6.1.7601.17514 WIA Video wifeman.dll 3.10.0.103 Windows WIFE interfac e core component wimgapi.dll 6.1.7601.17514 Windows Imaging Libra ry win32spl.dll 6.1.7601.17514 Client Side Rendering Print Provider win87em.dll winbio.dll 6.1.7600.16385 Windows Biometrics Cl ient API winbrand.dll 6.1.7600.16385 Windows Branding Reso urces wincredprovider.dll 6.1.7600.16385 wincredprovider DLL windowsaccessbridge.dll 2.0.7.0 Java Access Bridge fo r Windows windowscodecs.dll 6.1.7601.17514 Microsoft Windows Cod ecs Library windowscodecsext.dll 6.1.7600.16385 Microsoft Windows Cod ecs Extended Library winethc.dll 6.1.7600.16385 WinInet Helper Class winfax.dll 6.1.7600.16385 Microsoft Fax API Su pport DLL winhttp.dll 6.1.7601.17514 Windows HTTP Services wininet.dll 8.0.7601.17514 Internet Extensions f or Win32 winipsec.dll 6.1.7600.16385 Windows IPsec SPD Cli ent DLL winmm.dll 6.1.7601.17514 MCI API DLL winnls.dll 3.10.0.103 Windows IME interface core component winnsi.dll 6.1.7600.16385 Network Store Informa tion RPC interface winrnr.dll 6.1.7600.16385 LDAP RnR Provider DLL winrscmd.dll 6.1.7600.16385 remtsvc winrsmgr.dll 6.1.7600.16385 WSMan Shell API winrssrv.dll 6.1.7600.16385 winrssrv winsatapi.dll 6.1.7601.17514 Windows System Assess ment Tool API winscard.dll 6.1.7601.17514 Microsoft Smart Card API winshfhc.dll 6.1.7600.16385 File Risk Estimation winsock.dll 3.10.0.103 Windows Socket 16-Bit DLL winsockhc.dll 6.1.7600.16385 Winsock Network Diagn ostic Helper Class winsrpc.dll 6.1.7600.16385 WINS RPC LIBRARY winsrv.dll 6.1.7601.17514 Multi-User Windows Se rver DLL winsta.dll 6.1.7601.17514 Winstation Library winsync.dll 2007.94.7600.16385 Synchronization Frame work winsyncmetastore.dll 2007.94.7600.16385 Windows Synchronizati on Metadata Store winsyncproviders.dll 2007.94.7600.16385 Windows Synchronizati on Provider Framework wintrust.dll 6.1.7601.17514 Microsoft Trust Verif ication APIs winusb.dll 6.1.7600.16385 Windows USB Driver Us er Library wkscli.dll 6.1.7601.17514 Workstation Service C lient DLL wksprtps.dll 6.1.7600.16385 WorkspaceRuntime Prox yStub DLL wkssvc.dll 6.1.7601.17514 Workstation Service D LL wlanapi.dll 6.1.7600.16385 Windows WLAN AutoConf ig Client Side API DLL wlancfg.dll 6.1.7600.16385 Wlan Netsh Helper DLL wlanconn.dll 6.1.7600.16385 Dot11 Connection Flow s wlandlg.dll 6.1.7600.16385 Wireless Lan Dialog W izards wlangpui.dll 6.1.7601.17514 Wireless Network Poli cy Management Snap-in wlanhc.dll 6.1.7600.16385 Wireless LAN Helper C lasses wlanhlp.dll 6.1.7600.16385 Windows Wireless LAN 802.11 Client Side Helper API wlaninst.dll 6.1.7600.16385 Windows NET Device Cl ass Co-Installer for Wireless LAN wlanmm.dll 6.1.7600.16385 Dot11 Media and AdHoc Managers wlanmsm.dll 6.1.7601.17514 Windows Wireless LAN 802.11 MSM DLL wlanpref.dll 6.1.7601.17514 Wireless Preferred Ne tworks wlansec.dll 6.1.7600.16385 Windows Wireless LAN 802.11 MSM Security Module DLL wlansvc.dll 6.1.7600.16385 Windows WLAN AutoConf ig Service DLL wlanui.dll 6.1.7601.17514 Wireless Profile UI wlanutil.dll 6.1.7600.16385 Windows Wireless LAN 802.11 Utility DLL wldap32.dll 6.1.7601.17514 Win32 LDAP API DLL wlgpclnt.dll 6.1.7600.16385 802.11 Group Policy C lient wls0wndh.dll 6.1.7600.16385 Session0 Viewer Windo w Hook DLL wmadmod.dll 6.1.7601.17514 Windows Media Audio D ecoder wmadmoe.dll 6.1.7600.16385 Windows Media Audio 1 0 Encoder/Transcoder wmasf.dll 12.0.7600.16385 Windows Media ASF DLL wmcodecdspps.dll 6.1.7600.16385 Windows Media CodecDS P Proxy Stub Dll wmdmlog.dll 12.0.7600.16385 Windows Media Device Manager Logger wmdmps.dll 12.0.7600.16385 Windows Media Device Manager Proxy Stub wmdrmdev.dll 12.0.7601.17514 Windows Media DRM for Network Devices Registration DLL wmdrmnet.dll 12.0.7601.17514 Windows Media DRM for Network Devices DLL wmdrmsdk.dll 11.0.7601.17514 Windows Media DRM SDK DLL wmerror.dll 12.0.7600.16385 Windows Media Error D efinitions (English) wmi.dll 6.1.7600.16385 WMI DC and DP functio nality wmicmiplugin.dll 6.1.7601.17514 WMI CMI Plugin wmidx.dll 12.0.7600.16385 Windows Media Indexer DLL wmiprop.dll 6.1.7600.16385 WDM Provider Dynamic Property Page CoInstaller wmnetmgr.dll 12.0.7601.17514 Windows Media Network Plugin Manager DLL wmp.dll 12.0.7601.17514 Windows Media Player wmpcm.dll 12.0.7600.16385 Windows Media Player Compositing Mixer wmpdui.dll 12.0.7600.16385 Windows Media Player UI Engine wmpdxm.dll 12.0.7601.17514 Windows Media Player Extension wmpeffects.dll 12.0.7601.17514 Windows Media Player Effects wmpencen.dll 12.0.7601.17514 Windows Media Player Encoding Module wmphoto.dll 6.1.7601.17514 Windows Media Photo C odec wmploc.dll 12.0.7601.17514 Windows Media Player Resources wmpmde.dll 12.0.7601.17514 WMPMDE DLL wmpps.dll 12.0.7601.17514 Windows Media Player Proxy Stub Dll wmpshell.dll 12.0.7601.17514 Windows Media Player Launcher wmpsrcwp.dll 12.0.7601.17514 WMPSrcWp Module wmsgapi.dll 6.1.7600.16385 WinLogon IPC Client wmspdmod.dll 6.1.7601.17514 Windows Media Audio V oice Decoder wmspdmoe.dll 6.1.7600.16385 Windows Media Audio V oice Encoder wmvcore.dll 12.0.7601.17514 Windows Media Playbac k/Authoring DLL wmvdecod.dll 6.1.7601.17514 Windows Media Video D ecoder wmvdspa.dll 6.1.7600.16385 Windows Media Video D SP Components - Advanced wmvencod.dll 6.1.7600.16385 Windows Media Video 9 Encoder wmvsdecd.dll 6.1.7601.17514 Windows Media Screen Decoder wmvsencd.dll 6.1.7600.16385 Windows Media Screen Encoder wmvxencd.dll 6.1.7600.16385 Windows Media Video E ncoder wow32.dll 6.1.7600.16385 32-bit WOW Subsystem Library wpc.dll 1.0.0.1 WPC Settings Library wpcao.dll 6.1.7600.16385 WPC Administrator Ove rride wpccpl.dll 6.1.7601.17514 Parental Controls Con trol Panel wpcmig.dll 1.0.0.1 Windows Parental Cont rols Migration wpcsvc.dll 1.0.0.1 WPC Filtering Service wpcumi.dll 1.0.0.1 Windows Parental Cont rols Notifications wpd_ci.dll 6.1.7601.17514 Driver Setup Class In staller for Windows Portable Devices wpdbusenum.dll 6.1.7601.17514 Portable Device Enume rator wpdshext.dll 6.1.7601.17514 Portable Devices Shel l Extension wpdshserviceobj.dll 6.1.7601.17514 Windows Portable Devi ce Shell Service Object wpdsp.dll 6.1.7601.17514 WMDM Service Provider for Windows Portable Devices wpdwcn.dll 6.1.7601.17514 Windows Portable Devi ce WCN Wizard ws2_32.dll 6.1.7601.17514 Windows Socket 2.0 32 -Bit DLL ws2help.dll 6.1.7600.16385 Windows Socket 2.0 He lper for Windows NT wscapi.dll 6.1.7601.17514 Windows Security Cent er API wscinterop.dll 6.1.7600.16385 Windows Health Center WSC Interop wscisvif.dll 6.1.7600.16385 Windows Security Cent er ISV API wscmisetup.dll 6.1.7600.16385 Installers for Winsoc k Transport and Name Space Providers wscproxystub.dll 6.1.7600.16385 Windows Security Cent er ISV Proxy Stub wscsvc.dll 6.1.7600.16385 Windows Security Cent er Service wsdapi.dll 6.1.7601.17514 Web Services for Devi ces API DLL wsdchngr.dll 6.1.7601.17514 WSD Challenge Compone nt wsdmon.dll 6.1.7600.16385 WSD Printer Port Moni tor wsdprintproxy.dll 6.1.7600.16385 Function Discovery Pr inter Proxy Dll wsdscanproxy.dll 6.1.7600.16385 Function Discovery WS D Scanner Proxy Dll wsecedit.dll 6.1.7600.16385 Security Configuratio n UI Module wsepno.dll 7.0.7600.16385 Profile notification support for Windows Search Service wshbth.dll 6.1.7601.17514 Windows Sockets Helpe r DLL wshcon.dll 5.8.7600.16385 Microsoft ® Windows Scr ipt Controller wshelper.dll 6.1.7600.16385 Winsock Net shell hel per DLL for winsock wshext.dll 5.8.7600.16385 Microsoft ® Shell Exten sion for wship6.dll 6.1.7600.16385 Winsock2 Helper DLL ( TL/IPv6) wshirda.dll 6.1.7601.17514 Windows Sockets Helpe r DLL wshnetbs.dll 6.1.7600.16385 Netbios Windows Socke ts Helper DLL wshqos.dll 6.1.7600.16385 QoS Winsock2 Helper D LL wshrm.dll 6.1.7600.16385 Windows Sockets Helpe r DLL for PGM wshtcpip.dll 6.1.7600.16385 Winsock2 Helper DLL ( TL/IPv4) wsmanmigrationplugin.dll 6.1.7600.16385 WinRM Migration Plugi n wsmauto.dll 6.1.7600.16385 WSMAN Automation wsmplpxy.dll 6.1.7600.16385 wsmplpxy wsmres.dll 6.1.7600.16385 WSMan Resource DLL wsmsvc.dll 6.1.7601.17514 WSMan Service wsmwmipl.dll 6.1.7600.16385 WSMAN WMI Provider wsnmp32.dll 6.1.7601.17514 Microsoft WinSNMP v2. 0 Manager API wsock32.dll 6.1.7600.16385 Windows Socket 32-Bit DLL wtsapi32.dll 6.1.7601.17514 Windows Remote Deskto p Session Host Server SDK APIs wuapi.dll 7.5.7601.17514 Windows Update Client API wuaueng.dll 7.5.7601.17514 Windows Update Agent wucltux.dll 7.5.7601.17514 Windows Update Client User Experience wudfcoinstaller.dll 6.1.7601.17514 Windows Driver Founda tion - User-mode Platform Device Co-Installer wudfplatform.dll 6.1.7601.17514 Windows Driver Founda tion - User-mode Platform Library wudfsvc.dll 6.1.7601.17514 Windows Driver Founda tion - User-mode Driver Framework Service wudfx.dll 6.1.7601.17514 WDF:UMDF Framework Li brary wudriver.dll 7.5.7601.17514 Windows Update WUDriv er Stub wups.dll 7.5.7601.17514 Windows Update client proxy stub wups2.dll 7.5.7601.17514 Windows Update client proxy stub 2 wuwebv.dll 7.5.7601.17514 Windows Update Vista Web Control wvc.dll 6.1.7601.17514 Windows Visual Compon ents wwanadvui.dll 8.1.2.0 Wireless WAN Connecti on Flows wwanapi.dll 6.1.7600.16385 Mbnapi wwancfg.dll 6.1.7600.16385 MBN Netsh Helper DLL wwanconn.dll 8.1.7601.17514 Wireless WAN Connecti on Flows wwanhc.dll 8.1.2.0 Wireless WAN Helper C lass wwaninst.dll 8.1.2.0 Windows NET Device Cl ass Co-Installer for Wireless WAN wwanmm.dll 8.1.2.0 WWan Media Manager wwanpref.dll 8.1.2.0 Wireless WAN Profile Settings Editor wwanprotdim.dll 8.1.7601.17514 WWAN Device Interface Module wwansvc.dll 8.1.2.0 WWAN Auto Config Serv ice wwapi.dll 8.1.2.0 WWAN API wzcdlg.dll 6.1.7600.16385 Windows Connect Now - Flash Config Enrollee x3daudio1_0.dll 9.11.519.0 X3DAudio x3daudio1_1.dll 9.15.779.0 X3DAudio x3daudio1_2.dll 9.21.1148.0 X3DAudio x3daudio1_3.dll 9.22.1284.0 X3DAudio x3daudio1_4.dll 9.23.1350.0 X3DAudio x3daudio1_5.dll 9.25.1476.0 X3DAudio x3daudio1_6.dll 9.26.1590.0 3D Audio Library x3daudio1_7.dll 9.28.1886.0 3D Audio Library xactengine2_0.dll 9.11.519.0 XACT Engine API xactengine2_1.dll 9.12.589.0 XACT Engine API xactengine2_10.dll 9.21.1148.0 XACT Engine API xactengine2_2.dll 9.13.644.0 XACT Engine API xactengine2_3.dll 9.14.701.0 XACT Engine API xactengine2_4.dll 9.15.779.0 XACT Engine API xactengine2_5.dll 9.16.857.0 XACT Engine API xactengine2_6.dll 9.17.892.0 XACT Engine API xactengine2_7.dll 9.18.944.0 XACT Engine API xactengine2_8.dll 9.19.1007.0 XACT Engine API xactengine2_9.dll 9.20.1057.0 XACT Engine API xactengine3_0.dll 9.22.1284.0 XACT Engine API xactengine3_1.dll 9.23.1350.0 XACT Engine API xactengine3_2.dll 9.24.1400.0 XACT Engine API xactengine3_3.dll 9.25.1476.0 XACT Engine API xactengine3_4.dll 9.26.1590.0 XACT Engine API xactengine3_5.dll 9.27.1734.0 XACT Engine API xactengine3_6.dll 9.28.1886.0 XACT Engine API xactengine3_7.dll 9.29.1962.0 XACT Engine API xapofx1_0.dll 9.23.1350.0 XAPOFX xapofx1_1.dll 9.24.1400.0 XAPOFX xapofx1_2.dll 9.25.1476.0 XAPOFX xapofx1_3.dll 9.26.1590.0 Audio Effect Library xapofx1_4.dll 9.28.1886.0 Audio Effect Library xapofx1_5.dll 9.29.1962.0 Audio Effect Library xaudio2_0.dll 9.22.1284.0 XAudio2 Game Audio AP I xaudio2_1.dll 9.23.1350.0 XAudio2 Game Audio AP I xaudio2_2.dll 9.24.1400.0 XAudio2 Game Audio AP I xaudio2_3.dll 9.25.1476.0 XAudio2 Game Audio AP I xaudio2_4.dll 9.26.1590.0 XAudio2 Game Audio AP I xaudio2_5.dll 9.27.1734.0 XAudio2 Game Audio AP I xaudio2_6.dll 9.28.1886.0 XAudio2 Game Audio AP I xaudio2_7.dll 9.29.1962.0 XAudio2 Game Audio AP I xinput1_1.dll 9.12.589.0 Microsoft Common Cont roller API xinput1_2.dll 9.14.701.0 Microsoft Common Cont roller API xinput1_3.dll 9.18.944.0 Microsoft Common Cont roller API xinput9_1_0.dll 6.1.7600.16385 XNA Common Controller xmlfilter.dll 2008.0.7600.16385 XML Filter xmllite.dll 1.3.1000.0 Microsoft XmlLite Lib rary xmlprovi.dll 6.1.7600.16385 Network Provisioning Service Client API xmlrw.dll 2.0.3609.0 Microsoft XML Slim Li brary xmlrwbin.dll 2.0.3609.0 Microsoft XML Slim Li brary xolehlp.dll 2001.12.8530.16385 Microsoft Distributed Transaction Coordinator Helper APIs DLL xpsfilt.dll 6.1.7600.16385 XML Paper Specificati on Document IFilter xpsgdiconverter.dll 6.1.7601.17514 XPS to GDI Converter xpsprint.dll 6.1.7601.17514 XPS Printing DLL xpsrasterservice.dll 6.1.7601.17514 XPS Rasterization Ser vice Component xpsservices.dll 6.1.7601.17514 Xps Object Model in m emory creation and deserialization xpsshhdr.dll 6.1.7600.16385 Package Document Shel l Extension Handler xpssvcs.dll 6.1.7600.16385 Native Code Xps Servi ces Library xwizards.dll 6.1.7600.16385 Extensible Wizards Ma nager Module xwreg.dll 6.1.7600.16385 Extensible Wizard Reg istration Manager Module xwtpdui.dll 6.1.7600.16385 Extensible Wizard Typ e Plugin for DUI xwtpw32.dll 6.1.7600.16385 Extensible Wizard Typ e Plugin for Win32 zgmprxy.dll 6.1.7600.16385 Internal file used by the Internet Games zipfldr.dll 6.1.7601.17514 Compressed (zipped) F olders

------[ UpTime ]------Current Session: Last Shutdown Time 8/19/2013 4:58:04 PM Last Boot Time 8/19/2013 5:45:53 PM Current Time 8/19/2013 11:26:09 PM UpTime 20447 sec (0 days, 5 hou rs, 40 min, 47 sec) UpTime Statistics: First Boot Time 8/19/2013 2:04:24 PM First Shutdown Time 8/19/2013 2:03:31 PM Total UpTime 29545 sec (0 days, 8 hou rs, 12 min, 25 sec) Total DownTime 4285 sec (0 days, 1 hour s, 11 min, 25 sec) Longest UpTime 20447 sec (0 days, 5 hou rs, 40 min, 47 sec) Longest DownTime 2869 sec (0 days, 0 hour s, 47 min, 49 sec) Total Reboots 11 System Availability 87.33% Bluescreen Statistics: Total Bluescreens 0 Information: Information The above statistics are based on System Event Log entries

------[ Share ]------ADMIN$ Folder Remote Admin C:\Windows C$ Folder Default share C:\ D$ Folder Default share D:\ G$ Folder Default share G:\ IPC$ IPC Remote IPC

------[ Account Security ]------Account Security Properties: Computer Role Primary Domain Name emovhicRN Primary Domain Controller Not Specified Forced Logoff Time Disabled Min / Max Password Age 0 / 42 days Minimum Password Length 0 chars Password History Length Disabled Lockout Threshold Disabled Lockout Duration 30 min Lockout Observation Window 30 min

------[ Logon ]------Vic Tiangco EMOVHICRN emov hicRN

------[ Users ]------[ Administrator ] User Properties: User Name Administrator Full Name Administrator Comment Built-in account for adm inistering the computer/domain Member Of Groups Administrators Logon Count 6 Disk Quota - User Features: Logon Script Executed Yes Account Disabled Yes Locked Out User No Home Folder Required No Password Required Yes Read-Only Password No Password Never Expires Yes [ Guest ] User Properties: User Name Guest Full Name Guest Comment Built-in account for gue st access to the computer/domain Member Of Groups Guests Logon Count 0 Disk Quota - User Features: Logon Script Executed Yes Account Disabled Yes Locked Out User No Home Folder Required No Password Required No Read-Only Password Yes Password Never Expires Yes [ Vic Tiangco ] User Properties: User Name Vic Tiangco Full Name Vic Tiangco Member Of Groups Administrators Logon Count 14 Disk Quota - User Features: Logon Script Executed Yes Account Disabled No Locked Out User No Home Folder Required No Password Required No Read-Only Password No Password Never Expires Yes

------[ Local Groups ]------[ Administrators ] Local Group Properties: Comment Administrators have comp lete and unrestricted access to the computer/domain Group Members: Administrator Vic Tiangco [ Backup Operators ] Local Group Properties: Comment Backup Operators can ove rride security restrictions for the sole purpose of backing up or restoring file s [ Cryptographic Operators ] Local Group Properties: Comment Members are authorized t o perform cryptographic operations. [ Distributed COM Users ] Local Group Properties: Comment Members are allowed to l aunch, activate and use Distributed COM objects on this machine. [ Event Log Readers ] Local Group Properties: Comment Members of this group ca n read event logs from local machine [ Guests ] Local Group Properties: Comment Guests have the same acc ess as members of the Users group by default, except for the Guest account which is further restricted Group Members: Guest [ IIS_IUSRS ] Local Group Properties: Comment Built-in group used by I nternet Information Services. Group Members: IUSR [ Network Configuration Operators ] Local Group Properties: Comment Members in this group ca n have some administrative privileges to manage configuration of networking feat ures [ Performance Log Users ] Local Group Properties: Comment Members of this group ma y schedule logging of performance counters, enable trace providers, and collect event traces both locally and via remote access to this computer [ Performance Monitor Users ] Local Group Properties: Comment Members of this group ca n access performance counter data locally and remotely [ Power Users ] Local Group Properties: Comment Power Users are included for backwards compatibility and possess limited administrative powers [ Remote Desktop Users ] Local Group Properties: Comment Members in this group ar e granted the right to logon remotely [ Replicator ] Local Group Properties: Comment Supports file replicatio n in a domain [ Users ] Local Group Properties: Comment Users are prevented from making accidental or intentional system-wide changes and can run most applicati ons Group Members: Authenticated Users INTERACTIVE

------[ Global Groups ]------[ None ] Global Group Properties: Comment Ordinary users Group Members: Administrator Guest Vic Tiangco

------[ Windows Video ]------[ Mobile Intel(R) 915GM/GMS,910GML Express Chipset Family ] Video Adapter Properties: Device Description Mobile Intel(R) 915GM/GM S,910GML Express Chipset Family Adapter String Intel(R) 915GM/GMS,910GM L Express Chipset BIOS String Intel Video BIOS Chip Type Intel(R) 915GM/GMS,910GM L Express Chipset DAC Type Internal Memory Size 128 MB Installed Drivers: igxprd32 6.14.10.4704 Video Adapter Manufacturer: Company Name Intel Corporation Product Information http://www.intel.com/pro ducts/chipsets Driver Download http://support.intel.com /support/graphics Driver Update http://driveragent.com?r ef=59 [ Mobile Intel(R) 915GM/GMS,910GML Express Chipset Family ] Video Adapter Properties: Device Description Mobile Intel(R) 915GM/GM S,910GML Express Chipset Family Adapter String Intel(R) 915GM/GMS,910GM L Express Chipset BIOS String Intel Video BIOS Chip Type Intel(R) 915GM/GMS,910GM L Express Chipset DAC Type Internal Memory Size 128 MB Installed Drivers: igxprd32 6.14.10.4704 Video Adapter Manufacturer: Company Name Intel Corporation Product Information http://www.intel.com/pro ducts/chipsets Driver Download http://support.intel.com /support/graphics Driver Update http://driveragent.com?r ef=59

------[ PCI / AGP Video ]------Intel GMA 900 Video Adapter Intel GMA 900 3D Accelerator

------[ GPU ]------[ Integrated: Intel 82915GM Graphics Controller 0 ] Graphics Processor Properties: Video Adapter Intel 82915GM Graphics C ontroller 0 GPU Code Name Alviso-GM PCI Device 8086-2592 / 103C-30C4 ( Rev 03) Bus Type Integrated RAMDAC Clock 400 MHz Pixel Pipelines 4 TMU Per Pipeline 1 Vertex Shaders 1 (v2.0) Pixel Shaders 4 (v2.0) DirectX Hardware Support DirectX v9.0 Graphics Processor Manufacturer: Company Name Intel Corporation Product Information http://www.intel.com/pro ducts/chipsets Driver Download http://support.intel.com /support/graphics Driver Update http://driveragent.com?r ef=59

------[ Monitor ]------[ Chi Mei N154I2-L02 ] Monitor Properties: Monitor Name Chi Mei N154I2-L02 Monitor ID CMO1526 Manufacturer N154I2-L02 Monitor Type 15.4" LCD (WXGA) Manufacture Date Week 9 / 2006 Serial Number None Max. Visible Display Size 33 cm x 21 cm (15.4") Picture Aspect Ratio 16:10 Maximum Resolution 1280 x 800 Gamma 2.20 DPMS Mode Support None [ Chi Mei N154I2-L02 ] Monitor Properties: Monitor Name Chi Mei N154I2-L02 Monitor ID CMO1526 Manufacturer N154I2-L02 Monitor Type 15.4" LCD (WXGA) Manufacture Date Week 9 / 2006 Serial Number None Max. Visible Display Size 33 cm x 21 cm (15.4") Picture Aspect Ratio 16:10 Maximum Resolution 1280 x 800 Gamma 2.20 DPMS Mode Support None [ Chi Mei N154I2-L02 ] Monitor Properties: Monitor Name Chi Mei N154I2-L02 Monitor ID CMO1526 Manufacturer N154I2-L02 Monitor Type 15.4" LCD (WXGA) Manufacture Date Week 9 / 2006 Serial Number None Max. Visible Display Size 33 cm x 21 cm (15.4") Picture Aspect Ratio 16:10 Maximum Resolution 1280 x 800 Gamma 2.20 DPMS Mode Support None

------[ Desktop ]------Desktop Properties: Device Technology Raster Display Resolution 1280 x 800 Color Depth 32-bit Color Planes 1 Font Resolution 96 dpi Pixel Width / Height 36 / 36 Pixel Diagonal 51 Vertical Refresh Rate 60 Hz Desktop Wallpaper C:\Users\Vic Tiangco\App Data\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg Desktop Effects: Combo-Box Animation Disabled Drop Shadow Effect Disabled Flat Menu Effect Disabled Font Smoothing Disabled ClearType Disabled Full Window Dragging Disabled Gradient Window Title Bars Enabled Hide Menu Access Keys Enabled Hot Tracking Effect Enabled Icon Title Wrapping Enabled List-Box Smooth Scrolling Disabled Menu Animation Disabled Menu Fade Effect Enabled Minimize/Restore Animation Disabled Mouse Cursor Shadow Disabled Selection Fade Effect Disabled ShowSounds Accessibility Feature Disabled ToolTip Animation Disabled ToolTip Fade Effect Enabled Windows Aero Disabled Windows Plus! Extension Disabled

------[ Multi-Monitor ]------\\.\DISPLAY1 Yes (0,0) (1280,800) ------[ Video Modes ]------320 x 200 8-bit 60 Hz 320 x 200 16-bit 60 Hz 320 x 200 32-bit 60 Hz 320 x 240 8-bit 60 Hz 320 x 240 16-bit 60 Hz 320 x 240 32-bit 60 Hz 400 x 300 8-bit 60 Hz 400 x 300 16-bit 60 Hz 400 x 300 32-bit 60 Hz 512 x 384 8-bit 60 Hz 512 x 384 16-bit 60 Hz 512 x 384 32-bit 60 Hz 640 x 400 8-bit 60 Hz 640 x 400 16-bit 60 Hz 640 x 400 32-bit 60 Hz 640 x 480 4-bit Default 640 x 480 8-bit 60 Hz 640 x 480 16-bit 60 Hz 640 x 480 32-bit 60 Hz 800 x 600 8-bit 60 Hz 800 x 600 16-bit 60 Hz 800 x 600 32-bit 60 Hz 1024 x 768 8-bit 60 Hz 1024 x 768 16-bit 60 Hz 1024 x 768 32-bit 60 Hz 1280 x 600 8-bit 60 Hz 1280 x 600 16-bit 60 Hz 1280 x 600 32-bit 60 Hz 1280 x 720 8-bit 60 Hz 1280 x 720 16-bit 60 Hz 1280 x 720 32-bit 60 Hz 1280 x 768 8-bit 60 Hz 1280 x 768 16-bit 60 Hz 1280 x 768 32-bit 60 Hz 1280 x 800 8-bit 60 Hz 1280 x 800 16-bit 60 Hz 1280 x 800 32-bit 60 Hz

------[ OpenGL ]------OpenGL Properties: Vendor Microsoft Corporation Renderer GDI Generic Version 1.1.0 OpenGL DLL 6.1.7600.16385(win7_rtm. 090713-1255) Sub-Pixel Precision 3-bit Max Viewport Size 16384 x 16384 Max Clipping Planes 6 Max Display-List Nesting Level 64 Max Evaluator Order 30 Max Light Sources 8 Max Pixel Map Table Size 65536 OpenGL Compliancy: OpenGL 1.1 Yes (100%) OpenGL 1.2 No (12%) OpenGL 1.3 No (0%) OpenGL 1.4 No (0%) OpenGL 1.5 No (0%) OpenGL 2.0 No (0%) OpenGL 2.1 No (0%) OpenGL 3.0 No (0%) OpenGL 3.1 No (0%) Max Stack Depth: Attribute Stack 16 Client Attribute Stack 16 Modelview Matrix Stack 32 Name Stack 128 Projection Matrix Stack 10 Texture Matrix Stack 10 OpenGL Extensions: GL_3DFX_multisample Not Supported GL_3DFX_tbuffer Not Supported GL_3DFX_texture_compression_FXT1 Not Supported GL_3DL_direct_texture_access2 Not Supported GL_3Dlabs_multisample_transparency_id Not Supported GL_3Dlabs_multisample_transparency_range Not Supported GL_AMD_performance_monitor Not Supported GL_AMD_texture_texture4 Not Supported GL_AMDX_vertex_shader_tessellator Not Supported GL_APPLE_aux_depth_stencil Not Supported GL_APPLE_client_storage Not Supported GL_APPLE_element_array Not Supported GL_APPLE_fence Not Supported GL_APPLE_float_pixels Not Supported GL_APPLE_flush_buffer_range Not Supported GL_APPLE_flush_render Not Supported GL_APPLE_packed_pixel Not Supported GL_APPLE_packed_pixels Not Supported GL_APPLE_pixel_buffer Not Supported GL_APPLE_specular_vector Not Supported GL_APPLE_texture_range Not Supported GL_APPLE_transform_hint Not Supported GL_APPLE_vertex_array_object Not Supported GL_APPLE_vertex_array_range Not Supported GL_APPLE_vertex_program_evaluators Not Supported GL_APPLE_ycbcr_422 Not Supported GL_ARB_color_buffer_float Not Supported GL_ARB_compatibility Not Supported GL_ARB_copy_buffer Not Supported GL_ARB_depth_buffer_float Not Supported GL_ARB_depth_texture Not Supported GL_ARB_draw_buffers Not Supported GL_ARB_draw_instanced Not Supported GL_ARB_fragment_program Not Supported GL_ARB_fragment_program_shadow Not Supported GL_ARB_fragment_shader Not Supported GL_ARB_framebuffer_object Not Supported GL_ARB_framebuffer_sRGB Not Supported GL_ARB_geometry_shader4 Not Supported GL_ARB_half_float_pixel Not Supported GL_ARB_half_float_vertex Not Supported GL_ARB_imaging Not Supported GL_ARB_instanced_arrays Not Supported GL_ARB_map_buffer_range Not Supported GL_ARB_matrix_palette Not Supported GL_ARB_multisample Not Supported GL_ARB_multitexture Not Supported GL_ARB_occlusion_query Not Supported GL_ARB_pixel_buffer_object Not Supported GL_ARB_point_parameters Not Supported GL_ARB_point_sprite Not Supported GL_ARB_shader_objects Not Supported GL_ARB_shader_texture_lod Not Supported GL_ARB_shading_language_100 Not Supported GL_ARB_shadow Not Supported GL_ARB_shadow_ambient Not Supported GL_ARB_texture_border_clamp Not Supported GL_ARB_texture_buffer_object Not Supported GL_ARB_texture_compression Not Supported GL_ARB_texture_compression_rgtc Not Supported GL_ARB_texture_cube_map Not Supported GL_ARB_texture_env_add Not Supported GL_ARB_texture_env_combine Not Supported GL_ARB_texture_env_crossbar Not Supported GL_ARB_texture_env_dot3 Not Supported GL_ARB_texture_float Not Supported GL_ARB_texture_mirrored_repeat Not Supported GL_ARB_texture_non_power_of_two Not Supported GL_ARB_texture_rectangle Not Supported GL_ARB_texture_rg Not Supported GL_ARB_transpose_matrix Not Supported GL_ARB_uniform_buffer_object Not Supported GL_ARB_vertex_array_object Not Supported GL_ARB_vertex_blend Not Supported GL_ARB_vertex_buffer_object Not Supported GL_ARB_vertex_program Not Supported GL_ARB_vertex_shader Not Supported GL_ARB_window_pos Not Supported GL_ATI_array_rev_comps_in_4_bytes Not Supported GL_ATI_blend_equation_separate Not Supported GL_ATI_blend_weighted_minmax Not Supported GL_ATI_draw_buffers Not Supported GL_ATI_element_array Not Supported GL_ATI_envmap_bumpmap Not Supported GL_ATI_fragment_shader Not Supported GL_ATI_lock_texture Not Supported GL_ATI_map_object_buffer Not Supported GL_ATI_meminfo Not Supported GL_ATI_pixel_format_float Not Supported GL_ATI_pn_triangles Not Supported GL_ATI_point_cull_mode Not Supported GL_ATI_separate_stencil Not Supported GL_ATI_shader_texture_lod Not Supported GL_ATI_text_fragment_shader Not Supported GL_ATI_texture_compression_3dc Not Supported GL_ATI_texture_env_combine3 Not Supported GL_ATI_texture_float Not Supported GL_ATI_texture_mirror_once Not Supported GL_ATI_vertex_array_object Not Supported GL_ATI_vertex_attrib_array_object Not Supported GL_ATI_vertex_blend Not Supported GL_ATI_vertex_shader Not Supported GL_ATI_vertex_streams Not Supported GL_ATIX_pn_triangles Not Supported GL_ATIX_texture_env_combine3 Not Supported GL_ATIX_texture_env_route Not Supported GL_ATIX_vertex_shader_output_point_size Not Supported GL_Autodesk_facet_normal Not Supported GL_Autodesk_valid_back_buffer_hint Not Supported GL_DIMD_YUV Not Supported GL_EXT_422_pixels Not Supported GL_EXT_abgr Not Supported GL_EXT_bgra Supported GL_EXT_bindable_uniform Not Supported GL_EXT_blend_color Not Supported GL_EXT_blend_equation_separate Not Supported GL_EXT_blend_func_separate Not Supported GL_EXT_blend_logic_op Not Supported GL_EXT_blend_minmax Not Supported GL_EXT_blend_subtract Not Supported GL_EXT_Cg_shader Not Supported GL_EXT_clip_volume_hint Not Supported GL_EXT_cmyka Not Supported GL_EXT_color_matrix Not Supported GL_EXT_color_subtable Not Supported GL_EXT_color_table Not Supported GL_EXT_compiled_vertex_array Not Supported GL_EXT_convolution Not Supported GL_EXT_convolution_border_modes Not Supported GL_EXT_coordinate_frame Not Supported GL_EXT_copy_buffer Not Supported GL_EXT_copy_texture Not Supported GL_EXT_cull_vertex Not Supported GL_EXT_depth_bounds_test Not Supported GL_EXT_depth_buffer_float Not Supported GL_EXT_direct_state_access Not Supported GL_EXT_draw_buffers2 Not Supported GL_EXT_draw_instanced Not Supported GL_EXT_draw_range_elements Not Supported GL_EXT_fog_coord Not Supported GL_EXT_fog_function Not Supported GL_EXT_fog_offset Not Supported GL_EXT_fragment_lighting Not Supported GL_EXT_framebuffer_blit Not Supported GL_EXT_framebuffer_multisample Not Supported GL_EXT_framebuffer_object Not Supported GL_EXT_framebuffer_sRGB Not Supported GL_EXT_generate_mipmap Not Supported GL_EXT_geometry_shader4 Not Supported GL_EXT_gpu_program_parameters Not Supported GL_EXT_gpu_shader4 Not Supported GL_EXT_histogram Not Supported GL_EXT_index_array_formats Not Supported GL_EXT_index_func Not Supported GL_EXT_index_material Not Supported GL_EXT_index_texture Not Supported GL_EXT_interlace Not Supported GL_EXT_light_texture Not Supported GL_EXT_misc_attribute Not Supported GL_EXT_multi_draw_arrays Not Supported GL_EXT_multisample Not Supported GL_EXT_packed_depth_stencil Not Supported GL_EXT_packed_float Not Supported GL_EXT_packed_pixels Not Supported GL_EXT_packed_pixels_12 Not Supported GL_EXT_paletted_texture Supported GL_EXT_pixel_buffer_object Not Supported GL_EXT_pixel_format Not Supported GL_EXT_pixel_texture Not Supported GL_EXT_pixel_transform Not Supported GL_EXT_pixel_transform_color_table Not Supported GL_EXT_point_parameters Not Supported GL_EXT_polygon_offset Not Supported GL_EXT_rescale_normal Not Supported GL_EXT_scene_marker Not Supported GL_EXT_secondary_color Not Supported GL_EXT_separate_specular_color Not Supported GL_EXT_shadow_funcs Not Supported GL_EXT_shared_texture_palette Not Supported GL_EXT_stencil_clear_tag Not Supported GL_EXT_stencil_two_side Not Supported GL_EXT_stencil_wrap Not Supported GL_EXT_subtexture Not Supported GL_EXT_swap_control Not Supported GL_EXT_texgen_reflection Not Supported GL_EXT_texture Not Supported GL_EXT_texture_array Not Supported GL_EXT_texture_border_clamp Not Supported GL_EXT_texture_buffer_object Not Supported GL_EXT_texture_color_table Not Supported GL_EXT_texture_compression_dxt1 Not Supported GL_EXT_texture_compression_latc Not Supported GL_EXT_texture_compression_rgtc Not Supported GL_EXT_texture_compression_s3tc Not Supported GL_EXT_texture_cube_map Not Supported GL_EXT_texture_edge_clamp Not Supported GL_EXT_texture_env Not Supported GL_EXT_texture_env_add Not Supported GL_EXT_texture_env_combine Not Supported GL_EXT_texture_env_dot3 Not Supported GL_EXT_texture_filter_anisotropic Not Supported GL_EXT_texture_integer Not Supported GL_EXT_texture_lod Not Supported GL_EXT_texture_lod_bias Not Supported GL_EXT_texture_mirror_clamp Not Supported GL_EXT_texture_object Not Supported GL_EXT_texture_perturb_normal Not Supported GL_EXT_texture_rectangle Not Supported GL_EXT_texture_shared_exponent Not Supported GL_EXT_texture_sRGB Not Supported GL_EXT_texture_swizzle Not Supported GL_EXT_texture3D Not Supported GL_EXT_texture4D Not Supported GL_EXT_timer_query Not Supported GL_EXT_transform_feedback Not Supported GL_EXT_vertex_array Not Supported GL_EXT_vertex_array_bgra Not Supported GL_EXT_vertex_shader Not Supported GL_EXT_vertex_weighting Not Supported GL_EXTX_framebuffer_mixed_formats Not Supported GL_EXTX_packed_depth_stencil Not Supported GL_FGL_lock_texture Not Supported GL_GL2_geometry_shader Not Supported GL_GREMEDY_frame_terminator Not Supported GL_GREMEDY_string_marker Not Supported GL_HP_convolution_border_modes Not Supported GL_HP_image_transform Not Supported GL_HP_occlusion_test Not Supported GL_HP_texture_lighting Not Supported GL_I3D_argb Not Supported GL_I3D_color_clamp Not Supported GL_I3D_interlace_read Not Supported GL_IBM_clip_check Not Supported GL_IBM_cull_vertex Not Supported GL_IBM_load_named_matrix Not Supported GL_IBM_multi_draw_arrays Not Supported GL_IBM_multimode_draw_arrays Not Supported GL_IBM_occlusion_cull Not Supported GL_IBM_pixel_filter_hint Not Supported GL_IBM_rasterpos_clip Not Supported GL_IBM_rescale_normal Not Supported GL_IBM_static_data Not Supported GL_IBM_texture_clamp_nodraw Not Supported GL_IBM_texture_mirrored_repeat Not Supported GL_IBM_vertex_array_lists Not Supported GL_IBM_YCbCr Not Supported GL_INGR_blend_func_separate Not Supported GL_INGR_color_clamp Not Supported GL_INGR_interlace_read Not Supported GL_INGR_multiple_palette Not Supported GL_INTEL_parallel_arrays Not Supported GL_INTEL_texture_scissor Not Supported GL_KTX_buffer_region Not Supported GL_MESA_pack_invert Not Supported GL_MESA_resize_buffers Not Supported GL_MESA_window_pos Not Supported GL_MESA_ycbcr_texture Not Supported GL_MESAX_texture_stack Not Supported GL_MTX_fragment_shader Not Supported GL_MTX_precision_dpi Not Supported GL_NV_blend_square Not Supported GL_NV_centroid_sample Not Supported GL_NV_conditional_render Not Supported GL_NV_copy_depth_to_color Not Supported GL_NV_depth_buffer_float Not Supported GL_NV_depth_clamp Not Supported GL_NV_depth_range_unclamped Not Supported GL_NV_evaluators Not Supported GL_NV_explicit_multisample Not Supported GL_NV_fence Not Supported GL_NV_float_buffer Not Supported GL_NV_fog_distance Not Supported GL_NV_fragment_program Not Supported GL_NV_fragment_program_option Not Supported GL_NV_fragment_program2 Not Supported GL_NV_fragment_program4 Not Supported GL_NV_framebuffer_multisample_coverage Not Supported GL_NV_framebuffer_multisample_ex Not Supported GL_NV_geometry_program4 Not Supported GL_NV_geometry_shader4 Not Supported GL_NV_gpu_program4 Not Supported GL_NV_half_float Not Supported GL_NV_light_max_exponent Not Supported GL_NV_multisample_coverage Not Supported GL_NV_multisample_filter_hint Not Supported GL_NV_occlusion_query Not Supported GL_NV_packed_depth_stencil Not Supported GL_NV_parameter_buffer_object Not Supported GL_NV_pixel_buffer_object Not Supported GL_NV_pixel_data_range Not Supported GL_NV_point_sprite Not Supported GL_NV_present_video Not Supported GL_NV_primitive_restart Not Supported GL_NV_register_combiners Not Supported GL_NV_register_combiners2 Not Supported GL_NV_texgen_emboss Not Supported GL_NV_texgen_reflection Not Supported GL_NV_texture_compression_latc Not Supported GL_NV_texture_compression_vtc Not Supported GL_NV_texture_env_combine4 Not Supported GL_NV_texture_expand_normal Not Supported GL_NV_texture_rectangle Not Supported GL_NV_texture_shader Not Supported GL_NV_texture_shader2 Not Supported GL_NV_texture_shader3 Not Supported GL_NV_timer_query Not Supported GL_NV_transform_feedback Not Supported GL_NV_transform_feedback2 Not Supported GL_NV_vertex_array_range Not Supported GL_NV_vertex_array_range2 Not Supported GL_NV_vertex_program Not Supported GL_NV_vertex_program1_1 Not Supported GL_NV_vertex_program2 Not Supported GL_NV_vertex_program2_option Not Supported GL_NV_vertex_program3 Not Supported GL_NV_vertex_program4 Not Supported GL_NVX_conditional_render Not Supported GL_NVX_flush_hold Not Supported GL_NVX_ycrcb Not Supported GL_OES_byte_coordinates Not Supported GL_OES_compressed_paletted_texture Not Supported GL_OES_fixed_point Not Supported GL_OES_query_matrix Not Supported GL_OES_read_format Not Supported GL_OES_single_precision Not Supported GL_OML_interlace Not Supported GL_OML_resample Not Supported GL_OML_subsample Not Supported GL_PGI_misc_hints Not Supported GL_PGI_vertex_hints Not Supported GL_REND_screen_coordinates Not Supported GL_S3_performance_analyzer Not Supported GL_S3_s3tc Not Supported GL_SGI_color_matrix Not Supported GL_SGI_color_table Not Supported GL_SGI_compiled_vertex_array Not Supported GL_SGI_cull_vertex Not Supported GL_SGI_index_array_formats Not Supported GL_SGI_index_func Not Supported GL_SGI_index_material Not Supported GL_SGI_index_texture Not Supported GL_SGI_make_current_read Not Supported GL_SGI_texture_add_env Not Supported GL_SGI_texture_color_table Not Supported GL_SGI_texture_edge_clamp Not Supported GL_SGI_texture_lod Not Supported GL_SGIS_color_range Not Supported GL_SGIS_detail_texture Not Supported GL_SGIS_fog_function Not Supported GL_SGIS_generate_mipmap Not Supported GL_SGIS_multisample Not Supported GL_SGIS_multitexture Not Supported GL_SGIS_pixel_texture Not Supported GL_SGIS_point_line_texgen Not Supported GL_SGIS_sharpen_texture Not Supported GL_SGIS_texture_border_clamp Not Supported GL_SGIS_texture_color_mask Not Supported GL_SGIS_texture_edge_clamp Not Supported GL_SGIS_texture_filter4 Not Supported GL_SGIS_texture_lod Not Supported GL_SGIS_texture_select Not Supported GL_SGIS_texture4D Not Supported GL_SGIX_async Not Supported GL_SGIX_async_histogram Not Supported GL_SGIX_async_pixel Not Supported GL_SGIX_blend_alpha_minmax Not Supported GL_SGIX_clipmap Not Supported GL_SGIX_convolution_accuracy Not Supported GL_SGIX_depth_pass_instrument Not Supported GL_SGIX_depth_texture Not Supported GL_SGIX_flush_raster Not Supported GL_SGIX_fog_offset Not Supported GL_SGIX_framezoom Not Supported GL_SGIX_instruments Not Supported GL_SGIX_interlace Not Supported GL_SGIX_ir_instrument1 Not Supported GL_SGIX_list_priority Not Supported GL_SGIX_pbuffer Not Supported GL_SGIX_pixel_texture Not Supported GL_SGIX_pixel_texture_bits Not Supported GL_SGIX_reference_plane Not Supported GL_SGIX_resample Not Supported GL_SGIX_shadow Not Supported GL_SGIX_shadow_ambient Not Supported GL_SGIX_sprite Not Supported GL_SGIX_subsample Not Supported GL_SGIX_tag_sample_buffer Not Supported GL_SGIX_texture_add_env Not Supported GL_SGIX_texture_coordinate_clamp Not Supported GL_SGIX_texture_lod_bias Not Supported GL_SGIX_texture_multi_buffer Not Supported GL_SGIX_texture_range Not Supported GL_SGIX_texture_scale_bias Not Supported GL_SGIX_vertex_preclip Not Supported GL_SGIX_vertex_preclip_hint Not Supported GL_SGIX_ycrcb Not Supported GL_SGIX_ycrcb_subsample Not Supported GL_SUN_convolution_border_modes Not Supported GL_SUN_global_alpha Not Supported GL_SUN_mesh_array Not Supported GL_SUN_multi_draw_arrays Not Supported GL_SUN_slice_accum Not Supported GL_SUN_triangle_list Not Supported GL_SUN_vertex Not Supported GL_SUNX_constant_data Not Supported GL_WGL_ARB_extensions_string Not Supported GL_WGL_EXT_extensions_string Not Supported GL_WGL_EXT_swap_control Not Supported GL_WIN_phong_shading Not Supported GL_WIN_specular_fog Not Supported GL_WIN_swap_hint Supported GLU_EXT_nurbs_tessellator Not Supported GLU_EXT_object_space_tess Not Supported GLU_SGI_filter4_parameters Not Supported GLX_ARB_create_context Not Supported GLX_ARB_fbconfig_float Not Supported GLX_ARB_framebuffer_sRGB Not Supported GLX_ARB_get_proc_address Not Supported GLX_ARB_multisample Not Supported GLX_EXT_fbconfig_packed_float Not Supported GLX_EXT_framebuffer_sRGB Not Supported GLX_EXT_import_context Not Supported GLX_EXT_scene_marker Not Supported GLX_EXT_texture_from_pixmap Not Supported GLX_EXT_visual_info Not Supported GLX_EXT_visual_rating Not Supported GLX_MESA_agp_offset Not Supported GLX_MESA_copy_sub_buffer Not Supported GLX_MESA_pixmap_colormap Not Supported GLX_MESA_release_buffers Not Supported GLX_MESA_set_3dfx_mode Not Supported GLX_NV_present_video Not Supported GLX_NV_swap_group Not Supported GLX_NV_video_output Not Supported GLX_OML_swap_method Not Supported GLX_OML_sync_control Not Supported GLX_SGI_cushion Not Supported GLX_SGI_make_current_read Not Supported GLX_SGI_swap_control Not Supported GLX_SGI_video_sync Not Supported GLX_SGIS_blended_overlay Not Supported GLX_SGIS_color_range Not Supported GLX_SGIS_multisample Not Supported GLX_SGIX_dm_buffer Not Supported GLX_SGIX_fbconfig Not Supported GLX_SGIX_hyperpipe Not Supported GLX_SGIX_pbuffer Not Supported GLX_SGIX_swap_barrier Not Supported GLX_SGIX_swap_group Not Supported GLX_SGIX_video_resize Not Supported GLX_SGIX_video_source Not Supported GLX_SGIX_visual_select_group Not Supported GLX_SUN_get_transparent_index Not Supported GLX_SUN_video_resize Not Supported WGL_3DFX_gamma_control Not Supported WGL_3DFX_multisample Not Supported WGL_3DL_stereo_control Not Supported WGL_ARB_buffer_region Not Supported WGL_ARB_create_context Not Supported WGL_ARB_extensions_string Not Supported WGL_ARB_framebuffer_sRGB Not Supported WGL_ARB_make_current_read Not Supported WGL_ARB_multisample Not Supported WGL_ARB_pbuffer Not Supported WGL_ARB_pixel_format Not Supported WGL_ARB_pixel_format_float Not Supported WGL_ARB_render_texture Not Supported WGL_ATI_pbuffer_memory_hint Not Supported WGL_ATI_pixel_format_float Not Supported WGL_ATI_render_texture_rectangle Not Supported WGL_EXT_buffer_region Not Supported WGL_EXT_depth_float Not Supported WGL_EXT_display_color_table Not Supported WGL_EXT_extensions_string Not Supported WGL_EXT_framebuffer_sRGB Not Supported WGL_EXT_framebuffer_sRGBWGL_ARB_create_context Not Supported WGL_EXT_gamma_control Not Supported WGL_EXT_make_current_read Not Supported WGL_EXT_multisample Not Supported WGL_EXT_pbuffer Not Supported WGL_EXT_pixel_format Not Supported WGL_EXT_pixel_format_packed_float Not Supported WGL_EXT_render_texture Not Supported WGL_EXT_swap_control Not Supported WGL_EXT_swap_interval Not Supported WGL_I3D_digital_video_control Not Supported WGL_I3D_gamma Not Supported WGL_I3D_genlock Not Supported WGL_I3D_image_buffer Not Supported WGL_I3D_swap_frame_lock Not Supported WGL_I3D_swap_frame_usage Not Supported WGL_MTX_video_preview Not Supported WGL_NV_float_buffer Not Supported WGL_NV_gpu_affinity Not Supported WGL_NV_multisample_coverage Not Supported WGL_NV_present_video Not Supported WGL_NV_render_depth_texture Not Supported WGL_NV_render_texture_rectangle Not Supported WGL_NV_swap_group Not Supported WGL_NV_video_output Not Supported WGL_OML_sync_control Not Supported Supported Compressed Texture Formats: RGB DXT1 Not Supported RGBA DXT1 Not Supported RGBA DXT3 Not Supported RGBA DXT5 Not Supported RGB FXT1 Not Supported RGBA FXT1 Not Supported 3Dc Not Supported

------[ Fonts ]------@Batang Roman Regular Baltic 16 x 32 40 % @Batang Roman Regular Central European 16 x 32 40 % @Batang Roman Regular Cyrilli c 16 x 32 40 % @Batang Roman Regular Greek 16 x 32 40 % @Batang Roman Regular 16 x 32 40 % @Batang Roman Regular Turkish 16 x 32 40 % @Batang Roman Regular Western 16 x 32 40 % @BatangChe Modern Regular Baltic 16 x 32 40 % @BatangChe Modern Regular Central European 16 x 32 40 % @BatangChe Modern Regular Cyrilli c 16 x 32 40 % @BatangChe Modern Regular Greek 16 x 32 40 % @BatangChe Modern Regular Hangul 16 x 32 40 % @BatangChe Modern Regular Turkish 16 x 32 40 % @BatangChe Modern Regular Western 16 x 32 40 % @DFKai-SB Script Regular CHINESE _BIG5 16 x 32 40 % @DFKai-SB Script Regular Western 16 x 32 40 % @ Swiss Regular Baltic 16 x 32 40 % @Dotum Swiss Regular Central European 16 x 32 40 % @Dotum Swiss Regular Cyrilli c 16 x 32 40 % @Dotum Swiss Regular Greek 16 x 32 40 % @Dotum Swiss Regular Hangul 16 x 32 40 % @Dotum Swiss Regular Turkish 16 x 32 40 % @Dotum Swiss Regular Western 16 x 32 40 % @DotumChe Modern Regular Baltic 16 x 32 40 % @DotumChe Modern Regular Central European 16 x 32 40 % @DotumChe Modern Regular Cyrilli c 16 x 32 40 % @DotumChe Modern Regular Greek 16 x 32 40 % @DotumChe Modern Regular Hangul 16 x 32 40 % @DotumChe Modern Regular Turkish 16 x 32 40 % @DotumChe Modern Regular Western 16 x 32 40 % @FangSong Modern Regular CHINESE _GB2312 16 x 32 40 % @FangSong Modern Regular Western 16 x 32 40 % @Gulim Swiss Regular Baltic 16 x 32 40 % @Gulim Swiss Regular Central European 16 x 32 40 % @Gulim Swiss Regular Cyrilli c 16 x 32 40 % @Gulim Swiss Regular Greek 16 x 32 40 % @Gulim Swiss Regular Hangul 16 x 32 40 % @Gulim Swiss Regular Turkish 16 x 32 40 % @Gulim Swiss Regular Western 16 x 32 40 % @GulimChe Modern Regular Baltic 16 x 32 40 % @GulimChe Modern Regular Central European 16 x 32 40 % @GulimChe Modern Regular Cyrilli c 16 x 32 40 % @GulimChe Modern Regular Greek 16 x 32 40 % @GulimChe Modern Regular Hangul 16 x 32 40 % @GulimChe Modern Regular Turkish 16 x 32 40 % @GulimChe Modern Regular Western 16 x 32 40 % @Gungsuh Roman Regular Baltic 16 x 32 40 % @Gungsuh Roman Regular Central European 16 x 32 40 % @Gungsuh Roman Regular Cyrilli c 16 x 32 40 % @Gungsuh Roman Regular Greek 16 x 32 40 % @Gungsuh Roman Regular Hangul 16 x 32 40 % @Gungsuh Roman Regular Turkish 16 x 32 40 % @Gungsuh Roman Regular Western 16 x 32 40 % @GungsuhChe Modern Regular Baltic 16 x 32 40 % @GungsuhChe Modern Regular Central European 16 x 32 40 % @GungsuhChe Modern Regular Cyrilli c 16 x 32 40 % @GungsuhChe Modern Regular Greek 16 x 32 40 % @GungsuhChe Modern Regular Hangul 16 x 32 40 % @GungsuhChe Modern Regular Turkish 16 x 32 40 % @GungsuhChe Modern Regular Western 16 x 32 40 % @Hand Of Sean Special Regular Baltic 20 x 57 40 % @Hand Of Sean Special Regular Central European 20 x 57 40 % @Hand Of Sean Special Regular CHINESE _GB2312 20 x 57 40 % @Hand Of Sean Special Regular Cyrilli c 20 x 57 40 % @Hand Of Sean Special Regular Greek 20 x 57 40 % @Hand Of Sean Special Regular Hangul 20 x 57 40 % @Hand Of Sean Special Regular Japanes e 20 x 57 40 % @Hand Of Sean Special Regular Turkish 20 x 57 40 % @Hand Of Sean Special Regular Vietnam ese 20 x 57 40 % @Hand Of Sean Special Regular Western 20 x 57 40 % @KaiTi Modern Regular CHINESE _GB2312 16 x 32 40 % @KaiTi Modern Regular Western 16 x 32 40 % @ Swiss Regular Hangul 15 x 43 40 % @Malgun Gothic Swiss Regular Western 15 x 43 40 % @ UI Swiss Regular Baltic 17 x 41 40 % @Meiryo UI Swiss Regular Central European 17 x 41 40 % @Meiryo UI Swiss Regular Cyrilli c 17 x 41 40 % @Meiryo UI Swiss Regular Greek 17 x 41 40 % @Meiryo UI Swiss Regular Japanes e 17 x 41 40 % @Meiryo UI Swiss Regular Turkish 17 x 41 40 % @Meiryo UI Swiss Regular Western 17 x 41 40 % @Meiryo Swiss Regular Baltic 31 x 48 40 % @Meiryo Swiss Regular Central European 31 x 48 40 % @Meiryo Swiss Regular Cyrilli c 31 x 48 40 % @Meiryo Swiss Regular Greek 31 x 48 40 % @Meiryo Swiss Regular Japanes e 31 x 48 40 % @Meiryo Swiss Regular Turkish 31 x 48 40 % @Meiryo Swiss Regular Western 31 x 48 40 % @Microsoft JhengHei Swiss Regular CHINESE _BIG5 15 x 43 40 % @Microsoft JhengHei Swiss Regular Greek 15 x 43 40 % @Microsoft JhengHei Swiss Regular Western 15 x 43 40 % @Microsoft YaHei Swiss Regular Central European 15 x 42 40 % @Microsoft YaHei Swiss Regular CHINESE _GB2312 15 x 42 40 % @Microsoft YaHei Swiss Regular Cyrilli c 15 x 42 40 % @Microsoft YaHei Swiss Regular Greek 15 x 42 40 % @Microsoft YaHei Swiss Regular Turkish 15 x 42 40 % @Microsoft YaHei Swiss Regular Western 15 x 42 40 % @MingLiU Modern Regular CHINESE _BIG5 16 x 32 40 % @MingLiU Modern Regular Western 16 x 32 40 % @MingLiU_HKSCS Roman Regular CHINESE _BIG5 16 x 32 40 % @MingLiU_HKSCS Roman Regular Western 16 x 32 40 % @MingLiU_HKSCS-ExtB Roman Regular CHINESE _BIG5 16 x 32 40 % @MingLiU_HKSCS-ExtB Roman Regular Western 16 x 32 40 % @MingLiU-ExtB Roman Regular CHINESE _BIG5 16 x 32 40 % @MingLiU-ExtB Roman Regular Western 16 x 32 40 % @MS Gothic Modern Regular Baltic 16 x 32 40 % @MS Gothic Modern Regular Central European 16 x 32 40 % @MS Gothic Modern Regular Cyrilli c 16 x 32 40 % @MS Gothic Modern Regular Greek 16 x 32 40 % @MS Gothic Modern Regular Japanes e 16 x 32 40 % @MS Gothic Modern Regular Turkish 16 x 32 40 % @MS Gothic Modern Regular Western 16 x 32 40 % @MS Mincho Modern Regular Baltic 16 x 32 40 % @MS Mincho Modern Regular Central European 16 x 32 40 % @MS Mincho Modern Regular Cyrilli c 16 x 32 40 % @MS Mincho Modern Regular Greek 16 x 32 40 % @MS Mincho Modern Regular Japanes e 16 x 32 40 % @MS Mincho Modern Regular Turkish 16 x 32 40 % @MS Mincho Modern Regular Western 16 x 32 40 % @MS PGothic Swiss Regular Baltic 13 x 32 40 % @MS PGothic Swiss Regular Central European 13 x 32 40 % @MS PGothic Swiss Regular Cyrilli c 13 x 32 40 % @MS PGothic Swiss Regular Greek 13 x 32 40 % @MS PGothic Swiss Regular Japanes e 13 x 32 40 % @MS PGothic Swiss Regular Turkish 13 x 32 40 % @MS PGothic Swiss Regular Western 13 x 32 40 % @MS PMincho Roman Regular Baltic 13 x 32 40 % @MS PMincho Roman Regular Central European 13 x 32 40 % @MS PMincho Roman Regular Cyrilli c 13 x 32 40 % @MS PMincho Roman Regular Greek 13 x 32 40 % @MS PMincho Roman Regular Japanes e 13 x 32 40 % @MS PMincho Roman Regular Turkish 13 x 32 40 % @MS PMincho Roman Regular Western 13 x 32 40 % @MS UI Gothic Swiss Regular Baltic 13 x 32 40 % @MS UI Gothic Swiss Regular Central European 13 x 32 40 % @MS UI Gothic Swiss Regular Cyrilli c 13 x 32 40 % @MS UI Gothic Swiss Regular Greek 13 x 32 40 % @MS UI Gothic Swiss Regular Japanes e 13 x 32 40 % @MS UI Gothic Swiss Regular Turkish 13 x 32 40 % @MS UI Gothic Swiss Regular Western 13 x 32 40 % @NSimSun Modern Regular CHINESE _GB2312 16 x 32 40 % @NSimSun Modern Regular Western 16 x 32 40 % @PMingLiU Roman Regular CHINESE _BIG5 16 x 32 40 % @PMingLiU Roman Regular Western 16 x 32 40 % @PMingLiU-ExtB Roman Regular CHINESE _BIG5 16 x 32 40 % @PMingLiU-ExtB Roman Regular Western 16 x 32 40 % @SimHei Modern Regular CHINESE _GB2312 16 x 32 40 % @SimHei Modern Regular Western 16 x 32 40 % @SimSun Special Regular CHINESE _GB2312 16 x 32 40 % @SimSun Special Regular Western 16 x 32 40 % @SimSun-ExtB Modern Regular CHINESE _GB2312 16 x 32 40 % @SimSun-ExtB Modern Regular Western 16 x 32 40 % Special Bold Hebrew 15 x 32 70 % Andalus Roman Regular Arabic 15 x 49 40 % Andalus Roman Regular Western 15 x 49 40 % Angsana New Roman Regular Thai 8 x 43 40 % Angsana New Roman Regular Western 8 x 43 40 % AngsanaUPC Roman Regular Thai 8 x 43 40 % AngsanaUPC Roman Regular Western 8 x 43 40 % Aparajita Swiss Regular Western 16 x 38 40 % Arabic Typesetting Script Regular Arabic 9 x 36 40 % Arabic Typesetting Script Regular Baltic 9 x 36 40 % Arabic Typesetting Script Regular Central European 9 x 36 40 % Arabic Typesetting Script Regular Turkish 9 x 36 40 % Arabic Typesetting Script Regular Western 9 x 36 40 % Black Swiss Regular Baltic 18 x 45 90 % Arial Black Swiss Regular Central European 18 x 45 90 % Arial Black Swiss Regular Cyrilli c 18 x 45 90 % Arial Black Swiss Regular Greek 18 x 45 90 % Arial Black Swiss Regular Turkish 18 x 45 90 % Arial Black Swiss Regular Western 18 x 45 90 % Arial Narrow Swiss Regular Baltic 12 x 36 40 % Arial Narrow Swiss Regular Central European 12 x 36 40 % Arial Narrow Swiss Regular Cyrilli c 12 x 36 40 % Arial Narrow Swiss Regular Greek 12 x 36 40 % Arial Narrow Swiss Regular Turkish 12 x 36 40 % Arial Narrow Swiss Regular Western 12 x 36 40 % Arial Swiss Regular Arabic 14 x 36 40 % Arial Swiss Regular Baltic 14 x 36 40 % Arial Swiss Regular Central European 14 x 36 40 % Arial Swiss Regular Cyrilli c 14 x 36 40 % Arial Swiss Regular Greek 14 x 36 40 % Arial Swiss Regular Hebrew 14 x 36 40 % Arial Swiss Regular Turkish 14 x 36 40 % Arial Swiss Regular Vietnam ese 14 x 36 40 % Arial Swiss Regular Western 14 x 36 40 % Batang Roman Regular Baltic 16 x 32 40 % Batang Roman Regular Central European 16 x 32 40 % Batang Roman Regular Cyrilli c 16 x 32 40 % Batang Roman Regular Greek 16 x 32 40 % Batang Roman Regular Hangul 16 x 32 40 % Batang Roman Regular Turkish 16 x 32 40 % Batang Roman Regular Western 16 x 32 40 % BatangChe Modern Regular Baltic 16 x 32 40 % BatangChe Modern Regular Central European 16 x 32 40 % BatangChe Modern Regular Cyrilli c 16 x 32 40 % BatangChe Modern Regular Greek 16 x 32 40 % BatangChe Modern Regular Hangul 16 x 32 40 % BatangChe Modern Regular Turkish 16 x 32 40 % BatangChe Modern Regular Western 16 x 32 40 % Book Antiqua Roman Regular Baltic 14 x 40 40 % Book Antiqua Roman Regular Central European 14 x 40 40 % Book Antiqua Roman Regular Cyrilli c 14 x 40 40 % Book Antiqua Roman Regular Greek 14 x 40 40 % Book Antiqua Roman Regular Turkish 14 x 40 40 % Book Antiqua Roman Regular Western 14 x 40 40 % Bookman Old Style Roman Regular Baltic 16 x 36 30 % Bookman Old Style Roman Regular Central European 16 x 36 30 % Bookman Old Style Roman Regular Cyrilli c 16 x 36 30 % Bookman Old Style Roman Regular Greek 16 x 36 30 % Bookman Old Style Roman Regular Turkish 16 x 36 30 % Bookman Old Style Roman Regular Western 16 x 36 30 % Bookshelf 7 Special Regular Symbol 21 x 32 40 % Browallia New Swiss Regular Thai 9 x 40 40 % Browallia New Swiss Regular Western 9 x 40 40 % BrowalliaUPC Swiss Regular Thai 9 x 40 40 % BrowalliaUPC Swiss Regular Western 9 x 40 40 % Swiss Regular Baltic 17 x 39 40 % Calibri Swiss Regular Central European 17 x 39 40 % Calibri Swiss Regular Cyrilli c 17 x 39 40 % Calibri Swiss Regular Greek 17 x 39 40 % Calibri Swiss Regular Turkish 17 x 39 40 % Calibri Swiss Regular Vietnam ese 17 x 39 40 % Calibri Swiss Regular Western 17 x 39 40 % Math Roman Regular Baltic 20 x 179 40 % Cambria Math Roman Regular Central European 20 x 179 40 % Cambria Math Roman Regular Cyrilli c 20 x 179 40 % Cambria Math Roman Regular Greek 20 x 179 40 % Cambria Math Roman Regular Turkish 20 x 179 40 % Cambria Math Roman Regular Vietnam ese 20 x 179 40 % Cambria Math Roman Regular Western 20 x 179 40 % Cambria Roman Regular Baltic 20 x 38 40 % Cambria Roman Regular Central European 20 x 38 40 % Cambria Roman Regular Cyrilli c 20 x 38 40 % Cambria Roman Regular Greek 20 x 38 40 % Cambria Roman Regular Turkish 20 x 38 40 % Cambria Roman Regular Vietnam ese 20 x 38 40 % Cambria Roman Regular Western 20 x 38 40 % Swiss Regular Baltic 17 x 39 40 % Candara Swiss Regular Central European 17 x 39 40 % Candara Swiss Regular Cyrilli c 17 x 39 40 % Candara Swiss Regular Greek 17 x 39 40 % Candara Swiss Regular Turkish 17 x 39 40 % Candara Swiss Regular Vietnam ese 17 x 39 40 % Candara Swiss Regular Western 17 x 39 40 % Century Roman Regular Baltic 15 x 38 40 % Century Roman Regular Central European 15 x 38 40 % Century Roman Regular Cyrilli c 15 x 38 40 % Century Roman Regular Greek 15 x 38 40 % Century Roman Regular Turkish 15 x 38 40 % Century Roman Regular Western 15 x 38 40 % Cocaine Sans Special Regular Baltic 9 x 36 40 % Cocaine Sans Special Regular Central European 9 x 36 40 % Cocaine Sans Special Regular Cyrilli c 9 x 36 40 % Cocaine Sans Special Regular Greek 9 x 36 40 % Cocaine Sans Special Regular Turkish 9 x 36 40 % Cocaine Sans Special Regular Vietnam ese 9 x 36 40 % Cocaine Sans Special Regular Western 9 x 36 40 % MS Script Regular Baltic 15 x 45 40 % Comic Sans MS Script Regular Central European 15 x 45 40 % Comic Sans MS Script Regular Cyrilli c 15 x 45 40 % Comic Sans MS Script Regular Greek 15 x 45 40 % Comic Sans MS Script Regular Turkish 15 x 45 40 % Comic Sans MS Script Regular Western 15 x 45 40 % Modern Regular Baltic 18 x 37 40 % Consolas Modern Regular Central European 18 x 37 40 % Consolas Modern Regular Cyrilli c 18 x 37 40 % Consolas Modern Regular Greek 18 x 37 40 % Consolas Modern Regular Turkish 18 x 37 40 % Consolas Modern Regular Vietnam ese 18 x 37 40 % Consolas Modern Regular Western 18 x 37 40 % Roman Regular Baltic 17 x 39 40 % Constantia Roman Regular Central European 17 x 39 40 % Constantia Roman Regular Cyrilli c 17 x 39 40 % Constantia Roman Regular Greek 17 x 39 40 % Constantia Roman Regular Turkish 17 x 39 40 % Constantia Roman Regular Vietnam ese 17 x 39 40 % Constantia Roman Regular Western 17 x 39 40 % Swiss Regular Baltic 17 x 39 40 % Corbel Swiss Regular Central European 17 x 39 40 % Corbel Swiss Regular Cyrilli c 17 x 39 40 % Corbel Swiss Regular Greek 17 x 39 40 % Corbel Swiss Regular Turkish 17 x 39 40 % Corbel Swiss Regular Vietnam ese 17 x 39 40 % Corbel Swiss Regular Western 17 x 39 40 % Cordia New Swiss Regular Thai 9 x 44 40 % Cordia New Swiss Regular Western 9 x 44 40 % CordiaUPC Swiss Regular Thai 9 x 44 40 % CordiaUPC Swiss Regular Western 9 x 44 40 % New Modern Regular Arabic 19 x 36 40 % Courier New Modern Regular Baltic 19 x 36 40 % Courier New Modern Regular Central European 19 x 36 40 % Courier New Modern Regular Cyrilli c 19 x 36 40 % Courier New Modern Regular Greek 19 x 36 40 % Courier New Modern Regular Hebrew 19 x 36 40 % Courier New Modern Regular Turkish 19 x 36 40 % Courier New Modern Regular Vietnam ese 19 x 36 40 % Courier New Modern Regular Western 19 x 36 40 % Courier Modern Western 8 x 13 40 % DaunPenh Special Regular Western 12 x 43 40 % David Swiss Regular Hebrew 13 x 31 40 % DFKai-SB Script Regular CHINESE _BIG5 16 x 32 40 % DFKai-SB Script Regular Western 16 x 32 40 % DilleniaUPC Roman Regular Thai 9 x 42 40 % DilleniaUPC Roman Regular Western 9 x 42 40 % DokChampa Swiss Regular Thai 19 x 62 40 % DokChampa Swiss Regular Western 19 x 62 40 % Dotum Swiss Regular Baltic 16 x 32 40 % Dotum Swiss Regular Central European 16 x 32 40 % Dotum Swiss Regular Cyrilli c 16 x 32 40 % Dotum Swiss Regular Greek 16 x 32 40 % Dotum Swiss Regular Hangul 16 x 32 40 % Dotum Swiss Regular Turkish 16 x 32 40 % Dotum Swiss Regular Western 16 x 32 40 % DotumChe Modern Regular Baltic 16 x 32 40 % DotumChe Modern Regular Central European 16 x 32 40 % DotumChe Modern Regular Cyrilli c 16 x 32 40 % DotumChe Modern Regular Greek 16 x 32 40 % DotumChe Modern Regular Hangul 16 x 32 40 % DotumChe Modern Regular Turkish 16 x 32 40 % DotumChe Modern Regular Western 16 x 32 40 % Special Regular Baltic 19 x 43 40 % Ebrima Special Regular Central European 19 x 43 40 % Ebrima Special Regular Turkish 19 x 43 40 % Ebrima Special Regular Western 19 x 43 40 % Egregio Script_demo Special Regular Turkish 21 x 49 40 % Egregio Script_demo Special Regular Vietnam ese 21 x 49 40 % Egregio Script_demo Special Regular Western 21 x 49 40 % Estrangelo Edessa Script Regular Western 16 x 36 40 % EucrosiaUPC Roman Regular Thai 9 x 39 40 % EucrosiaUPC Roman Regular Western 9 x 39 40 % Euphemia Swiss Regular Western 22 x 42 40 % FangSong Modern Regular CHINESE _GB2312 16 x 32 40 % FangSong Modern Regular Western 16 x 32 40 % Modern Western 8 x 15 40 % Medium Swiss Regular Baltic 14 x 36 40 % Franklin Gothic Medium Swiss Regular Central European 14 x 36 40 % Franklin Gothic Medium Swiss Regular Cyrilli c 14 x 36 40 % Franklin Gothic Medium Swiss Regular Greek 14 x 36 40 % Franklin Gothic Medium Swiss Regular Turkish 14 x 36 40 % Franklin Gothic Medium Swiss Regular Western 14 x 36 40 % FrankRuehl Swiss Regular Hebrew 13 x 30 40 % FreesiaUPC Swiss Regular Thai 9 x 38 40 % FreesiaUPC Swiss Regular Western 9 x 38 40 % Decorative Regular Baltic 16 x 59 40 % Gabriola Decorative Regular Central European 16 x 59 40 % Gabriola Decorative Regular Cyrilli c 16 x 59 40 % Gabriola Decorative Regular Greek 16 x 59 40 % Gabriola Decorative Regular Turkish 16 x 59 40 % Gabriola Decorative Regular Western 16 x 59 40 % Garamond Roman Regular Baltic 12 x 36 40 % Garamond Roman Regular Central European 12 x 36 40 % Garamond Roman Regular Cyrilli c 12 x 36 40 % Garamond Roman Regular Greek 12 x 36 40 % Garamond Roman Regular Turkish 12 x 36 40 % Garamond Roman Regular Western 12 x 36 40 % Swiss Regular Western 18 x 56 40 % Roman Regular Baltic 14 x 36 40 % Georgia Roman Regular Central European 14 x 36 40 % Georgia Roman Regular Cyrilli c 14 x 36 40 % Georgia Roman Regular Greek 14 x 36 40 % Georgia Roman Regular Turkish 14 x 36 40 % Georgia Roman Regular Western 14 x 36 40 % Gisha Swiss Regular Hebrew 16 x 38 40 % Gisha Swiss Regular Western 16 x 38 40 % Gulim Swiss Regular Baltic 16 x 32 40 % Gulim Swiss Regular Central European 16 x 32 40 % Gulim Swiss Regular Cyrilli c 16 x 32 40 % Gulim Swiss Regular Greek 16 x 32 40 % Gulim Swiss Regular Hangul 16 x 32 40 % Gulim Swiss Regular Turkish 16 x 32 40 % Gulim Swiss Regular Western 16 x 32 40 % GulimChe Modern Regular Baltic 16 x 32 40 % GulimChe Modern Regular Central European 16 x 32 40 % GulimChe Modern Regular Cyrilli c 16 x 32 40 % GulimChe Modern Regular Greek 16 x 32 40 % GulimChe Modern Regular Hangul 16 x 32 40 % GulimChe Modern Regular Turkish 16 x 32 40 % GulimChe Modern Regular Western 16 x 32 40 % Gungsuh Roman Regular Baltic 16 x 32 40 % Gungsuh Roman Regular Central European 16 x 32 40 % Gungsuh Roman Regular Cyrilli c 16 x 32 40 % Gungsuh Roman Regular Greek 16 x 32 40 % Gungsuh Roman Regular Hangul 16 x 32 40 % Gungsuh Roman Regular Turkish 16 x 32 40 % Gungsuh Roman Regular Western 16 x 32 40 % GungsuhChe Modern Regular Baltic 16 x 32 40 % GungsuhChe Modern Regular Central European 16 x 32 40 % GungsuhChe Modern Regular Cyrilli c 16 x 32 40 % GungsuhChe Modern Regular Greek 16 x 32 40 % GungsuhChe Modern Regular Hangul 16 x 32 40 % GungsuhChe Modern Regular Turkish 16 x 32 40 % GungsuhChe Modern Regular Western 16 x 32 40 % Hand Of Sean Special Regular Baltic 20 x 57 40 % Hand Of Sean Special Regular Central European 20 x 57 40 % Hand Of Sean Special Regular CHINESE _GB2312 20 x 57 40 % Hand Of Sean Special Regular Cyrilli c 20 x 57 40 % Hand Of Sean Special Regular Greek 20 x 57 40 % Hand Of Sean Special Regular Hangul 20 x 57 40 % Hand Of Sean Special Regular Japanes e 20 x 57 40 % Hand Of Sean Special Regular Turkish 20 x 57 40 % Hand Of Sean Special Regular Vietnam ese 20 x 57 40 % Hand Of Sean Special Regular Western 20 x 57 40 % Swiss Regular Baltic 13 x 39 40 % Impact Swiss Regular Central European 13 x 39 40 % Impact Swiss Regular Cyrilli c 13 x 39 40 % Impact Swiss Regular Greek 13 x 39 40 % Impact Swiss Regular Turkish 13 x 39 40 % Impact Swiss Regular Western 13 x 39 40 % IrisUPC Swiss Regular Thai 9 x 40 40 % IrisUPC Swiss Regular Western 9 x 40 40 % Iskoola Pota Swiss Regular Western 22 x 36 40 % JasmineUPC Roman Regular Thai 9 x 34 40 % JasmineUPC Roman Regular Western 9 x 34 40 % Jellyka - Estrya's Handwriting Special Regular Baltic 4 x 24 40 % Jellyka - Estrya's Handwriting Special Regular Central European 4 x 24 40 % Jellyka - Estrya's Handwriting Special Regular Cyrilli c 4 x 24 40 % Jellyka - Estrya's Handwriting Special Regular Greek 4 x 24 40 % Jellyka - Estrya's Handwriting Special Regular Turkish 4 x 24 40 % Jellyka - Estrya's Handwriting Special Regular Vietnam ese 4 x 24 40 % Jellyka - Estrya's Handwriting Special Regular Western 4 x 24 40 % KaiTi Modern Regular CHINESE _GB2312 16 x 32 40 % KaiTi Modern Regular Western 16 x 32 40 % Kalinga Swiss Regular Western 19 x 48 40 % Kartika Roman Regular Western 27 x 46 40 % Khmer UI Swiss Regular Western 21 x 36 40 % KodchiangUPC Roman Regular Thai 9 x 31 40 % KodchiangUPC Roman Regular Western 9 x 31 40 % Kokila Swiss Regular Western 13 x 37 40 % Lao UI Swiss Regular Western 18 x 43 40 % Latha Swiss Regular Western 23 x 44 40 % Leelawadee Swiss Regular Thai 17 x 38 40 % Leelawadee Swiss Regular Western 17 x 38 40 % Levenim MT Special Regular Hebrew 16 x 42 40 % LeviBrush Special Regular Western 15 x 43 40 % LilyUPC Swiss Regular Thai 9 x 30 40 % LilyUPC Swiss Regular Western 9 x 30 40 % Lobster 1.4 Modern Regular Western 17 x 40 40 % Console Modern Regular Central European 19 x 32 40 % Lucida Console Modern Regular Cyrilli c 19 x 32 40 % Lucida Console Modern Regular Greek 19 x 32 40 % Lucida Console Modern Regular Turkish 19 x 32 40 % Lucida Console Modern Regular Western 19 x 32 40 % Swiss Regular Baltic 16 x 49 40 % Lucida Sans Unicode Swiss Regular Central European 16 x 49 40 % Lucida Sans Unicode Swiss Regular Cyrilli c 16 x 49 40 % Lucida Sans Unicode Swiss Regular Greek 16 x 49 40 % Lucida Sans Unicode Swiss Regular Hebrew 16 x 49 40 % Lucida Sans Unicode Swiss Regular Turkish 16 x 49 40 % Lucida Sans Unicode Swiss Regular Western 16 x 49 40 % Malgun Gothic Swiss Regular Hangul 15 x 43 40 % Malgun Gothic Swiss Regular Western 15 x 43 40 % Mangal Roman Regular Western 19 x 54 40 % Special Regular Symbol 31 x 32 50 % Meiryo UI Swiss Regular Baltic 17 x 41 40 % Meiryo UI Swiss Regular Central European 17 x 41 40 % Meiryo UI Swiss Regular Cyrilli c 17 x 41 40 % Meiryo UI Swiss Regular Greek 17 x 41 40 % Meiryo UI Swiss Regular Japanes e 17 x 41 40 % Meiryo UI Swiss Regular Turkish 17 x 41 40 % Meiryo UI Swiss Regular Western 17 x 41 40 % Meiryo Swiss Regular Baltic 31 x 48 40 % Meiryo Swiss Regular Central European 31 x 48 40 % Meiryo Swiss Regular Cyrilli c 31 x 48 40 % Meiryo Swiss Regular Greek 31 x 48 40 % Meiryo Swiss Regular Japanes e 31 x 48 40 % Meiryo Swiss Regular Turkish 31 x 48 40 % Meiryo Swiss Regular Western 31 x 48 40 % Microsoft Himalaya Special Regular Western 13 x 32 40 % Microsoft JhengHei Swiss Regular CHINESE _BIG5 15 x 43 40 % Microsoft JhengHei Swiss Regular Greek 15 x 43 40 % Microsoft JhengHei Swiss Regular Western 15 x 43 40 % Microsoft New Tai Lue Swiss Regular Western 19 x 42 40 % Microsoft PhagsPa Swiss Regular Western 24 x 41 40 % Swiss Regular Arabic 14 x 36 40 % Microsoft Sans Serif Swiss Regular Baltic 14 x 36 40 % Microsoft Sans Serif Swiss Regular Central European 14 x 36 40 % Microsoft Sans Serif Swiss Regular Cyrilli c 14 x 36 40 % Microsoft Sans Serif Swiss Regular Greek 14 x 36 40 % Microsoft Sans Serif Swiss Regular Hebrew 14 x 36 40 % Microsoft Sans Serif Swiss Regular Thai 14 x 36 40 % Microsoft Sans Serif Swiss Regular Turkish 14 x 36 40 % Microsoft Sans Serif Swiss Regular Vietnam ese 14 x 36 40 % Microsoft Sans Serif Swiss Regular Western 14 x 36 40 % Microsoft Tai Le Swiss Regular Western 19 x 41 40 % Microsoft Uighur Special Regular Arabic 13 x 32 40 % Microsoft Uighur Special Regular Western 13 x 32 40 % Microsoft YaHei Swiss Regular Central European 15 x 42 40 % Microsoft YaHei Swiss Regular CHINESE _GB2312 15 x 42 40 % Microsoft YaHei Swiss Regular Cyrilli c 15 x 42 40 % Microsoft YaHei Swiss Regular Greek 15 x 42 40 % Microsoft YaHei Swiss Regular Turkish 15 x 42 40 % Microsoft YaHei Swiss Regular Western 15 x 42 40 % Microsoft Yi Baiti Script Regular Western 21 x 32 40 % MingLiU Modern Regular CHINESE _BIG5 16 x 32 40 % MingLiU Modern Regular Western 16 x 32 40 % MingLiU_HKSCS Roman Regular CHINESE _BIG5 16 x 32 40 % MingLiU_HKSCS Roman Regular Western 16 x 32 40 % MingLiU_HKSCS-ExtB Roman Regular CHINESE _BIG5 16 x 32 40 % MingLiU_HKSCS-ExtB Roman Regular Western 16 x 32 40 % MingLiU-ExtB Roman Regular CHINESE _BIG5 16 x 32 40 % MingLiU-ExtB Roman Regular Western 16 x 32 40 % Miriam Fixed Modern Regular Hebrew 19 x 32 40 % Miriam Swiss Regular Hebrew 13 x 32 40 % Modern Modern OEM/DOS 19 x 37 40 % Mongolian Baiti Script Regular Western 14 x 34 40 % Monotype Corsiva Script Regular Baltic 11 x 35 40 % Monotype Corsiva Script Regular Central European 11 x 35 40 % Monotype Corsiva Script Regular Cyrilli c 11 x 35 40 % Monotype Corsiva Script Regular Greek 11 x 35 40 % Monotype Corsiva Script Regular Turkish 11 x 35 40 % Monotype Corsiva Script Regular Western 11 x 35 40 % MoolBoran Swiss Regular Western 13 x 43 40 % MS Gothic Modern Regular Baltic 16 x 32 40 % MS Gothic Modern Regular Central European 16 x 32 40 % MS Gothic Modern Regular Cyrilli c 16 x 32 40 % MS Gothic Modern Regular Greek 16 x 32 40 % MS Gothic Modern Regular Japanes e 16 x 32 40 % MS Gothic Modern Regular Turkish 16 x 32 40 % MS Gothic Modern Regular Western 16 x 32 40 % MS Mincho Modern Regular Baltic 16 x 32 40 % MS Mincho Modern Regular Central European 16 x 32 40 % MS Mincho Modern Regular Cyrilli c 16 x 32 40 % MS Mincho Modern Regular Greek 16 x 32 40 % MS Mincho Modern Regular Japanes e 16 x 32 40 % MS Mincho Modern Regular Turkish 16 x 32 40 % MS Mincho Modern Regular Western 16 x 32 40 % MS PGothic Swiss Regular Baltic 13 x 32 40 % MS PGothic Swiss Regular Central European 13 x 32 40 % MS PGothic Swiss Regular Cyrilli c 13 x 32 40 % MS PGothic Swiss Regular Greek 13 x 32 40 % MS PGothic Swiss Regular Japanes e 13 x 32 40 % MS PGothic Swiss Regular Turkish 13 x 32 40 % MS PGothic Swiss Regular Western 13 x 32 40 % MS PMincho Roman Regular Baltic 13 x 32 40 % MS PMincho Roman Regular Central European 13 x 32 40 % MS PMincho Roman Regular Cyrilli c 13 x 32 40 % MS PMincho Roman Regular Greek 13 x 32 40 % MS PMincho Roman Regular Japanes e 13 x 32 40 % MS PMincho Roman Regular Turkish 13 x 32 40 % MS PMincho Roman Regular Western 13 x 32 40 % MS Reference Sans Serif Swiss Regular Baltic 16 x 39 40 % MS Reference Sans Serif Swiss Regular Central European 16 x 39 40 % MS Reference Sans Serif Swiss Regular Cyrilli c 16 x 39 40 % MS Reference Sans Serif Swiss Regular Greek 16 x 39 40 % MS Reference Sans Serif Swiss Regular Turkish 16 x 39 40 % MS Reference Sans Serif Swiss Regular Vietnam ese 16 x 39 40 % MS Reference Sans Serif Swiss Regular Western 16 x 39 40 % MS Reference Specialty Special Regular Symbol 23 x 39 40 % MS Sans Serif Swiss Western 5 x 13 40 % MS Serif Roman Western 5 x 13 40 % MS UI Gothic Swiss Regular Baltic 13 x 32 40 % MS UI Gothic Swiss Regular Central European 13 x 32 40 % MS UI Gothic Swiss Regular Cyrilli c 13 x 32 40 % MS UI Gothic Swiss Regular Greek 13 x 32 40 % MS UI Gothic Swiss Regular Japanes e 13 x 32 40 % MS UI Gothic Swiss Regular Turkish 13 x 32 40 % MS UI Gothic Swiss Regular Western 13 x 32 40 % MV Boli Special Regular Western 18 x 52 40 % my dream Special Medium Western 11 x 34 50 % Narkisim Swiss Regular Hebrew 12 x 32 40 % NSimSun Modern Regular CHINESE _GB2312 16 x 32 40 % NSimSun Modern Regular Western 16 x 32 40 % Special Regular Baltic 18 x 33 40 % Nyala Special Regular Central European 18 x 33 40 % Nyala Special Regular Turkish 18 x 33 40 % Nyala Special Regular Western 18 x 33 40 % Linotype Roman Regular Baltic 14 x 43 40 % Palatino Linotype Roman Regular Central European 14 x 43 40 % Palatino Linotype Roman Regular Cyrilli c 14 x 43 40 % Palatino Linotype Roman Regular Greek 14 x 43 40 % Palatino Linotype Roman Regular Turkish 14 x 43 40 % Palatino Linotype Roman Regular Vietnam ese 14 x 43 40 % Palatino Linotype Roman Regular Western 14 x 43 40 % Plantagenet Cherokee Roman Regular Western 14 x 41 40 % PMingLiU Roman Regular CHINESE _BIG5 16 x 32 40 % PMingLiU Roman Regular Western 16 x 32 40 % PMingLiU-ExtB Roman Regular CHINESE _BIG5 16 x 32 40 % PMingLiU-ExtB Roman Regular Western 16 x 32 40 % Raavi Swiss Regular Western 13 x 53 40 % Remachine Script Personal Use Special Regular Baltic 15 x 34 40 % Remachine Script Personal Use Special Regular Central European 15 x 34 40 % Remachine Script Personal Use Special Regular Turkish 15 x 34 40 % Remachine Script Personal Use Special Regular Vietnam ese 15 x 34 40 % Remachine Script Personal Use Special Regular Western 15 x 34 40 % Rod Modern Regular Hebrew 19 x 31 40 % Roman Roman OEM/DOS 22 x 37 40 % Sakkal Majalla Special Regular Arabic 16 x 45 40 % Sakkal Majalla Special Regular Baltic 16 x 45 40 % Sakkal Majalla Special Regular Central European 16 x 45 40 % Sakkal Majalla Special Regular Turkish 16 x 45 40 % Sakkal Majalla Special Regular Western 16 x 45 40 % Script Script OEM/DOS 16 x 36 40 % Scriptina - Alternates Special Regular Western 277 x 85 40 % Scriptina Special Regular Western 13 x 93 40 % Print Special Regular Baltic 21 x 56 40 % Segoe Print Special Regular Central European 21 x 56 40 % Segoe Print Special Regular Cyrilli c 21 x 56 40 % Segoe Print Special Regular Greek 21 x 56 40 % Segoe Print Special Regular Turkish 21 x 56 40 % Segoe Print Special Regular Western 21 x 56 40 % Segoe Script Swiss Regular Baltic 22 x 51 40 % Segoe Script Swiss Regular Central European 22 x 51 40 % Segoe Script Swiss Regular Cyrilli c 22 x 51 40 % Segoe Script Swiss Regular Greek 22 x 51 40 % Segoe Script Swiss Regular Turkish 22 x 51 40 % Segoe Script Swiss Regular Western 22 x 51 40 % Segoe UI Light Swiss Regular Baltic 17 x 43 30 % Segoe UI Light Swiss Regular Central European 17 x 43 30 % Segoe UI Light Swiss Regular Cyrilli c 17 x 43 30 % Segoe UI Light Swiss Regular Greek 17 x 43 30 % Segoe UI Light Swiss Regular Turkish 17 x 43 30 % Segoe UI Light Swiss Regular Vietnam ese 17 x 43 30 % Segoe UI Light Swiss Regular Western 17 x 43 30 % Segoe UI Semibold Swiss Regular Baltic 18 x 43 60 % Segoe UI Semibold Swiss Regular Central European 18 x 43 60 % Segoe UI Semibold Swiss Regular Cyrilli c 18 x 43 60 % Segoe UI Semibold Swiss Regular Greek 18 x 43 60 % Segoe UI Semibold Swiss Regular Turkish 18 x 43 60 % Segoe UI Semibold Swiss Regular Vietnam ese 18 x 43 60 % Segoe UI Semibold Swiss Regular Western 18 x 43 60 % Segoe UI Symbol Swiss Regular Western 23 x 43 40 % Segoe UI Swiss Regular Arabic 17 x 43 40 % Segoe UI Swiss Regular Baltic 17 x 43 40 % Segoe UI Swiss Regular Central European 17 x 43 40 % Segoe UI Swiss Regular Cyrilli c 17 x 43 40 % Segoe UI Swiss Regular Greek 17 x 43 40 % Segoe UI Swiss Regular Turkish 17 x 43 40 % Segoe UI Swiss Regular Vietnam ese 17 x 43 40 % Segoe UI Swiss Regular Western 17 x 43 40 % Shonar Bangla Swiss Regular Western 16 x 41 40 % Shruti Swiss Regular Western 14 x 54 40 % SimHei Modern Regular CHINESE _GB2312 16 x 32 40 % SimHei Modern Regular Western 16 x 32 40 % Simplified Arabic Fixed Modern Regular Arabic 19 x 35 40 % Simplified Arabic Fixed Modern Regular Western 19 x 35 40 % Simplified Arabic Roman Regular Arabic 13 x 53 40 % Simplified Arabic Roman Regular Western 13 x 53 40 % SimSun Special Regular CHINESE _GB2312 16 x 32 40 % SimSun Special Regular Western 16 x 32 40 % SimSun-ExtB Modern Regular CHINESE _GB2312 16 x 32 40 % SimSun-ExtB Modern Regular Western 16 x 32 40 % Small Fonts Swiss Western 1 x 3 40 % Southern Aire Personal Use Only Special Regular Baltic 14 x 33 40 % Southern Aire Personal Use Only Special Regular Central European 14 x 33 40 % Southern Aire Personal Use Only Special Regular Turkish 14 x 33 40 % Southern Aire Personal Use Only Special Regular Vietnam ese 14 x 33 40 % Southern Aire Personal Use Only Special Regular Western 14 x 33 40 % Roman Regular Baltic 13 x 42 40 % Sylfaen Roman Regular Central European 13 x 42 40 % Sylfaen Roman Regular Cyrilli c 13 x 42 40 % Sylfaen Roman Regular Greek 13 x 42 40 % Sylfaen Roman Regular Turkish 13 x 42 40 % Sylfaen Roman Regular Western 13 x 42 40 % Symbol Roman Regular Symbol 19 x 39 40 % System Swiss Western 7 x 16 70 % Swiss Regular Arabic 14 x 39 40 % Tahoma Swiss Regular Baltic 14 x 39 40 % Tahoma Swiss Regular Central European 14 x 39 40 % Tahoma Swiss Regular Cyrilli c 14 x 39 40 % Tahoma Swiss Regular Greek 14 x 39 40 % Tahoma Swiss Regular Hebrew 14 x 39 40 % Tahoma Swiss Regular Thai 14 x 39 40 % Tahoma Swiss Regular Turkish 14 x 39 40 % Tahoma Swiss Regular Vietnam ese 14 x 39 40 % Tahoma Swiss Regular Western 14 x 39 40 % TeamViewer8 Decorative Medium Other 23 x 32 50 % Terminal Modern OEM/DOS 8 x 12 40 % Roman Regular Arabic 13 x 35 40 % Times New Roman Roman Regular Baltic 13 x 35 40 % Times New Roman Roman Regular Central European 13 x 35 40 % Times New Roman Roman Regular Cyrilli c 13 x 35 40 % Times New Roman Roman Regular Greek 13 x 35 40 % Times New Roman Roman Regular Hebrew 13 x 35 40 % Times New Roman Roman Regular Turkish 13 x 35 40 % Times New Roman Roman Regular Vietnam ese 13 x 35 40 % Times New Roman Roman Regular Western 13 x 35 40 % Traditional Arabic Roman Regular Arabic 15 x 48 40 % Traditional Arabic Roman Regular Western 15 x 48 40 % Trebuchet MS Swiss Regular Baltic 15 x 37 40 % Trebuchet MS Swiss Regular Central European 15 x 37 40 % Trebuchet MS Swiss Regular Cyrilli c 15 x 37 40 % Trebuchet MS Swiss Regular Greek 15 x 37 40 % Trebuchet MS Swiss Regular Turkish 15 x 37 40 % Trebuchet MS Swiss Regular Western 15 x 37 40 % Tunga Swiss Regular Western 18 x 53 40 % Utsaah Swiss Regular Western 13 x 36 40 % Vani Swiss Regular Western 23 x 54 40 % Swiss Regular Baltic 16 x 39 40 % Verdana Swiss Regular Central European 16 x 39 40 % Verdana Swiss Regular Cyrilli c 16 x 39 40 % Verdana Swiss Regular Greek 16 x 39 40 % Verdana Swiss Regular Turkish 16 x 39 40 % Verdana Swiss Regular Vietnam ese 16 x 39 40 % Verdana Swiss Regular Western 16 x 39 40 % Vijaya Swiss Regular Western 19 x 32 40 % Swiss Regular Western 20 x 44 40 % Waltograph UI Script Bold Western 20 x 35 70 % Waltograph Script Regular Western 14 x 44 50 % Roman Regular Symbol 31 x 32 40 % 2 Roman Regular Symbol 27 x 34 40 % Wingdings 3 Roman Regular Symbol 25 x 36 40 % Wingdings Special Regular Symbol 28 x 36 40 %

------[ Windows Audio ]-------out.0 0001 001B Microsoft GS Wavetable Synth mixer.0 0001 0068 Speakers (Conexant AC-Link Audi mixer.1 0001 0068 Microphone (Conexant AC-Link Au wave-in.0 0001 0065 Microphone (Conexant AC-Link Au wave-out.0 0001 0064 Speakers (Conexant AC-Link Audi

------[ PCI / PnP Audio ]------Conexant Cx20468 @ Intel 82801FBM ICH6-M - AC'97 Audio Controller [B-1] PCI

------[ Audio Codecs ]------[ Fraunhofer IIS MPEG Layer-3 Codec (decode only) ] ACM Driver Properties: Driver Description Fraunhofer IIS MPEG Laye r-3 Codec (decode only) Copyright Notice Copyright © 1996-1999 Frau nhofer Institut Integrierte Schaltungen IIS Driver Features decoder only version Driver Version 1.09 [ Microsoft ADPCM CODEC ] ACM Driver Properties: Driver Description Microsoft ADPCM CODEC Copyright Notice Copyright (C) 1992-1996 Microsoft Corporation Driver Features Compresses and decompres ses Microsoft ADPCM audio data. Driver Version 4.00 [ Microsoft CCITT G.711 A-Law and u-Law CODEC ] ACM Driver Properties: Driver Description Microsoft CCITT G.711 A- Law and u-Law CODEC Copyright Notice Copyright (c) 1993-1996 Microsoft Corporation Driver Features Compresses and decompres ses CCITT G.711 A-Law and u-Law audio data. Driver Version 4.00 [ Microsoft GSM 6.10 Audio CODEC ] ACM Driver Properties: Driver Description Microsoft GSM 6.10 Audio CODEC Copyright Notice Copyright (C) 1993-1996 Microsoft Corporation Driver Features Compresses and decompres ses audio data conforming to the ETSI-GSM (European Telecommunications Standards Institute-Groupe Special Mobile) recommendation 6.10. Driver Version 4.00 [ Microsoft IMA ADPCM CODEC ] ACM Driver Properties: Driver Description Microsoft IMA ADPCM CODE C Copyright Notice Copyright (C) 1992-1996 Microsoft Corporation Driver Features Compresses and decompres ses IMA ADPCM audio data. Driver Version 4.00 [ Microsoft PCM Converter ] ACM Driver Properties: Driver Description Microsoft PCM Converter Copyright Notice Copyright (C) 1992-1996 Microsoft Corporation Driver Features Converts frequency and b its per sample of PCM audio data. Driver Version 5.00

------[ Video Codecs ]------ff_vfw.dll ffdshow video encoder iccvid.dll 1.10.0.11 Cinepak® Codec iyuv_32.dll 6.1.7600.16385 (win7_rtm.090713-1255) Intel Inde o(R) Video YUV Codec msrle32.dll 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft RLE Compressor msvidc32.dll 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft Video 1 Compressor msyuv.dll 6.1.7601.17514 (win7sp1_rtm.101119-1850) Microso ft UYVY Video Decompressor tsbyuv.dll 6.1.7601.17514 (win7sp1_rtm.101119-1850) Toshiba Video Codec

------[ MCI ]------[ AVIVideo ] MCI Device Properties: Device AVIVideo Name Video for Windows Description Video For Windows MCI dr iver Type Digital Video Device Driver mciavi32.dll Status Enabled MCI Device Features: Compound Device Yes File Based Device Yes Can Eject No Can Play Yes Can Play In Reverse Yes Can Record No Can Save Data No Can Freeze Data No Can Lock Data No Can Stretch Frame Yes Can Stretch Input No Can Test Yes Audio Capable Yes Video Capable Yes Still Image Capable No [ CDAudio ] MCI Device Properties: Device CDAudio Name CD Audio Description MCI driver for cdaudio d evices Type CD Audio Device Driver mcicda.dll Status Enabled MCI Device Features: Compound Device No File Based Device No Can Eject Yes Can Play Yes Can Record No Can Save Data No Audio Capable Yes Video Capable No [ MPEGVideo ] MCI Device Properties: Device MPEGVideo Name DirectShow Description DirectShow MCI Driver Type Digital Video Device Driver mciqtz32.dll Status Enabled MCI Device Features: Compound Device Yes File Based Device Yes Can Eject No Can Play Yes Can Play In Reverse No Can Record No Can Save Data No Can Freeze Data No Can Lock Data No Can Stretch Frame Yes Can Stretch Input No Can Test Yes Audio Capable Yes Video Capable Yes Still Image Capable No [ Sequencer ] MCI Device Properties: Device Sequencer Name MIDI Sequencer Description MCI driver for MIDI sequ encer Type Sequencer Device Driver mciseq.dll Status Enabled MCI Device Features: Compound Device Yes File Based Device Yes Can Eject No Can Play Yes Can Record No Can Save Data No Audio Capable Yes Video Capable No [ WaveAudio ] MCI Device Properties: Device WaveAudio Name Sound Description MCI driver for waveform audio Type Waveform Audio Device Driver mciwave.dll Status Enabled MCI Device Features: Compound Device Yes File Based Device Yes Can Eject No Can Play Yes Can Record Yes Can Save Data Yes Audio Capable Yes Video Capable No

------[ Windows Storage ]------[ ST950032 5AS USB Device ] Device Properties: Driver Description ST950032 5AS USB Device Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File disk.inf Disk Device Physical Info: Manufacturer Seagate Hard Disk Name Momentus 5400.6 500325 Form Factor 2.5" Formatted Capacity 500 GB Disks 2 Recording Surfaces 4 Physical Dimensions 100.5 x 69.85 x 9.5 mm Max. Weight 98.8 g Average Rotational Latency 5.6 ms Rotational Speed 5400 RPM Max. Internal Data Rate 1175 Mbit/s Interface SATA-II Buffer-to-Host Data Rate 300 MB/s Buffer Size 8 MB Device Manufacturer: Company Name Seagate Technology LLC Product Information http://www.seagate.com/p roducts [ WDC WD600UE-22KVT0 ATA Device ] Device Properties: Driver Description WDC WD600UE-22KVT0 ATA D evice Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File disk.inf Device Manufacturer: Company Name Western Digital Corporat ion Product Information http://www.westerndigita l.com/en/products [ DTSOFT Virtual CdRom Device ] Device Properties: Driver Description DTSOFT Virtual CdRom Dev ice Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File cdrom.inf [ HL-DT-ST DVDRAM GSA-T10N ATA Device ] Device Properties: Driver Description HL-DT-ST DVDRAM GSA-T10N ATA Device Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File cdrom.inf Optical Drive Properties: Manufacturer Hitachi-LG Device Type DVD+RW/DVD-RW/DVD-RAM Interface ATAPI Writing Speeds: DVD+R9 Dual Layer 4x DVD+R 8x DVD+RW 8x DVD-R9 Dual Layer 4x DVD-R 8x DVD-RW 6x DVD-RAM 5x CD-R 24x CD-RW 24x Reading Speeds: DVD-ROM 8x CD-ROM 24x Device Manufacturer: Company Name LG Electronics Product Information http://www.lge.com/produ cts/category/list/computer%20products_optical%20storage.jhtml Firmware Download http://www.lge.com/suppo rt/main.jhtml [ ATA Channel 0 ] Device Properties: Driver Description ATA Channel 0 Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File mshdc.inf Device Resources: IRQ 14 Port 01F0-01F7 Port 03F6-03F6 [ Intel(R) 82801FB/FBM Ultra ATA Storage Controllers - 266F ] Device Properties: Driver Description Intel(R) 82801FB/FBM Ult ra ATA Storage Controllers - 266F Driver Date 2/25/2013 Driver Version 9.1.9.1003 Driver Provider Intel INF File oem4.inf Device Resources: Port 3580-358F

------[ Logical Drives ]------C: Local Disk NTFS 27129 MB 17287 MB 9842 MB 36 % 5887-1E46 D: (Courseware 2013) Local Disk NTFS 29998 MB 240 MB 29758 MB 99 % 9C3D-4D24 E: Optical Drive

F: Optical Drive

G: (Seagate Vic) Local Disk NTFS 4 76936 MB 370226 MB 106710 MB 22 % B236-75FE

------[ Physical Drives ]------[ Drive #1 - WDC WD600UE-22KVT0 (55 GB) ] #1 (Active) NTFS 1 MB 100 MB #2 NTFS C: 101 MB 27130 MB #3 NTFS D: (Courseware 2013) 27231 MB 29999 MB [ Drive #2 - ST9500325AS (465 GB) ] #1 NTFS G: (Seagate Vic) 1 MB 476937 MB

------[ Optical Drives ]------[ E:\ HL-DT-ST DVDRAM GSA-T10N ATA Device ] Optical Drive Properties: Device Description HL-DT-ST DVDRAM GSA-T10N ATA Device Serial Number KY971AL0833 Firmware Revision PC05 Firmware Date 7/20/2006 Buffer Size 2 MB Manufacturer Hitachi-LG Device Type DVD+RW/DVD-RW/DVD-RAM Interface ATAPI Region Code 3 Remaining User Changes 3 Remaining Vendor Changes 4 Writing Speeds: DVD+R9 Dual Layer 4x DVD+R 8x DVD+RW 8x DVD-R9 Dual Layer 4x DVD-R 8x DVD-RW 6x DVD-RAM 5x CD-R 24x CD-RW 24x Reading Speeds: DVD-ROM 8x CD-ROM 24x Supported Disk Types: BD-ROM Not Supported BD-R Not Supported BD-RE Not Supported HD DVD-ROM Not Supported HD DVD-R Not Supported HD DVD-RW Not Supported DVD-ROM Read DVD+R9 Dual Layer Read + Write DVD+R Read + Write DVD+RW Read + Write DVD-R9 Dual Layer Read + Write DVD-R Read + Write DVD-RW Read + Write DVD-RAM Read + Write CD-ROM Read CD-R Read + Write CD-RW Read + Write Optical Drive Features: Buffer Underrun Protection Supported C2 Error Pointers Supported CD+G Not Supported CD-Text Supported Hybrid Disc Not Supported JustLink Not Supported LabelFlash Not Supported Layer-Jump Recording Supported LightScribe Not Supported Mount Rainier Not Supported SMART Supported CSS Supported CPRM Supported AACS Not Supported VCPS Not Supported BD CPS Not Supported Device Manufacturer: Company Name LG Electronics Product Information http://www.lge.com/produ cts/category/list/computer%20products_optical%20storage.jhtml Firmware Download http://www.lge.com/suppo rt/main.jhtml [ F:\ DTSOFT Virtual CdRom Device ] Optical Drive Properties: Device Description DTSOFT Virtual CdRom Dev ice Firmware Revision 1.05 Buffer Size 128 KB Region Code 1 Remaining User Changes 4 Remaining Vendor Changes 4 Supported Disk Types: BD-ROM Read BD-R Read BD-RE Read HD DVD-ROM Not Supported HD DVD-R Not Supported HD DVD-RW Not Supported DVD-ROM Read DVD+R9 Dual Layer Read DVD+R Read DVD+RW Read DVD-R9 Dual Layer Read DVD-R Read DVD-RW Read DVD-RAM Not Supported CD-ROM Read CD-R Read CD-RW Read Optical Drive Features: Buffer Underrun Protection Not Supported C2 Error Pointers Supported CD+G Supported CD-Text Supported Hybrid Disc Not Supported JustLink Not Supported LabelFlash Not Supported Layer-Jump Recording Not Supported LightScribe Not Supported Mount Rainier Not Supported SMART Not Supported CSS Not Supported CPRM Not Supported AACS Not Supported VCPS Not Supported BD CPS Not Supported

------[ ATA ]------[ WDC WD600UE-22KVT0 (WD-WXCX06132557) ] ATA Device Properties: Model ID WDC WD600UE-22KVT0 Serial Number WD-WXCX06132557 Revision 01.03K01 World Wide Name 5-0014EE-2001A7DEA Device Type ATA-100 Parameters 116280 cylinders, 16 hea ds, 63 sectors per track, 512 bytes per sector LBA Sectors 117210240 Buffer 2 MB Multiple Sectors 16 ECC Bytes 56 Max. PIO Transfer Mode PIO 4 Max. UDMA Transfer Mode UDMA 5 (ATA-100) Active UDMA Transfer Mode UDMA 5 (ATA-100) Unformatted Capacity 57232 MB ATA Device Features: 48-bit LBA Supported Advanced Power Management Supported, Enabled Automatic Acoustic Management Supported, Disabled Device Configuration Overlay Supported DMA Setup Auto-Activate Not Supported General Purpose Logging Not Supported Host Protected Area Supported, Enabled In-Order Data Delivery Not Supported Native Command Queuing Not Supported Phy Event Counters Not Supported Power Management Supported, Enabled Power-Up In Standby Not Supported Read Look-Ahead Supported, Enabled Release Interrupt Not Supported Security Mode Supported, Disabled SMART Supported, Enabled SMART Error Logging Supported SMART Self-Test Supported Software Settings Preservation Not Supported Streaming Not Supported Tagged Command Queuing Not Supported Write Cache Supported, Enabled ATA Device Manufacturer: Company Name Western Digital Corporat ion Product Information http://www.westerndigita l.com/en/products [ ST9500325AS (6VETQDD0) ] ATA Device Properties: Model ID ST9500325AS Serial Number 6VETQDD0 Revision 0003SDM1 World Wide Name 5-000C50-0375E0093 Device Type SATA-II @ Oxford Parameters 969021 cylinders, 16 hea ds, 63 sectors per track, 512 bytes per sector LBA Sectors 976773168 Buffer 8 MB Multiple Sectors 16 ECC Bytes 4 Unformatted Capacity 476940 MB ATA Device Features: 48-bit LBA Supported Advanced Power Management Supported, Enabled Automatic Acoustic Management Not Supported Device Configuration Overlay Supported DMA Setup Auto-Activate Not Supported General Purpose Logging Supported Host Protected Area Supported, Enabled In-Order Data Delivery Not Supported Native Command Queuing Supported Phy Event Counters Supported Power Management Supported, Enabled Power-Up In Standby Not Supported Read Look-Ahead Supported, Enabled Release Interrupt Not Supported Security Mode Supported, Disabled SMART Supported, Enabled SMART Error Logging Supported SMART Self-Test Supported Software Settings Preservation Supported, Enabled Streaming Not Supported Tagged Command Queuing Not Supported Write Cache Supported, Enabled ATA Device Physical Info: Manufacturer Seagate Hard Disk Name Momentus 5400.6 500325 Form Factor 2.5" Formatted Capacity 500 GB Disks 2 Recording Surfaces 4 Physical Dimensions 100.5 x 69.85 x 9.5 mm Max. Weight 98.8 g Average Rotational Latency 5.6 ms Rotational Speed 5400 RPM Max. Internal Data Rate 1175 Mbit/s Interface SATA-II Buffer-to-Host Data Rate 300 MB/s Buffer Size 8 MB ATA Device Manufacturer: Company Name Seagate Technology LLC Product Information http://www.seagate.com/p roducts

------[ SMART ]------[ WDC WD600UE-22KVT0 (WD-WXCX06132557) ] 01 Raw Read Error Rate 51 200 200 16 OK: Valu e is normal 03 Spinup Time 21 159 156 1008 OK: Valu e is normal 04 Start/Stop Count 0 86 86 14277 OK: Alwa ys passes 05 Reallocated Sector Count 140 149 149 402 OK: Valu e is normal 07 Seek Error Rate 51 200 200 0 OK: Valu e is normal 09 Power-On Time Count 0 68 68 24051 OK: Alwa ys passes 0A Spinup Retry Count 51 100 100 0 OK: Valu e is normal 0B Calibration Retry Count 51 100 100 0 OK: Valu e is normal 0C Power Cycle Count 0 91 91 9603 OK: Alwa ys passes C0 Power-Off Retract Count 0 188 188 9443 OK: Alwa ys passes C1 Load/Unload Cycle Count 0 61 61 419847 OK: Alwa ys passes C2 Temperature 0 99 88 44 OK: Alwa ys passes C4 Reallocation Event Count 0 60 60 140 OK: Alwa ys passes C5 Current Pending Sector Count 0 200 200 0 OK: Alwa ys passes C6 Offline Uncorrectable Sector Count 0 200 200 0 OK: Alwa ys passes C7 Ultra ATA CRC Error Rate 0 200 200 309 OK: Alwa ys passes C8 Write Error Rate 51 200 200 0 OK: Valu e is normal [ ST9500325AS (6VETQDD0) ] 01 Raw Read Error Rate 6 116 99 111262278 OK: Valu e is normal 03 Spinup Time 0 99 98 0 OK: Alwa ys passes 04 Start/Stop Count 20 98 98 2657 OK: Valu e is normal 05 Reallocated Sector Count 36 100 100 0 OK: Valu e is normal 07 Seek Error Rate 30 82 60 182943644 OK: Valu e is normal 09 Power-On Time Count 0 89 89 9802 OK: Alwa ys passes 0A Spinup Retry Count 97 100 100 0 OK: Valu e is normal 0C Power Cycle Count 20 98 98 2539 OK: Valu e is normal B8 99 100 100 0 OK: Valu e is normal BB 0 100 100 0 OK: Alwa ys passes BC 0 100 93 393297 OK: Alwa ys passes BD 0 100 100 0 OK: Alwa ys passes BE Airflow Temperature 45 68 50 538837024 OK: Valu e is normal BF Mechanical Shock 0 99 99 2029 OK: Alwa ys passes C0 Power-Off Retract Count 0 100 100 326 OK: Alwa ys passes C1 Load/Unload Cycle Count 0 47 47 107854 OK: Alwa ys passes C2 Temperature 0 32 50 32 OK: Alwa ys passes C3 Hardware ECC Recovered 0 55 49 111262278 OK: Alwa ys passes C5 Current Pending Sector Count 0 100 100 0 OK: Alwa ys passes C6 Offline Uncorrectable Sector Count 0 100 100 0 OK: Alwa ys passes C7 Ultra ATA CRC Error Rate 0 200 200 2 OK: Alwa ys passes FE 0 100 100 0 OK: Alwa ys passes

------[ Windows Network ]------[ Intel(R) PRO/100 VE Network Connection ] Network Adapter Properties: Network Adapter Intel(R) PRO/100 VE Netw ork Connection Interface Type Ethernet Hardware Address 00-16-D4-BC-CE-11 Connection Name Local Area Connection Connection Speed 10 Mbps MTU 1500 bytes Bytes Received 0 Bytes Sent 0 Network Adapter Manufacturer: Company Name Intel Corporation Product Information http://www.intel.com/des ign/network/products/ethernet/linecard_ec.htm Driver Download http://support.intel.com /support/network Driver Update http://driveragent.com?r ef=59 [ Intel(R) PRO/Wireless 2200BG Network Connection ] Network Adapter Properties: Network Adapter Intel(R) PRO/Wireless 22 00BG Network Connection Interface Type 802.11 Wireless Ethernet Hardware Address 00-16-6F-C7-55-78 Connection Name Wireless Network Connect ion Connection Speed 54 Mbps MTU 1500 bytes DHCP Lease Obtained 8/19/2013 11:01:18 PM DHCP Lease Expires 8/20/2013 12:01:18 AM WLAN Signal Strength -33 dBm (Excellent) Bytes Received 405831060 (387.0 MB) Bytes Sent 28880728 (27.5 MB) Network Adapter Addresses: IP / Subnet Mask 192.168.43.3 / 255.255.2 55.0 Gateway 192.168.43.1 DHCP 192.168.43.1 DNS 192.168.43.1 Network Adapter Manufacturer: Company Name Intel Corporation Product Information http://www.intel.com/des ign/network/products/ethernet/linecard_ec.htm Driver Download http://support.intel.com /support/network Driver Update http://driveragent.com?r ef=59

------[ PCI / PnP Network ]------HP PRO/Wireless 2200BG 3B Network Connection PCI Intel PRO/100 VE Network Connection PCI

------[ IAM ]------[ Microsoft Communities ] Account Properties: Account Name Microsoft Communities Account ID account{9E2C0896-48A6-45 F9-9F79-A250A6BE7FE4}.oeaccount Account Type News (Default) Connection Name Not Specified (IE Defaul t) NNTP Server msnews.microsoft.com Account Features: NNTP Prompt For Password No NNTP Secure Authentication No NNTP Secure Connection No NNTP Use Group Descriptions No NNTP Post Using Plain Text Format No NNTP Post Using HTML Format No [ Active Directory ] Account Properties: Account Name Active Directory Account ID account{4D537664-B4C3-49 2C-AD70-CF109B7FC846}.oeaccount Account Type LDAP Connection Name Not Specified (IE Defaul t) LDAP Server NULL:3268 LDAP User Name NULL LDAP Search Base NULL LDAP Search Timeout 1 min Account Features: LDAP Authentication Required Yes LDAP Secure Authentication Yes LDAP Secure Connection No LDAP Simple Search Filter No [ VeriSign Internet Directory Service ] Account Properties: Account Name VeriSign Internet Direct ory Service Account ID account{CB9EC4F5-E86A-41 51-A79C-99EF967221E1}.oeaccount Account Type LDAP Connection Name Not Specified (IE Defaul t) LDAP Server directory.verisign.com LDAP URL http://www.verisign.com LDAP Search Base NULL LDAP Search Timeout 1 min Account Features: LDAP Authentication Required No LDAP Secure Authentication No LDAP Secure Connection No LDAP Simple Search Filter Yes

------[ Internet ]------Internet Settings: Start Page http://go.microsoft.com/ fwlink/?LinkId=69157 Search Page http://go.microsoft.com/ fwlink/?LinkId=54896 Download Folder Current Proxy: Proxy Status Disabled LAN Proxy: Proxy Status Disabled

------[ Routes ]------Active 0.0.0.0 0.0.0.0 192.168.43.1 25 192.16 8.43.3 (Intel(R) PRO/Wireless 2200BG Network Connection) Active 127.0.0.0 255.0.0.0 127.0.0.1 306 127.0. 0.1 (Software Loopback Interface 1) Active 127.0.0.1 255.255.255.255 127.0.0.1 306 127.0. 0.1 (Software Loopback Interface 1) Active 127.255.255.255 255.255.255.255 127.0.0.1 306 127.0. 0.1 (Software Loopback Interface 1) Active 192.168.43.0 255.255.255.0 192.168.43.3 281 192.16 8.43.3 (Intel(R) PRO/Wireless 2200BG Network Connection) Active 192.168.43.3 255.255.255.255 192.168.43.3 281 192.16 8.43.3 (Intel(R) PRO/Wireless 2200BG Network Connection) Active 192.168.43.255 255.255.255.255 192.168.43.3 281 192.16 8.43.3 (Intel(R) PRO/Wireless 2200BG Network Connection) Active 224.0.0.0 240.0.0.0 127.0.0.1 306 127.0. 0.1 (Software Loopback Interface 1) Active 224.0.0.0 240.0.0.0 192.168.43.3 281 192.16 8.43.3 (Intel(R) PRO/Wireless 2200BG Network Connection) Active 255.255.255.255 255.255.255.255 127.0.0.1 306 127.0. 0.1 (Software Loopback Interface 1) Active 255.255.255.255 255.255.255.255 192.168.43.3 281 192.16 8.43.3 (Intel(R) PRO/Wireless 2200BG Network Connection)

------[ Browser History ]------2013-08-19 16:52:44 Vic Tiangco@res://C:\Program Files\Dll-Files.com Fixer\ DLLFixer.exe/426 2013-08-19 16:52:44 Vic Tiangco@res://C:\Program Files\Dll-Files.com Fixer\ DLLFixer.exe/445 2013-08-19 16:52:45 Vic Tiangco@res://C:\Program Files\Dll-Files.com Fixer\ DLLFixer.exe/424 2013-08-19 16:52:46 Vic Tiangco@res://C:\Program Files\Dll-Files.com Fixer\ DLLFixer.exe/420 2013-08-19 16:52:46 Vic Tiangco@res://C:\Program Files\Dll-Files.com Fixer\ DLLFixer.exe/421 2013-08-19 16:52:46 Vic Tiangco@res://C:\Program Files\Dll-Files.com Fixer\ DLLFixer.exe/427 2013-08-19 16:52:46 Vic Tiangco@res://C:\Program Files\Dll-Files.com Fixer\ DLLFixer.exe/428

------[ DirectX Files ]------amstream.dll 6.06.7601.17514 Final Retail En glish 70656 11/21/2010 5:29:07 AM bdaplgin.ax 6.01.7600.16385 Final Retail En glish 74240 7/14/2009 9:14:10 AM d3d8.dll 6.01.7600.16385 Final Retail En glish 1036800 7/14/2009 9:15:08 AM d3d8thk.dll 6.01.7600.16385 Final Retail En glish 11264 7/14/2009 9:15:08 AM d3d9.dll 6.01.7601.17514 Final Retail En glish 1828352 11/21/2010 5:29:19 AM d3dim.dll 6.01.7600.16385 Final Retail En glish 386048 7/14/2009 9:15:08 AM d3dim700.dll 6.01.7600.16385 Final Retail En glish 817664 7/14/2009 9:15:08 AM d3dramp.dll 6.01.7600.16385 Final Retail En glish 593920 7/14/2009 9:15:08 AM d3dxof.dll 6.01.7600.16385 Final Retail En glish 53760 7/14/2009 9:15:08 AM ddraw.dll 6.01.7600.16385 Final Retail En glish 531968 7/14/2009 9:15:10 AM ddrawex.dll 6.01.7600.16385 Final Retail En glish 30208 7/14/2009 9:15:10 AM devenum.dll 6.06.7600.16385 Final Retail En glish 66560 7/14/2009 9:15:10 AM dinput.dll 6.01.7600.16385 Final Retail En glish 136704 7/14/2009 9:15:11 AM dinput8.dll 6.01.7600.16385 Final Retail En glish 145408 7/14/2009 9:15:11 AM dmband.dll 6.01.7600.16385 Final Retail En glish 30720 7/14/2009 9:15:12 AM dmcompos.dll 6.01.7600.16385 Final Retail En glish 63488 7/14/2009 9:15:12 AM dmime.dll 6.01.7600.16385 Final Retail En glish 179712 7/14/2009 9:15:12 AM dmloader.dll 6.01.7600.16385 Final Retail En glish 38400 7/14/2009 9:15:12 AM dmscript.dll 6.01.7600.16385 Final Retail En glish 86016 7/14/2009 9:15:12 AM dmstyle.dll 6.01.7600.16385 Final Retail En glish 105984 7/14/2009 9:15:12 AM dmsynth.dll 6.01.7600.16385 Final Retail En glish 105472 7/14/2009 9:15:12 AM dmusic.dll 6.01.7600.16385 Final Retail En glish 101376 7/14/2009 9:15:12 AM dplaysvr.exe 6.01.7600.16385 Final Retail En glish 29184 7/14/2009 9:14:18 AM dplayx.dll 6.01.7600.16385 Final Retail En glish 213504 7/14/2009 9:15:12 AM dpmodemx.dll 6.01.7600.16385 Final Retail En glish 23040 7/14/2009 9:15:12 AM dpnaddr.dll 6.01.7601.17514 Final Retail En glish 2560 11/21/2010 5:29:06 AM dpnet.dll 6.01.7600.16385 Final Retail En glish 376832 7/14/2009 9:15:12 AM dpnhpast.dll 6.01.7600.16385 Final Retail En glish 7168 7/14/2009 9:15:12 AM dpnhupnp.dll 6.01.7600.16385 Final Retail En glish 7168 7/14/2009 9:15:12 AM dpnlobby.dll 6.01.7600.16385 Final Retail En glish 2560 7/14/2009 9:04:52 AM dpnsvr.exe 6.01.7600.16385 Final Retail En glish 33280 7/14/2009 9:14:18 AM dpwsockx.dll 6.01.7600.16385 Final Retail En glish 44032 7/14/2009 9:15:12 AM dsdmo.dll 6.01.7600.16385 Final Retail En glish 173568 7/14/2009 9:15:13 AM dsound.dll 6.01.7600.16385 Final Retail En glish 453632 7/14/2009 9:15:13 AM dswave.dll 6.01.7600.16385 Final Retail En glish 20992 7/14/2009 9:15:13 AM dxapi.sys 6.01.7600.16385 Final Retail En glish 13312 7/14/2009 7:25:26 AM dxdiagn.dll 6.01.7601.17514 Final Retail En glish 210432 11/21/2010 5:29:19 AM dxmasf.dll 12.00.7601.17514 Final Retail En glish 4096 11/21/2010 5:29:41 AM encapi.dll 6.01.7600.16385 Final Retail En glish 20992 7/14/2009 9:15:14 AM gcdef.dll 6.01.7600.16385 Final Retail En glish 120832 7/14/2009 9:15:22 AM iac25_32.ax 2.00.0005.0053 Final Retail En glish 197632 7/14/2009 9:14:10 AM ir41_32.ax 4.51.0016.0003 Final Retail En glish 839680 7/14/2009 9:14:10 AM ir41_qc.dll 4.30.0062.0002 Final Retail En glish 120320 7/14/2009 9:15:34 AM ir41_qcx.dll 4.30.0062.0002 Final Retail En glish 120320 7/14/2009 9:15:34 AM ir50_32.dll 5.2562.0015.0055 Final Retail En glish 746496 7/14/2009 9:15:34 AM ir50_qc.dll 5.00.0063.0048 Final Retail En glish 200192 7/14/2009 9:15:34 AM ir50_qcx.dll 5.00.0063.0048 Final Retail En glish 200192 7/14/2009 9:15:34 AM ivfsrc.ax 5.10.0002.0051 Final Retail En glish 146944 7/14/2009 9:14:10 AM joy.cpl 6.01.7600.16385 Final Retail En glish 138240 7/14/2009 9:14:09 AM ks.sys 6.01.7601.17514 Final Retail En glish 190976 11/21/2010 5:29:21 AM ksproxy.ax 6.01.7601.17514 Final Retail En glish 193536 11/21/2010 5:29:24 AM kstvtune.ax 6.01.7601.17514 Final Retail En glish 84480 11/21/2010 5:29:38 AM ksuser.dll 6.01.7600.16385 Final Retail En glish 4608 7/14/2009 9:15:35 AM kswdmcap.ax 6.01.7601.17514 Final Retail En glish 107008 11/21/2010 5:29:13 AM ksxbar.ax 6.01.7601.17514 Final Retail En glish 48640 11/21/2010 5:29:38 AM mciqtz32.dll 6.06.7601.17514 Final Retail En glish 36352 11/21/2010 5:29:07 AM mfc40.dll 4.01.0000.6151 Beta Retail En glish 954752 11/21/2010 5:29:07 AM mfc42.dll 6.06.8063.0000 Beta Retail En glish 1136640 7/14/2009 9:15:39 AM Microsoft.DirectX.AudioVideoPlayback.dll 5.04.0000.2904 Final Retail En glish 53248 8/19/2013 2:34:46 PM Microsoft.DirectX.Diagnostics.dll 5.04.0000.2904 Final Retail En glish 12800 8/19/2013 2:34:46 PM Microsoft.DirectX.Direct3D.dll 9.05.0132.0000 Final Retail En glish 473600 8/19/2013 2:34:46 PM Microsoft.DirectX.Direct3DX.dll 5.04.0000.3900 Final Retail En glish 2676224 8/19/2013 2:34:44 PM Microsoft.DirectX.Direct3DX.dll 9.04.0091.0000 Final Retail En glish 2846720 8/19/2013 2:34:45 PM Microsoft.DirectX.Direct3DX.dll 9.05.0132.0000 Final Retail En glish 563712 8/19/2013 2:34:45 PM Microsoft.DirectX.Direct3DX.dll 9.06.0168.0000 Final Retail En glish 567296 8/19/2013 2:34:45 PM Microsoft.DirectX.Direct3DX.dll 9.07.0239.0000 Final Retail En glish 576000 8/19/2013 2:34:45 PM Microsoft.DirectX.Direct3DX.dll 9.08.0299.0000 Final Retail En glish 577024 8/19/2013 2:34:46 PM Microsoft.DirectX.Direct3DX.dll 9.09.0376.0000 Final Retail En glish 577536 8/19/2013 2:34:46 PM Microsoft.DirectX.Direct3DX.dll 9.10.0455.0000 Final Retail En glish 577536 8/19/2013 2:34:46 PM Microsoft.DirectX.Direct3DX.dll 9.11.0519.0000 Final Retail En glish 578560 8/19/2013 2:34:46 PM Microsoft.DirectX.Direct3DX.dll 9.12.0589.0000 Final Retail En glish 578560 8/19/2013 2:34:46 PM Microsoft.DirectX.DirectDraw.dll 5.04.0000.2904 Final Retail En glish 145920 8/19/2013 2:34:46 PM Microsoft.DirectX.DirectInput.dll 5.04.0000.2904 Final Retail En glish 159232 8/19/2013 2:34:46 PM Microsoft.DirectX.DirectPlay.dll 5.04.0000.2904 Final Retail En glish 364544 8/19/2013 2:34:46 PM Microsoft.DirectX.DirectSound.dll 5.04.0000.2904 Final Retail En glish 178176 8/19/2013 2:34:46 PM Microsoft.DirectX.dll 5.04.0000.2904 Final Retail En glish 223232 8/19/2013 2:34:46 PM mpeg2data.ax 6.06.7601.17514 Final Retail En glish 72704 11/21/2010 5:29:38 AM mpg2splt.ax 6.06.7601.17514 Final Retail En glish 199680 11/21/2010 5:29:38 AM msdmo.dll 6.06.7601.17514 Final Retail En glish 30720 11/21/2010 5:29:08 AM msdvbnp.ax 6.06.7601.17514 Final Retail En glish 59904 11/21/2010 5:29:38 AM mskssrv.sys 6.01.7600.16385 Final Retail En glish 8320 7/14/2009 7:45:08 AM mspclock.sys 6.01.7600.16385 Final Retail En glish 5888 7/14/2009 7:45:08 AM mspqm.sys 6.01.7600.16385 Final Retail En glish 5504 7/14/2009 7:45:07 AM mstee.sys 6.01.7600.16385 Final Retail En glish 6144 7/14/2009 7:45:08 AM msvidctl.dll 6.05.7601.17514 Final Retail En glish 2291712 11/21/2010 5:29:38 AM msyuv.dll 6.01.7601.17514 Final Retail En glish 22528 11/21/2010 5:29:04 AM pid.dll 6.01.7600.16385 Final Retail En glish 36352 7/14/2009 9:16:12 AM psisdecd.dll 6.06.7600.16385 Final Retail En glish 465408 7/14/2009 9:16:12 AM psisrndr.ax 6.06.7601.17514 Final Retail En glish 75776 11/21/2010 5:29:38 AM qasf.dll 12.00.7601.17514 Final Retail En glish 206848 11/21/2010 5:29:08 AM qcap.dll 6.06.7601.17514 Final Retail En glish 190976 11/21/2010 5:29:12 AM qdv.dll 6.06.7601.17514 Final Retail En glish 283136 11/21/2010 5:29:12 AM qdvd.dll 6.06.7601.17514 Final Retail En glish 514560 11/21/2010 5:29:06 AM qedit.dll 6.06.7601.17514 Final Retail En glish 509440 11/21/2010 5:29:40 AM qedwipes.dll 6.06.7600.16385 Final Retail En glish 733184 7/14/2009 9:09:35 AM quartz.dll 6.06.7601.17514 Final Retail En glish 1328128 11/21/2010 5:29:07 AM stream.sys 6.01.7600.16385 Final Retail En glish 53632 7/14/2009 7:50:57 AM swenum.sys 6.01.7600.16385 Final Retail En glish 12240 7/14/2009 9:19:10 AM vbisurf.ax 6.01.7601.17514 Final Retail En glish 33792 11/21/2010 5:29:38 AM vfwwdm32.dll 6.01.7601.17514 Final Retail En glish 56832 11/21/2010 5:29:12 AM wsock32.dll 6.01.7600.16385 Final Retail En glish 15360 7/14/2009 9:16:20 AM

------[ DirectX Video ]------[ Primary Display Driver ] DirectDraw Device Properties: DirectDraw Driver Name display DirectDraw Driver Description Primary Display Driver Hardware Driver igxprd32.dll (6.14.10.47 04) Hardware Description Mobile Intel(R) 915GM/GM S,910GML Express Chipset Family Direct3D Device Properties: Rendering Bit Depths 16, 32 Z-Buffer Bit Depths 16, 24 Min Texture Size 1 x 1 Max Texture Size 2048 x 2048 Vertex Shader Version Not Supported Pixel Shader Version 2.0 Direct3D Device Features: Additive Texture Blending Supported AGP Texturing Not Supported Anisotropic Filtering Supported Automatic Mipmap Generation Not Supported Bilinear Filtering Supported Cubic Environment Mapping Supported Cubic Filtering Not Supported Decal-Alpha Texture Blending Supported Decal Texture Blending Supported DirectX Texture Compression Not Supported DirectX Volumetric Texture Compression Not Supported Dithering Supported Dot3 Texture Blending Supported Dynamic Textures Supported Edge Anti-Aliasing Not Supported Environmental Bump Mapping Supported Environmental Bump Mapping + Luminance Supported Factor Alpha Blending Supported Geometric Hidden-Surface Removal Not Supported Guard Band Supported Hardware Scene Rasterization Not Supported Hardware Transform & Lighting Not Supported Legacy Depth Bias Supported Mipmap LOD Bias Adjustments Supported Mipmapped Cube Textures Supported Mipmapped Volume Textures Supported Modulate-Alpha Texture Blending Supported Modulate Texture Blending Supported Non-Square Textures Supported N-Patches Not Supported Perspective Texture Correction Supported Point Sampling Supported Projective Textures Not Supported Quintic Bezier Curves & B-Splines Not Supported Range-Based Fog Not Supported Rectangular & Triangular Patches Not Supported Rendering In Windowed Mode Supported Scissor Test Supported Slope-Scale Based Depth Bias Supported Specular Flat Shading Supported Specular Gouraud Shading Supported Specular Phong Shading Not Supported Spherical Mapping Not Supported Stencil Buffers Supported Sub-Pixel Accuracy Supported Subtractive Texture Blending Supported Table Fog Supported Texture Alpha Blending Supported Texture Clamping Supported Texture Mirroring Supported Texture Transparency Supported Texture Wrapping Supported Triangle Culling Not Supported Trilinear Filtering Supported Two-Sided Stencil Test Supported Vertex Alpha Blending Supported Vertex Fog Supported Vertex Tweening Not Supported Volume Textures Supported W-Based Fog Supported W-Buffering Not Supported Z-Based Fog Supported Z-Bias Supported Z-Test Not Supported Supported FourCC Codes: I420 Supported IMC1 Supported IMC2 Supported IMC3 Supported IMC4 Supported IYUV Supported UYVY Supported VYUY Supported YUY2 Supported YV12 Supported YVU9 Supported YVYU Supported Video Adapter Manufacturer: Company Name Intel Corporation Product Information http://www.intel.com/pro ducts/chipsets Driver Download http://support.intel.com /support/graphics Driver Update http://driveragent.com?r ef=59

------[ DirectX Sound ]------[ Primary Sound Driver ] DirectSound Device Properties: Device Description Primary Sound Driver Driver Module Primary Buffers 1 Min / Max Secondary Buffers Sample Rate 100 / 200000 Hz Primary Buffers Sound Formats 8-bit, 16-bit, Mono, Ste reo Secondary Buffers Sound Formats 8-bit, 16-bit, Mono, Ste reo Total / Free Sound Buffers 1 / 0 Total / Free Static Sound Buffers 1 / 0 Total / Free Streaming Sound Buffers 1 / 0 Total / Free 3D Sound Buffers 0 / 0 Total / Free 3D Static Sound Buffers 0 / 0 Total / Free 3D Streaming Sound Buffers 0 / 0 DirectSound Device Features: Certified Driver No Emulated Device No Precise Sample Rate Supported DirectSound3D Not Supported Creative EAX 1.0 Not Supported Creative EAX 2.0 Not Supported Creative EAX 3.0 Not Supported Creative EAX 4.0 Not Supported Creative EAX 5.0 Not Supported I3DL2 Not Supported ZoomFX Not Supported [ Speakers (Conexant AC-Link Audio) ] DirectSound Device Properties: Device Description Speakers (Conexant AC-Li nk Audio) Driver Module {0.0.0.00000000}.{ab5363 c9-ead8-41f2-a5d0-6164be9fc07f} Primary Buffers 1 Min / Max Secondary Buffers Sample Rate 100 / 200000 Hz Primary Buffers Sound Formats 8-bit, 16-bit, Mono, Ste reo Secondary Buffers Sound Formats 8-bit, 16-bit, Mono, Ste reo Total / Free Sound Buffers 1 / 0 Total / Free Static Sound Buffers 1 / 0 Total / Free Streaming Sound Buffers 1 / 0 Total / Free 3D Sound Buffers 0 / 0 Total / Free 3D Static Sound Buffers 0 / 0 Total / Free 3D Streaming Sound Buffers 0 / 0 DirectSound Device Features: Certified Driver No Emulated Device No Precise Sample Rate Supported DirectSound3D Not Supported Creative EAX 1.0 Not Supported Creative EAX 2.0 Not Supported Creative EAX 3.0 Not Supported Creative EAX 4.0 Not Supported Creative EAX 5.0 Not Supported I3DL2 Not Supported Sensaura ZoomFX Not Supported

------[ DirectX Music ]------[ Microsoft MIDI Mapper [Emulated] ] DirectMusic Device Properties: Device Description Microsoft MIDI Mapper [E mulated] Synthesizer Type Hardware Device Class Output Port Device Type Windows Multimedia MIDI Channels 16 DirectMusic Device Features: Built-In GM Instrument Set No Built-In Roland GS Sound Set No DirectSound Not Supported DLS L1 Sample Collections Not Supported DLS L2 Sample Collections Not Supported External MIDI Port No Fixed DLS Memory Size No Port Sharing Supported Chorus Effect Not Supported Delay Effect Not Supported Reverb Effect Not Supported [ Microsoft GS Wavetable Synth [Emulated] ] DirectMusic Device Properties: Device Description Microsoft GS Wavetable S ynth [Emulated] Synthesizer Type Hardware Device Class Output Port Device Type Windows Multimedia MIDI Channels 16 DirectMusic Device Features: Built-In GM Instrument Set No Built-In Roland GS Sound Set No DirectSound Not Supported DLS L1 Sample Collections Not Supported DLS L2 Sample Collections Not Supported External MIDI Port No Fixed DLS Memory Size No Port Sharing Supported Chorus Effect Not Supported Delay Effect Not Supported Reverb Effect Not Supported [ Microsoft Synthesizer ] DirectMusic Device Properties: Device Description Microsoft Synthesizer Synthesizer Type Software Device Class Output Port Device Type User-Mode Synthesizer Audio Channels 2 MIDI Channels 16000 Voices 1000 Available Memory System Memory DirectMusic Device Features: Built-In GM Instrument Set No Built-In Roland GS Sound Set No DirectSound Supported DLS L1 Sample Collections Supported DLS L2 Sample Collections Supported External MIDI Port No Fixed DLS Memory Size No Port Sharing Not Supported Chorus Effect Not Supported Delay Effect Not Supported Reverb Effect Supported

------[ DirectX Input ]------[ Mouse ] DirectInput Device Properties: Device Description Mouse Device Type Unknown Device Subtype Unknown Axes 3 Buttons/Keys 5 DirectInput Device Features: Emulated Device Yes Alias Device No Polled Device No Polled Data Format No Attack Force Feedback Not Supported Deadband Force Feedback Not Supported Fade Force Feedback Not Supported Force Feedback Not Supported Saturation Force Feedback Not Supported +/- Force Feedback Coefficients Not Supported +/- Force Feedback Saturation Not Supported [ Keyboard ] DirectInput Device Properties: Device Description Keyboard Device Type Unknown Device Subtype Unknown Buttons/Keys 128 DirectInput Device Features: Emulated Device Yes Alias Device No Polled Device No Polled Data Format No Attack Force Feedback Not Supported Deadband Force Feedback Not Supported Fade Force Feedback Not Supported Force Feedback Not Supported Saturation Force Feedback Not Supported +/- Force Feedback Coefficients Not Supported +/- Force Feedback Saturation Not Supported [ HP Hotkey Device ] DirectInput Device Properties: Device Description HP Hotkey Device Device Type Unknown Device Subtype Unknown Buttons/Keys 12 DirectInput Device Features: Emulated Device Yes Alias Device No Polled Device No Polled Data Format No Attack Force Feedback Not Supported Deadband Force Feedback Not Supported Fade Force Feedback Not Supported Force Feedback Not Supported Saturation Force Feedback Not Supported +/- Force Feedback Coefficients Not Supported +/- Force Feedback Saturation Not Supported

------[ Windows Devices ]------[ Devices ] Batteries: Microsoft AC Adapter 6.1.7600.16385 Microsoft ACPI-Compliant Control Method Battery 6.1.7600.16385 Microsoft Composite Battery 6.1.7600.16385 Computer: ACPI x86-based PC 6.1.7600.16385 Disk drives: ST950032 5AS USB Device 6.1.7600.16385 WDC WD600UE-22KVT0 ATA Device 6.1.7600.16385 Display adapters: Mobile Intel(R) 915GM/GMS,910GML Express Chipset Family6.14.10.4704 Mobile Intel(R) 915GM/GMS,910GML Express Chipset Family6.14.10.4704 DVD/CD-ROM drives: DTSOFT Virtual CdRom Device 6.1.7601.17514 HL-DT-ST DVDRAM GSA-T10N ATA Device 6.1.7601.17514 Human Interface Devices: HID-compliant device 6.1.7601.17514 HP Hotkey Device 7.0.3.1 USB Input Device 6.1.7601.17514 IDE ATA/ATAPI controllers: ATA Channel 0 6.1.7601.17514 Intel(R) 82801FB/FBM Ultra ATA Storage Controllers - 266F9.1.9.1003 Keyboards: HID Keyboard Device 6.1.7601.17514 Standard PS/2 Keyboard 6.1.7601.17514 Mice and other pointing devices: HID-compliant mouse 6.1.7600.16385 PS/2 Compatible Mouse 6.1.7600.16385 Modems: Motorola SM56 Data Fax Modem 6.12.25.4 Monitors: Generic PnP Monitor 6.1.7600.16385 Generic PnP Monitor 6.1.7600.16385 Generic PnP Monitor 6.1.7600.16385 Network adapters: Intel(R) PRO/100 VE Network Connection 8.0.47.1 Intel(R) PRO/Wireless 2200BG Network Connection 9.0.4.39 Microsoft ISATAP Adapter #2 6.1.7600.16385 Microsoft ISATAP Adapter 6.1.7600.16385 RAS Async Adapter 6.1.7601.17514 Teredo Tunneling Pseudo-Interface 6.1.7600.16385 WAN Miniport (IKEv2) 6.1.7601.17514 WAN Miniport (IP) 6.1.7601.17514 WAN Miniport (IPv6) 6.1.7601.17514 WAN Miniport (L2TP) 6.1.7601.17514 WAN Miniport (Network Monitor) 6.1.7601.17514 WAN Miniport (PPPOE) 6.1.7601.17514 WAN Miniport (PPTP) 6.1.7601.17514 WAN Miniport (SSTP) 6.1.7601.17514 Non-Plug and Play Drivers: Ancillary Function Driver for Winsock Beep Bitlocker Drive Encryption Filter Driver CNG Common Log (CLFS) Disk Virtual Machine Bus Acceleration Filter Driver Dynamic Volume Manager Hardware Policy Driver HTTP IDMWFP Kernel Mode Driver Frameworks service KSecDD KSecPkg Link-Layer Topology Discovery Mapper I/O Driver Link-Layer Topology Discovery Responder Mount Point Manager msisadrv NativeWiFi Filter NDIS System Driver NDIS Usermode I/O Protocol NDProxy NETBT NetIO Legacy TDI Support Driver NSI proxy service driver. Null Offline Files Driver Parvdm PEAUTH Performance Counters for Windows Driver QoS Packet Scheduler RDP Encoder Mirror Driver RDPCDD Reflector Display Driver used to gain access to graphics data Remote Access IPv6 ARP Driver Security Driver Security Processor Loader Driver Storage volumes System Attribute Cache TCP/IP Protocol Driver TCP/IP Registry Compatibility VgaSave WFP Lightweight Filter Windows Firewall Authorization Driver PCMCIA adapters: ENE CB-1410/851 Cardbus Controller 5.1.2600.3001 Ports (COM & LPT): Printer Port (LPT1) 6.1.7600.16385 Processors: Intel(R) Pentium(R) M processor 2.13GHz 6.1.7600.16385 Sound, video and game controllers: Conexant AC-Link Audio 6.14.10.675 Storage volume shadow copies: Generic volume shadow copy 6.1.7600.16385 Generic volume shadow copy 6.1.7600.16385 Generic volume shadow copy 6.1.7600.16385 Storage Volumes: Generic volume 6.1.7601.17514 Generic volume 6.1.7601.17514 Generic volume 6.1.7601.17514 Generic volume 6.1.7601.17514 System devices: ACPI Fixed Feature Button 6.1.7601.17514 ACPI Lid 6.1.7601.17514 ACPI Sleep Button 6.1.7601.17514 ACPI Thermal Zone 6.1.7601.17514 Composite Bus Enumerator 6.1.7601.17514 DAEMON Tools Virtual Bus 5.0.1.282 Direct memory access controller 6.1.7601.17514 Extended IO Bus 6.1.7601.17514 File as Volume Driver 6.1.7600.16385 Intel(R) 82801 PCI Bridge - 2448 6.1.7601.17514 Intel(R) 82801FBM LPC Interface Controller - 2641 9.1.9.1003 Microsoft ACPI-Compliant Embedded Controller 6.1.7601.17514 Microsoft ACPI-Compliant System 6.1.7601.17514 Microsoft System Management BIOS Driver 6.1.7601.17514 Microsoft Virtual Drive Enumerator Driver 6.1.7601.17514 Microsoft Windows Management Interface for ACPI 6.1.7601.17514 Mobile Intel(R) 915GM/PM/GMS/910GML Express Processor to DRAM Controller - 25909.1.9.1003 Motherboard resources 6.1.7601.17514 Motherboard resources 6.1.7601.17514 Motherboard resources 6.1.7601.17514 Numeric data processor 6.1.7601.17514 PCI bus 1.0.7.248 Plug and Play Software Device Enumerator 6.1.7601.17514 Printer Port Logical Interface 6.1.7601.17514 Programmable interrupt controller 6.1.7601.17514 Remote Desktop Device Redirector Bus 6.1.7600.16385 System board 6.1.7601.17514 System CMOS/real time clock 6.1.7601.17514 System speaker 6.1.7601.17514 System timer 6.1.7601.17514 Terminal Server Keyboard Driver 6.1.7601.17514 Terminal Server Mouse Driver 6.1.7601.17514 UMBus Enumerator 6.1.7601.17514 UMBus Root Bus Enumerator 6.1.7601.17514 Volume Manager 6.1.7601.17514 Universal Serial Bus controllers: Generic USB Hub 6.1.7601.17514 Generic USB Hub 6.1.7601.17514 Intel(R) 82801FB/FBM USB Universal Host Controller - 26589.1.9.1003 Intel(R) 82801FB/FBM USB2 Enhanced Host Controller - 265C9.1.9.1003 Unknown Device 6.1.7601.17514 USB Mass Storage Device 6.1.7601.17514 USB Root Hub 6.1.7601.17514 USB Root Hub 6.1.7601.17514 [ Batteries / Microsoft AC Adapter ] Device Properties: Driver Description Microsoft AC Adapter Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File battery.inf Hardware ID ACPI\ACPI0003 PnP Device Microsoft AC Adapter [ Batteries / Microsoft ACPI-Compliant Control Method Battery ] Device Properties: Driver Description Microsoft ACPI-Compliant Control Method Battery Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File battery.inf Hardware ID ACPI\PNP0C0A PnP Device Control Method Battery [ Batteries / Microsoft Composite Battery ] Device Properties: Driver Description Microsoft Composite Batt ery Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File battery.inf Hardware ID COMPOSITE_BATTERY [ Computer / ACPI x86-based PC ] Device Properties: Driver Description ACPI x86-based PC Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File hal.inf Hardware ID acpiapic [ Disk drives / ST950032 5AS USB Device ] Device Properties: Driver Description ST950032 5AS USB Device Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File disk.inf Hardware ID USBSTOR\DiskST9500325AS______[ Disk drives / WDC WD600UE-22KVT0 ATA Device ] Device Properties: Driver Description WDC WD600UE-22KVT0 ATA D evice Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File disk.inf Hardware ID IDE\DiskWDC_WD600UE-22KV T0______01.03K01 Location Information Channel 0, Target 0, Lun 0 [ Display adapters / Mobile Intel(R) 915GM/GMS,910GML Express Chipset Family ] Device Properties: Driver Description Mobile Intel(R) 915GM/GM S,910GML Express Chipset Family Driver Date 10/6/2006 Driver Version 6.14.10.4704 Driver Provider Intel Corporation INF File oem11.inf Hardware ID PCI\VEN_8086&DEV_2592&SU BSYS_30C4103C&REV_03 Location Information @system32\drivers\pci.sy s,#65536;PCI bus %1, device %2, function %3;(0,2,0) PCI Device Intel 82915GM Graphics C ontroller 0 Device Resources: IRQ 16 Memory 000A0000-000BFFFF Memory C0000000-CFFFFFFF Memory D0600000-D067FFFF Memory D0680000-D06BFFFF Port 03B0-03BB Port 03C0-03DF Port 3000-3007 [ Display adapters / Mobile Intel(R) 915GM/GMS,910GML Express Chipset Family ] Device Properties: Driver Description Mobile Intel(R) 915GM/GM S,910GML Express Chipset Family Driver Date 10/6/2006 Driver Version 6.14.10.4704 Driver Provider Intel Corporation INF File oem11.inf Hardware ID PCI\VEN_8086&DEV_2792&SU BSYS_30C4103C&REV_03 Location Information @system32\drivers\pci.sy s,#65536;PCI bus %1, device %2, function %3;(0,2,1) PCI Device Intel 82915GM Graphics C ontroller 1 Device Resources: Memory D0700000-D077FFFF [ DVD/CD-ROM drives / DTSOFT Virtual CdRom Device ] Device Properties: Driver Description DTSOFT Virtual CdRom Dev ice Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File cdrom.inf Hardware ID DTSOFTBUS&Rev1\DTCDROM&R ev1 Location Information 00 [ DVD/CD-ROM drives / HL-DT-ST DVDRAM GSA-T10N ATA Device ] Device Properties: Driver Description HL-DT-ST DVDRAM GSA-T10N ATA Device Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File cdrom.inf Hardware ID IDE\CdRomHL-DT-ST_DVDRAM _GSA-T10N______PC05____ Location Information Channel 0, Target 1, Lun 0 [ Human Interface Devices / HID-compliant device ] Device Properties: Driver Description HID-compliant device Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File input.inf Hardware ID HID\HPQ0006&Col01 [ Human Interface Devices / HP Hotkey Device ] Device Properties: Driver Description HP Hotkey Device Driver Date 7/26/2011 Driver Version 7.0.3.1 Driver Provider Hewlett-Packard Developm ent Company, L.P. INF File oem8.inf Hardware ID ACPI\HPQ0006 PnP Device HP Quick Launch Buttons [ Human Interface Devices / USB Input Device ] Device Properties: Driver Description USB Input Device Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File input.inf Hardware ID USB\VID_1D57&PID_0016&RE V_0021 Location Information Port_#0004.Hub_#0003 [ IDE ATA/ATAPI controllers / ATA Channel 0 ] Device Properties: Driver Description ATA Channel 0 Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File mshdc.inf Hardware ID Intel-266f Location Information Channel 0 Device Resources: IRQ 14 Port 01F0-01F7 Port 03F6-03F6 [ IDE ATA/ATAPI controllers / Intel(R) 82801FB/FBM Ultra ATA Storage Controlle rs - 266F ] Device Properties: Driver Description Intel(R) 82801FB/FBM Ult ra ATA Storage Controllers - 266F Driver Date 2/25/2013 Driver Version 9.1.9.1003 Driver Provider Intel INF File oem4.inf Hardware ID PCI\VEN_8086&DEV_266F&SU BSYS_30C4103C&REV_03 Location Information @system32\drivers\pci.sy s,#65536;PCI bus %1, device %2, function %3;(0,31,1) PCI Device Intel 82801FBM ICH6-M - ATA-100 IDE Controller [B-1] Device Resources: Port 3580-358F [ Keyboards / HID Keyboard Device ] Device Properties: Driver Description HID Keyboard Device Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File keyboard.inf Hardware ID HID\HPQ0006&Col02 [ Keyboards / Standard PS/2 Keyboard ] Device Properties: Driver Description Standard PS/2 Keyboard Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File keyboard.inf Hardware ID ACPI\PNP0303 PnP Device 101/102-Key or MS Natura l Keyboard Device Resources: IRQ 01 Port 0060-0060 Port 0064-0064 [ Mice and other pointing devices / HID-compliant mouse ] Device Properties: Driver Description HID-compliant mouse Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File msmouse.inf Hardware ID HID\VID_1D57&PID_0016&RE V_0021 [ Mice and other pointing devices / PS/2 Compatible Mouse ] Device Properties: Driver Description PS/2 Compatible Mouse Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File msmouse.inf Hardware ID ACPI\SYN0132 PnP Device Synaptics PS/2 Port Touc hPad Device Resources: IRQ 12 [ Modems / Motorola SM56 Data Fax Modem ] Device Properties: Driver Description Motorola SM56 Data Fax M odem Driver Date 3/12/2009 Driver Version 6.12.25.4 Driver Provider Motorola Inc INF File oem7.inf Hardware ID PCI\VEN_8086&DEV_266D&SU BSYS_30C4103C&REV_03 Location Information @system32\drivers\pci.sy s,#65536;PCI bus %1, device %2, function %3;(0,30,3) PCI Device Intel 82801FBM ICH6-M - AC'97 Modem Controller [B-1] Device Resources: IRQ 17 Port 3400-34FF Port 3500-357F [ Monitors / Generic PnP Monitor ] Device Properties: Driver Description Generic PnP Monitor Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File monitor.inf Hardware ID Monitor\CMO1526 Monitor Chi Mei N154I2-L02 [ Monitors / Generic PnP Monitor ] Device Properties: Driver Description Generic PnP Monitor Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File monitor.inf Hardware ID Monitor\CMO1526 Monitor Chi Mei N154I2-L02 [ Monitors / Generic PnP Monitor ] Device Properties: Driver Description Generic PnP Monitor Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File monitor.inf Hardware ID Monitor\CMO1526 Monitor Chi Mei N154I2-L02 [ Network adapters / Intel(R) PRO/100 VE Network Connection ] Device Properties: Driver Description Intel(R) PRO/100 VE Netw ork Connection Driver Date 11/16/2007 Driver Version 8.0.47.1 Driver Provider Microsoft INF File netefe32.inf Hardware ID PCI\VEN_8086&DEV_1092&SU BSYS_30C4103C&REV_03 Location Information @system32\drivers\pci.sy s,#65536;PCI bus %1, device %2, function %3;(2,8,0) PCI Device Intel PRO/100 VE Network Connection Device Resources: IRQ 20 Memory D0002000-D0002FFF Port 2000-203F [ Network adapters / Intel(R) PRO/Wireless 2200BG Network Connection ] Device Properties: Driver Description Intel(R) PRO/Wireless 22 00BG Network Connection Driver Date 12/19/2007 Driver Version 9.0.4.39 Driver Provider Intel INF File oem9.inf Hardware ID PCI\VEN_8086&DEV_4220&SU BSYS_12F6103C&REV_05 Location Information @system32\drivers\pci.sy s,#65536;PCI bus %1, device %2, function %3;(2,4,0) PCI Device HP PRO/Wireless 2200BG 3 B Network Connection Device Resources: IRQ 21 Memory D0000000-D0000FFF [ Network adapters / Microsoft ISATAP Adapter #2 ] Device Properties: Driver Description Microsoft ISATAP Adapter #2 Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File nettun.inf Hardware ID *ISATAP [ Network adapters / Microsoft ISATAP Adapter ] Device Properties: Driver Description Microsoft ISATAP Adapter Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File nettun.inf Hardware ID *ISATAP [ Network adapters / RAS Async Adapter ] Device Properties: Driver Description RAS Async Adapter Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File netrasa.inf Hardware ID SW\{eeab7790-c514-11d1-b 42b-00805fc1270e} [ Network adapters / Teredo Tunneling Pseudo-Interface ] Device Properties: Driver Description Teredo Tunneling Pseudo- Interface Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File nettun.inf Hardware ID *TEREDO [ Network adapters / WAN Miniport (IKEv2) ] Device Properties: Driver Description WAN Miniport (IKEv2) Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File netavpna.inf Hardware ID ms_agilevpnminiport [ Network adapters / WAN Miniport (IP) ] Device Properties: Driver Description WAN Miniport (IP) Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File netrasa.inf Hardware ID ms_ndiswanip [ Network adapters / WAN Miniport (IPv6) ] Device Properties: Driver Description WAN Miniport (IPv6) Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File netrasa.inf Hardware ID ms_ndiswanipv6 [ Network adapters / WAN Miniport (L2TP) ] Device Properties: Driver Description WAN Miniport (L2TP) Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File netrasa.inf Hardware ID ms_l2tpminiport [ Network adapters / WAN Miniport (Network Monitor) ] Device Properties: Driver Description WAN Miniport (Network Mo nitor) Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File netrasa.inf Hardware ID ms_ndiswanbh [ Network adapters / WAN Miniport (PPPOE) ] Device Properties: Driver Description WAN Miniport (PPPOE) Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File netrasa.inf Hardware ID ms_pppoeminiport [ Network adapters / WAN Miniport (PPTP) ] Device Properties: Driver Description WAN Miniport (PPTP) Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File netrasa.inf Hardware ID ms_pptpminiport [ Network adapters / WAN Miniport (SSTP) ] Device Properties: Driver Description WAN Miniport (SSTP) Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File netsstpa.inf Hardware ID ms_sstpminiport [ Non-Plug and Play Drivers / Ancillary Function Driver for Winsock ] Device Properties: Driver Description Ancillary Function Drive r for Winsock [ Non-Plug and Play Drivers / Beep ] Device Properties: Driver Description Beep [ Non-Plug and Play Drivers / Bitlocker Drive Encryption Filter Driver ] Device Properties: Driver Description Bitlocker Drive Encrypti on Filter Driver [ Non-Plug and Play Drivers / CNG ] Device Properties: Driver Description CNG [ Non-Plug and Play Drivers / Common Log (CLFS) ] Device Properties: Driver Description Common Log (CLFS) [ Non-Plug and Play Drivers / Disk Virtual Machine Bus Acceleration Filter Dri ver ] Device Properties: Driver Description Disk Virtual Machine Bus Acceleration Filter Driver [ Non-Plug and Play Drivers / Dynamic Volume Manager ] Device Properties: Driver Description Dynamic Volume Manager [ Non-Plug and Play Drivers / Hardware Policy Driver ] Device Properties: Driver Description Hardware Policy Driver [ Non-Plug and Play Drivers / HTTP ] Device Properties: Driver Description HTTP [ Non-Plug and Play Drivers / IDMWFP ] Device Properties: Driver Description IDMWFP [ Non-Plug and Play Drivers / Kernel Mode Driver Frameworks service ] Device Properties: Driver Description Kernel Mode Driver Frame works service [ Non-Plug and Play Drivers / KSecDD ] Device Properties: Driver Description KSecDD [ Non-Plug and Play Drivers / KSecPkg ] Device Properties: Driver Description KSecPkg [ Non-Plug and Play Drivers / Link-Layer Topology Discovery Mapper I/O Driver ] Device Properties: Driver Description Link-Layer Topology Disc overy Mapper I/O Driver [ Non-Plug and Play Drivers / Link-Layer Topology Discovery Responder ] Device Properties: Driver Description Link-Layer Topology Disc overy Responder [ Non-Plug and Play Drivers / Mount Point Manager ] Device Properties: Driver Description Mount Point Manager [ Non-Plug and Play Drivers / msisadrv ] Device Properties: Driver Description msisadrv [ Non-Plug and Play Drivers / NativeWiFi Filter ] Device Properties: Driver Description NativeWiFi Filter [ Non-Plug and Play Drivers / NDIS System Driver ] Device Properties: Driver Description NDIS System Driver [ Non-Plug and Play Drivers / NDIS Usermode I/O Protocol ] Device Properties: Driver Description NDIS Usermode I/O Protoc ol [ Non-Plug and Play Drivers / NDProxy ] Device Properties: Driver Description NDProxy [ Non-Plug and Play Drivers / NETBT ] Device Properties: Driver Description NETBT [ Non-Plug and Play Drivers / NetIO Legacy TDI Support Driver ] Device Properties: Driver Description NetIO Legacy TDI Support Driver [ Non-Plug and Play Drivers / NSI proxy service driver. ] Device Properties: Driver Description NSI proxy service driver . [ Non-Plug and Play Drivers / Null ] Device Properties: Driver Description Null [ Non-Plug and Play Drivers / Offline Files Driver ] Device Properties: Driver Description Offline Files Driver [ Non-Plug and Play Drivers / Parvdm ] Device Properties: Driver Description Parvdm [ Non-Plug and Play Drivers / PEAUTH ] Device Properties: Driver Description PEAUTH [ Non-Plug and Play Drivers / Performance Counters for Windows Driver ] Device Properties: Driver Description Performance Counters for Windows Driver [ Non-Plug and Play Drivers / QoS Packet Scheduler ] Device Properties: Driver Description QoS Packet Scheduler [ Non-Plug and Play Drivers / RDP Encoder Mirror Driver ] Device Properties: Driver Description RDP Encoder Mirror Drive r [ Non-Plug and Play Drivers / RDPCDD ] Device Properties: Driver Description RDPCDD [ Non-Plug and Play Drivers / Reflector Display Driver used to gain access to graphics data ] Device Properties: Driver Description Reflector Display Driver used to gain access to graphics data [ Non-Plug and Play Drivers / Remote Access IPv6 ARP Driver ] Device Properties: Driver Description Remote Access IPv6 ARP D river [ Non-Plug and Play Drivers / Security Driver ] Device Properties: Driver Description Security Driver [ Non-Plug and Play Drivers / Security Processor Loader Driver ] Device Properties: Driver Description Security Processor Loade r Driver [ Non-Plug and Play Drivers / Storage volumes ] Device Properties: Driver Description Storage volumes [ Non-Plug and Play Drivers / System Attribute Cache ] Device Properties: Driver Description System Attribute Cache [ Non-Plug and Play Drivers / TCP/IP Protocol Driver ] Device Properties: Driver Description TCP/IP Protocol Driver [ Non-Plug and Play Drivers / TCP/IP Registry Compatibility ] Device Properties: Driver Description TCP/IP Registry Compatib ility [ Non-Plug and Play Drivers / VgaSave ] Device Properties: Driver Description VgaSave [ Non-Plug and Play Drivers / WFP Lightweight Filter ] Device Properties: Driver Description WFP Lightweight Filter [ Non-Plug and Play Drivers / Windows Firewall Authorization Driver ] Device Properties: Driver Description Windows Firewall Authori zation Driver [ PCMCIA adapters / ENE CB-1410/851 Cardbus Controller ] Device Properties: Driver Description ENE CB-1410/851 Cardbus Controller Driver Date 1/31/2007 Driver Version 5.1.2600.3001 Driver Provider ENE TECHNOLOGY INC. INF File oem2.inf Hardware ID PCI\VEN_1524&DEV_1410&SU BSYS_30C4103C&REV_01 Location Information @system32\drivers\pci.sy s,#65536;PCI bus %1, device %2, function %3;(2,6,0) PCI Device ENE Tech. CB1410 CardBus Controller Device Resources: IRQ 18 Memory D0001000-D0001FFF Memory D05FE000-D05FEFFF Memory D05FF000-D05FFFFF Memory FFEFF000-FFEFFFFF Port 2C00-2C03 [ Ports (COM & LPT) / Printer Port (LPT1) ] Device Properties: Driver Description Printer Port (LPT1) Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File msports.inf Hardware ID ACPI\PNP0400 PnP Device Parallel Port Device Resources: Port 0378-037F Port 0778-077A [ Processors / Intel(R) Pentium(R) M processor 2.13GHz ] Device Properties: Driver Description Intel(R) Pentium(R) M pr ocessor 2.13GHz Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File cpu.inf Hardware ID ACPI\GenuineIntel_-_x86_ Family_6_Model_13 [ Sound, video and game controllers / Conexant AC-Link Audio ] Device Properties: Driver Description Conexant AC-Link Audio Driver Date 8/22/2006 Driver Version 6.14.10.675 Driver Provider Conexant INF File oem12.inf Hardware ID PCI\VEN_8086&DEV_266E&SU BSYS_30C4103C&REV_03 Location Information @system32\drivers\pci.sy s,#65536;PCI bus %1, device %2, function %3;(0,30,2) PCI Device Intel 82801FBM ICH6-M - AC'97 Audio Controller [B-1] Device Resources: IRQ 17 Memory D0781000-D07811FF Memory D0782000-D07820FF Port 3100-31FF Port 3200-323F [ Storage volume shadow copies / Generic volume shadow copy ] Device Properties: Driver Description Generic volume shadow co py Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File volsnap.inf Hardware ID STORAGE\VolumeSnapshot [ Storage volume shadow copies / Generic volume shadow copy ] Device Properties: Driver Description Generic volume shadow co py Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File volsnap.inf Hardware ID STORAGE\VolumeSnapshot [ Storage volume shadow copies / Generic volume shadow copy ] Device Properties: Driver Description Generic volume shadow co py Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File volsnap.inf Hardware ID STORAGE\VolumeSnapshot [ Storage Volumes / Generic volume ] Device Properties: Driver Description Generic volume Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File volume.inf Hardware ID STORAGE\Volume [ Storage Volumes / Generic volume ] Device Properties: Driver Description Generic volume Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File volume.inf Hardware ID STORAGE\Volume [ Storage Volumes / Generic volume ] Device Properties: Driver Description Generic volume Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File volume.inf Hardware ID STORAGE\Volume [ Storage Volumes / Generic volume ] Device Properties: Driver Description Generic volume Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File volume.inf Hardware ID STORAGE\Volume [ System devices / ACPI Fixed Feature Button ] Device Properties: Driver Description ACPI Fixed Feature Butto n Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ACPI\FixedButton [ System devices / ACPI Lid ] Device Properties: Driver Description ACPI Lid Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ACPI\PNP0C0D PnP Device Lid [ System devices / ACPI Sleep Button ] Device Properties: Driver Description ACPI Sleep Button Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ACPI\PNP0C0E PnP Device Sleep Button [ System devices / ACPI Thermal Zone ] Device Properties: Driver Description ACPI Thermal Zone Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ACPI\ThermalZone [ System devices / Composite Bus Enumerator ] Device Properties: Driver Description Composite Bus Enumerator Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File compositebus.inf Hardware ID ROOT\CompositeBus [ System devices / DAEMON Tools Virtual Bus ] Device Properties: Driver Description DAEMON Tools Virtual Bus Driver Date 1/13/2012 Driver Version 5.0.1.282 Driver Provider DT Soft Ltd INF File oem15.inf Hardware ID root\DTSoftBus01 [ System devices / Direct memory access controller ] Device Properties: Driver Description Direct memory access con troller Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ACPI\PNP0200 PnP Device DMA Controller Device Resources: DMA 04 Port 0000-000F Port 0080-008F Port 00C0-00DF [ System devices / Extended IO Bus ] Device Properties: Driver Description Extended IO Bus Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ACPI\PNP0A06 PnP Device Extended IO Bus [ System devices / File as Volume Driver ] Device Properties: Driver Description File as Volume Driver Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File blbdrive.inf Hardware ID ROOT\BLBDRIVE [ System devices / Intel(R) 82801 PCI Bridge - 2448 ] Device Properties: Driver Description Intel(R) 82801 PCI Bridg e - 2448 Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID PCI\VEN_8086&DEV_2448&SU BSYS_30C4103C&REV_D3 Location Information @system32\drivers\pci.sy s,#65536;PCI bus %1, device %2, function %3;(0,30,0) PCI Device Intel 82801FBM I/O Contr oller Hub 6 (ICH6-M) [B-1] Device Resources: Memory D0000000-D05FFFFF Port 2000-2FFF [ System devices / Intel(R) 82801FBM LPC Interface Controller - 2641 ] Device Properties: Driver Description Intel(R) 82801FBM LPC In terface Controller - 2641 Driver Date 2/25/2013 Driver Version 9.1.9.1003 Driver Provider Intel INF File oem6.inf Hardware ID PCI\VEN_8086&DEV_2641&SU BSYS_30C4103C&REV_03 Location Information @system32\drivers\pci.sy s,#65536;PCI bus %1, device %2, function %3;(0,31,0) PCI Device Intel 82801FBM ICH6-M - LPC Bridge [B-1] [ System devices / Microsoft ACPI-Compliant Embedded Controller ] Device Properties: Driver Description Microsoft ACPI-Compliant Embedded Controller Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ACPI\PNP0C09 PnP Device Embedded Controller Devi ce Device Resources: Port 0062-0062 Port 0066-0066 [ System devices / Microsoft ACPI-Compliant System ] Device Properties: Driver Description Microsoft ACPI-Compliant System Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File acpi.inf Hardware ID ACPI_HAL\PNP0C08 PnP Device ACPI Driver/BIOS Device Resources: IRQ 100 IRQ 101 IRQ 102 IRQ 103 IRQ 104 IRQ 105 IRQ 106 IRQ 107 IRQ 108 IRQ 109 IRQ 110 IRQ 111 IRQ 112 IRQ 113 IRQ 114 IRQ 115 IRQ 116 IRQ 117 IRQ 118 IRQ 119 IRQ 120 IRQ 121 IRQ 122 IRQ 123 IRQ 124 IRQ 125 IRQ 126 IRQ 127 IRQ 128 IRQ 129 IRQ 130 IRQ 131 IRQ 132 IRQ 133 IRQ 134 IRQ 135 IRQ 136 IRQ 137 IRQ 138 IRQ 139 IRQ 140 IRQ 141 IRQ 142 IRQ 143 IRQ 144 IRQ 145 IRQ 146 IRQ 147 IRQ 148 IRQ 149 IRQ 150 IRQ 151 IRQ 152 IRQ 153 IRQ 154 IRQ 155 IRQ 156 IRQ 157 IRQ 158 IRQ 159 IRQ 160 IRQ 161 IRQ 162 IRQ 163 IRQ 164 IRQ 165 IRQ 166 IRQ 167 IRQ 168 IRQ 169 IRQ 170 IRQ 171 IRQ 172 IRQ 173 IRQ 174 IRQ 175 IRQ 176 IRQ 177 IRQ 178 IRQ 179 IRQ 180 IRQ 181 IRQ 182 IRQ 183 IRQ 184 IRQ 185 IRQ 186 IRQ 187 IRQ 188 IRQ 189 IRQ 190 IRQ 81 IRQ 82 IRQ 83 IRQ 84 IRQ 85 IRQ 86 IRQ 87 IRQ 88 IRQ 89 IRQ 90 IRQ 91 IRQ 92 IRQ 93 IRQ 94 IRQ 95 IRQ 96 IRQ 97 IRQ 98 IRQ 99 [ System devices / Microsoft System Management BIOS Driver ] Device Properties: Driver Description Microsoft System Managem ent BIOS Driver Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ROOT\mssmbios [ System devices / Microsoft Virtual Drive Enumerator Driver ] Device Properties: Driver Description Microsoft Virtual Drive Enumerator Driver Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ROOT\vdrvroot [ System devices / Microsoft Windows Management Interface for ACPI ] Device Properties: Driver Description Microsoft Windows Manage ment Interface for ACPI Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File acpi.inf Hardware ID ACPI\PNP0C14 PnP Device ACPI Management Interfac e [ System devices / Mobile Intel(R) 915GM/PM/GMS/910GML Express Processor to DR AM Controller - 2590 ] Device Properties: Driver Description Mobile Intel(R) 915GM/PM /GMS/910GML Express Processor to DRAM Controller - 2590 Driver Date 2/25/2013 Driver Version 9.1.9.1003 Driver Provider Intel INF File oem5.inf Hardware ID PCI\VEN_8086&DEV_2590&SU BSYS_30C4103C&REV_03 Location Information @system32\drivers\pci.sy s,#65536;PCI bus %1, device %2, function %3;(0,0,0) PCI Device Intel 82915GM Memory Con troller Hub [B-1] [ System devices / Motherboard resources ] Device Properties: Driver Description Motherboard resources Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ACPI\PNP0C02 PnP Device Motherboard Resources Device Resources: Memory FEC01000-FEC01FFF Memory FEDA0000-FEDBFFFF [ System devices / Motherboard resources ] Device Properties: Driver Description Motherboard resources Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ACPI\PNP0C02 PnP Device Motherboard Resources Device Resources: Memory E0000000-EFFFFFFF Memory FEC00000-FEC000FF Memory FED20000-FED8FFFF Memory FED90000-FED9AFFF Port 04D0-04D1 Port 1000-107F Port 1100-113F Port 1200-121F [ System devices / Motherboard resources ] Device Properties: Driver Description Motherboard resources Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ACPI\PNP0C02 PnP Device Motherboard Resources Device Resources: Memory FFB00000-FFBFFFFF Memory FFF00000-FFFFFFFF Port 0010-001F Port 0024-003F Port 004E-004F Port 0050-0053 Port 0063-0063 Port 0065-0065 Port 0067-0067 Port 0074-0077 Port 0090-009F Port 00A4-00BD Port 0200-0203 Port 0500-057F [ System devices / Numeric data processor ] Device Properties: Driver Description Numeric data processor Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ACPI\PNP0C04 PnP Device Numeric Data Processor Device Resources: IRQ 13 Port 00F0-00FF [ System devices / PCI bus ] Device Properties: Driver Description PCI bus Driver Date 12/4/2012 Driver Version 1.0.7.248 Driver Provider Intel INF File oem10.inf Hardware ID ACPI\PNP0A08 PnP Device ACPI Three-wire Device B us Device Resources: Memory 000A0000-000BFFFF Memory 000D0000-000DFFFF Memory 3F800000-FEC00FFF Memory FEC02000-FFFFFFFF Port 0000-0CF7 Port 0D00-FFFF [ System devices / Plug and Play Software Device Enumerator ] Device Properties: Driver Description Plug and Play Software D evice Enumerator Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID root\swenum [ System devices / Printer Port Logical Interface ] Device Properties: Driver Description Printer Port Logical Int erface Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID LPTENUM\MicrosoftRawPort 958A Location Information LPT1 [ System devices / Programmable interrupt controller ] Device Properties: Driver Description Programmable interrupt c ontroller Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ACPI\PNP0000 PnP Device Programmable Interrupt C ontroller Device Resources: Port 0020-0021 Port 00A0-00A1 [ System devices / Remote Desktop Device Redirector Bus ] Device Properties: Driver Description Remote Desktop Device Re director Bus Driver Date 6/21/2006 Driver Version 6.1.7600.16385 Driver Provider Microsoft INF File rdpbus.inf Hardware ID ROOT\RDPBUS [ System devices / System board ] Device Properties: Driver Description System board Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ACPI\PNP0C01 PnP Device System Board Extension Device Resources: Memory 00000000-0009FFFF Memory 000E0000-000FFFFF Memory 00100000-3F7FFFFF [ System devices / System CMOS/real time clock ] Device Properties: Driver Description System CMOS/real time cl ock Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ACPI\PNP0B00 PnP Device Real-Time Clock Device Resources: IRQ 08 Port 0070-0071 Port 0072-0073 [ System devices / System speaker ] Device Properties: Driver Description System speaker Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ACPI\PNP0800 PnP Device PC Speaker Device Resources: Port 0061-0061 [ System devices / System timer ] Device Properties: Driver Description System timer Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ACPI\PNP0100 PnP Device System Timer Device Resources: IRQ 00 Port 0040-0043 [ System devices / Terminal Server Keyboard Driver ] Device Properties: Driver Description Terminal Server Keyboard Driver Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ROOT\RDP_KBD [ System devices / Terminal Server Mouse Driver ] Device Properties: Driver Description Terminal Server Mouse Dr iver Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ROOT\RDP_MOU [ System devices / UMBus Enumerator ] Device Properties: Driver Description UMBus Enumerator Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File umbus.inf Hardware ID UMB\UMBUS [ System devices / UMBus Root Bus Enumerator ] Device Properties: Driver Description UMBus Root Bus Enumerato r Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File umbus.inf Hardware ID root\umbus [ System devices / Volume Manager ] Device Properties: Driver Description Volume Manager Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File machine.inf Hardware ID ROOT\VOLMGR [ Universal Serial Bus controllers / Generic USB Hub ] Device Properties: Driver Description Generic USB Hub Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File usb.inf Hardware ID USB\VID_1A40&PID_0101&RE V_0111 Location Information Port_#0002.Hub_#0001 [ Universal Serial Bus controllers / Generic USB Hub ] Device Properties: Driver Description Generic USB Hub Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File usb.inf Hardware ID USB\VID_1A40&PID_0101&RE V_0111 Location Information Port_#0001.Hub_#0003 [ Universal Serial Bus controllers / Intel(R) 82801FB/FBM USB Universal Host C ontroller - 2658 ] Device Properties: Driver Description Intel(R) 82801FB/FBM USB Universal Host Controller - 2658 Driver Date 2/25/2013 Driver Version 9.1.9.1003 Driver Provider Intel INF File oem3.inf Hardware ID PCI\VEN_8086&DEV_2658&SU BSYS_30C4103C&REV_03 Location Information @system32\drivers\pci.sy s,#65536;PCI bus %1, device %2, function %3;(0,29,0) PCI Device Intel 82801FBM ICH6-M - USB Universal Host Controller [B-1] Device Resources: IRQ 19 Port 3020-303F [ Universal Serial Bus controllers / Intel(R) 82801FB/FBM USB2 Enhanced Host C ontroller - 265C ] Device Properties: Driver Description Intel(R) 82801FB/FBM USB 2 Enhanced Host Controller - 265C Driver Date 2/25/2013 Driver Version 9.1.9.1003 Driver Provider Intel INF File oem3.inf Hardware ID PCI\VEN_8086&DEV_265C&SU BSYS_30C4103C&REV_03 Location Information @system32\drivers\pci.sy s,#65536;PCI bus %1, device %2, function %3;(0,29,7) PCI Device Intel 82801FBM ICH6-M - Enhanced USB2 Controller [B-1] Device Resources: IRQ 19 Memory D0780000-D07803FF [ Universal Serial Bus controllers / Unknown Device ] Device Properties: Driver Description Unknown Device Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File usb.inf Hardware ID USB\UNKNOWN Location Information Port_#0002.Hub_#0003 [ Universal Serial Bus controllers / USB Mass Storage Device ] Device Properties: Driver Description USB Mass Storage Device Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File usbstor.inf Hardware ID USB\VID_14CD&PID_6116&RE V_0200 Location Information Port_#0001.Hub_#0002 [ Universal Serial Bus controllers / USB Root Hub ] Device Properties: Driver Description USB Root Hub Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File usbport.inf Hardware ID USB\ROOT_HUB&VID8086&PID 2658&REV0003 [ Universal Serial Bus controllers / USB Root Hub ] Device Properties: Driver Description USB Root Hub Driver Date 6/21/2006 Driver Version 6.1.7601.17514 Driver Provider Microsoft INF File usbport.inf Hardware ID USB\ROOT_HUB20&VID8086&P ID265C&REV0003

------[ Physical Devices ]------PCI Devices: Bus 2, Device 6, Function 0 ENE Tech. CB1410 CardBus Controller Bus 2, Device 4, Function 0 HP PRO/Wireless 2200BG 3 B Network Connection Bus 0, Device 30, Function 0 Intel 82801FBM I/O Contr oller Hub 6 (ICH6-M) [B-1] Bus 0, Device 30, Function 2 Intel 82801FBM ICH6-M - AC'97 Audio Controller [B-1] Bus 0, Device 30, Function 3 Intel 82801FBM ICH6-M - AC'97 Modem Controller [B-1] Bus 0, Device 31, Function 1 Intel 82801FBM ICH6-M - ATA-100 IDE Controller [B-1] Bus 0, Device 29, Function 7 Intel 82801FBM ICH6-M - Enhanced USB2 Controller [B-1] Bus 0, Device 31, Function 0 Intel 82801FBM ICH6-M - LPC Bridge [B-1] Bus 0, Device 31, Function 3 Intel 82801FBM ICH6-M - SMBus Controller [B-1] Bus 0, Device 29, Function 0 Intel 82801FBM ICH6-M - USB Universal Host Controller [B-1] Bus 0, Device 2, Function 0 Intel 82915GM Graphics C ontroller 0 Bus 0, Device 2, Function 1 Intel 82915GM Graphics C ontroller 1 Bus 0, Device 0, Function 0 Intel 82915GM Memory Con troller Hub [B-1] Bus 2, Device 8, Function 0 Intel PRO/100 VE Network Connection PnP Devices: PNP0303 101/102-Key or MS Natura l Keyboard PNP0C08 ACPI Driver/BIOS FIXEDBUTTON ACPI Fixed Feature Butto n PNP0C14 ACPI Management Interfac e THERMALZONE ACPI Thermal Zone PNP0A08 ACPI Three-wire Device B us PNP0C0A Control Method Battery PNP0200 DMA Controller PNP0C09 Embedded Controller Devi ce PNP0A06 Extended IO Bus HPQ0006 HP Quick Launch Buttons GENUINEINTEL_-_X86_FAMILY_6_MODEL_13_-______INTEL(R)_PENTIUM(R)_M_PROCE SSOR_2.13GHZIntel(R) Pentium(R) M processor 2.13GHz PNP0C0D Lid ACPI0003 Microsoft AC Adapter ISATAP Microsoft ISATAP Adapter #2 ISATAP Microsoft ISATAP Adapter PNP0C02 Motherboard Resources PNP0C02 Motherboard Resources PNP0C02 Motherboard Resources PNP0C04 Numeric Data Processor PNP0400 Parallel Port PNP0800 PC Speaker PNP0000 Programmable Interrupt C ontroller PNP0B00 Real-Time Clock PNP0C0E Sleep Button SYN0132 Synaptics PS/2 Port Touc hPad PNP0C01 System Board Extension PNP0100 System Timer TEREDO Teredo Tunneling Pseudo- Interface LPT PnP Devices: MICROSOFTRAWPORT Printer Port Logical Int erface USB Devices: 1A40 0101 Generic USB Hub 1A40 0101 Generic USB Hub 0000 0000 Unknown Device 1D57 0016 USB Input Device 14CD 6116 USB Mass Storage Device Ports: LPT1 Printer Port (LPT1) ------[ PCI Devices ]------[ ENE Tech. CB1410 CardBus Controller ] Device Properties: Device Description ENE Tech. CB1410 CardBus Controller Bus Type PCI Bus / Device / Function 2 / 6 / 0 Device ID 1524-1410 Subsystem ID 2C00-0000 Device Class 0607 (PCI/CardBus Bridge ) Revision 01 Fast Back-to-Back Transactions Not Supported Device Features: 66 MHz Operation Not Supported Bus Mastering Enabled [ HP PRO/Wireless 2200BG 3B Network Connection ] Device Properties: Device Description HP PRO/Wireless 2200BG 3 B Network Connection Bus Type PCI Bus / Device / Function 2 / 4 / 0 Device ID 8086-4220 Subsystem ID 103C-12F6 Device Class 0280 (Network Controller ) Revision 05 Fast Back-to-Back Transactions Supported, Disabled Device Features: 66 MHz Operation Not Supported Bus Mastering Enabled [ Intel 82801FBM I/O Controller Hub 6 (ICH6-M) [B-1] ] Device Properties: Device Description Intel 82801FBM I/O Contr oller Hub 6 (ICH6-M) [B-1] Bus Type PCI Bus / Device / Function 0 / 30 / 0 Device ID 8086-2448 Subsystem ID 0000-0000 Device Class 0604 (PCI/PCI Bridge) Revision D3 Fast Back-to-Back Transactions Not Supported Device Features: 66 MHz Operation Not Supported Bus Mastering Enabled [ Intel 82801FBM ICH6-M - AC'97 Audio Controller [B-1] ] Device Properties: Device Description Intel 82801FBM ICH6-M - AC'97 Audio Controller [B-1] Bus Type PCI Bus / Device / Function 0 / 30 / 2 Device ID 8086-266E Subsystem ID 103C-30C4 Device Class 0401 (Audio Device) Revision 03 Fast Back-to-Back Transactions Supported, Disabled Device Features: 66 MHz Operation Not Supported Bus Mastering Enabled [ Intel 82801FBM ICH6-M - AC'97 Modem Controller [B-1] ] Device Properties: Device Description Intel 82801FBM ICH6-M - AC'97 Modem Controller [B-1] Bus Type PCI Bus / Device / Function 0 / 30 / 3 Device ID 8086-266D Subsystem ID 103C-30C4 Device Class 0703 (Modem) Revision 03 Fast Back-to-Back Transactions Supported, Disabled Device Features: 66 MHz Operation Not Supported Bus Mastering Disabled [ Intel 82801FBM ICH6-M - ATA-100 IDE Controller [B-1] ] Device Properties: Device Description Intel 82801FBM ICH6-M - ATA-100 IDE Controller [B-1] Bus Type PCI Bus / Device / Function 0 / 31 / 1 Device ID 8086-266F Subsystem ID 103C-30C4 Device Class 0101 (IDE Controller) Revision 03 Fast Back-to-Back Transactions Supported, Disabled Device Features: 66 MHz Operation Not Supported Bus Mastering Enabled [ Intel 82801FBM ICH6-M - Enhanced USB2 Controller [B-1] ] Device Properties: Device Description Intel 82801FBM ICH6-M - Enhanced USB2 Controller [B-1] Bus Type PCI Bus / Device / Function 0 / 29 / 7 Device ID 8086-265C Subsystem ID 103C-30C4 Device Class 0C03 (USB Controller) Revision 03 Fast Back-to-Back Transactions Supported, Disabled Device Features: 66 MHz Operation Not Supported Bus Mastering Enabled [ Intel 82801FBM ICH6-M - LPC Bridge [B-1] ] Device Properties: Device Description Intel 82801FBM ICH6-M - LPC Bridge [B-1] Bus Type PCI Bus / Device / Function 0 / 31 / 0 Device ID 8086-2641 Subsystem ID 103C-30C4 Device Class 0601 (PCI/ISA Bridge) Revision 03 Fast Back-to-Back Transactions Not Supported Device Features: 66 MHz Operation Not Supported Bus Mastering Enabled [ Intel 82801FBM ICH6-M - SMBus Controller [B-1] ] Device Properties: Device Description Intel 82801FBM ICH6-M - SMBus Controller [B-1] Bus Type PCI Bus / Device / Function 0 / 31 / 3 Device ID 8086-266A Subsystem ID 0000-0000 Device Class 0C05 (SMBus Controller) Revision 03 Fast Back-to-Back Transactions Supported, Disabled Device Features: 66 MHz Operation Not Supported Bus Mastering Disabled [ Intel 82801FBM ICH6-M - USB Universal Host Controller [B-1] ] Device Properties: Device Description Intel 82801FBM ICH6-M - USB Universal Host Controller [B-1] Bus Type PCI Bus / Device / Function 0 / 29 / 0 Device ID 8086-2658 Subsystem ID 103C-30C4 Device Class 0C03 (USB Controller) Revision 03 Fast Back-to-Back Transactions Supported, Disabled Device Features: 66 MHz Operation Not Supported Bus Mastering Enabled [ Intel 82915GM Graphics Controller 0 ] Device Properties: Device Description Intel 82915GM Graphics C ontroller 0 Bus Type PCI Bus / Device / Function 0 / 2 / 0 Device ID 8086-2592 Subsystem ID 103C-30C4 Device Class 0300 (VGA Display Contro ller) Revision 03 Fast Back-to-Back Transactions Supported, Disabled Device Features: 66 MHz Operation Not Supported Bus Mastering Enabled [ Intel 82915GM Graphics Controller 1 ] Device Properties: Device Description Intel 82915GM Graphics C ontroller 1 Bus Type PCI Bus / Device / Function 0 / 2 / 1 Device ID 8086-2792 Subsystem ID 103C-30C4 Device Class 0380 (Display Controller ) Revision 03 Fast Back-to-Back Transactions Supported, Disabled Device Features: 66 MHz Operation Not Supported Bus Mastering Enabled [ Intel 82915GM Memory Controller Hub [B-1] ] Device Properties: Device Description Intel 82915GM Memory Con troller Hub [B-1] Bus Type PCI Bus / Device / Function 0 / 0 / 0 Device ID 8086-2590 Subsystem ID 103C-30C4 Device Class 0600 (Host/PCI Bridge) Revision 03 Fast Back-to-Back Transactions Supported, Disabled Device Features: 66 MHz Operation Not Supported Bus Mastering Enabled [ Intel PRO/100 VE Network Connection ] Device Properties: Device Description Intel PRO/100 VE Network Connection Bus Type PCI Bus / Device / Function 2 / 8 / 0 Device ID 8086-1092 Subsystem ID 103C-30C4 Device Class 0200 (Ethernet Controlle r) Revision 03 Fast Back-to-Back Transactions Supported, Disabled Device Features: 66 MHz Operation Not Supported Bus Mastering Enabled

------[ USB Devices ]------[ USB Mass Storage Device (USB 2.0 SATA BRIDGE) ] Device Properties: Device Description USB Mass Storage Device Device ID 14CD-6116 Device Class 08 / 06 (Mass Storage) Device Protocol 50 Manufacturer Super Top Product USB 2.0 SATA BRIDGE Serial Number M6116A016V20 Supported USB Version 2.00 Current Speed High (USB 2.0) [ Generic USB Hub (USB 2.0 Hub [Safe]) ] Device Properties: Device Description Generic USB Hub Device ID 1A40-0101 Device Class 09 / 00 (Full-Speed Hub) Device Protocol 00 Product USB 2.0 Hub [Safe] Supported USB Version 2.00 Current Speed Full (USB 1.1) [ Generic USB Hub ] Device Properties: Device Description Generic USB Hub Device ID 1A40-0101 Device Class 09 / 00 (Full-Speed Hub) Device Protocol 00 Supported USB Version 2.00 Current Speed Full (USB 1.1) [ Unknown Device ] Device Properties: Device Description Unknown Device Device ID 0000-0000 Device Class 00 / 00 Device Protocol 00 Supported USB Version 0.00 Current Speed Low (USB 1.1) [ USB Input Device ] Device Properties: Device Description USB Input Device Device ID 1D57-0016 Device Class 03 / 01 (Human Interface Device) Device Protocol 02 Manufacturer HID Wireless Mouse? Supported USB Version 1.10 Current Speed Full (USB 1.1)

------[ Device Resources ]------DMA 04 Exclusive Direct memory access cont roller IRQ 00 Exclusive System timer IRQ 01 Exclusive Standard PS/2 Keyboard IRQ 08 Exclusive System CMOS/real time clo ck IRQ 100 Exclusive Microsoft ACPI-Compliant System IRQ 101 Exclusive Microsoft ACPI-Compliant System IRQ 102 Exclusive Microsoft ACPI-Compliant System IRQ 103 Exclusive Microsoft ACPI-Compliant System IRQ 104 Exclusive Microsoft ACPI-Compliant System IRQ 105 Exclusive Microsoft ACPI-Compliant System IRQ 106 Exclusive Microsoft ACPI-Compliant System IRQ 107 Exclusive Microsoft ACPI-Compliant System IRQ 108 Exclusive Microsoft ACPI-Compliant System IRQ 109 Exclusive Microsoft ACPI-Compliant System IRQ 110 Exclusive Microsoft ACPI-Compliant System IRQ 111 Exclusive Microsoft ACPI-Compliant System IRQ 112 Exclusive Microsoft ACPI-Compliant System IRQ 113 Exclusive Microsoft ACPI-Compliant System IRQ 114 Exclusive Microsoft ACPI-Compliant System IRQ 115 Exclusive Microsoft ACPI-Compliant System IRQ 116 Exclusive Microsoft ACPI-Compliant System IRQ 117 Exclusive Microsoft ACPI-Compliant System IRQ 118 Exclusive Microsoft ACPI-Compliant System IRQ 119 Exclusive Microsoft ACPI-Compliant System IRQ 12 Exclusive PS/2 Compatible Mouse IRQ 120 Exclusive Microsoft ACPI-Compliant System IRQ 121 Exclusive Microsoft ACPI-Compliant System IRQ 122 Exclusive Microsoft ACPI-Compliant System IRQ 123 Exclusive Microsoft ACPI-Compliant System IRQ 124 Exclusive Microsoft ACPI-Compliant System IRQ 125 Exclusive Microsoft ACPI-Compliant System IRQ 126 Exclusive Microsoft ACPI-Compliant System IRQ 127 Exclusive Microsoft ACPI-Compliant System IRQ 128 Exclusive Microsoft ACPI-Compliant System IRQ 129 Exclusive Microsoft ACPI-Compliant System IRQ 13 Exclusive Numeric data processor IRQ 130 Exclusive Microsoft ACPI-Compliant System IRQ 131 Exclusive Microsoft ACPI-Compliant System IRQ 132 Exclusive Microsoft ACPI-Compliant System IRQ 133 Exclusive Microsoft ACPI-Compliant System IRQ 134 Exclusive Microsoft ACPI-Compliant System IRQ 135 Exclusive Microsoft ACPI-Compliant System IRQ 136 Exclusive Microsoft ACPI-Compliant System IRQ 137 Exclusive Microsoft ACPI-Compliant System IRQ 138 Exclusive Microsoft ACPI-Compliant System IRQ 139 Exclusive Microsoft ACPI-Compliant System IRQ 14 Exclusive ATA Channel 0 IRQ 140 Exclusive Microsoft ACPI-Compliant System IRQ 141 Exclusive Microsoft ACPI-Compliant System IRQ 142 Exclusive Microsoft ACPI-Compliant System IRQ 143 Exclusive Microsoft ACPI-Compliant System IRQ 144 Exclusive Microsoft ACPI-Compliant System IRQ 145 Exclusive Microsoft ACPI-Compliant System IRQ 146 Exclusive Microsoft ACPI-Compliant System IRQ 147 Exclusive Microsoft ACPI-Compliant System IRQ 148 Exclusive Microsoft ACPI-Compliant System IRQ 149 Exclusive Microsoft ACPI-Compliant System IRQ 150 Exclusive Microsoft ACPI-Compliant System IRQ 151 Exclusive Microsoft ACPI-Compliant System IRQ 152 Exclusive Microsoft ACPI-Compliant System IRQ 153 Exclusive Microsoft ACPI-Compliant System IRQ 154 Exclusive Microsoft ACPI-Compliant System IRQ 155 Exclusive Microsoft ACPI-Compliant System IRQ 156 Exclusive Microsoft ACPI-Compliant System IRQ 157 Exclusive Microsoft ACPI-Compliant System IRQ 158 Exclusive Microsoft ACPI-Compliant System IRQ 159 Exclusive Microsoft ACPI-Compliant System IRQ 16 Shared Mobile Intel(R) 915GM/GMS ,910GML Express Chipset Family IRQ 160 Exclusive Microsoft ACPI-Compliant System IRQ 161 Exclusive Microsoft ACPI-Compliant System IRQ 162 Exclusive Microsoft ACPI-Compliant System IRQ 163 Exclusive Microsoft ACPI-Compliant System IRQ 164 Exclusive Microsoft ACPI-Compliant System IRQ 165 Exclusive Microsoft ACPI-Compliant System IRQ 166 Exclusive Microsoft ACPI-Compliant System IRQ 167 Exclusive Microsoft ACPI-Compliant System IRQ 168 Exclusive Microsoft ACPI-Compliant System IRQ 169 Exclusive Microsoft ACPI-Compliant System IRQ 17 Shared Motorola SM56 Data Fax Mo dem IRQ 17 Shared Conexant AC-Link Audio IRQ 170 Exclusive Microsoft ACPI-Compliant System IRQ 171 Exclusive Microsoft ACPI-Compliant System IRQ 172 Exclusive Microsoft ACPI-Compliant System IRQ 173 Exclusive Microsoft ACPI-Compliant System IRQ 174 Exclusive Microsoft ACPI-Compliant System IRQ 175 Exclusive Microsoft ACPI-Compliant System IRQ 176 Exclusive Microsoft ACPI-Compliant System IRQ 177 Exclusive Microsoft ACPI-Compliant System IRQ 178 Exclusive Microsoft ACPI-Compliant System IRQ 179 Exclusive Microsoft ACPI-Compliant System IRQ 18 Shared ENE CB-1410/851 Cardbus C ontroller IRQ 180 Exclusive Microsoft ACPI-Compliant System IRQ 181 Exclusive Microsoft ACPI-Compliant System IRQ 182 Exclusive Microsoft ACPI-Compliant System IRQ 183 Exclusive Microsoft ACPI-Compliant System IRQ 184 Exclusive Microsoft ACPI-Compliant System IRQ 185 Exclusive Microsoft ACPI-Compliant System IRQ 186 Exclusive Microsoft ACPI-Compliant System IRQ 187 Exclusive Microsoft ACPI-Compliant System IRQ 188 Exclusive Microsoft ACPI-Compliant System IRQ 189 Exclusive Microsoft ACPI-Compliant System IRQ 19 Shared Intel(R) 82801FB/FBM USB Universal Host Controller - 2658 IRQ 19 Shared Intel(R) 82801FB/FBM USB2 Enhanced Host Controller - 265C IRQ 190 Exclusive Microsoft ACPI-Compliant System IRQ 20 Shared Intel(R) PRO/100 VE Netwo rk Connection IRQ 21 Shared Intel(R) PRO/Wireless 220 0BG Network Connection IRQ 81 Exclusive Microsoft ACPI-Compliant System IRQ 82 Exclusive Microsoft ACPI-Compliant System IRQ 83 Exclusive Microsoft ACPI-Compliant System IRQ 84 Exclusive Microsoft ACPI-Compliant System IRQ 85 Exclusive Microsoft ACPI-Compliant System IRQ 86 Exclusive Microsoft ACPI-Compliant System IRQ 87 Exclusive Microsoft ACPI-Compliant System IRQ 88 Exclusive Microsoft ACPI-Compliant System IRQ 89 Exclusive Microsoft ACPI-Compliant System IRQ 90 Exclusive Microsoft ACPI-Compliant System IRQ 91 Exclusive Microsoft ACPI-Compliant System IRQ 92 Exclusive Microsoft ACPI-Compliant System IRQ 93 Exclusive Microsoft ACPI-Compliant System IRQ 94 Exclusive Microsoft ACPI-Compliant System IRQ 95 Exclusive Microsoft ACPI-Compliant System IRQ 96 Exclusive Microsoft ACPI-Compliant System IRQ 97 Exclusive Microsoft ACPI-Compliant System IRQ 98 Exclusive Microsoft ACPI-Compliant System IRQ 99 Exclusive Microsoft ACPI-Compliant System Memory 00000000-0009FFFF Exclusive System board Memory 000A0000-000BFFFF Shared PCI bus Memory 000A0000-000BFFFF Shared Mobile Intel(R) 915GM/GMS ,910GML Express Chipset Family Memory 000D0000-000DFFFF Shared PCI bus Memory 000E0000-000FFFFF Exclusive System board Memory 00100000-3F7FFFFF Exclusive System board Memory 3F800000-FEC00FFF Shared PCI bus Memory C0000000-CFFFFFFF Exclusive Mobile Intel(R) 915GM/GMS ,910GML Express Chipset Family Memory D0000000-D0000FFF Exclusive Intel(R) PRO/Wireless 220 0BG Network Connection Memory D0000000-D05FFFFF Exclusive Intel(R) 82801 PCI Bridge - 2448 Memory D0001000-D0001FFF Exclusive ENE CB-1410/851 Cardbus C ontroller Memory D0002000-D0002FFF Exclusive Intel(R) PRO/100 VE Netwo rk Connection Memory D05FE000-D05FEFFF Exclusive ENE CB-1410/851 Cardbus C ontroller Memory D05FF000-D05FFFFF Exclusive ENE CB-1410/851 Cardbus C ontroller Memory D0600000-D067FFFF Exclusive Mobile Intel(R) 915GM/GMS ,910GML Express Chipset Family Memory D0680000-D06BFFFF Exclusive Mobile Intel(R) 915GM/GMS ,910GML Express Chipset Family Memory D0700000-D077FFFF Exclusive Mobile Intel(R) 915GM/GMS ,910GML Express Chipset Family Memory D0780000-D07803FF Exclusive Intel(R) 82801FB/FBM USB2 Enhanced Host Controller - 265C Memory D0781000-D07811FF Exclusive Conexant AC-Link Audio Memory D0782000-D07820FF Exclusive Conexant AC-Link Audio Memory E0000000-EFFFFFFF Exclusive Motherboard resources Memory FEC00000-FEC000FF Exclusive Motherboard resources Memory FEC01000-FEC01FFF Exclusive Motherboard resources Memory FEC02000-FFFFFFFF Shared PCI bus Memory FED20000-FED8FFFF Exclusive Motherboard resources Memory FED90000-FED9AFFF Exclusive Motherboard resources Memory FEDA0000-FEDBFFFF Exclusive Motherboard resources Memory FFB00000-FFBFFFFF Exclusive Motherboard resources Memory FFEFF000-FFEFFFFF Exclusive ENE CB-1410/851 Cardbus C ontroller Memory FFF00000-FFFFFFFF Exclusive Motherboard resources Port 0000-000F Exclusive Direct memory access cont roller Port 0000-0CF7 Shared PCI bus Port 0010-001F Exclusive Motherboard resources Port 0020-0021 Exclusive Programmable interrupt co ntroller Port 0024-003F Exclusive Motherboard resources Port 0040-0043 Exclusive System timer Port 004E-004F Exclusive Motherboard resources Port 0050-0053 Exclusive Motherboard resources Port 0060-0060 Exclusive Standard PS/2 Keyboard Port 0061-0061 Exclusive System speaker Port 0062-0062 Exclusive Microsoft ACPI-Compliant Embedded Controller Port 0063-0063 Exclusive Motherboard resources Port 0064-0064 Exclusive Standard PS/2 Keyboard Port 0065-0065 Exclusive Motherboard resources Port 0066-0066 Exclusive Microsoft ACPI-Compliant Embedded Controller Port 0067-0067 Exclusive Motherboard resources Port 0070-0071 Exclusive System CMOS/real time clo ck Port 0072-0073 Exclusive System CMOS/real time clo ck Port 0074-0077 Exclusive Motherboard resources Port 0080-008F Exclusive Direct memory access cont roller Port 0090-009F Exclusive Motherboard resources Port 00A0-00A1 Exclusive Programmable interrupt co ntroller Port 00A4-00BD Exclusive Motherboard resources Port 00C0-00DF Exclusive Direct memory access cont roller Port 00F0-00FF Exclusive Numeric data processor Port 01F0-01F7 Exclusive ATA Channel 0 Port 0200-0203 Exclusive Motherboard resources Port 0378-037F Exclusive Printer Port (LPT1) Port 03B0-03BB Shared Mobile Intel(R) 915GM/GMS ,910GML Express Chipset Family Port 03C0-03DF Shared Mobile Intel(R) 915GM/GMS ,910GML Express Chipset Family Port 03F6-03F6 Exclusive ATA Channel 0 Port 04D0-04D1 Exclusive Motherboard resources Port 0500-057F Exclusive Motherboard resources Port 0778-077A Exclusive Printer Port (LPT1) Port 0D00-FFFF Shared PCI bus Port 1000-107F Exclusive Motherboard resources Port 1100-113F Exclusive Motherboard resources Port 1200-121F Exclusive Motherboard resources Port 2000-203F Exclusive Intel(R) PRO/100 VE Netwo rk Connection Port 2000-2FFF Exclusive Intel(R) 82801 PCI Bridge - 2448 Port 2C00-2C03 Exclusive ENE CB-1410/851 Cardbus C ontroller Port 3000-3007 Exclusive Mobile Intel(R) 915GM/GMS ,910GML Express Chipset Family Port 3020-303F Exclusive Intel(R) 82801FB/FBM USB Universal Host Controller - 2658 Port 3100-31FF Exclusive Conexant AC-Link Audio Port 3200-323F Exclusive Conexant AC-Link Audio Port 3400-34FF Exclusive Motorola SM56 Data Fax Mo dem Port 3500-357F Exclusive Motorola SM56 Data Fax Mo dem Port 3580-358F Exclusive Intel(R) 82801FB/FBM Ultr a ATA Storage Controllers - 266F

------[ Input ]------[ HID Keyboard Device ] Keyboard Properties: Keyboard Name HID Keyboard Device Keyboard Type IBM enhanced (101- or 10 2-key) keyboard Keyboard Layout US ANSI Code Page 1252 - @%SystemRoot%\sys tem32\mlang.dll,-4612 OEM Code Page 437 Repeat Delay 1 Repeat Rate 31 [ HID-compliant mouse ] Mouse Properties: Mouse Name HID-compliant mouse Mouse Buttons 5 Mouse Hand Right Pointer Speed 1 Double-Click Time 500 msec X/Y Threshold 6 / 10 Wheel Scroll Lines 3 Mouse Features: Active Window Tracking Disabled ClickLock Disabled Hide Pointer While Typing Enabled Mouse Wheel Present Move Pointer To Default Button Disabled Pointer Trails Disabled Sonar Disabled

------[ Printers ]------[ Canon MP250 series Printer (Default) ] Printer Properties: Printer Name Canon MP250 series Print er Default Printer Yes Share Point Not shared Printer Port COM1: Printer Driver Canon MP250 series Print er (v12.06) Device Name Canon MP250 series Print er Print Processor Canon MP250 series Print Processor Separator Page None Availability Always Priority 1 Print Jobs Queued 0 Status Unknown Paper Properties: Paper Size Letter, 8.5 x 11 in Orientation Portrait Print Quality Medium Color Printer Manufacturer: Company Name Canon U.S.A.,Inc. Product Information http://consumer.usa.cano n.com/ir/controller?act=ProductCatIndexAct&fcategoryid=103 Driver Update http://driveragent.com?r ef=59 [ Fax ] Printer Properties: Printer Name Fax Default Printer No Share Point Not shared Printer Port SHRFAX: Printer Driver Microsoft Shared Fax Dri ver (v4.00) Device Name Fax Print Processor winprint Separator Page None Availability 9:00 AM - 9:00 AM Priority 1 Print Jobs Queued 0 Status Unknown Paper Properties: Paper Size Letter, 8.5 x 11 in Orientation Portrait Print Quality 200 x 200 dpi Mono [ Microsoft XPS Document Writer ] Printer Properties: Printer Name Microsoft XPS Document W riter Default Printer No Share Point Not shared Printer Port XPSPort: Printer Driver Microsoft XPS Document W riter (v6.00) Device Name Microsoft XPS Document W riter Print Processor winprint Separator Page None Availability Always Priority 1 Print Jobs Queued 0 Status Unknown Paper Properties: Paper Size Letter, 8.5 x 11 in Orientation Portrait Print Quality 600 x 600 dpi Color [ Universal Document Converter ] Printer Properties: Printer Name Universal Document Conve rter Default Printer No Share Point UDC Printer Port UDC Printer Driver Universal Document Conve rter (v5.03) Device Name Comment www.print-driver.com Location UDC Output Files Print Processor winprint Separator Page None Availability Always Priority 1 Print Jobs Queued 0 Status Unknown Paper Properties: Paper Size A4, 210 x 297 mm Orientation Portrait Print Quality 300 x 300 dpi Color

------[ Auto Start ]------IDMan Registry\User\Run C:\Program Files \Internet Download Manager\IDMan.exe /onboot

------[ Scheduled ]------[ AutoKMS ] Task Properties: Task Name AutoKMS Status Enabled Application Name C:\Windows\AutoKMS\AutoK MS.exe Application Parameters Working Folder Comment Account Name Creator SYSTEM Last Run Unknown Next Run 8/20/2013 5:47:00 PM Task Triggers: Trigger #1 At 5:47 PM every day, st arting 8/19/2013 Trigger #2 Run at system startup [ DLL-files.com Fixer_UPDATES ] Task Properties: Task Name DLL-files.com Fixer_UPDA TES Status Not scheduled Application Name C:\Program Files\Dll-Fil es.com Fixer\DLLFixer.exe Application Parameters -updatecheck Working Folder Comment Account Name emovhicRN\Vic Tiangco Creator Vic Tiangco Last Run Unknown Next Run 8/21/2013 3:02:00 PM Task Triggers: Trigger #1 At 3:02 PM every Wed of every week, starting 8/19/2013

------[ Installed Programs ]------µTorrent 3.3.1.29756 Unknown Acoustica Mixcraft 6 b213 Unknown Adobe Flash Player 11 Plugin 11.8.800.115 Unknown Canon Inkjet Printer/Scanner/Fax Extended Survey Program Unknown Canon MP Navigator EX 3.0 Unknown Canon MP250 series MP Drivers Unknown Canon Utilities My Printer Unknown Canon Utilities Solution Menu Unknown CCleaner 4.00 Unknown Conexant AC-Link Audio Unknown Cool Edit Pro 2.1 Unknown DAEMON Tools Pro 5.3.0.0359 Unknown Dll-Files.com Fixer wersja 2.7.72.2024 2.7.72.2024 Unknown EVEREST Ultimate Edition v5.01 5.01 Unknown ffdshow [rev 3154] [2009-12-09] 1.0 Unknown FormatFactory 2.96 2.96 Unknown Foxit Reader 5.3.1.606 Unknown Game Booster 3 3.5 Unknown Globe Broadband 11.300.05.18.158 Unknown Google Chrome 26.0.1410.43 Unknown Intel(R) Graphics Media Accelerator Driver Unknown Internet Download Manager Unknown Java 7 Update 25 7.0.250 Unknown Java Auto Updater 2.1.9.5 Unknown Microsoft .NET Framework 4.5 4.5.50709 Unknown Microsoft .NET Framework 4.5 4.5.50709 Unknown Microsoft Office Access MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office Access Setup Metadata MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office Excel MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office Groove MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office InfoPath MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office OneNote MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office Outlook MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office PowerPoint MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office Professional Plus 2010 14.0.4734.1000 Unknown Microsoft Office Professional Plus 2010 14.0.4734.1000 Unknown Microsoft Office Proof (English) 2010 14.0.4734.1000 Unknown Microsoft Office Proof (French) 2010 [french (france)] 14.0.4734.1000 Unknown Microsoft Office Proof (Spanish) 2010 [spanish (spain, international sort)] 14.0.4734.1000 Unknown Microsoft Office Proofing (English) 2010 14.0.4734.1000 Unknown Microsoft Office Publisher MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office Shared MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office Shared Setup Metadata MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office Word MUI (English) 2010 14.0.4734.1000 Unknown 5.1.20125.0 Unknown Microsoft Visual C++ 2005 Redistributable 8.0.59193 Unknown Motorola SM56 Data Fax Modem 6.12.25.04 Unknown Mouse and Keyboard Recorder 3.1.9.2 Unknown Mozilla Firefox 20.0 (x86 en-US) 20.0 Unknown Nero Burning ROM 10 10.2.11000.12.100 Unknown Nero Burning ROM 10 10.5.10300 Unknown Nero Control Center 10 10.2.10600.0.6 Unknown Nero Core Components 10 2.0.17400.8.2 Unknown Notepad++ 6.3.1 Unknown Photodex Presenter Unknown ProShow Producer Unknown Skype 5.10 5.10.116 Unknown TeamViewer 8 8.0.17396 Unknown Universal Document Converter Server Edition 5.3 Unknown USB Vibration Joystick 2007.08.17 Unknown VLC media player 2.0.7 2.0.7 Unknown WinRAR archiver Unknown

------[ Licenses ]------Microsoft Internet Explorer 8.0.7601.17514 MHFP T-8C8M2-V9488-FGM44-2C9T3 Microsoft Windows 7 Ultimate MHFP T-8C8M2-V9488-FGM44-2C9T3

------[ File Types ]------386 Virtual Device Driver

3G2 VLC media file (.3g2) video/3gpp2 3GA VLC media file (.3ga)

3GP VLC media file (.3gp) video/3gpp 3GP2 VLC media file (.3gp2) video/3gpp2 3GPP VLC media file (.3gpp) video/3gpp 669 VLC media file (.669)

7Z WinRAR archive

A52 VLC media file (.a52)

AAC VLC media file (.aac) audio/vnd.dlna.adts AC3 VLC media file (.ac3)

ACE WinRAR archive

ACL AutoCorrect List File

ADT VLC media file (.adt) audio/vnd.dlna.adts ADTS VLC media file (.adts) audio/vnd.dlna.adts AIF VLC media file (.aif) audio/aiff AIFC VLC media file (.aifc) audio/aiff AIFF VLC media file (.aiff) audio/aiff AMR VLC media file (.amr)

AMV VLC media file (.amv)

ANI Animated Cursor

AOB VLC media file (.aob)

APE VLC media file (.ape)

APPLICATION Application Manifest application/x-ms-application APPREF-MS Application Reference

ARJ WinRAR archive

ASA ASA File

ASF VLC media file (.asf) video/x-ms-asf ASP ASP File

ASX VLC media file (.asx) video/x-ms-asf AU VLC media file (.au) audio/basic AVI VLC media file (.avi) video/avi AW Answer Wizard File

B4S VLC media file (.b4s)

B5T B5T File

B6T B6T File

BAT Windows Batch File

BIN VLC media file (.bin)

BLG Performance Monitor File

BMP Bitmap Image image/bmp BWT BWT File

BZ WinRAR archive

BZ2 WinRAR archive

C2R C2R File

CAB WinRAR archive

CAF VLC media file (.caf)

CAMP WCS Viewing Condition Profile

CAT Security Catalog application/vnd.ms-pki.seccat CCD CCD File

CDA VLC media file (.cda)

CDI CDI File

CDMP WCS Device Profile

CDX CDX File

CEL Cool Edit Pro loop file

CER Security Certificate application/x-x509-ca-cert CHESSTITANSSAVE-MS .ChessTitansSave-ms

CHK Recovered File Fragments

CHM Compiled HTML Help file

CMD Windows Command Script

COM MS-DOS Application

COMFYCAKESSAVE-MS .ComfyCakesSave-ms

COMPOSITEFONT Composite Font File

CONTACT Contact File text/x-ms-contact CPL Control Panel Item

CRD Information Card

CRDS Information Card Store

CRL Certificate Revocation List application/pkix-crl CRT Security Certificate application/x-x509-ca-cert CRTX Microsoft Office Chart Template

CSS Cascading Style Sheet Document text/css CSV Microsoft Excel Comma Separated Values File application/vnd.ms-excel CUE Image Files

CUR Cursor

DB Data Base File

DBL 64 bit Doubles file

DER Security Certificate application/x-x509-ca-cert DESKLINK Desktop Shortcut

DIAGCAB Diagnostic Cabinet

DIAGCFG Diagnostic Configuration

DIAGPKG Diagnostic Document

DIB Bitmap Image image/bmp DIC Text Document

DIVX VLC media file (.divx)

DLL Application Extension application/x-msdownload DOC 97 - 2003 Document application/msword DOCHTML Microsoft Word HTML Document

DOCM Microsoft Word Macro-Enabled Document application/vnd.ms-word.document.macroEnabled.12 DOCMHTML DOCMHTML File

DOCX Microsoft Word Document application/vnd.openxmlformats-officedocument.wordprocessingml.document DOCXML Microsoft Word XML Document

DOT Microsoft Word 97 - 2003 Template application/msword DOTHTML Microsoft Word HTML Template

DOTM Microsoft Word Macro-Enabled Template application/vnd.ms-word.template.macroEnabled.12 DOTX Microsoft Word Template application/vnd.openxmlformats-officedocument.wordprocessingml.template DQY Microsoft Excel ODBC Query files

DRC VLC media file (.drc)

DRV Device Driver

DSN Microsoft OLE DB Provider for ODBC Drivers

DTS VLC media file (.dts)

DV VLC media file (.dv)

DVR Microsoft Recorded TV Show

DVR-MS Microsoft Recorded TV Show

DWD DiamondWare Digitized file

DWFX XPS Document model/vnd.dwfx+xps EASMX XPS Document model/vnd.easmx+xps EDRWX XPS Document model/vnd.edrwx+xps ELM Microsoft Office Themes File

EMF EMF File

EPRTX XPS Document model/vnd.eprtx+xps EVT EVT File

EVTX EVTX File

EXC Text Document

EXE Application application/x-msdownload F4V VLC media file (.f4v)

FDF Foxit Reader FDF Document application/vnd.fdf FLAC VLC media file (.flac)

FLV VLC media file (.flv)

FON Font file

FREECELLSAVE-MS .FreeCellSave-ms

GADGET Windows Gadget

GCSX Microsoft Office SmartArt Graphic Color Variation

GIF GIF Image image/gif GLOX Microsoft Office SmartArt Graphic Layout

GMMP WCS Gamut Mapping Profile

GQSX Microsoft Office SmartArt Graphic Quick Style

GROUP Contact Group File text/x-ms-group GRP Microsoft Program Group

GXF VLC media file (.gxf)

GZ WinRAR archive

H1C Windows Help Collection Definition File

H1D Windows Help Validator File

H1F Windows Help Include File

H1H Windows Help Merged Hierarchy

H1K Windows Help Index File

H1Q Windows Help Merged Query Index

H1S Compiled Windows Help file

H1T Windows Help Table of Contents File

H1V Windows Help Virtual Topic Definition File

H1W Windows Help Merged Keyword Index

HEARTSSAVE-MS .HeartsSave-ms

HLP Help File

HTA HTML Application application/hta HTM HTML Document text/ HTML HTML Document text/html HXA Microsoft Help Attribute Definition File application/xml HXC Microsoft Help Collection Definition File application/xml HXD Microsoft Help Validator File application/octet-stream HXE Microsoft Help Samples Definition File application/xml HXF Microsoft Help Include File application/xml HXH Microsoft Help Merged Hierarchy File application/octet-stream HXI Microsoft Help Compiled Index File application/octet-stream HXK Microsoft Help Index File application/xml HXQ Microsoft Help Merged Query Index File application/octet-stream HXR Microsoft Help Merged Attribute Index File application/octet-stream HXS Microsoft Help Compiled Storage File application/octet-stream HXT Microsoft Help Table of Contents File application/xml HXV Microsoft Help Virtual Topic Definition File application/xml HXW Microsoft Help Attribute Definition File application/octet-stream ICC ICC Profile

ICL Icon Library

ICM ICC Profile

ICO Icon image/x-icon IFF Amiga audio file

IFO VLC media file (.ifo)

IMG Image Files

INF Setup Information

INI Configuration Settings

IQY Microsoft Excel Web Query File text/x-ms-iqy ISO Image Files

ISZ ISZ File

IT VLC media file (.it)

JAR Executable Jar File

JFIF JPEG Image image/jpeg JNLP JNLP File application/x-java-jnlp-file JNT Journal Document

JOB Task Scheduler Task Object

JOD Microsoft.Jet.OLEDB.4.0

JPE JPEG Image image/jpeg JPEG JPEG Image image/jpeg JPG JPEG Image image/jpeg JS JScript Script File

JSE JScript Encoded File

JTP Journal Template

JTX XPS Document application/x-jtx+xps LABEL Property List

LEX Dictionary File

LHA WinRAR archive

LIBRARY-MS Library Folder application/windows-library+xml LNK Shortcut

LOG Text Document

LZH WinRAR archive

M1V VLC media file (.m1v) video/mpeg M2T VLC media file (.m2t) video/vnd.dlna.mpeg-tts M2TS VLC media file (.m2ts) video/vnd.dlna.mpeg-tts M2V VLC media file (.m2v) video/mpeg M3U VLC media file (.m3u) audio/x-mpegurl M3U8 VLC media file (.m3u8)

M4A VLC media file (.m4a) audio/mp4 M4P VLC media file (.m4p)

M4V VLC media file (.m4v) video/mp4 MAHJONGTITANSSAVE-MS .MahjongTitansSave-ms

MAPIMAIL Mail Service

MCL MCL File

MDF MDF File

MDS MDS File

MDX MDX File

MHT MHTML Document message/rfc822 MHTML MHTML Document message/rfc822 MID VLC media file (.mid) audio/mid MIDI MIDI Sequence audio/mid MIG Migration Store

MINESWEEPERSAVE-MS .MinesweeperSave-ms

MKA VLC media file (.mka)

MKV VLC media file (.mkv)

MLC Language Pack File_

MLP VLC media file (.mlp)

MOD VLC media file (.mod) video/mpeg MOV VLC media file (.mov) video/quicktime MP1 VLC media file (.mp1)

MP2 VLC media file (.mp2) audio/mpeg MP2V VLC media file (.mp2v) video/mpeg MP3 VLC media file (.mp3) audio/mpeg MP4 VLC media file (.mp4) video/mp4 MP4V VLC media file (.mp4v) video/mp4 MPA VLC media file (.mpa) video/mpeg MPC VLC media file (.mpc)

MPE VLC media file (.mpe) video/mpeg MPEG VLC media file (.mpeg) video/mpeg MPEG1 VLC media file (.mpeg1)

MPEG2 VLC media file (.mpeg2)

MPEG4 VLC media file (.mpeg4)

MPG VLC media file (.mpg) video/mpeg MPV2 VLC media file (.mpv2) video/mpeg MSC Microsoft Common Console Document

MSDVD MSDVD File

MSI Windows Installer Package

MSP Windows Installer Patch

MSRCINCIDENT Windows Remote Assistance Invitation

MSSTYLES Windows Visual Style File

MSU Microsoft Update Standalone Package

MTS VLC media file (.mts) video/vnd.dlna.mpeg-tts MTV VLC media file (.mtv)

MX6 Mixcraft 6 Project file

MX6TEMPLATE Mixcraft 6 Project file

MXF VLC media file (.mxf)

MYDOCS MyDocs Drop Target

NBS CD-ROM (SecurDisc) Compilation

NBV BDMV Compilation

NCP Check Point Compilation

NDS DiscSpan Compilation

NEROSERIAL Nero Serial Number

NFO MSInfo Configuration File

NHB AVCHD(TM) BD Compilation

NHD AVCHD(TM) DVD Compilation

NRA Audio CD Compilation

NRB CD-ROM (Boot) Compilation

NRC CD-ROM (UDF/ISO) Compilation

NRD DVD-Video Compilation

NRE CD EXTRA Compilation

NRG Disc Image

NRI CD-ROM (ISO) Compilation

NRM Mixed Mode CD Compilation

NRU CD-ROM (UDF) Compilation

NSV VLC media file (.nsv)

NUV VLC media file (.nuv)

OCX ActiveX control

ODC Microsoft Office Data Connection text/x-ms-odc ODCCUBEFILE ODCCUBEFILE File

ODCDATABASEFILE ODCDATABASEFILE File

ODCNEWFILE ODCNEWFILE File

ODCTABLEFILE ODCTABLEFILE File

ODP OpenDocument Presentation application/vnd.oasis.opendocument.presentation ODS OpenDocument Spreadsheet application/vnd.oasis.opendocument.spreadsheet ODT OpenDocument Text application/vnd.oasis.opendocument.text OGA VLC media file (.oga)

OGG VLC media file (.ogg)

OGM VLC media file (.ogm)

OGV VLC media file (.ogv)

OGX VLC media file (.ogx)

OMA VLC media file (.oma)

OPC Microsoft Clean-up Wizard File

OPUS VLC media file (.opus)

OQY Microsoft Excel OLAP Query File

OSDX OpenSearch Description File application/opensearchdescription+xml OTF OpenType Font file

P10 Certificate Request application/pkcs10 P12 Personal Information Exchange application/x-pkcs12 P7B PKCS #7 Certificates application/x-pkcs7-certificates P7C Digital ID File application/pkcs7-mime P7M PKCS #7 MIME Message application/pkcs7-mime P7R Certificate Request Response application/x-pkcs7-certreqresp P7S PKCS #7 Signature application/pkcs7-signature PBK Dial-Up Phonebook

PCB PCB File

PCM Raw PCM file

PDF Foxit Reader PDF Document application/pdf PERFMONCFG Performance Monitor Configuration

PFM Type 1 Font file

PFX Personal Information Exchange application/x-pkcs12 PIF Shortcut to MS-DOS Program

PKO Public Key Security Object application/vnd.ms-pki.pko PLS VLC media file (.pls)

PNF Precompiled Setup Information

PNG PNG Image image/png POT Microsoft PowerPoint 97-2003 Template application/vnd.ms-powerpoint POTHTML Microsoft PowerPoint HTML Template

POTM Microsoft PowerPoint Macro-Enabled Design Template application/vnd.ms-powerpoint.template.macroEnabled.12 POTX Microsoft PowerPoint Template application/vnd.openxmlformats-officedocument.presentationml.template PPA Microsoft PowerPoint 97-2003 Addin application/vnd.ms-powerpoint PPAM Microsoft PowerPoint Addin application/vnd.ms-powerpoint.addin.macroEnabled.12 PPR ProShow Project

PPS Microsoft PowerPoint 97-2003 Slide Show application/vnd.ms-powerpoint PPSM Microsoft PowerPoint Macro-Enabled Slide Show application/vnd.ms-powerpoint.slideshow.macroEnabled.12 PPSX Microsoft PowerPoint Slide Show application/vnd.openxmlformats-officedocument.presentationml.slideshow PPT Microsoft PowerPoint 97-2003 Presentation application/vnd.ms-powerpoint PPTHTML Microsoft PowerPoint HTML Document

PPTM Microsoft PowerPoint Macro-Enabled Presentation application/vnd.ms-powerpoint.presentation.macroEnabled.12 PPTMHTML PPTMHTML File

PPTX Microsoft PowerPoint Presentation application/vnd.openxmlformats-officedocument.presentationml.presentation PPTXML Microsoft PowerPoint XML Presentation

PRF PICS Rules File application/pics-rules PRINTEREXPORT Printer Migration File

PS1 PS1 File

PS1XML PS1XML File

PSC1 PSC1 File application/PowerShell PSD1 PSD1 File

PSH ProShow Slideshow

PSM1 PSM1 File

PURBLEPAIRSSAVE-MS .PurblePairsSave-ms

PURBLESHOPSAVE-MS .PurbleShopSave-ms

PWZ Microsoft PowerPoint Wizard application/vnd.ms-powerpoint PX Photodex Presenter Show

PXS ProShow Slide Style

PXT ProShow Transition

PXW ProShow Web Archive

QCP VLC media file (.qcp)

QDS Directory Query

R00 WinRAR archive

R01 WinRAR archive

R02 WinRAR archive

R03 WinRAR archive

R04 WinRAR archive

R05 WinRAR archive

R06 WinRAR archive

R07 WinRAR archive

R08 WinRAR archive

R09 WinRAR archive

R10 WinRAR archive

R11 WinRAR archive

R12 WinRAR archive

R13 WinRAR archive

R14 WinRAR archive

R15 WinRAR archive

R16 WinRAR archive

R17 WinRAR archive

R18 WinRAR archive

R19 WinRAR archive

R20 WinRAR archive

R21 WinRAR archive

R22 WinRAR archive

R23 WinRAR archive

R24 WinRAR archive

R25 WinRAR archive

R26 WinRAR archive

R27 WinRAR archive

R28 WinRAR archive

R29 WinRAR archive

RAM VLC media file (.ram)

RAR WinRAR archive

RAT Rating System File application/rat-file RDP Remote Desktop Connection

REC VLC media file (.rec)

REG Registration Entries

RELS XML Document

RESMONCFG Resource Monitor Configuration

REV RAR recovery volume

RLE RLE File

RLL Application Extension

RM VLC media file (.rm)

RMI VLC media file (.rmi) audio/mid RMVB VLC media file (.rmvb)

RQY Microsoft Excel OLE DB Query files text/x-ms-rqy RSMK Robot Soft Mouse and Keyboard Record File

RSMR Robot Soft Mouse Record File

RTF Rich Text Format application/msword S3M VLC media file (.s3m)

SAM 8 bit signed file

SCF Windows Explorer Command

SCP Text Document

SCR Screen saver

SCT Windows Script Component text/scriptlet SDP VLC media file (.sdp)

SEARCHCONNECTOR-MS Search Connector Folder application/windows-search-connector+xml SEARCH-MS Saved Search

SES Cool Edit Pro session file

SFCACHE ReadyBoost Cache File

SHTML SHTML File text/html SKYPE Skype Content application/x-skype SLDM Microsoft PowerPoint Macro-Enabled Slide application/vnd.ms-powerpoint.slide.macroEnabled.12 SLDX Microsoft PowerPoint Slide application/vnd.openxmlformats-officedocument.presentationml.slide SLK Microsoft Excel SLK Data Import Format application/vnd.ms-excel SLUPKG-MS XrML Digital License Package application/x-ms-license SMP SampleVision file

SND VLC media file (.snd) audio/basic SOLITAIRESAVE-MS .SolitaireSave-ms

SPC PKCS #7 Certificates application/x-pkcs7-certificates SPIDERSOLITAIRESAVE-MS .SpiderSolitaireSave-ms

SPX VLC media file (.spx)

SST Microsoft Serialized Certificate Store application/vnd.ms-pki.certstore STL Certificate Trust List application/vnd.ms-pki.stl SVX Amiga audio file

SYS System file

TAR WinRAR archive

TAZ WinRAR archive

TBZ WinRAR archive

TBZ2 WinRAR archive

TGZ WinRAR archive

THEME Windows Theme File

THEMEPACK Windows Theme Pack

THMX Microsoft Office Theme application/vnd.ms-officetheme TIF TIF File image/tiff TIFF TIFF File image/tiff TOD VLC media file (.tod)

TS VLC media file (.ts) video/vnd.dlna.mpeg-tts TTA VLC media file (.tta)

TTC TrueType Collection Font file

TTF TrueType Font file

TTS VLC media file (.tts) video/vnd.dlna.mpeg-tts TVC TVC File

TVS TVS File

TXT Text Document text/plain UDL Microsoft Data Link

URL URL File

UU WinRAR archive

UUE WinRAR archive

UXDC UXDC File

VBE VBScript Encoded File

VBS VBScript Script File

VCF vCard File text/x-vcard VLC VLC media file (.vlc)

VOB VLC media file (.vob)

VOC VLC media file (.voc)

VOX Dialogic VOX file

VQF VLC media file (.vqf)

VRO VLC media file (.vro)

VXD Virtual Device Driver

W64 VLC media file (.w64)

WAB Address Book File

WAV VLC media file (.wav) audio/wav WAX Windows Media Audio shortcut audio/x-ms-wax WBCAT Windows Backup Catalog File

WBK Microsoft Word Backup Document application/msword WCX Workspace Configuration File

WDP Windows Media Photo image/vnd.ms-photo WEBPNP Web Point And Print File

WIZ Microsoft Word Wizard application/msword WLL WLL File

WM Windows Media Audio/Video file video/x-ms-wm WMA VLC media file (.wma) audio/x-ms-wma WMD Windows Media Player Download Package application/x-ms-wmd WMDB Windows Media Library

WMF WMF File

WMS Windows Media Player Skin File

WMV VLC media file (.wmv) video/x-ms-wmv WMX Windows Media Audio/Video playlist video/x-ms-wmx WMZ Windows Media Player Skin Package application/x-ms-wmz WPL Windows Media playlist application/vnd.ms-wpl WSC Windows Script Component text/scriptlet WSF Windows Script File

WSH Windows Script Host Settings File

WTV Windows Recorded TV Show

WTX Text Document

WV VLC media file (.wv)

WVX Windows Media Audio/Video playlist video/x-ms-wvx XA VLC media file (.xa)

XAML Windows Markup File application/xaml+xml XBAP XAML Browser Application application/x-ms-xbap XEVGENXML XEVGENXML File

XHT XHT File application/xhtml+xml XHTML XHTML File application/xhtml+xml XLA Microsoft Excel Add-In application/vnd.ms-excel XLAM Microsoft Excel Add-In application/vnd.ms-excel.addin.macroEnabled.12 XLD Microsoft Excel 5.0 DialogSheet application/vnd.ms-excel XLK Microsoft Excel Backup File application/vnd.ms-excel XLL Microsoft Excel XLL Add-In application/vnd.ms-excel XLM Microsoft Excel 4.0 Macro application/vnd.ms-excel XLS Microsoft Excel 97-2003 Worksheet application/vnd.ms-excel XLSB Microsoft Excel Binary Worksheet application/vnd.ms-excel.sheet.binary.macroEnabled.12 XLSHTML Microsoft Excel HTML Document

XLSM Microsoft Excel Macro-Enabled Worksheet application/vnd.ms-excel.sheet.macroEnabled.12 XLSMHTML XLSMHTML File

XLSX Microsoft Excel Worksheet application/vnd.openxmlformats-officedocument.spreadsheetml.sheet XLT Microsoft Excel Template application/vnd.ms-excel XLTHTML Microsoft Excel HTML Template

XLTM Microsoft Excel Macro-Enabled Template application/vnd.ms-excel.template.macroEnabled.12 XLTX Microsoft Excel Template application/vnd.openxmlformats-officedocument.spreadsheetml.template XLW Microsoft Excel Workspace application/vnd.ms-excel XLXML Microsoft Excel XML Worksheet

XM VLC media file (.xm)

XML XML Document text/xml XPS XPS Document application/vnd.ms-xpsdocument XRM-MS XrML Digital License text/xml XSL XSL Stylesheet text/xml XSPF VLC media file (.xspf)

XXE WinRAR archive

Z WinRAR archive

ZFSENDTOTARGET Compressed (zipped) Folder SendTo Target

ZIP WinRAR ZIP archive

------[ Sidebar Gadgets ]------[ Calendar ] Gadget Properties: Name Calendar Description Browse the days of the c alendar. Version 1.1.0.0 Author Microsoft Corporation Copyright © 2009 URL http://go.microsoft.com/ fwlink/?LinkId=124093 Folder ProgramFiles XML Calendar.Gadget\en-US\ga dget.xml [ Clock ] Gadget Properties: Name Clock Description Watch the clock in your own time zone or any city in the world. Version 1.0.0.0 Author Microsoft Corporation Copyright © 2009 URL http://go.microsoft.com/ fwlink/?LinkId=124093 Folder ProgramFiles XML Clock.Gadget\en-US\gadge t.xml [ CPU Meter ] Gadget Properties: Name CPU Meter Description See the current computer CPU and system memory (RAM). Version 1.0.0.0 Author Microsoft Corporation Copyright © 2009 URL http://go.microsoft.com/ fwlink/?LinkId=124093 Folder ProgramFiles XML CPU.Gadget\en-US\gadget. xml [ Currency ] Gadget Properties: Name Currency Description Convert from one currenc y to another. Version 1.0.0.0 Author Microsoft Corporation Copyright © 2009 URL http://go.microsoft.com/ fwlink/?LinkId=124093 Folder ProgramFiles XML Currency.Gadget\en-US\ga dget.xml [ DAEMON Tools ] Gadget Properties: Name DAEMON Tools Description Use main DAEMON Tools Pr o features faster and easier. Version 1.0.1.0 Author DAEMON Tools Gadget Copyright Copyright © 2009-2010 URL http://www.disc-soft.com /products/dtproAdv Folder LocalAppData XML DT.gadget\gadget.xml [ Feed Headlines ] Gadget Properties: Name Feed Headlines Description Track the latest news, s ports, and entertainment headlines. Version 1.1.0.0 Author Microsoft Corporation Copyright © 2009 URL http://go.microsoft.com/ fwlink/?LinkId=124093 Folder ProgramFiles XML RSSFeeds.Gadget\en-US\ga dget.xml [ Picture Puzzle ] Gadget Properties: Name Picture Puzzle Description Move the pieces of the p uzzle and try to put them in order. Version 1.0.0.0 Author Microsoft Corporation Copyright © 2009 URL http://go.microsoft.com/ fwlink/?LinkId=124093 Folder ProgramFiles XML PicturePuzzle.Gadget\en- US\gadget.xml [ Slide Show ] Gadget Properties: Name Slide Show Description Show a continuous slide show of your pictures. Version 1.0.0.0 Author Microsoft Corporation Copyright © 2009 URL http://go.microsoft.com/ fwlink/?LinkId=124093 Folder ProgramFiles XML SlideShow.Gadget\en-US\g adget.xml [ Weather ] Gadget Properties: Name Weather Description See what the weather loo ks like around the world. Version 1.1.0.0 Author Microsoft Corporation Copyright © 2009 URL http://go.microsoft.com/ fwlink/?LinkId=124093 Folder ProgramFiles XML Weather.Gadget\en-US\gad get.xml [ Windows Media Center ] Gadget Properties: Name Windows Media Center Description Play your latest TV reco rdings, new Internet TV clips, and favorite music and pictures. Version 1.0.0.0 Author Microsoft Corporation Copyright © 2009 URL http://go.microsoft.com/ fwlink/?LinkId=124093 Folder ProgramFiles XML MediaCenter.Gadget\en-US \gadget.xml

------[ Windows Security ]------Operating System Properties: OS Name Microsoft Windows 7 Ulti mate OS Service Pack Service Pack 1 Winlogon Shell explorer.exe User Account Control (UAC) Disabled System Restore Enabled Data Execution Prevention (DEP, NX, EDB): Supported by Operating System Yes Supported by CPU Yes Active (To Protect Applications) Yes Active (To Protect Drivers) Yes

------[ Windows Update ]------(Automatic Update) Disabled Definition Update for Windows Defender - KB915597 (Definition 1.155.2386.0) Update 8/19/2013

------[ Firewall ]------Windows Firewall 6.1.7600.16385 Enabled

------[ Anti-Spyware ]------Microsoft Windows Defender 6.1.7600.16385(win7_rtm.090713-125 5)

------[ Regional ]------Time Zone: Current Time Zone Taipei Standard Time Current Time Zone Description (UTC+08:00) Taipei Change To Standard Time Change To Daylight Saving Time Language: Language Name (Native) English Language Name (English) English Language Name (ISO 639) en Country/Region: Country Name (Native) United States Country Name (English) United States Country Name (ISO 3166) US Country Code 1 Currency: Currency Name (Native) US Dollar Currency Name (English) US Dollar Currency Symbol (Native) $ Currency Symbol (ISO 4217) USD Currency Format $123,456,789.00 Negative Currency Format ($123,456,789.00) Formatting: Time Format h:mm:ss tt Short Date Format M/d/yyyy Long Date Format dddd, MMMM dd, yyyy Number Format 123,456,789.00 Negative Number Format -123,456,789.00 List Format first, second, third Native Digits 0123456789 Days of Week: Native Name for Monday Monday / Mon Native Name for Tuesday Tuesday / Tue Native Name for Wednesday Wednesday / Wed Native Name for Thursday Thursday / Thu Native Name for Friday Friday / Fri Native Name for Saturday Saturday / Sat Native Name for Sunday Sunday / Sun Months: Native Name for January January / Jan Native Name for February February / Feb Native Name for March March / Mar Native Name for April April / Apr Native Name for May May / May Native Name for June June / Jun Native Name for July July / Jul Native Name for August August / Aug Native Name for September September / Sep Native Name for October October / Oct Native Name for November November / Nov Native Name for December December / Dec Miscellaneous: Calendar Type Gregorian (localized) Default Paper Size US Letter Measurement System U.S. ------[ Environment ]------__APPCOMPAT_MANIFEST __COMPAT_LAYER VistaSetup ALLUSERSPROFILE C:\ProgramData APPDATA C:\Users\Vic Tiangco\AppData\Roaming CommonProgramFiles C:\Program Files\Common Files COMPUTERNAME EMOVHICRN ComSpec C:\Windows\system32\cmd.exe FP_NO_HOST_CHECK NO HOMEDRIVE C: HOMEPATH \Users\Vic Tiangco LOCALAPPDATA C:\Users\Vic Tiangco\AppData\Local LOGONSERVER \\EMOVHICRN MOZ_PLUGIN_PATH C:\Program Files\Foxit Software\Foxit Reader\plugi ns\ NUMBER_OF_PROCESSORS 1 OS Windows_NT Path C:\Windows\system32;C:\Windows;C:\Windows\System32 \Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ PATHEXT .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;. MSC PROCESSOR_ARCHITECTURE x86 PROCESSOR_IDENTIFIER x86 Family 6 Model 13 Stepping 8, GenuineIntel PROCESSOR_LEVEL 6 PROCESSOR_REVISION 0d08 ProgramData C:\ProgramData ProgramFiles C:\Program Files PSModulePath C:\Windows\system32\WindowsPowerShell\v1.0\Modules \ PUBLIC C:\Users\Public SESSIONNAME Console SystemDrive C: SystemRoot C:\Windows TEMP C:\Users\VICTIA~1\AppData\Local\Temp TMP C:\Users\VICTIA~1\AppData\Local\Temp USERDOMAIN emovhicRN USERNAME Vic Tiangco USERPROFILE C:\Users\Vic Tiangco windir C:\Windows windows_tracing_flags 3 windows_tracing_logfile C:\BVTBin\Tests\installpackage\csilogfile.log

------[ Control Panel ]------Action Center Review recent messages and resolve problems with your computer. Administrative Tools Configure administrative settings for your computer. AutoPlay Change default settings for CDs, D VDs, and devices so that you can automatically play music, view pictures, instal l software, and play games. Backup and Restore Backup and restore your files and system. Monitor latest backup status and configuration. BitLocker Drive Encryption Protect your computer using BitLoc ker Drive Encryption. Change advanced color management s ettings for displays, scanners, and printers. Credential Manager Manage your Windows Credentials. Date and Time Set the date, time, and time zone for your computer. Default Programs Choose which programs you want Win dows to use for activities like web browsing, editing photos, sending e-mail, an d playing music. Desktop Gadgets View the desktop gadgets installed on your computer. Device Manager View and update your hardware's se ttings and driver software. Devices and Printers View and manage devices, printers, and print jobs Display Change your display settings and m ake it easier to read what's on your screen. Ease of Access Center Make your computer easier to use. Flash Player Manage Flash Player Settings Folder Options Customize the display of files and folders. Fonts Add, change, and manage fonts on y our computer. Getting Started Learn about Windows features and s tart using them. HomeGroup View HomeGroup settings, choose sh aring options, and view or change the password. Indexing Options Change how Windows indexes items f or faster searching Internet Options Configure your Internet display an d connection settings. Java Java Control Panel Keyboard Customize your keyboard settings, such as the cursor blink rate and the character repeat rate. Location and Other Sensors Configure your sensor settings. Mouse Customize your mouse settings, suc h as the button configuration, double-click speed, mouse pointers, and motion sp eed. Network and Sharing Center Check network status, change netwo rk settings and set preferences for sharing files and printers. Notification Area Icons Select which icons and notificatio ns appear in the notification area. Parental Controls Change Parental Controls settings. Performance Information and Tools Get information about your compute r's speed and performance. If solutions to performance problems are available, W indows lets you know. Personalization Change the pictures, colors, and s ounds for this computer. Phone and Modem Configure your telephone dialing r ules and modem settings. Power Options Conserve energy or maximize perfor mance by choosing how your computer manages power. Programs and Features Uninstall or change programs on yo ur computer. Recovery Restore your system to an earlier time without affecting your files, or replace everything on your computer and re install Windows. Region and Language Customize settings for the display of languages, numbers, times, and dates. RemoteApp and Desktop Connections Manage your RemoteApp and Desktop Connections Sound Configure your audio devices or ch ange the sound scheme for your computer. Speech Recognition Configure how speech recognition w orks on your computer. Sync Center Sync files between your computer a nd network folders System View information about your comput er, and change settings for hardware, performance, and remote connections. Taskbar and Start Menu Customize the Start Menu and the t askbar, such as the types of items to be displayed and how they should appear. Troubleshooting Troubleshoot and fix common comput er problems. User Accounts Change user account settings and p asswords for people who share this computer. Windows CardSpace Manage Information Cards used to l og on and register with websites and online services. Windows Defender Protection against spyware and pot entially unwanted software Windows Firewall Set firewall security options to h elp protect your computer from hackers and malicious software. Windows Mobility Center Adjust display brightness, volume, power options, and other commonly used mobile PC settings. Windows Update Check for software and driver upda tes, choose automatic updating settings, or view installed updates.

------[ Recycle Bin ]------C: 0 0 ? ? D: 0 0 ? ? G: 0 0 ? ?

------[ System Files ]------[ autoexec.bat ] REM Dummy file for NTVDM [ config.sys ] FILES=40 [ autoexec.nt ] @echo off

REM AUTOEXEC.BAT is not used to initialize the MS-DOS environment. REM AUTOEXEC.NT is used to initialize the MS-DOS environment unless a REM different startup file is specified in an application's PIF.

REM Install CD ROM extensions lh %SystemRoot%\system32\mscdexnt.exe

REM Install network redirector (load before dosx.exe) lh %SystemRoot%\system32\redir

REM Install DPMI support lh %SystemRoot%\system32\dosx

REM The following line enables 2.0 support on NTVDM. REM The command for setting the BLASTER environment is as follows: REM SET BLASTER=A220 I5 D1 P330 REM where: REM A specifies the sound blaster's base I/O port REM I specifies the interrupt request line REM D specifies the 8-bit DMA channel REM P specifies the MPU-401 base I/O port REM T specifies the type of sound blaster card REM 1 - Sound Blaster 1.5 REM 2 - Sound Blaster Pro I REM 3 - Sound Blaster 2.0 REM 4 - Sound Blaster Pro II REM 6 - SOund Blaster 16/AWE 32/32/64 REM REM The default value is A220 I5 D1 T3 and P330. If any of the switches is REM left unspecified, the default value will be used. (NOTE, since all th e REM ports are virtualized, the information provided here does not have to REM match the real hardware setting.) NTVDM supports Sound Blaster 2.0 o nly. REM The T switch must be set to 3, if specified. SET BLASTER=A220 I5 D1 P330 T3

REM To disable the sound blaster 2.0 support on NTVDM, specify an invalid REM SB base I/O port address. For example: REM SET BLASTER=A0 [ config.nt ] REM Windows MS-DOS Startup File REM REM CONFIG.SYS vs CONFIG.NT REM CONFIG.SYS is not used to initialize the MS-DOS environment. REM CONFIG.NT is used to initialize the MS-DOS environment unless a REM different startup file is specified in an application's PIF. REM REM ECHOCONFIG REM By default, no information is displayed when the MS-DOS environment REM is initialized. To display CONFIG.NT/AUTOEXEC.NT information, add REM the command echoconfig to CONFIG.NT or other startup file. REM REM NTCMDPROMPT REM When you return to the command prompt from a TSR or while running an REM MS-DOS-based application, Windows runs COMMAND.COM. This allows the REM TSR to remain active. To run CMD.EXE, the Windows command prompt, REM rather than COMMAND.COM, add the command ntcmdprompt to CONFIG.NT or REM other startup file. REM REM DOSONLY REM By default, you can start any type of application when running REM COMMAND.COM. If you start an application other than an MS-DOS-based REM application, any running TSR may be disrupted. To ensure that only REM MS-DOS-based applications can be started, add the command dosonly to REM CONFIG.NT or other startup file. REM REM EMM REM You can use EMM command line to configure EMM(Expanded Memory Manager). REM The syntax is: REM REM EMM = [A=AltRegSets] [B=BaseSegment] [RAM] REM REM AltRegSets REM specifies the total Alternative Mapping Register Sets you REM want the system to support. 1 <= AltRegSets <= 255. The REM default value is 8. REM BaseSegment REM specifies the starting segment address in the Dos conventional REM memory you want the system to allocate for EMM page frames. REM The value must be given in Hexdecimal. REM 0x1000 <= BaseSegment <= 0x4000. The value is rounded down to REM 16KB boundary. The default value is 0x4000 REM RAM REM specifies that the system should only allocate 64Kb address REM space from the Upper Memory Block(UMB) area for EMM page frames REM and leave the rests(if available) to be used by DOS to support REM loadhigh and devicehigh commands. The system, by default, would REM allocate all possible and available UMB for page frames. REM REM The EMM size is determined by pif file(either the one associated REM with your application or _default.pif). If the size from PIF file REM is zero, EMM will be disabled and the EMM line will be ignored. REM dos=high, umb device=%SystemRoot%\system32\himem.sys files=40 [ system.ini ] ; for 16-bit app support [386Enh] woafont=dosapp.fon EGA80WOA.FON=EGA80WOA.FON EGA40WOA.FON=EGA40WOA.FON CGA80WOA.FON=CGA80WOA.FON CGA40WOA.FON=CGA40WOA.FON

[drivers] wave=mmdrv.dll timer=timer.drv

[mci] [network] Bios=1438834079 SSID=1438834079 [ win.ini ] ; for 16-bit app support [fonts] [extensions] [mci extensions] [files] [Mail] MAPI=1 [MCI Extensions.BAK] 3g2=MPEGVideo 3gp=MPEGVideo 3gp2=MPEGVideo 3gpp=MPEGVideo aac=MPEGVideo adt=MPEGVideo adts=MPEGVideo m2t=MPEGVideo m2ts=MPEGVideo m2v=MPEGVideo m4a=MPEGVideo m4v=MPEGVideo mod=MPEGVideo mov=MPEGVideo mp4=MPEGVideo mp4v=MPEGVideo mts=MPEGVideo ts=MPEGVideo tts=MPEGVideo [Internet] URLID=1426241622 inet=1426241622 [ hosts ]

[ lmhosts.sam ]

------[ System Folders ]------Administrative Tools C:\Users\Vic Tiangco\AppData\Roaming\Microsoft\ Windows\Start Menu\Programs\Administrative Tools AppData C:\Users\Vic Tiangco\AppData\Roaming Cache C:\Users\Vic Tiangco\AppData\Local\Microsoft\Wi ndows\ CD Burning C:\Users\Vic Tiangco\AppData\Local\Microsoft\Wi ndows\Burn\Burn Common Administrative Tools C:\ProgramData\Microsoft\Windows\Start Menu\Pro grams\Administrative Tools Common AppData C:\ProgramData Common Desktop C:\Users\Public\Desktop Common Documents C:\Users\Public\Documents Common Favorites C:\Users\Vic Tiangco\Favorites Common Files C:\Program Files\Common Files Common Music C:\Users\Public\Music Common Pictures C:\Users\Public\Pictures Common Programs C:\ProgramData\Microsoft\Windows\Start Menu\Pro grams Common Start Menu C:\ProgramData\Microsoft\Windows\Start Menu Common Startup C:\ProgramData\Microsoft\Windows\Start Menu\Pro grams\Startup Common Templates C:\ProgramData\Microsoft\Windows\Templates Common Video C:\Users\Public\Videos Cookies C:\Users\Vic Tiangco\AppData\Roaming\Microsoft\ Windows\Cookies Desktop C:\Users\Vic Tiangco\Desktop Device C:\Windows\inf Favorites C:\Users\Vic Tiangco\Favorites Fonts C:\Windows\Fonts History C:\Users\Vic Tiangco\AppData\Local\Microsoft\Wi ndows\History Local AppData C:\Users\Vic Tiangco\AppData\Local My Documents C:\Users\Vic Tiangco\Documents My Music C:\Users\Vic Tiangco\Music My Pictures C:\Users\Vic Tiangco\Pictures My Video C:\Users\Vic Tiangco\Videos NetHood C:\Users\Vic Tiangco\AppData\Roaming\Microsoft\ Windows\Network Shortcuts PrintHood C:\Users\Vic Tiangco\AppData\Roaming\Microsoft\ Windows\Printer Shortcuts Profile C:\Users\Vic Tiangco Program Files C:\Program Files Programs C:\Users\Vic Tiangco\AppData\Roaming\Microsoft\ Windows\Start Menu\Programs Recent C:\Users\Vic Tiangco\AppData\Roaming\Microsoft\ Windows\Recent Resources C:\Windows\resources SendTo C:\Users\Vic Tiangco\AppData\Roaming\Microsoft\ Windows\SendTo Start Menu C:\Users\Vic Tiangco\AppData\Roaming\Microsoft\ Windows\Start Menu Startup C:\Users\Vic Tiangco\AppData\Roaming\Microsoft\ Windows\Start Menu\Programs\Startup System C:\Windows\system32 Temp C:\Users\VICTIA~1\AppData\Local\Temp\ Templates C:\Users\Vic Tiangco\AppData\Roaming\Microsoft\ Windows\Templates Windows C:\Windows

------[ Event Logs ]------Application Information None 2013-08-19 14:02:20 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0xC 004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x0 0000000, 0, 1], [(?)( 5 0x00000000 30 43200)( 1 0x00000000 0 0 msft:rm/algorithm /flags/1.0 0x00000000 0)(?)(?)(?)])] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157- b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7 : ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)( ?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F01 4, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5 , 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2- 40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28db c8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 14:02:20 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0xC 004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x0 0000000, 0, 1], [(?)( 5 0x00000000 30 43200)( 1 0x00000000 0 0 msft:rm/algorithm /flags/1.0 0x00000000 0)(?)(?)(?)])] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157- b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7 : ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)( ?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F01 4, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5 , 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2- 40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28db c8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information 1 2013-08-19 14:02:21 Windows Search Service 1010: The Windows Search Servic e has successfully removed the old search index. Application Information 1 2013-08-19 14:02:21 Windows Search Service 1004: The Windows Search servic e is creating the new search index {Reason: Full Index Reset}. Application Warning 1 2013-08-19 14:02:21 Windows Search Service 1008: The Windows Search Servic e is starting up and attempting to remove the old search index {Reason: Full Ind ex Reset}. Application Information None 2013-08-19 14:02:26 Software Protection Platform Service 1004: The Software Protec tion service has successfully installed the license. License Title=OEM Certific ate License Id=ed176cc3-8c60-4186-9ee9-f36716afbc7b Application Information None 2013-08-19 14:03:01 Software Protection Platform Service 1016: Proof of Purchase i nstalled successfully. ACID=7cfd4696-69a9-4af7-af36-ff3d12b6b6c8 PKeyId=9fe34 5b3-d1b9-9d2d-f76d-069544c771e4 Application Information None 2013-08-19 14:03:02 Software Protection Platform Service 1033: These policies are being excluded since they are only defined with override-only attribute. Policy Names=(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet -Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicen sing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs- clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA) App Id=55c927 34-d682-4d71-983e-d6ec3f16059f Sku Id=7cfd4696-69a9-4af7-af36-ff3d12b6b6c8 Application Information None 2013-08-19 14:03:02 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0xC 004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x0 0000000, 0, 1], [(?)( 5 0x00000000 30 43200)( 1 0x00000000 0 0 msft:rm/algorithm /flags/1.0 0x00000000 0)(?)(?)(?)])] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157- b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7 : ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)( ?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F01 4, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5 , 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2- 40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28db c8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information 1 2013-08-19 14:03:04 ESENT 102: Windows (2420) Windows: Th e database engine (6.01.7601.0000) started a new instance (0). Application Information 1 2013-08-19 14:03:16 Windows Search Service 1005: The Windows Search Servic e has successfully created the new search index. Application Information 1 2013-08-19 14:03:16 Windows Search Service 1003: The Windows Search Servic e started. Application Information None 2013-08-19 14:03:18 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 14:03:18 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Information None 2013-08-19 14:03:19 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information None 2013-08-19 14:03:26 Desktop Window Manager 9007: The Desktop Window Manage r was unable to start because WDDM is not in use Application Information None 2013-08-19 14:03:28 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information None 2013-08-19 14:03:28 Desktop Window Manager 9007: The Desktop Window Manage r was unable to start because WDDM is not in use Application Information None 2013-08-19 14:03:30 Desktop Window Manager 9009: The Desktop Window Manage r has exited with code (0x40010004) Application Information None 2013-08-19 14:03:30 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Warning None 2013-08-19 14:03:30 Wlclntfy 6001: The winlogon notification subscriber failed a notification event. Application Warning None 2013-08-19 14:03:30 SYSTEM Microsoft-Windows-User Profiles Service 1530: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 1 user registry handles leaked from \Registry\User\S-1-5-21-2415673615-2399998967-532945099-1000: Proces s 380 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \RE GISTRY\USER\S-1-5-21-2415673615-2399998967-532945099-1000 Application Information None 2013-08-19 14:03:32 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 14:04:27 EventSystem Application Information None 2013-08-19 14:04:27 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 14:04:37 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 14:04:37 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Information None 2013-08-19 14:04:40 WinMgmt Application Information None 2013-08-19 14:04:43 Desktop Window Manager 9007: The Desktop Window Manage r was unable to start because WDDM is not in use Application Information None 2013-08-19 14:04:52 WinMgmt Application Information 1 2013-08-19 14:04:54 ESENT 102: WinMail (1728) WindowsMail 0: The database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 14:04:56 ESENT 210: WinMail (1728) WindowsMail 0: A full backup is starting. Application Information 3 2013-08-19 14:04:56 ESENT 220: WinMail (1728) WindowsMail 0: Beginning the backup of the file C:\Users\Vic Tiangco\AppData\Local\Microsoft \Windows Mail\WindowsMail.MSMessageStore (size 2 Mb). Application Information 3 2013-08-19 14:04:57 ESENT 221: WinMail (1728) WindowsMail 0: Ending the backup of the file C:\Users\Vic Tiangco\AppData\Local\Microsoft\Wi ndows Mail\WindowsMail.MSMessageStore. Application Information 3 2013-08-19 14:04:57 ESENT 223: WinMail (1728) WindowsMail 0: Starting the backup of log files (range C:\Users\Vic Tiangco\AppData\Local\Mi crosoft\Windows Mail\edb00001.log - C:\Users\Vic Tiangco\AppData\Local\Microsoft \Windows Mail\edb00001.log). Application Information 3 2013-08-19 14:04:57 ESENT 225: WinMail (1728) WindowsMail 0: No log files can be truncated. Application Information 3 2013-08-19 14:04:57 ESENT 213: WinMail (1728) WindowsMail 0: The backup procedure has been successfully completed. Application Information 1 2013-08-19 14:05:02 ESENT 103: WinMail (1728) WindowsMail 0: The database engine stopped the instance (0). Application Information 1 2013-08-19 14:05:10 ESENT 102: Windows (2024) Windows: Th e database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 14:05:10 ESENT 300: Windows (2024) Windows: Th e database engine is initiating recovery steps. Application Information 3 2013-08-19 14:05:10 ESENT 301: Windows (2024) Windows: Th e database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Da ta\Applications\Windows\MSS.log. Application Information 1 2013-08-19 14:05:11 Windows Search Service 1003: The Windows Search Servic e started. Application Information 3 2013-08-19 14:05:11 ESENT 302: Windows (2024) Windows: Th e database engine has successfully completed recovery steps. Application Error None 2013-08-19 14:05:53 WinMgmt Application Information None 2013-08-19 14:06:49 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 14:06:52 SecurityCenter 1: The Windows Security Center Service has started. Application Information None 2013-08-19 14:06:52 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 14:06:54 Software Protection Platform Service 1033: These policies are being excluded since they are only defined with override-only attribute. Policy Names=(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet -Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicen sing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs- clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA) App Id=55c927 34-d682-4d71-983e-d6ec3f16059f Sku Id=7cfd4696-69a9-4af7-af36-ff3d12b6b6c8 Application Information None 2013-08-19 14:06:54 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 14:06:54 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information None 2013-08-19 14:07:01 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: BDATunePIA Application Information None 2013-08-19 14:07:01 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehCIR Application Information None 2013-08-19 14:07:01 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiProxy Application Information None 2013-08-19 14:07:15 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehExtHost Application Information None 2013-08-19 14:07:16 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter

Application Information None 2013-08-19 14:07:16 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. UI Application Information None 2013-08-19 14:07:16 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiUserXp Application Information None 2013-08-19 14:07:17 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehRecObj Application Information None 2013-08-19 14:07:17 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: mcepg Application Information None 2013-08-19 14:07:17 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: mcstore Application Information None 2013-08-19 14:07:17 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: mcstoredb Application Information None 2013-08-19 14:07:18 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiVidCtl Application Information None 2013-08-19 14:07:18 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiExtens Application Information None 2013-08-19 14:07:18 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiActivScp Application Information None 2013-08-19 14:07:18 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiBmlDataCarousel Application Information None 2013-08-19 14:07:18 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiiTv Application Information None 2013-08-19 14:07:21 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiTVMSMusic Application Information None 2013-08-19 14:07:21 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. iTv.Hosting Application Information None 2013-08-19 14:07:21 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiUPnP Application Information None 2013-08-19 14:07:21 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiwmp Application Information None 2013-08-19 14:07:21 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiWUapi Application Information None 2013-08-19 14:07:23 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. Shell Application Information None 2013-08-19 14:07:23 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. Interop Application Information None 2013-08-19 14:07:23 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. ITVVM Application Information None 2013-08-19 14:07:24 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. Playback Application Information None 2013-08-19 14:07:24 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. TV.Tuners.Interop Application Information None 2013-08-19 14:07:24 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. Sports Application Information None 2013-08-19 14:07:25 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehshell Application Information None 2013-08-19 14:07:25 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Mcx2Dvcs Application Information None 2013-08-19 14:07:25 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. iTv Application Information None 2013-08-19 14:07:26 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. iTv.Media Application Information None 2013-08-19 14:07:26 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: LoadMxf Application Information None 2013-08-19 14:07:28 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: MCESidebarCtrl Application Information None 2013-08-19 14:07:29 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: mcGlidHostObj Application Information None 2013-08-19 14:07:29 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: mcplayerinterop Application Information None 2013-08-19 14:07:30 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: mcupdate Application Information None 2013-08-19 14:07:31 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.ApplicationI d.Framework Application Information None 2013-08-19 14:07:32 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.ApplicationI d.RuleWizard Application Information None 2013-08-19 14:07:32 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.Security.App licationId.PolicyManagement.PolicyModel Application Information None 2013-08-19 14:07:32 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.Security.App licationId.PolicyManagement.XmlHelper Application Information None 2013-08-19 14:07:32 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.Security.App licationId.PolicyManagement.PolicyManager Application Information None 2013-08-19 14:07:32 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.Security.App licationId.PolicyManagement.PolicyEngineApi.Interop Application Information None 2013-08-19 14:07:32 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.GroupPolicy. AdmTmplEditor Application Information None 2013-08-19 14:07:33 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.GroupPolicy. Interop Application Information None 2013-08-19 14:07:35 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.GroupPolicy. Reporting Application Information None 2013-08-19 14:07:35 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: SecurityAuditPoliciesS napIn Application Information None 2013-08-19 14:07:36 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. Bml Application Information None 2013-08-19 14:07:38 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. Mheg Application Information None 2013-08-19 14:07:40 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.Security.App licationId.Wizards.AutomaticRuleGenerationWizard Application Information None 2013-08-19 14:07:44 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: SrpUxSnapIn Application Information None 2013-08-19 14:07:57 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information None 2013-08-19 14:10:20 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 14:10:21 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 14:12:45 Software Protection Platform Service 903: The Software Protect ion service has stopped. Application Information None 2013-08-19 14:14:03 Desktop Window Manager 9009: The Desktop Window Manage r has exited with code (0x40010004) Application Information None 2013-08-19 14:14:03 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Information None 2013-08-19 14:14:04 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 14:14:46 EventSystem Application Information None 2013-08-19 14:14:46 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 14:14:51 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 14:14:51 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Information None 2013-08-19 14:14:51 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information None 2013-08-19 14:14:52 WinMgmt Application Information None 2013-08-19 14:14:57 WinMgmt Application Information 1 2013-08-19 14:15:05 ESENT 102: Windows (100) Windows: The database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 14:15:05 ESENT 300: Windows (100) Windows: The database engine is initiating recovery steps. Application Information 3 2013-08-19 14:15:05 ESENT 301: Windows (100) Windows: The database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Dat a\Applications\Windows\MSS00001.log. Application Information 1 2013-08-19 14:15:06 Windows Search Service 1003: The Windows Search Servic e started. Application Information 3 2013-08-19 14:15:06 ESENT 301: Windows (100) Windows: The database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Dat a\Applications\Windows\MSS00002.log. Application Information 3 2013-08-19 14:15:06 ESENT 301: Windows (100) Windows: The database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Dat a\Applications\Windows\MSS.log. Application Information 3 2013-08-19 14:15:06 ESENT 302: Windows (100) Windows: The database engine has successfully completed recovery steps. Application Error None 2013-08-19 14:16:29 WinMgmt Application Information None 2013-08-19 14:16:29 Microsoft-Windows-CAPI2 4097: Successful auto update of third-party root certificate:: Subject: Sha1 thum bprint: . Application Information None 2013-08-19 14:18:17 EventSystem Application Information None 2013-08-19 14:18:17 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 14:18:21 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 14:18:21 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Information None 2013-08-19 14:18:21 WinMgmt Application Information None 2013-08-19 14:18:23 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information None 2013-08-19 14:18:23 WinMgmt Application Information 1 2013-08-19 14:18:33 ESENT 102: Windows (2024) Windows: Th e database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 14:18:33 ESENT 300: Windows (2024) Windows: Th e database engine is initiating recovery steps. Application Information 3 2013-08-19 14:18:33 ESENT 301: Windows (2024) Windows: Th e database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Da ta\Applications\Windows\MSS.log. Application Information 3 2013-08-19 14:18:33 ESENT 302: Windows (2024) Windows: Th e database engine has successfully completed recovery steps. Application Information 1 2013-08-19 14:18:34 Windows Search Service 1003: The Windows Search Servic e started. Application Information None 2013-08-19 14:18:35 WinMgmt Application Warning 3 2013-08-19 14:18:37 Windows Search Service 3036: The content source cannot be accessed. Context: Application, SystemIndex Catalog Details: The URL was already processed duri ng this update. If you received this message while processing alerts, then the a lerts are redundant, or else Modify should be used instead of Add. (HRESULT : 0 x80040d0d) (0x80040d0d) Application Information None 2013-08-19 14:19:45 Microsoft-Windows-CAPI2 4097: Successful auto update of third-party root certificate:: Subject: Sha1 thum bprint: . Application Error None 2013-08-19 14:20:01 WinMgmt Application Information None 2013-08-19 14:20:26 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 14:20:27 SecurityCenter 1: The Windows Security Center Service has started. Application Information None 2013-08-19 14:20:28 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 14:20:28 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 14:20:28 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information None 2013-08-19 14:22:28 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PnPRequestAdditionalSoftware Response: Not available Cab Id: 0 Pr oblem signature: P1: x86 P2: HID\HPQ0006&Col01 P3: 6.1.1.0 P4: 0409 P5: inp ut.inf P6: * P7: P8: P9: P10: Attached files: These files may be available here: C:\Users\Vic Tiangco\AppData\Local\Microsoft\Windows\WER\Report Queue\NonCritical_x86_c4d9ca529790a52d1ea67dc1742ddcdbba7c98b2_cab_0a101430 A nalysis symbol: Rechecking for solution: 0 Report Id: b7cb3d9b-0897-11e3-8e24 -0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 14:23:39 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 14:23:40 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 14:24:32 Desktop Window Manager 9009: The Desktop Window Manage r has exited with code (0x40010004) Application Information None 2013-08-19 14:24:32 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Information None 2013-08-19 14:24:34 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 14:25:18 EventSystem Application Information None 2013-08-19 14:25:18 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 14:25:23 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 14:25:23 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Information None 2013-08-19 14:25:24 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information None 2013-08-19 14:25:24 WinMgmt Application Information None 2013-08-19 14:25:29 WinMgmt Application Information 1 2013-08-19 14:25:32 ESENT 102: Windows (272) Windows: The database engine (6.01.7601.0000) started a new instance (0). Application Information 1 2013-08-19 14:25:33 Windows Search Service 1003: The Windows Search Servic e started. Application Information 3 2013-08-19 14:25:33 ESENT 300: Windows (272) Windows: The database engine is initiating recovery steps. Application Information 3 2013-08-19 14:25:33 ESENT 301: Windows (272) Windows: The database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Dat a\Applications\Windows\MSS.log. Application Information 3 2013-08-19 14:25:33 ESENT 302: Windows (272) Windows: The database engine has successfully completed recovery steps. Application Information None 2013-08-19 14:26:21 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PCA2 Response: Not available Cab Id: 0 Problem signature: P1: mo bile-intel-915gm-express-chipset-driver-windows-7-sp34749.exe P2: 4.0.100.1189 P3: unknown P4: 915GM Video Driver for Vista P5: HP P6: 200 P7: -1 P8: P 9: P10: Attached files: C:\Users\Vic Tiangco\AppData\Local\Temp\{867df382 -66b2-4796-88c6-810d61a33bb3}\appcompat.txt C:\Users\Vic Tiangco\AppData\Local\ Temp\Tab48EB.tmp These files may be available here: Analysis symbol: R echecking for solution: 0 Report Id: 431676e6-0898-11e3-89d7-0016d4bcce11 Repo rt Status: 0 Application Information None 2013-08-19 14:26:21 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PCA2 Response: Not available Cab Id: 0 Problem signature: P1: mo bile-intel-915gm-express-chipset-driver-windows-7-sp34749.exe P2: 4.0.100.1189 P3: unknown P4: 915GM Video Driver for Vista P5: HP P6: 200 P7: -1 P8: P 9: P10: Attached files: C:\Users\Vic Tiangco\AppData\Local\Temp\{867df382 -66b2-4796-88c6-810d61a33bb3}\appcompat.txt C:\Users\Vic Tiangco\AppData\Local\ Temp\Tab48EB.tmp These files may be available here: C:\Users\Vic Tiangco\App Data\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_mobile-intel-915_56896f 3a343323e7b74eb4969c8b7d4eeda8a_cab_07f149f4 Analysis symbol: Rechecking fo r solution: 0 Report Id: 431676e6-0898-11e3-89d7-0016d4bcce11 Report Status: 6

Application Error None 2013-08-19 14:26:58 WinMgmt Application Information None 2013-08-19 14:27:27 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 14:27:28 SecurityCenter 1: The Windows Security Center Service has started. Application Information None 2013-08-19 14:27:30 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 14:27:30 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 14:27:30 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information None 2013-08-19 14:28:18 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PCA2 Response: Not available Cab Id: 0 Problem signature: P1: sp 33906.exe P2: 4.0.100.1189 P3: unknown P4: Conexant CX20468-31 AC97 Audio Dri ver P5: Hewlett-Packard P6: 200 P7: -1 P8: P9: P10: Attached files: C:\Users\Vic Tiangco\AppData\Local\Temp\{7f197887-68eb-4530-aeaf-75a79c129112}\ appcompat.txt C:\Users\Vic Tiangco\AppData\Local\Temp\Tab1109.tmp These file s may be available here: Analysis symbol: Rechecking for solution: 0 Rep ort Id: 88ad19c6-0898-11e3-89d7-0016d4bcce11 Report Status: 0 Application Information None 2013-08-19 14:28:18 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PCA2 Response: Not available Cab Id: 0 Problem signature: P1: sp 33906.exe P2: 4.0.100.1189 P3: unknown P4: Conexant CX20468-31 AC97 Audio Dri ver P5: Hewlett-Packard P6: 200 P7: -1 P8: P9: P10: Attached files: C:\Users\Vic Tiangco\AppData\Local\Temp\{7f197887-68eb-4530-aeaf-75a79c129112}\ appcompat.txt C:\Users\Vic Tiangco\AppData\Local\Temp\Tab1109.tmp These file s may be available here: C:\Users\Vic Tiangco\AppData\Local\Microsoft\Windows\W ER\ReportQueue\NonCritical_sp33906.exe_697397fe5e3327b75a42aa3427f3ec0159969d_ca b_07bf1222 Analysis symbol: Rechecking for solution: 0 Report Id: 88ad19c6 -0898-11e3-89d7-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 14:29:35 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 14:29:36 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 14:29:46 Desktop Window Manager 9009: The Desktop Window Manage r has exited with code (0x40010004) Application Information None 2013-08-19 14:29:46 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Information None 2013-08-19 14:29:48 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 14:30:41 EventSystem Application Information None 2013-08-19 14:30:41 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 14:30:42 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 14:30:42 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Information None 2013-08-19 14:30:42 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information None 2013-08-19 14:30:45 WinMgmt Application Information None 2013-08-19 14:30:49 WinMgmt Application Information 1 2013-08-19 14:30:51 ESENT 102: Windows (1084) Windows: Th e database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 14:30:51 ESENT 300: Windows (1084) Windows: Th e database engine is initiating recovery steps. Application Information 3 2013-08-19 14:30:51 ESENT 301: Windows (1084) Windows: Th e database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Da ta\Applications\Windows\MSS.log. Application Information 1 2013-08-19 14:30:52 Windows Search Service 1003: The Windows Search Servic e started. Application Information 3 2013-08-19 14:30:52 ESENT 302: Windows (1084) Windows: Th e database engine has successfully completed recovery steps. Application Information None 2013-08-19 14:32:05 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 14:32:05 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Error None 2013-08-19 14:32:10 WinMgmt Application Information None 2013-08-19 14:32:47 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 14:32:48 SecurityCenter 1: The Windows Security Center Service has started. Application Information None 2013-08-19 14:32:50 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 14:32:50 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 14:32:50 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Error None 2013-08-19 14:34:17 VSS 8194: Volume Shadow Copy Servic e error: Unexpected error querying for the IVssWriterCallback interface. hr = 0 x80070005, Access is denied. . This is often caused by incorrect security sett ings in either the writer or requestor process. Operation: Gathering Write r Data Context: Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220} W riter Name: System Writer Writer Instance ID: {8ae223f3-fb78-478a-87a8-539733 7c0b0b} Application Information None 2013-08-19 14:34:34 System Restore 8194: Successfully created rest ore point (Process = C:\Users\Vic Tiangco\AppData\Local\Temp\7ZipSfx.000\DXSETUP .exe Tiangco\AppData\Local\Temp\7ZipSfx.000\DXSETUP.exe" /SILENT; Description = Installed DirectX). Application Information None 2013-08-19 14:35:09 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 14:35:09 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 14:36:01 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PCA2 Response: Not available Cab Id: 0 Problem signature: P1: ir setup.exe P2: 0.0.0.0 P3: irsetup.exe P4: unknown P5: unknown P6: 1 P7: 20 0 P8: P9: P10: Attached files: These files may be available here: C :\Users\Vic Tiangco\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_ irsetup.exe_6c1da901735d7bbb7ec4a5edcff4aafaa60a1b1_cab_062d5d98 Analysis sym bol: Rechecking for solution: 0 Report Id: 9d013bf4-0899-11e3-be51-0016d4bcce 11 Report Status: 6 Application Information None 2013-08-19 14:37:44 VSS 8224: The VSS service is shutti ng down due to idle timeout. Application Information None 2013-08-19 14:37:50 Software Protection Platform Service 903: The Software Protect ion service has stopped. Application Information None 2013-08-19 14:45:55 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: MpTelemetry Response: Not available Cab Id: 0 Problem signature: P1: 8024001f P2: EndSearch P3: Search P4: 6.1.7601.17514 P5: MpSigDwn.dll P6: 6.1.7600.16385 P7: Windows Defender P8: P9: P10: Attached files: C:\Windows\Temp\MPTelemetrySubmit\client_manifest.txt These files may be avai lable here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_802400 1f_73aea48bd74c52b523f34668a59a345e9e5b5_cab_0f466ca0 Analysis symbol: Rech ecking for solution: 0 Report Id: fede75a1-089a-11e3-be51-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 14:46:00 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: WindowsUpdateFailure Response: Not available Cab Id: 0 Problem si gnature: P1: 7.5.7601.17514 P2: 8024001f P3: 00000000-0000-0000-0000-00000000 0000 P4: Scan P5: 101 P6: Unmanaged P7: P8: P9: P10: Attached file s: These files may be available here: Analysis symbol: Rechecking for solution: 0 Report Id: 01c65351-089b-11e3-be51-0016d4bcce11 Report Status: 0 Application Information None 2013-08-19 14:46:00 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: WindowsUpdateFailure Response: Not available Cab Id: 0 Problem si gnature: P1: 7.5.7601.17514 P2: 8024001f P3: 00000000-0000-0000-0000-00000000 0000 P4: Scan P5: 101 P6: Unmanaged P7: P8: P9: P10: Attached file s: These files may be available here: C:\ProgramData\Microsoft\Windows\WER\R eportQueue\NonCritical_7.5.7601.17514_78efc842cf92e79bab1c4f2fb5bd805f263a65_cab _049281be Analysis symbol: Rechecking for solution: 0 Report Id: 01c65351- 089b-11e3-be51-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 14:46:36 IJPLMSVC 1: The service is started. Application Information None 2013-08-19 14:49:23 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PCA2 Response: Not available Cab Id: 0 Problem signature: P1: CE P2REG.EXE P2: 2.0.0.0 P3: Cool Edit Pro 2.0 Registration P4: H??GD P5: Syntr illium Software Corporation P6: 1 P7: 200 P8: P9: P10: Attached files : C:\Users\Vic Tiangco\AppData\Local\Temp\{0a4692a2-5770-4d22-990c-ee22bc0c7e75 }\appcompat.txt These files may be available here: C:\Users\Vic Tiangco\AppD ata\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_CEP2REG.EXE_af3716dd3444 5e2cf5e85ee4072808c84264f37_cab_063998b3 Analysis symbol: Rechecking for so lution: 0 Report Id: 7abef634-089b-11e3-be51-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 14:50:56 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: MpTelemetry Response: Not available Cab Id: 0 Problem signature: P1: 8024001f P2: EndSearch P3: Search P4: 6.1.7601.17514 P5: MpSigDwn.dll P6: 6.1.7600.16385 P7: Windows Defender P8: P9: P10: Attached files: These files may be available here: C:\ProgramData\Microsoft\Windows\WER\Repor tQueue\NonCritical_8024001f_73aea48bd74c52b523f34668a59a345e9e5b5_0f7b04a7 An alysis symbol: Rechecking for solution: 0 Report Id: b2556bf2-089b-11e3-be51- 0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 14:51:01 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: WindowsUpdateFailure Response: Not available Cab Id: 0 Problem si gnature: P1: 7.5.7601.17514 P2: 8024001f P3: 00000000-0000-0000-0000-00000000 0000 P4: Scan P5: 101 P6: Unmanaged P7: P8: P9: P10: Attached file s: These files may be available here: Analysis symbol: Rechecking for solution: 0 Report Id: b5505c72-089b-11e3-be51-0016d4bcce11 Report Status: 0 Application Information None 2013-08-19 14:51:01 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: WindowsUpdateFailure Response: Not available Cab Id: 0 Problem si gnature: P1: 7.5.7601.17514 P2: 8024001f P3: 00000000-0000-0000-0000-00000000 0000 P4: Scan P5: 101 P6: Unmanaged P7: P8: P9: P10: Attached file s: These files may be available here: C:\ProgramData\Microsoft\Windows\WER\R eportQueue\NonCritical_7.5.7601.17514_78efc842cf92e79bab1c4f2fb5bd805f263a65_098 f189c Analysis symbol: Rechecking for solution: 0 Report Id: b5505c72-089b -11e3-be51-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 14:55:06 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T06:55:06.690429600Z. Application Information None 2013-08-19 14:55:06 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T06:55:06.690429600Z. Application Information None 2013-08-19 14:55:10 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T06:55:10.061523400Z. Application Information None 2013-08-19 14:55:10 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T06:55:10.061523400Z. Application Information None 2013-08-19 14:55:10 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T06:55:10.975585900Z. Application Information None 2013-08-19 14:55:11 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T06:55:10.975585900Z. Application Information None 2013-08-19 14:55:11 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T06:55:11.621093700Z. Application Information None 2013-08-19 14:55:11 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T06:55:11.621093700Z. Application Information None 2013-08-19 14:55:12 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T06:55:12.056640600Z. Application Information None 2013-08-19 14:55:12 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T06:55:12.056640600Z. Application Information None 2013-08-19 14:55:21 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T06:55:21.816406200Z. Application Information None 2013-08-19 14:55:21 Vic Tiangco Microsoft-Windows-RestartManager 10005: Machine restart is req uired. Application Information None 2013-08-19 14:55:21 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T06:55:21.816406200Z. Application Information None 2013-08-19 14:55:29 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T06:55:29.566406200Z. Application Information None 2013-08-19 14:55:29 Vic Tiangco Microsoft-Windows-RestartManager 10005: Machine restart is req uired. Application Information None 2013-08-19 14:55:29 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T06:55:29.566406200Z. Application Information None 2013-08-19 14:55:30 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T06:55:30.566406200Z. Application Information None 2013-08-19 14:55:30 Vic Tiangco Microsoft-Windows-RestartManager 10005: Machine restart is req uired. Application Information None 2013-08-19 14:55:30 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T06:55:30.566406200Z. Application Information None 2013-08-19 14:55:31 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T06:55:31.550781200Z. Application Information None 2013-08-19 14:55:31 Vic Tiangco Microsoft-Windows-RestartManager 10005: Machine restart is req uired. Application Information None 2013-08-19 14:55:31 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T06:55:31.550781200Z. Application Information None 2013-08-19 14:55:32 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T06:55:32.394531200Z. Application Information None 2013-08-19 14:55:32 Vic Tiangco Microsoft-Windows-RestartManager 10005: Machine restart is req uired. Application Information None 2013-08-19 14:55:32 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T06:55:32.394531200Z. Application Information None 2013-08-19 14:57:31 System Restore 8194: Successfully created rest ore point (Process = C:\Windows\system32\DrvInst.exe "4" "20" "C:\Users\VICTIA~1 \AppData\Local\Temp\{4cfaa8e4-db40-4bcd-13b3-2657c435086e}\dtsoftbus01.inf" "0" "68f824c73" "00000524" "WinSta0\Default" "000002DC" "208" "C:\Program Files\DAEM ON Tools Pro"; Description = Device Driver Package Install: DT Soft Ltd System d evices). Application Information None 2013-08-19 14:57:50 Microsoft-Windows-CAPI2 4097: Successful auto update of third-party root certificate:: Subject: Sha1 thumbprint: . Application Information None 2013-08-19 14:58:59 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 14:58:59 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 15:00:14 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T07:00:14.593750000Z. Application Information None 2013-08-19 15:00:14 Vic Tiangco Microsoft-Windows-RestartManager 10005: Machine restart is req uired. Application Information None 2013-08-19 15:00:14 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T07:00:14.593750000Z. Application Information None 2013-08-19 15:00:40 VSS 8224: The VSS service is shutti ng down due to idle timeout. Application Information None 2013-08-19 15:03:36 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PCA2 Response: Not available Cab Id: 0 Problem signature: P1: Wi nRAR v3.61 (Registered).exe P2: 0.0.0.0 P3: WinRAR v3.61 (Registered).exe P4: unknown P5: unknown P6: 1 P7: 200 P8: P9: P10: Attached files: C:\ Users\Vic Tiangco\AppData\Local\Temp\{3c12dde0-6038-4acd-96af-22b30873e8a4}\appc ompat.txt These files may be available here: C:\Users\Vic Tiangco\AppData\Lo cal\Microsoft\Windows\WER\ReportQueue\NonCritical_WinRAR v3.61 (Re_c7855f1bb8ce2 c45945ecd29399e0e44a797b16_cab_06369b53 Analysis symbol: Rechecking for sol ution: 0 Report Id: 76fa8377-089d-11e3-be51-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 15:04:06 System Restore 8194: Successfully created rest ore point (Process = C:\Program Files\Dll-Files.com Fixer\DLLFixer.exe Files\Dll -Files.com Fixer\DLLFixer.exe"; Description = DLL-Files.com Fixer Pn, sie 19, 13 15:03). Application Information None 2013-08-19 15:07:10 VSS 8224: The VSS service is shutti ng down due to idle timeout. Application Information None 2013-08-19 15:09:49 Desktop Window Manager 9009: The Desktop Window Manage r has exited with code (0xc00002fe) Application Information None 2013-08-19 15:09:49 IJPLMSVC 2: The service is finished. Application Information None 2013-08-19 15:13:44 Microsoft-Windows-CAPI2 4097: Successful auto update of third-party root certificate:: Subject: Sha1 thumbprint: <4EB6D5 78499B1CCF5F581EAD56BE3D9B6744A5E5>. Application Information None 2013-08-19 15:13:45 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\Users\Vic Tiangco\AppData\LocalLow\Sun\Java\jre1.7.0_25\jre 1.7.0_25.msi. Client Process Id: 3912. Application Information None 2013-08-19 15:13:57 System Restore 8194: Successfully created rest ore point (Process = C:\Windows\system32\msiexec.exe /V; Description = Installed Java 7 Update 25). Application Information None 2013-08-19 15:14:20 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\Users\Vic Tiangco\AppData\LocalLow\Sun\Java\jre1.7.0_25\jre1.7 .0_25.msi. Client Process Id: 3912. Application Information None 2013-08-19 15:14:20 Vic Tiangco MsiInstaller 11707: Product: Java 7 Update 2 5 -- Installation operation completed successfully. Application Information None 2013-08-19 15:14:20 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Java 7 Update 25. Product Version: 7.0.250. Produc t Language: 1033. Manufacturer: Oracle. Installation success or error status: 0.

Application Information None 2013-08-19 15:14:57 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\Users\Vic Tiangco\AppData\LocalLow\Sun\Java\AU\au.msi. Clie nt Process Id: 1972. Application Information None 2013-08-19 15:14:57 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 0 - 2 013-08-19T07:14:57.967773400Z. Application Information None 2013-08-19 15:15:00 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\Users\Vic Tiangco\AppData\LocalLow\Sun\Java\AU\au.msi. Client Process Id: 1972. Application Information None 2013-08-19 15:15:00 Vic Tiangco MsiInstaller 11707: Product: Java Auto Updat er -- Installation operation completed successfully. Application Information None 2013-08-19 15:15:00 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Java Auto Updater. Product Version: 2.1.9.5. Produ ct Language: 1033. Manufacturer: Sun Microsystems, Inc.. Installation success or error status: 0. Application Information None 2013-08-19 15:15:00 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 0 start ed 2013-08-19T07:14:57.967773400Z. Application Information None 2013-08-19 15:17:14 VSS 8224: The VSS service is shutti ng down due to idle timeout. Application Information None 2013-08-19 15:17:36 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Information None 2013-08-19 15:17:40 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 15:18:55 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 15:25:15 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 15:25:54 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 15:28:48 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 15:29:28 EventSystem Application Information None 2013-08-19 15:29:28 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 15:29:35 WinMgmt Application Information None 2013-08-19 15:29:39 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 15:29:39 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Information None 2013-08-19 15:29:39 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information 1 2013-08-19 15:29:55 ESENT 102: Windows (304) Windows: The database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 15:29:55 ESENT 300: Windows (304) Windows: The database engine is initiating recovery steps. Application Information 3 2013-08-19 15:29:55 ESENT 301: Windows (304) Windows: The database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Dat a\Applications\Windows\MSS00003.log. Application Information 3 2013-08-19 15:30:00 ESENT 301: Windows (304) Windows: The database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Dat a\Applications\Windows\MSS.log. Application Information None 2013-08-19 15:30:01 WinMgmt Application Information 1 2013-08-19 15:30:01 Windows Search Service 1003: The Windows Search Servic e started. Application Information 3 2013-08-19 15:30:01 ESENT 302: Windows (304) Windows: The database engine has successfully completed recovery steps. Application Error None 2013-08-19 15:31:12 WinMgmt Application Information None 2013-08-19 15:31:25 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T07:31:25.740234300Z. Application Information None 2013-08-19 15:31:33 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\ca718b0b01f596f41bb551\netfx_Full_x86.msi. Client Process I d: 644. Application Information None 2013-08-19 15:31:33 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 0 - 2 013-08-19T07:31:33.839843700Z. Application Information None 2013-08-19 15:32:03 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 15:32:13 SecurityCenter 1: The Windows Security Center Service has started. Application Information None 2013-08-19 15:34:30 Vic Tiangco Microsoft-Windows-LoadPerf 1000: Performance counters for the .NET Memory Cache 4.0 (.NET Memory Cache 4.0) service were loaded successful ly. The Record Data in the data section contains the new index values assigned t o this service. Application Information 1 2013-08-19 15:34:35 ASP.NET 4.0.30319.0 1017: Start registering ASP.NET (version 4.0.30319.0) (internal flag: 0x00000404) Application Information None 2013-08-19 15:34:40 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 15:34:40 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 15:34:40 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information None 2013-08-19 15:34:42 Vic Tiangco Microsoft-Windows-LoadPerf 1000: Performance counters for the aspnet_state (ASP.NET State Service) service were loaded successfully. The R ecord Data in the data section contains the new index values assigned to this se rvice. Application Information None 2013-08-19 15:34:47 Vic Tiangco Microsoft-Windows-LoadPerf 1000: Performance counters for the ASP.NET_4.0.30319 (ASP.NET_4.0.30319) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this s ervice. Application Information None 2013-08-19 15:34:50 Vic Tiangco Microsoft-Windows-LoadPerf 1000: Performance counters for the ASP.NET (ASP.NET) service were loaded successfully. The Record Data in the d ata section contains the new index values assigned to this service. Application Information 1 2013-08-19 15:34:51 ASP.NET 4.0.30319.0 1019: Finish registering ASP.NE T (version 4.0.30319.0). Detailed registration logs can be found in C:\Users\VIC TIA~1\AppData\Local\Temp\ASPNETSetup_00000.log Application Warning 1 2013-08-19 15:34:51 ASP.NET 4.0.30319.0 1020: Updates to the IIS metaba se were aborted because IIS is either not installed or is disabled on this machi ne. To configure ASP.NET to run in IIS, please install or enable IIS and re-regi ster ASP.NET using aspnet_regiis.exe /i. Application Information None 2013-08-19 15:34:54 Vic Tiangco Microsoft-Windows-LoadPerf 1000: Performance counters for the {890c10c3-8c2a-4fe3-a36a-9eca153d47cb} (ServiceModel 4.0.0.0) service were l oaded successfully. The Record Data in the data section contains the new index v alues assigned to this service. Application Information None 2013-08-19 15:34:54 Vic Tiangco Microsoft-Windows-LoadPerf 1000: Performance counters for the {f6c5ad57-a5be-4259-9060-b2c4ebfccd96} (WorkflowServiceHost 4.0.0.0) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 15:34:54 Vic Tiangco Microsoft-Windows-LoadPerf 1000: Performance counters for the SMSvcHost 4.0.0.0 (SMSvcHost 4.0.0.0) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this s ervice. Application Information None 2013-08-19 15:34:56 Vic Tiangco Microsoft-Windows-LoadPerf 1000: Performance counters for the MSDTC Bridge 4.0.0.0 (MSDTC Bridge 4.0.0.0) service were loaded successfully . The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 15:34:59 Vic Tiangco Microsoft-Windows-LoadPerf 1000: Performance counters for the Windows Workflow Foundation 4.0.0.0 (Windows Workflow Foundation 4.0.0.0) se rvice were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 15:35:00 Vic Tiangco Microsoft-Windows-LoadPerf 1000: Performance counters for the .NET CLR Networking 4.0.0.0 (.NET CLR Networking 4.0.0.0) service were loade d successfully. The Record Data in the data section contains the new index value s assigned to this service. Application Information None 2013-08-19 15:35:00 Vic Tiangco Microsoft-Windows-LoadPerf 1002: Performance counters for the .NET Data Provider for Oracle (.NET Data Provider for Oracle) service are al ready in the registry, no need to reinstall. This only happens when you install the same counter twice. The second time install will generate this event. Application Error None 2013-08-19 15:35:51 VSS 8194: Volume Shadow Copy Servic e error: Unexpected error querying for the IVssWriterCallback interface. hr = 0 x80070005, Access is denied. . This is often caused by incorrect security sett ings in either the writer or requestor process. Operation: Gathering Write r Data Context: Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220} W riter Name: System Writer Writer Instance ID: {2ddc0311-bde2-4031-994d-55a562 d4a6c3} Application Information None 2013-08-19 15:36:33 System Restore 8194: Successfully created rest ore point (Process = C:\Program Files\USB Vibration\7906\setup\setup.exe -delete r ; Description = Installed USB Vibration Joystick). Application Information None 2013-08-19 15:37:20 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\ca718b0b01f596f41bb551\netfx_Full_x86.msi. Client Process Id: 644. Application Information None 2013-08-19 15:37:20 Vic Tiangco MsiInstaller 11707: Product: Microsoft .NET Framework 4.5 -- Installation completed successfully. Application Information None 2013-08-19 15:37:20 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft .NET Framework 4.5. Product Version: 4.5 .50709. Product Language: 0. Manufacturer: Microsoft Corporation. Installation s uccess or error status: 0. Application Information None 2013-08-19 15:37:20 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 0 start ed 2013-08-19T07:31:33.839843700Z. Application Information None 2013-08-19 15:37:22 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T07:31:25.740234300Z. Application Information None 2013-08-19 15:37:24 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 15:37:24 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 15:39:42 Software Protection Platform Service 903: The Software Protect ion service has stopped. Application Information None 2013-08-19 15:39:46 VSS 8224: The VSS service is shutti ng down due to idle timeout. Application Information None 2013-08-19 15:45:07 Desktop Window Manager 9009: The Desktop Window Manage r has exited with code (0x40010004) Application Information None 2013-08-19 15:45:07 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Information None 2013-08-19 15:45:10 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 15:46:23 EventSystem Application Information None 2013-08-19 15:46:23 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 15:46:24 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 15:46:24 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Information None 2013-08-19 15:46:25 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information None 2013-08-19 15:46:31 WinMgmt Application Information None 2013-08-19 15:46:42 WinMgmt Application Information 1 2013-08-19 15:46:43 ESENT 102: Windows (584) Windows: The database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 15:46:44 ESENT 300: Windows (584) Windows: The database engine is initiating recovery steps. Application Information 3 2013-08-19 15:46:45 ESENT 301: Windows (584) Windows: The database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Dat a\Applications\Windows\MSS.log. Application Information 3 2013-08-19 15:46:47 ESENT 302: Windows (584) Windows: The database engine has successfully completed recovery steps. Application Information 1 2013-08-19 15:46:48 Windows Search Service 1003: The Windows Search Servic e started. Application Error None 2013-08-19 15:47:38 WinMgmt Application Information None 2013-08-19 15:48:25 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: c:\77d7a2687dd9950ba044a760473f4f5e\Silverlight.msi. Client Pr ocess Id: 3216. Application Information None 2013-08-19 15:48:26 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 0 - 2 013-08-19T07:48:26.339843700Z. Application Information None 2013-08-19 15:48:29 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: c:\77d7a2687dd9950ba044a760473f4f5e\Silverlight.msi. Client Proce ss Id: 3216. Application Information None 2013-08-19 15:48:29 Vic Tiangco MsiInstaller 11707: Product: Microsoft Silve rlight -- Installation completed successfully. Application Information None 2013-08-19 15:48:29 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Silverlight. Product Version: 1.0.0.0. P roduct Language: 1033. Manufacturer: Microsoft Corporation. Installation success or error status: 0. Application Information None 2013-08-19 15:48:29 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 0 start ed 2013-08-19T07:48:26.339843700Z. Application Information None 2013-08-19 15:48:30 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}. Client Process Id: 321 6. Application Information None 2013-08-19 15:48:31 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 0 - 2 013-08-19T07:48:31.011718700Z. Application Information None 2013-08-19 15:48:36 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}. Client Process Id: 3216.

Application Information None 2013-08-19 15:48:36 Vic Tiangco MsiInstaller 1022: Product: Microsoft Silver light - Update 'Microsoft Silverlight 5.1.20125.0' installed successfully. Application Information None 2013-08-19 15:48:36 Vic Tiangco MsiInstaller 1036: Windows Installer install ed an update. Product Name: Microsoft Silverlight. Product Version: 5.1.20125.0. Product Language: 1033. Manufacturer: Microsoft Corporation. Update Name: Micro soft Silverlight 5.1.20125.0. Installation success or error status: 0. Application Information None 2013-08-19 15:48:36 Vic Tiangco MsiInstaller 11728: Product: Microsoft Silve rlight -- Configuration completed successfully. Application Information None 2013-08-19 15:48:36 Vic Tiangco MsiInstaller 1035: Windows Installer reconfi gured the product. Product Name: Microsoft Silverlight. Product Version: 5.1.201 25.0. Product Language: 1033. Manufacturer: Microsoft Corporation. Reconfigurati on success or error status: 0. Application Information None 2013-08-19 15:48:36 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 0 start ed 2013-08-19T07:48:31.011718700Z. Application Information None 2013-08-19 15:48:57 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 15:48:58 SecurityCenter 1: The Windows Security Center Service has started. Application Information None 2013-08-19 15:48:59 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 15:48:59 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 15:48:59 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information None 2013-08-19 15:49:31 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: D:\Courseware 2013\Skype\SkypeSetup_5.10.0.116.msi. Client Pro cess Id: 268. Application Information None 2013-08-19 15:49:49 System Restore 8194: Successfully created rest ore point (Process = C:\Windows\system32\msiexec.exe /V; Description = Installed Skype 5.10). Application Information None 2013-08-19 15:49:49 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 0 - 2 013-08-19T07:49:49.289062500Z. Application Information None 2013-08-19 15:50:03 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: D:\Courseware 2013\Skype\SkypeSetup_5.10.0.116.msi. Client Proces s Id: 268. Application Information None 2013-08-19 15:50:03 Vic Tiangco MsiInstaller 11707: Product: Skype 5.10 -- In stallation completed successfully. Application Information None 2013-08-19 15:50:03 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Skype 5.10. Product Version: 5.10.116. Product Lang uage: 1033. Manufacturer: Skype Technologies S.A.. Installation success or error status: 0. Application Information None 2013-08-19 15:50:03 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 0 start ed 2013-08-19T07:49:49.289062500Z. Application Information 1 2013-08-19 15:50:11 SkypeUpdate 100: Service started. Application Information None 2013-08-19 15:50:40 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 15:50:40 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information 1 2013-08-19 15:51:11 SkypeUpdate 103: SkypeUpdate service is shu tting down due to idle timeout. Application Information 1 2013-08-19 15:51:12 SkypeUpdate 101: Service stopped. Application Information None 2013-08-19 15:53:00 VSS 8224: The VSS service is shutti ng down due to idle timeout. Application Information None 2013-08-19 15:54:26 Software Protection Platform Service 903: The Software Protect ion service has stopped. Application Information None 2013-08-19 15:56:14 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 15:56:14 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 15:56:46 System Restore 8194: Successfully created rest ore point (Process = C:\Users\VICTIA~1\AppData\Local\Temp\OWP36C7.tmp\setup.exe; Description = Installed Microsoft Office Professional Plus 2010). Application Information None 2013-08-19 15:57:00 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C \OfficeMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:57:28 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Of ficeMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:57:28 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Shared MUI (English) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:57:28 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Shared MUI (English) 2010. Produc t Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corpo ration. Installation success or error status: 0. Application Information None 2013-08-19 15:57:29 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C \OfficeMUISet.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:57:36 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Of ficeMUISet.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:57:36 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Shared Setup Metadata MUI (English) 2010 -- Installation operation completed s uccessfully. Application Information None 2013-08-19 15:57:36 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Shared Setup Metadata MUI (Englis h) 2010. Product Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corporation. Installation success or error status: 0. Application Information None 2013-08-19 15:57:36 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C \PowerPointMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:57:54 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Po werPointMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:57:54 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e PowerPoint MUI (English) 2010 -- Installation operation completed successfully . Application Information None 2013-08-19 15:57:54 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office PowerPoint MUI (English) 2010. Pr oduct Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft C orporation. Installation success or error status: 0. Application Information None 2013-08-19 15:57:54 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C \ExcelMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:06 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Ex celMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:06 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Excel MUI (English) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:58:06 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Excel MUI (English) 2010. Product Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corpor ation. Installation success or error status: 0. Application Information None 2013-08-19 15:58:06 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C \GrooveMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:16 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Gr ooveMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:16 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Groove MUI (English) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:58:16 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Groove MUI (English) 2010. Produc t Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corpo ration. Installation success or error status: 0. Application Information None 2013-08-19 15:58:17 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C \OutlookMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:30 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Ou tlookMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:30 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Outlook MUI (English) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:58:30 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Outlook MUI (English) 2010. Produ ct Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corp oration. Installation success or error status: 0. Application Information None 2013-08-19 15:58:30 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C \Proof.es\Proof.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:34 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Pr oof.es\Proof.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:34 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Proof (Spanish) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:58:34 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Proof (Spanish) 2010. Product Ver sion: 14.0.4734.1000. Product Language: 3082. Manufacturer: Microsoft Corporatio n. Installation success or error status: 0. Application Information None 2013-08-19 15:58:35 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C \Proof.fr\Proof.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:38 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Proof (French) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:58:38 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Proof (French) 2010. Product Vers ion: 14.0.4734.1000. Product Language: 1036. Manufacturer: Microsoft Corporation . Installation success or error status: 0. Application Information None 2013-08-19 15:58:39 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Pr oof.fr\Proof.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:39 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C \Proof.en\Proof.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:43 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Pr oof.en\Proof.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:43 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Proof (English) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:58:43 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Proof (English) 2010. Product Ver sion: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corporatio n. Installation success or error status: 0. Application Information None 2013-08-19 15:58:43 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C \Proofing.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:47 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Pr oofing.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:47 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Proofing (English) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:58:47 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Proofing (English) 2010. Product Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corpora tion. Installation success or error status: 0. Application Information None 2013-08-19 15:58:47 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C \OneNoteMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:00 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\On eNoteMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:00 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e OneNote MUI (English) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:59:00 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office OneNote MUI (English) 2010. Produ ct Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corp oration. Installation success or error status: 0. Application Information None 2013-08-19 15:59:00 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C \InfoPathMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:15 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e InfoPath MUI (English) 2010 -- Installation operation completed successfully.

Application Information None 2013-08-19 15:59:15 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office InfoPath MUI (English) 2010. Prod uct Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Cor poration. Installation success or error status: 0. Application Information None 2013-08-19 15:59:16 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\In foPathMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:16 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C \Access.en-us\AccessMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:32 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Access MUI (English) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:59:32 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Access MUI (English) 2010. Produc t Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corpo ration. Installation success or error status: 0. Application Information None 2013-08-19 15:59:33 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Ac cess.en-us\AccessMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:33 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C \AccessMUISet.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:36 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Ac cessMUISet.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:36 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Access Setup Metadata MUI (English) 2010 -- Installation operation completed s uccessfully. Application Information None 2013-08-19 15:59:36 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Access Setup Metadata MUI (Englis h) 2010. Product Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corporation. Installation success or error status: 0. Application Information None 2013-08-19 15:59:36 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C \PublisherMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:42 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Pu blisherMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:42 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Publisher MUI (English) 2010 -- Installation operation completed successfully.

Application Information None 2013-08-19 15:59:42 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Publisher MUI (English) 2010. Pro duct Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Co rporation. Installation success or error status: 0. Application Information None 2013-08-19 15:59:42 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C \WordMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:51 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Wo rdMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:51 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Word MUI (English) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:59:51 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Word MUI (English) 2010. Product Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corpora tion. Installation success or error status: 0. Application Information None 2013-08-19 15:59:51 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C \ProPlusWW.msi. Client Process Id: 2208. Application Information None 2013-08-19 16:00:07 VSS 8224: The VSS service is shutti ng down due to idle timeout. Application Information None 2013-08-19 16:01:39 Office Software Protection Platform Service 900: The Software Protection service is starting. Application Information None 2013-08-19 16:01:40 Office Software Protection Platform Service 902: The Software Protection service has started. 14.0.370.400 Application Information None 2013-08-19 16:01:44 Office Software Protection Platform Service 8206: Token Store not found. Recreating empty Token Store. Application Information None 2013-08-19 16:01:44 Office Software Protection Platform Service 1066: Initializati on status for service objects. C:\Program Files\Common Files\Microsoft Shared\O fficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x000 00000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareP rotectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000 000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatf orm\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DL L, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 16:01:44 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Gener ic Rights Account Certificate (Private) License Id=5f7130f8-17f4-4735-8fd9-9827 2e7fd5e5 Application Information None 2013-08-19 16:01:44 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Gener ic Rights Account Certificate (Public) License Id=09713a06-3d2a-47c9-b20a-2bfe9 4dd18f2 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Gener ic Security Processor Certificate (Private) License Id=cb9c4ceb-1b86-4457-8918- cb2fb95ad5af Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Gener ic Security Processor Certificate (Public) License Id=c6134e36-57f5-4705-87d9-2 f3f08efc83d Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-PKC Issuance License License Id=9e54f6ea-be00-4909-84d0-3cbce8e57e5d Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-PLUGIN-MANIFEST Issuance License License Id=27f341f4-c27b-4fde-a556-3a5ee00eb d8c Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-PPD Issuance License License Id=9508580c-068f-4ddf-b7b8-df89ac541bbc Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-RAC Issuance License License Id=95c2c6b8-ea2f-431d-8902-eeafc6376965 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-ROOT Issuance License License Id=80e74f83-3c1f-448d-bacd-5bb3d73fdcc4 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-SPC Issuance License License Id=57d6dc1b-f556-4f5b-935b-3b379fd9dda8 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-STIL Issuance License License Id=285583cd-fc43-4806-ace6-d247b7edd434 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-UL Issuance License License Id=4961cc30-d690-43be-910c-8e2db01fc5ad Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-UL-OEM Issuance License License Id=9fb32152-3abd-4c4c-a5e1-467a1c50eb30 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-UL-OOB Issuance License License Id=7e3094cf-ce3e-4ed4-8c8c-20c2be1add03 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-UL-PHN Issuance License License Id=812f33a7-edaf-404b-a05a-f4397954033c Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-WGALIC Issuance License License Id=770c4fab-e917-4899-a2cc-a76b894d5d3d Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=XrML 2.1 License - Product Key Configuration License Id=8d0bdca0-33c9-43bd-8729-9871 bba08c71 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-Volume License (Public) License Id=e2e326c2-ca6a-4577-a305-9d1e03fc5773

Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-Volume License (Private) License Id=82bb1ddf-033e-4de5-a65f-88465f74aec f Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-OOB License (Public) License Id=7bcc5eee-f730-4c93-97c4-877e27333324 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-OOB License (Private) License Id=2453acfb-0e3f-49b2-9a78-209b1ff3908c Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 - Product PPD License (Security-SPP-Component-SKU-OfficeProPlus-KMS_Client) License Id=cb7fd957-6868-58b3-086e-cd303db4a8c5 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=XrML 2.1 License - {msft:sl/RAC/VOLUME/PRIVATE} License Id=eb981526-3397-447c-9e08-6 7f546a23f65 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=XrML 2.1 License - {msft:sl/RAC/VOLUME/PRIVATE} License Id=eb981526-3397-447c-9e08-6 7f546a23f65 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 Publishing License (Public) License Id=d8f1b81d-bca4-4879-aea8-3845a14c482 4 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 Publishing License (Private) License Id=3ff0b18b-c7e1-470a-96e1-fc6fc346ed 5a Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-PHN License (Public) License Id=64026624-f349-46f0-87db-37442cf6f3da Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-PHN License (Private) License Id=98aa5ac0-0173-4df5-a223-670bb3bdef16 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-OOB License (Public) License Id=70202bca-2321-4f18-a3ff-29cd3ba38307 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-OOB License (Private) License Id=4d9f9ff4-b7f5-452b-9587-8d2b38dd0c45 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 - Product PPD License (Security-SPP-Component-SKU-OfficeProPlus-MAK) Licen se Id=f27036d3-9c72-40d1-4b15-fb058ead0470 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 Publishing License (Public) License Id=ba56ca2a-1bcc-42a6-942b-a028288538f 0 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 Publishing License (Private) License Id=3e5fd99c-6695-4e20-acd9-aac39450e8 f0 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-PHN License (Public) License Id=eaa7248f-f01e-49f9-b4a7-3b91e93071f4 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-PHN License (Private) License Id=19f33eae-0433-486d-88b7-cdab1d569835 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-OOB License (Public) License Id=4637b7ac-35d2-4b4b-90d0-cc565abde0a6 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-OOB License (Private) License Id=f68958fc-afc0-46fd-b92b-12fa0f2b21c7 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 - Product PPD License (Security-SPP-Component-SKU-OfficeProPlusAcad-MAK) L icense Id=54369957-b369-15be-8690-2342fef6c903 Application Information None 2013-08-19 16:01:51 Office Software Protection Platform Service 1016: Proof of Pur chase installed successfully. ACID=6f327760-8c5c-417c-9b61-836a98287e0c PKeyI d=bf9e64e9-452c-4e05-8f74-16eb7fbf2726 Application Information None 2013-08-19 16:01:52 Office Software Protection Platform Service 1025: Grace period has been started. Grace days=30 Grace type=5. Application Information None 2013-08-19 16:01:52 Office Software Protection Platform Service 1033: These polici es are being excluded since they are only defined with override-only attribute. Policy Names=(Security-SPP-Reserved-EnableNotificationMode) App Id=59a52881-a 989-479d-af46-f275c6370663 Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c Application Information None 2013-08-19 16:01:52 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f3277 60-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algor ithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x000 00000 30 43200)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(? )(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [( ?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:01:56 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: MpTelemetry Response: Not available Cab Id: 0 Problem signature: P1: 8024402c P2: EndSearch P3: Search P4: 6.1.7601.17514 P5: MpSigDwn.dll P6: 6.1.7600.16385 P7: Windows Defender P8: P9: P10: Attached files: C:\Windows\Temp\MPTelemetrySubmit\client_manifest.txt These files may be avai lable here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_802440 2c_eae1492941e9345dd519441a16a35f278cd6238_cab_0d16ed4a Analysis symbol: Re checking for solution: 0 Report Id: 9d5e18a4-08a5-11e3-8d6f-0016d4bcce11 Repor t Status: 6 Application Information None 2013-08-19 16:02:37 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f3277 60-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algor ithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x000 00000 30 43200)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(? )(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [( ?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Error None 2013-08-19 16:02:38 WinMgmt Application Information 1 2013-08-19 16:02:51 ESENT 103: Windows (584) Windows: The database engine stopped the instance (0). Application Information 1 2013-08-19 16:02:51 Windows Search Service 1013: Windows Search Service st opped normally. Application Information 1 2013-08-19 16:02:52 ESENT 102: Windows (3804) Windows: Th e database engine (6.01.7601.0000) started a new instance (0). Application Information 1 2013-08-19 16:02:53 Windows Search Service 1003: The Windows Search Servic e started. Application Information None 2013-08-19 16:02:54 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Pr oPlusWW.msi. Client Process Id: 2208. Application Information None 2013-08-19 16:02:54 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Professional Plus 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 16:02:54 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Professional Plus 2010. Product V ersion: 14.0.4734.1000. Product Language: 0. Manufacturer: Microsoft Corporation . Installation success or error status: 0. Application Information None 2013-08-19 16:05:03 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.Security.App licationId.PolicyManagement.Cmdlets Application Information None 2013-08-19 16:06:58 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: MpTelemetry Response: Not available Cab Id: 0 Problem signature: P1: 8024402c P2: EndSearch P3: Search P4: 6.1.7601.17514 P5: MpSigDwn.dll P6: 6.1.7600.16385 P7: Windows Defender P8: P9: P10: Attached files: These files may be available here: C:\ProgramData\Microsoft\Windows\WER\Repor tQueue\NonCritical_8024402c_eae1492941e9345dd519441a16a35f278cd6238_0bdf887d Analysis symbol: Rechecking for solution: 0 Report Id: 515adef0-08a6-11e3-8d6 f-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 16:08:10 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f3277 60-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algor ithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x000 00000 30 43194)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(? )(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [( ?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:08:10 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f3277 60-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algor ithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x000 00000 30 43194)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(? )(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [( ?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:10:04 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\Users\VICTIA~1\AppData\Local\Temp\IXP000.TMP\vcredist.msi. Client Process Id: 3716. Application Information None 2013-08-19 16:10:19 System Restore 8194: Successfully created rest ore point (Process = C:\Windows\system32\msiexec.exe /V; Description = Installed Microsoft Visual C++ 2005 Redistributable). Application Information None 2013-08-19 16:10:20 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 0 - 2 013-08-19T08:10:20.263671800Z. Application Information None 2013-08-19 16:10:49 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\Users\VICTIA~1\AppData\Local\Temp\IXP000.TMP\vcredist.msi. Cli ent Process Id: 3716. Application Information None 2013-08-19 16:10:49 Vic Tiangco MsiInstaller 11707: Product: Microsoft Visua l C++ 2005 Redistributable -- Installation completed successfully. Application Information None 2013-08-19 16:10:49 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Visual C++ 2005 Redistributable. Product Version: 8.0.59193. Product Language: 0. Manufacturer: Microsoft Corporation. I nstallation success or error status: 0. Application Information None 2013-08-19 16:10:49 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 0 start ed 2013-08-19T08:10:20.263671800Z. Application Information None 2013-08-19 16:11:01 Desktop Window Manager 9009: The Desktop Window Manage r has exited with code (0x40010004) Application Information None 2013-08-19 16:11:01 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Warning None 2013-08-19 16:11:02 SYSTEM Microsoft-Windows-User Profiles Service 1530: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL - 2 user registry handles leaked from \Registry\User\S-1-5-21-2415673615-2399998967-532945099-1000: Proces s 3264 (\Device\HarddiskVolume2\Windows\System32\msiexec.exe) has opened key \RE GISTRY\USER\S-1-5-21-2415673615-2399998967-532945099-1000\Software\Microsoft\Win dows\CurrentVersion\Explorer\FileExts Process 3264 (\Device\HarddiskVolume2\Wind ows\System32\msiexec.exe) has opened key \REGISTRY\USER\S-1-5-21-2415673615-2399 998967-532945099-1000\Software\Microsoft\Windows\CurrentVersion\Explorer Application Information None 2013-08-19 16:11:09 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 16:12:25 EventSystem Application Information None 2013-08-19 16:12:25 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 16:12:27 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 16:12:27 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Information None 2013-08-19 16:12:27 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information 1 2013-08-19 16:12:29 SkypeUpdate 100: Service started. Application Information None 2013-08-19 16:12:34 WinMgmt Application Information None 2013-08-19 16:12:52 WinMgmt Application Information 1 2013-08-19 16:12:53 ESENT 102: Windows (528) Windows: The database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 16:12:54 ESENT 300: Windows (528) Windows: The database engine is initiating recovery steps. Application Information 3 2013-08-19 16:12:55 ESENT 301: Windows (528) Windows: The database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Dat a\Applications\Windows\MSS.log. Application Information 3 2013-08-19 16:12:56 ESENT 302: Windows (528) Windows: The database engine has successfully completed recovery steps. Application Information 1 2013-08-19 16:12:57 Windows Search Service 1003: The Windows Search Servic e started. Application Error None 2013-08-19 16:13:41 WinMgmt Application Information None 2013-08-19 16:14:09 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\Users\Vic Tiangco\AppData\Local\Temp\NeroInstallFiles\NERO2 0101008164809345\Nero.BurningROMSuite.msi. Client Process Id: 304. Application Information None 2013-08-19 16:14:27 System Restore 8194: Successfully created rest ore point (Process = C:\Windows\system32\msiexec.exe /V; Description = Installed Nero Burning ROM 10.). Application Information None 2013-08-19 16:14:28 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 0 - 2 013-08-19T08:14:28.107421800Z. Application Information 1 2013-08-19 16:14:29 SkypeUpdate 103: SkypeUpdate service is shu tting down due to idle timeout. Application Information 1 2013-08-19 16:14:30 SkypeUpdate 101: Service stopped. Application Information None 2013-08-19 16:14:36 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 0 start ed 2013-08-19T08:14:28.107421800Z. Application Information None 2013-08-19 16:14:41 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 0 - 2 013-08-19T08:14:41.138671800Z. Application Information None 2013-08-19 16:14:44 Vic Tiangco MsiInstaller 11707: Product: Nero Control Ce nter 10 -- Installation operation completed successfully. Application Information None 2013-08-19 16:14:44 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Nero Control Center 10. Product Version: 10.2.1060 0.0.6. Product Language: 1033. Manufacturer: Nero AG. Installation success or er ror status: 0. Application Information None 2013-08-19 16:14:44 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 0 start ed 2013-08-19T08:14:41.138671800Z. Application Information None 2013-08-19 16:14:49 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 0 - 2 013-08-19T08:14:49.060546800Z. Application Information None 2013-08-19 16:14:52 Vic Tiangco MsiInstaller 11707: Product: Nero Core Compo nents 10 -- Installation operation completed successfully. Application Information None 2013-08-19 16:14:52 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Nero Core Components 10. Product Version: 2.0.1740 0.8.2. Product Language: 1033. Manufacturer: Nero AG. Installation success or er ror status: 0. Application Information None 2013-08-19 16:14:52 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 0 start ed 2013-08-19T08:14:49.060546800Z. Application Information None 2013-08-19 16:14:59 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 16:14:59 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 0 - 2 013-08-19T08:14:59.355468700Z. Application Information None 2013-08-19 16:15:13 SecurityCenter 1: The Windows Security Center Service has started. Application Information None 2013-08-19 16:16:06 Office Software Protection Platform Service 900: The Software Protection service is starting. Application Information None 2013-08-19 16:16:14 Vic Tiangco MsiInstaller 11707: Product: Nero Burning RO M 10 -- Installation operation completed successfully. Application Information None 2013-08-19 16:16:14 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Nero Burning ROM 10. Product Version: 10.2.11000.1 2.100. Product Language: 1033. Manufacturer: Nero AG. Installation success or er ror status: 0. Application Information None 2013-08-19 16:16:14 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 0 start ed 2013-08-19T08:14:59.355468700Z. Application Information None 2013-08-19 16:16:17 Office Software Protection Platform Service 1066: Initializati on status for service objects. C:\Program Files\Common Files\Microsoft Shared\O fficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x000 00000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareP rotectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000 000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatf orm\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DL L, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 16:16:17 Office Software Protection Platform Service 902: The Software Protection service has started. 14.0.370.400 Application Information None 2013-08-19 16:16:17 Vic Tiangco MsiInstaller 1042: Ending a Windows Installe r transaction: C:\Users\Vic Tiangco\AppData\Local\Temp\NeroInstallFiles\NERO2010 1008164809345\Nero.BurningROMSuite.msi. Client Process Id: 3332. Application Information None 2013-08-19 16:16:18 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 16:16:21 Software Protection Platform Service 1033: These policies are being excluded since they are only defined with override-only attribute. Policy Names=(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet -Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicen sing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs- clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA) App Id=55c927 34-d682-4d71-983e-d6ec3f16059f Sku Id=7cfd4696-69a9-4af7-af36-ff3d12b6b6c8 Application Information None 2013-08-19 16:16:21 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:16:21 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information None 2013-08-19 16:16:23 Vic Tiangco MsiInstaller 11707: Product: Nero Burning RO M 10 -- Installation operation completed successfully. Application Information None 2013-08-19 16:16:23 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Nero Burning ROM 10. Product Version: 10.5.10300. Product Language: 1033. Manufacturer: Nero AG. Installation success or error sta tus: 0. Application Information None 2013-08-19 16:16:45 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:16:46 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/v olume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x000 00000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43186)( 1 0x 00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] Application Information None 2013-08-19 16:16:47 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b4 8b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:16:53 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:16:54 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/v olume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x000 00000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43185)( 1 0x 00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] Application Information None 2013-08-19 16:16:55 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b4 8b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:16:56 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/v olume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x000 00000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43185)( 1 0x 00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] Application Information None 2013-08-19 16:16:56 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:16:57 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/v olume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x000 00000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43185)( 1 0x 00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] Application Information None 2013-08-19 16:16:58 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b4 8b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:16:58 Office Software Protection Platform Service 903: The Software Protection service has stopped. Application Information None 2013-08-19 16:17:01 Office Software Protection Platform Service 900: The Software Protection service is starting. Application Information None 2013-08-19 16:17:02 Office Software Protection Platform Service 1066: Initializati on status for service objects. C:\Program Files\Common Files\Microsoft Shared\O fficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x000 00000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareP rotectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000 000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatf orm\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DL L, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 16:17:02 Office Software Protection Platform Service 902: The Software Protection service has started. 14.0.370.400 Application Information None 2013-08-19 16:17:02 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:17:03 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/v olume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x000 00000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43185)( 1 0x 00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] Application Information None 2013-08-19 16:17:04 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b4 8b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:17:05 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/v olume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x000 00000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43185)( 1 0x 00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] Application Information None 2013-08-19 16:17:06 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:17:07 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/v olume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x000 00000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43185)( 1 0x 00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] Application Information None 2013-08-19 16:17:07 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b4 8b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:17:08 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:08 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 4501032, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:17:09 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:09 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 9006136, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:17:10 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:10 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 9007672, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:17:11 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:11 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 9008248, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:17:11 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:11 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 9007032, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:17:12 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:12 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 9007736, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:17:13 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:13 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 9008184, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:17:13 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:13 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 9007096, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:17:14 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:14 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 9008056, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:17:15 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:15 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 9007224, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:17:15 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:17:16 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/v olume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x000 00000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43185)( 1 0x 00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] Application Information None 2013-08-19 16:17:17 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b4 8b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:17:18 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:18 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2013/08/19 08:17 Application Information None 2013-08-19 16:17:25 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 16:17:25 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 16:17:34 VSS 8224: The VSS service is shutti ng down due to idle timeout. Application Information None 2013-08-19 16:21:34 Software Protection Platform Service 903: The Software Protect ion service has stopped. Application Information None 2013-08-19 16:28:04 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: MpTelemetry Response: Not available Cab Id: 0 Problem signature: P1: 8024402c P2: EndSearch P3: Search P4: 6.1.7601.17514 P5: MpSigDwn.dll P6: 6.1.7600.16385 P7: Windows Defender P8: P9: P10: Attached files: These files may be available here: C:\ProgramData\Microsoft\Windows\WER\Repor tQueue\NonCritical_8024402c_eae1492941e9345dd519441a16a35f278cd6238_00ff0565 Analysis symbol: Rechecking for solution: 0 Report Id: 441cdd17-08a9-11e3-845 6-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 16:33:08 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: MpTelemetry Response: Not available Cab Id: 0 Problem signature: P1: 8024402c P2: EndSearch P3: Search P4: 6.1.7601.17514 P5: MpSigDwn.dll P6: 6.1.7600.16385 P7: Windows Defender P8: P9: P10: Attached files: These files may be available here: C:\ProgramData\Microsoft\Windows\WER\Repor tQueue\NonCritical_8024402c_eae1492941e9345dd519441a16a35f278cd6238_0bf7a9b1 Analysis symbol: Rechecking for solution: 0 Report Id: f9606bb2-08a9-11e3-845 6-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 16:38:18 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 16:38:18 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 16:40:28 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T08:40:28.555664000Z. Application Information None 2013-08-19 16:40:28 Vic Tiangco Microsoft-Windows-RestartManager 10005: Machine restart is req uired. Application Information None 2013-08-19 16:40:28 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T08:40:28.555664000Z. Application Information None 2013-08-19 16:41:06 Desktop Window Manager 9009: The Desktop Window Manage r has exited with code (0x40010004) Application Information None 2013-08-19 16:41:06 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Information None 2013-08-19 16:41:10 Office Software Protection Platform Service 903: The Software Protection service has stopped. Application Information None 2013-08-19 16:41:11 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 16:42:17 EventSystem Application Information None 2013-08-19 16:42:17 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 16:42:19 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 16:42:19 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Information None 2013-08-19 16:42:19 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information 1 2013-08-19 16:42:21 SkypeUpdate 100: Service started. Application Information None 2013-08-19 16:42:24 WinMgmt Application Information None 2013-08-19 16:42:31 WinMgmt Application Information 1 2013-08-19 16:42:37 ESENT 102: Windows (1608) Windows: Th e database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 16:42:37 ESENT 300: Windows (1608) Windows: Th e database engine is initiating recovery steps. Application Information 3 2013-08-19 16:42:37 ESENT 301: Windows (1608) Windows: Th e database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Da ta\Applications\Windows\MSS.log. Application Information None 2013-08-19 16:42:43 Office Software Protection Platform Service 900: The Software Protection service is starting. Application Information None 2013-08-19 16:42:46 Office Software Protection Platform Service 1066: Initializati on status for service objects. C:\Program Files\Common Files\Microsoft Shared\O fficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x000 00000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareP rotectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000 000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatf orm\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DL L, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 16:42:46 Office Software Protection Platform Service 902: The Software Protection service has started. 14.0.370.400 Application Information None 2013-08-19 16:42:47 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 16:42:48 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 16:42:48 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:42:48 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information 3 2013-08-19 16:42:49 ESENT 302: Windows (1608) Windows: Th e database engine has successfully completed recovery steps. Application Information 1 2013-08-19 16:42:53 Windows Search Service 1003: The Windows Search Servic e started. Application Information None 2013-08-19 16:42:58 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:00 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algor ithm/volume/1.0 0x00000000 259175)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:01 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b4 8b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:02 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:43, 0, 1, 259175, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:43:02 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 2150408, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:43:03 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:43, 0, 1, 259175, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:43:03 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2013/08/19 08:43 Application Information None 2013-08-19 16:43:03 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:06 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 436cef53-8387-4692-bb4a-9492cd8226 0e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:08 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:09 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 57a232fe-0931-48fe-9389-e4586967c6 61, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:11 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 7cfd4696-69a9-4af7-af36-ff3d12b6b6 c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bio s/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:11 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 8ec16e01-e86f-415f-b333-1819f41452 94, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:13 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: a0cde89c-3304-4157-b61c-c8ad785d1f ad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:15 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: ac96e1a8-6cc4-4310-a4ff-332ce77fb5 b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:15 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:15 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: b2c4b9f6-3ee6-4a2a-a361-64ad3b61de d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:17 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: bba42084-cacd-4ad4-b606-9f3d6c93b2 c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:19 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: c619d61c-c2f2-40c3-ab3f-c5924314b0 f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:21 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: cfb3e52c-d707-4861-af51-11b27ee616 9c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Error None 2013-08-19 16:43:39 WinMgmt Application Information 1 2013-08-19 16:44:21 SkypeUpdate 103: SkypeUpdate service is shu tting down due to idle timeout. Application Information 1 2013-08-19 16:44:22 SkypeUpdate 101: Service stopped. Application Information None 2013-08-19 16:44:36 SecurityCenter 1: The Windows Security Center Service has started. Application Information None 2013-08-19 16:46:33 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 16:46:34 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 16:47:37 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PnPRequestAdditionalSoftware Response: Not available Cab Id: 0 Pr oblem signature: P1: x86 P2: USB\VID_1A2C&PID_0023&REV_0110&MI_00 P3: 6.1.1.0 P4: 0409 P5: input.inf P6: * P7: P8: P9: P10: Attached files: These files may be available here: C:\Users\Vic Tiangco\AppData\Local\Microsoft \Windows\WER\ReportQueue\NonCritical_x86_a643a4308dacc59d8c5d86e89f77fc8223298_c ab_0a1975b4 Analysis symbol: Rechecking for solution: 0 Report Id: fe87935 1-08ab-11e3-8671-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 16:47:37 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PnPRequestAdditionalSoftware Response: Not available Cab Id: 0 Pr oblem signature: P1: x86 P2: USB\VID_1A2C&PID_0023&REV_0110&MI_01 P3: 6.1.1.0 P4: 0409 P5: input.inf P6: * P7: P8: P9: P10: Attached files: These files may be available here: C:\Users\Vic Tiangco\AppData\Local\Microsoft \Windows\WER\ReportQueue\NonCritical_x86_3ed633e358777265fed4752c3248d4961376474 7_cab_0a19768f Analysis symbol: Rechecking for solution: 0 Report Id: fe87 9352-08ab-11e3-8671-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 16:47:40 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PnPRequestAdditionalSoftware Response: Not available Cab Id: 0 Pr oblem signature: P1: x86 P2: HID\VID_1A2C&PID_0023&REV_0110&MI_01&Col02 P3: 6 .1.1.0 P4: 0409 P5: input.inf P6: * P7: P8: P9: P10: Attached file s: These files may be available here: C:\Users\Vic Tiangco\AppData\Local\Mic rosoft\Windows\WER\ReportQueue\NonCritical_x86_bd4b8701dcd88f198397ec8ca5e368143 b35bb7_cab_0a19845a Analysis symbol: Rechecking for solution: 0 Report Id: fe879353-08ab-11e3-8671-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 16:48:23 Software Protection Platform Service 903: The Software Protect ion service has stopped. Application Information None 2013-08-19 16:55:14 Desktop Window Manager 9009: The Desktop Window Manage r has exited with code (0x40010004) Application Information None 2013-08-19 16:55:14 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Information None 2013-08-19 16:55:15 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 16:56:18 EventSystem Application Information None 2013-08-19 16:56:18 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 16:56:20 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 16:56:20 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Information None 2013-08-19 16:56:21 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information 1 2013-08-19 16:56:22 SkypeUpdate 100: Service started. Application Information None 2013-08-19 16:56:24 WinMgmt Application Information None 2013-08-19 16:56:25 WinMgmt Application Information None 2013-08-19 16:56:35 Office Software Protection Platform Service 900: The Software Protection service is starting. Application Information None 2013-08-19 16:56:40 Office Software Protection Platform Service 1066: Initializati on status for service objects. C:\Program Files\Common Files\Microsoft Shared\O fficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x000 00000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareP rotectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000 000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatf orm\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DL L, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 16:56:40 Office Software Protection Platform Service 902: The Software Protection service has started. 14.0.370.400 Application Information 1 2013-08-19 16:56:40 ESENT 102: Windows (2188) Windows: Th e database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 16:56:40 ESENT 300: Windows (2188) Windows: Th e database engine is initiating recovery steps. Application Information 3 2013-08-19 16:56:40 ESENT 301: Windows (2188) Windows: Th e database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Da ta\Applications\Windows\MSS.log. Application Information 3 2013-08-19 16:56:41 ESENT 302: Windows (2188) Windows: Th e database engine has successfully completed recovery steps. Application Information None 2013-08-19 16:56:42 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information 1 2013-08-19 16:56:42 Windows Search Service 1003: The Windows Search Servic e started. Application Information None 2013-08-19 16:56:44 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 16:56:44 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:44 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information None 2013-08-19 16:56:51 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:53 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algor ithm/volume/1.0 0x00000000 259187)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:53 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b4 8b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:54 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:56, 0, 1, 259187, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:56:55 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2013/08/19 08:56 Application Information None 2013-08-19 16:56:55 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:55 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 436cef53-8387-4692-bb4a-9492cd8226 0e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:55 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:56 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 57a232fe-0931-48fe-9389-e4586967c6 61, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:56 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 7cfd4696-69a9-4af7-af36-ff3d12b6b6 c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bio s/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:56 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 8ec16e01-e86f-415f-b333-1819f41452 94, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:57 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: a0cde89c-3304-4157-b61c-c8ad785d1f ad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:57 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: ac96e1a8-6cc4-4310-a4ff-332ce77fb5 b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:57 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:57 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: b2c4b9f6-3ee6-4a2a-a361-64ad3b61de d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:58 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: bba42084-cacd-4ad4-b606-9f3d6c93b2 c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:58 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: c619d61c-c2f2-40c3-ab3f-c5924314b0 f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:58 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: cfb3e52c-d707-4861-af51-11b27ee616 9c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Error None 2013-08-19 16:57:37 WinMgmt Application Information None 2013-08-19 16:58:02 Desktop Window Manager 9009: The Desktop Window Manage r has exited with code (0x40010004) Application Information None 2013-08-19 16:58:02 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Information None 2013-08-19 16:58:04 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 17:45:53 EventSystem Application Information None 2013-08-19 17:45:53 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 17:45:57 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 17:45:57 Wlclntfy 6000: The winlogon notification subscriber was unavailable to handle a notification event. Application Information None 2013-08-19 17:46:06 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information 1 2013-08-19 17:46:17 SkypeUpdate 100: Service started. Application Information None 2013-08-19 17:46:39 WinMgmt Application Information None 2013-08-19 17:46:46 WinMgmt Application Information 1 2013-08-19 17:46:50 ESENT 102: Windows (2076) Windows: Th e database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 17:46:50 ESENT 300: Windows (2076) Windows: Th e database engine is initiating recovery steps. Application Information 3 2013-08-19 17:46:50 ESENT 301: Windows (2076) Windows: Th e database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Da ta\Applications\Windows\MSS.log. Application Information None 2013-08-19 17:46:51 Office Software Protection Platform Service 900: The Software Protection service is starting. Application Information 3 2013-08-19 17:46:51 ESENT 302: Windows (2076) Windows: Th e database engine has successfully completed recovery steps. Application Information 1 2013-08-19 17:46:54 Windows Search Service 1003: The Windows Search Servic e started. Application Information None 2013-08-19 17:46:56 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: P2: P3: P4: P5: P6: P7: P8: P9: P10: Attached files: C:\Windows\Minidump\081913-24656-01.dmp C:\Users\Vic Tiangco\AppData\Local\Temp \WER-38953-0.sysdata.xml These files may be available here: C:\Users\Vic Tia ngco\AppData\Local\Microsoft\Windows\WER\ReportArchive\Kernel_0_0_cab_058578e4 Analysis symbol: Rechecking for solution: 0 Report Id: 081913-24656-01 Rep ort Status: 2 Application Information None 2013-08-19 17:46:57 Office Software Protection Platform Service 1066: Initializati on status for service objects. C:\Program Files\Common Files\Microsoft Shared\O fficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x000 00000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareP rotectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000 000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatf orm\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DL L, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 17:46:57 Office Software Protection Platform Service 902: The Software Protection service has started. 14.0.370.400 Application Information None 2013-08-19 17:46:59 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 17:47:02 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 17:47:02 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:03 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information None 2013-08-19 17:47:10 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:11 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algor ithm/volume/1.0 0x00000000 259150)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:12 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b4 8b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:13 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 09:47, 0, 1, 259150, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 17:47:13 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2013/08/19 09:47 Application Information None 2013-08-19 17:47:14 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:14 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 436cef53-8387-4692-bb4a-9492cd8226 0e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:14 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:15 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 57a232fe-0931-48fe-9389-e4586967c6 61, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:15 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 7cfd4696-69a9-4af7-af36-ff3d12b6b6 c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bio s/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:15 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 8ec16e01-e86f-415f-b333-1819f41452 94, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:16 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: a0cde89c-3304-4157-b61c-c8ad785d1f ad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:16 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: ac96e1a8-6cc4-4310-a4ff-332ce77fb5 b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:16 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:17 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: b2c4b9f6-3ee6-4a2a-a361-64ad3b61de d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:17 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: bba42084-cacd-4ad4-b606-9f3d6c93b2 c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:17 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: c619d61c-c2f2-40c3-ab3f-c5924314b0 f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:17 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: cfb3e52c-d707-4861-af51-11b27ee616 9c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Error None 2013-08-19 17:47:20 WinMgmt Application Information 1 2013-08-19 17:48:17 SkypeUpdate 103: SkypeUpdate service is shu tting down due to idle timeout. Application Information 1 2013-08-19 17:48:18 SkypeUpdate 101: Service stopped. Application Information None 2013-08-19 17:48:44 SecurityCenter 1: The Windows Security Center Service has started. Application Information None 2013-08-19 17:50:49 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 17:50:49 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 17:52:18 Software Protection Platform Service 903: The Software Protect ion service has stopped. Application Information None 2013-08-19 17:54:42 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 17:54:42 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 18:02:17 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 18:02:18 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 18:02:18 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 18:02:18 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information None 2013-08-19 18:07:18 Software Protection Platform Service 903: The Software Protect ion service has stopped. Application Information None 2013-08-19 18:49:30 System Restore 8194: Successfully created rest ore point (Process = C:\Windows\system32\svchost.exe -k netsvcs; Description = W indows Update). Application Information None 2013-08-19 18:53:11 VSS 8224: The VSS service is shutti ng down due to idle timeout. Application Information None 2013-08-19 20:48:51 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PnPRequestAdditionalSoftware Response: Not available Cab Id: 0 Pr oblem signature: P1: x86 P2: USB\VID_1D57&PID_0016&REV_0021 P3: 6.1.1.0 P4: 0409 P5: input.inf P6: * P7: P8: P9: P10: Attached files: These files may be available here: C:\Users\Vic Tiangco\AppData\Local\Microsoft\Windo ws\WER\ReportQueue\NonCritical_x86_f484c0f15c1e5a491597958a92564c404567493f_cab_ 0e9802dd Analysis symbol: Rechecking for solution: 0 Report Id: b2151d68-0 8cd-11e3-a9a7-0016d4bcce11 Report Status: 4 Application Information None 2013-08-19 20:50:36 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PnPDeviceProblemCode Response: Not available Cab Id: 0 Problem si gnature: P1: x86 P2: USB\UNKNOWN P3: {36fc9e60-c465-11cf-8056-444553540000} P4: 0000002B P5: unknown P6: unknown P7: unknown P8: P9: P10: Attach ed files: C:\Users\Vic Tiangco\AppData\Local\Temp\DMI9F47.tmp.log.xml C:\Windo ws\inf\usb.inf These files may be available here: C:\Users\Vic Tiangco\AppDa ta\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_a796cc5babf24d790d38c fc7dd844dad2e847e4_cab_022d9ff3 Analysis symbol: Rechecking for solution: 0 Report Id: f11457f7-08cd-11e3-a9a7-0016d4bcce11 Report Status: 4 Application Information None 2013-08-19 23:24:41 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 23:24:45 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 23:24:45 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 23:24:45 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information None 2013-08-19 23:26:32 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 23:26:32 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Security Audit Success 12288 2013-08-19 14:02:18 Microsoft-Windows-Security-Auditing 4616: The system time was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Proces s ID: 0x13c Name: C:\Windows\System32\oobe\msoobe.exe Previous Time: 2013 -08-19T21:02:18.265625000Z New Time: 2013-08-19T06:02:18.187000000Z This ev ent is generated when the system time is changed. It is normal for the Windows T ime Service, which runs with System privilege, to change the system time on a re gular basis. Other system time changes may be indicative of attempts to tamper w ith the computer. Security Audit Success 13824 2013-08-19 14:02:18 Microsoft-Windows-Security-Auditing 4720: A user account was c reated. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 New Account: Security ID: S -1-5-21-2415673615-2399998967-532945099-1000 Account Name: Vic Tiangco Acco unt Domain: emovhicRN Attributes: SAM Account Name: Vic Tiangco Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%179 3 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 Allowed To Delegate To: - Old UAC Value: 0x0 New UAC Value: 0x15 User Account Control: %%2080 %%2082 %%2084 User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges - Security Audit Success 13824 2013-08-19 14:02:18 Microsoft-Windows-Security-Auditing 4722: A user account was e nabled. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Name: Vic Tiangco A ccount Domain: emovhicRN Security Audit Success 13824 2013-08-19 14:02:18 Microsoft-Windows-Security-Auditing 4738: A user account was c hanged. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Name: Vic Tiangco A ccount Domain: emovhicRN Changed Attributes: SAM Account Name: Vic Tiangco Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Ho me Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstat ions: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Gr oup ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x15 New UAC Value: 0x 14 User Account Control: %%2048 User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: - Security Audit Success 13826 2013-08-19 14:02:18 Microsoft-Windows-Security-Auditing 4728: A member was added t o a security-enabled global group. Subject: Security ID: S-1-5-18 Accoun t Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Mem ber: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: - Group: Security ID: S-1-5-21-2415673615-2399998967-532945099-513 G roup Name: None Group Domain: emovhicRN Additional Information: Privile ges: - Security Audit Success 13826 2013-08-19 14:02:18 Microsoft-Windows-Security-Auditing 4732: A member was added t o a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Memb er: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Name : - Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Additional Information: Privileges: - Security Audit Success 13826 2013-08-19 14:02:18 Microsoft-Windows-Security-Auditing 4732: A member was added t o a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Memb er: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Name : - Group: Security ID: S-1-5-32-544 Group Name: Administrators Grou p Domain: Builtin Additional Information: Privileges: - Security Audit Success 13824 2013-08-19 14:02:19 Microsoft-Windows-Security-Auditing 4738: A user account was c hanged. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Name: Vic Tiangco A ccount Domain: emovhicRN Changed Attributes: SAM Account Name: Vic Tiangco Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Ho me Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstat ions: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Gr oup ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x14 New UAC Value: 0x 214 User Account Control: %%2089 User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: - Security Audit Success 13824 2013-08-19 14:02:19 Microsoft-Windows-Security-Auditing 4738: A user account was c hanged. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Name: Vic Tiangco A ccount Domain: emovhicRN Changed Attributes: SAM Account Name: Vic Tiangco Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Ho me Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstat ions: %%1793 Password Last Set: 8/19/2013 2:02:19 PM Account Expires: %%179 4 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x214 New UAC Value: 0x214 User Account Control: - User Parameters: - SID History: - Logon Hours: %%1797 Additional Information: Privileges: - Security Audit Success 13824 2013-08-19 14:02:19 Microsoft-Windows-Security-Auditing 4724: An attempt was made to reset an account's password. Subject: Security ID: S-1-5-18 Account N ame: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Accoun t Name: Vic Tiangco Account Domain: emovhicRN Security Audit Success 13824 2013-08-19 14:02:19 Microsoft-Windows-Security-Auditing 4738: A user account was c hanged. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Name: Vic Tiangco A ccount Domain: emovhicRN Changed Attributes: SAM Account Name: - Display Name: - User Principal Name: - Home Directory: - Home Drive: - Scrip t Path: - Profile Path: - User Workstations: - Password Last Set: - Ac count Expires: - Primary Group ID: - AllowedToDelegateTo: - Old UAC Value : - New UAC Value: - User Account Control: - User Parameters: - SID Hi story: - Logon Hours: - Additional Information: Privileges: - Security Audit Success 13826 2013-08-19 14:02:19 Microsoft-Windows-Security-Auditing 4733: A member was removed from a security-enabled local group. Subject: Security ID: S-1-5-18 Acc ount Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Member: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Name: - Group: Security ID: S-1-5-32-545 Group Name: Users Group Dom ain: Builtin Additional Information: Privileges: - Security Audit Success 12544 2013-08-19 14:02:20 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1 FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: N T AUTHORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000 000} Process Information: Process ID: 0x1b8 Process Name: C:\Windows\Sy stem32\services.exe Network Information: Workstation Name: Source Networ k Address: - Source Port: - Detailed Authentication Information: Logon P rocess: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a l ogon session is created. It is generated on the computer that was accessed. T he subject fields indicate the account on the local system which requested the l ogon. This is most commonly a service such as the Server service, or a local pro cess such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (n etwork). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate wh ere a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields pr ovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated sessio n key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:02:20 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:03:10 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUI D: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Use d: Account Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {000 00000-0000-0000-0000-000000000000} Target Server: Target Server Name: local host Additional Information: localhost Process Information: Process ID: 0x17c Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a proce ss attempts to log on an account by explicitly specifying that accounts credentia ls. This most commonly occurs in batch-type configurations such as scheduled ta sks, or when using the RUNAS command. Security Audit Success 12544 2013-08-19 14:03:10 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1 FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Logon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Accou nt Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x53d3a Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x17c Process Name: C:\Windows\System32\winlogon.exe Network Informat ion: Workstation Name: WIN-LQ1FLH44Q2B Source Network Address: 127.0.0.1 S ource Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTL M only): - Key Length: 0 This event is generated when a logon session is c reated. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is mos t commonly a service such as the Server service, or a local process such as Winl ogon.exe or Services.exe. The logon type field indicates the kind of logon th at occurred. The most common types are 2 (interactive) and 3 (network). The N ew Logon fields indicate the account for whom the new logon was created, i.e. th e account that was logged on. The network fields indicate where a remote logo n request originated. Workstation name is not always available and may be left b lank in some cases. The authentication information fields provide detailed in formation about this specific logon request. - Logon GUID is a unique identifi er that can be used to correlate this event with a KDC event. - Transited serv ices indicate which intermediate services have participated in this logon reques t. - Package name indicates which sub-protocol was used among the NTLM protoco ls. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:03:10 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1 FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Logon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Accou nt Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x53d81 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x17c Process Name: C:\Windows\System32\winlogon.exe Network Informat ion: Workstation Name: WIN-LQ1FLH44Q2B Source Network Address: 127.0.0.1 S ource Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTL M only): - Key Length: 0 This event is generated when a logon session is c reated. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is mos t commonly a service such as the Server service, or a local process such as Winl ogon.exe or Services.exe. The logon type field indicates the kind of logon th at occurred. The most common types are 2 (interactive) and 3 (network). The N ew Logon fields indicate the account for whom the new logon was created, i.e. th e account that was logged on. The network fields indicate where a remote logo n request originated. Workstation name is not always available and may be left b lank in some cases. The authentication information fields provide detailed in formation about this specific logon request. - Logon GUID is a unique identifi er that can be used to correlate this event with a KDC event. - Transited serv ices indicate which intermediate services have participated in this logon reques t. - Package name indicates which sub-protocol was used among the NTLM protoco ls. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:03:10 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0x53d3a Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDeb ugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 103 2013-08-19 14:03:30 Microsoft-Windows-Eventlog 1100: The event logging service has shut down. Security Audit Success 12545 2013-08-19 14:03:30 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x53d81 T his event is generated when a logoff is initiated. No further user-initiated act ivity can occur. This event can be interpreted as a logoff event. Security Audit Success 12288 2013-08-19 14:04:17 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 14:04:18 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: - Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 13568 2013-08-19 14:04:21 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x698e Security Audit Success 12544 2013-08-19 14:04:22 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1b8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:04:22 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:04:23 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1b8 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: - Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:04:23 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x1b8 Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:04:23 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:04:23 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:04:24 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1b8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:04:24 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1b8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:04:24 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:04:24 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:04:31 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1b8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:04:31 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 14:04:33 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12544 2013-08-19 14:04:33 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {00000000- 0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x17c Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that accounts credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 14:04:33 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xf043 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 17c Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12544 2013-08-19 14:04:33 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xf069 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 17c Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12548 2013-08-19 14:04:33 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0xf043 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebu gPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 14:04:36 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 14:04:46 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x139b7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: - Network Information: Wor kstation Name: Source Network Address: - Source Port: - Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 14:05:10 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1b8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:05:10 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:06:49 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1b8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:06:49 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12545 2013-08-19 14:14:03 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xf069 Th is event is generated when a logoff is initiated. No further user-initiated acti vity can occur. This event can be interpreted as a logoff event. Security Audit Success 103 2013-08-19 14:14:04 Microsoft-Windows-Eventlog 1100: The event logging service has shut down. Security Audit Success 12288 2013-08-19 14:14:43 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 14:14:44 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: - Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:14:44 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:14:44 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 14:14:44 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x651b Security Audit Success 12544 2013-08-19 14:14:45 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: - Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:14:45 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:14:45 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:14:45 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:14:45 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:14:45 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:14:45 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:14:45 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:14:48 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:14:48 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 14:14:49 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12544 2013-08-19 14:14:49 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {00000000- 0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x184 Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that accounts credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 14:14:49 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xea20 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 184 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12544 2013-08-19 14:14:49 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xea4d Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 184 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12548 2013-08-19 14:14:49 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0xea20 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebu gPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 14:14:50 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 14:14:52 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x131bf Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: - Network Information: Wor kstation Name: Source Network Address: - Source Port: - Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 14:14:52 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:14:52 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:15:05 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:15:05 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12288 2013-08-19 14:18:15 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 14:18:15 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: - Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:18:15 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:18:15 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 14:18:15 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x6530 Security Audit Success 101 2013-08-19 14:18:16 Microsoft-Windows-Eventlog 1101: Audit events have been dr opped by the transport. 0 Security Audit Success 12544 2013-08-19 14:18:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: - Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:18:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:18:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:18:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:18:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:18:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:18:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:18:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:18:19 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:18:19 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 14:18:20 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12544 2013-08-19 14:18:20 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {00000000- 0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x184 Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that accounts credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 14:18:20 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xea0a Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 184 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12544 2013-08-19 14:18:20 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xea37 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 184 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12548 2013-08-19 14:18:20 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0xea0a Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebu gPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 14:18:21 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 14:18:23 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x131d0 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: - Network Information: Wor kstation Name: Source Network Address: - Source Port: - Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 14:18:23 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:18:23 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:18:31 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:18:31 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12290 2013-08-19 14:23:08 Microsoft-Windows-Security-Auditing 5056: A cryptographic self test was performed. Subject: Security ID: S-1-5-18 Account Name: EMOVH ICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Module: ncrypt.dll Return Code: 0x0 Security Audit Success 12545 2013-08-19 14:24:32 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xea37 Th is event is generated when a logoff is initiated. No further user-initiated acti vity can occur. This event can be interpreted as a logoff event. Security Audit Success 103 2013-08-19 14:24:34 Microsoft-Windows-Eventlog 1100: The event logging service has shut down. Security Audit Success 12288 2013-08-19 14:25:16 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 14:25:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: - Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: - Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x6f70 Security Audit Success 12290 2013-08-19 14:25:18 Microsoft-Windows-Security-Auditing 5056: A cryptographic self test was performed. Subject: Security ID: S-1-5-18 Account Name: EMOVH ICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Module: ncrypt.dll Return Code: 0x0 Security Audit Success 12544 2013-08-19 14:25:22 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {00000000- 0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x194 Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that accounts credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 14:25:22 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xef95 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 194 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12548 2013-08-19 14:25:22 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0xef95 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebu gPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 14:25:23 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12544 2013-08-19 14:25:23 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:25:23 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 14:25:24 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 14:25:24 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x13fea Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: - Network Information: Wor kstation Name: Source Network Address: - Source Port: - Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 14:25:25 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:25:25 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:25:32 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:25:32 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12545 2013-08-19 14:29:46 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xef95 Th is event is generated when a logoff is initiated. No further user-initiated acti vity can occur. This event can be interpreted as a logoff event. Security Audit Success 103 2013-08-19 14:29:48 Microsoft-Windows-Eventlog 1100: The event logging service has shut down. Security Audit Success 12288 2013-08-19 14:30:33 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 14:30:33 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: - Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 13568 2013-08-19 14:30:33 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x6d1d Security Audit Success 12544 2013-08-19 14:30:40 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:30:40 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: - Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:30:40 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:30:40 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:30:40 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:30:40 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:30:40 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:30:40 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:30:41 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:30:41 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12290 2013-08-19 14:30:42 Microsoft-Windows-Security-Auditing 5056: A cryptographic self test was performed. Subject: Security ID: S-1-5-18 Account Name: EMOVH ICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Module: ncrypt.dll Return Code: 0x0 Security Audit Success 12544 2013-08-19 14:30:42 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {00000000- 0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x1f4 Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that accounts credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 14:30:42 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x101dc Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0 x1f4 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentic ation Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It i s generated on the computer that was accessed. The subject fields indicate th e account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fie lds indicate the account for whom the new logon was created, i.e. the account th at was logged on. The network fields indicate where a remote logon request or iginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information ab out this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicat e which intermediate services have participated in this logon request. - Packa ge name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no s ession key was requested. Security Audit Success 12548 2013-08-19 14:30:42 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0x101dc Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDeb ugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 14:30:44 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12544 2013-08-19 14:30:44 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:30:44 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 14:30:45 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 14:30:45 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x19a37 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: - Network Information: Wor kstation Name: Source Network Address: - Source Port: - Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 14:30:45 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:30:45 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:30:51 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:30:51 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:33:40 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:33:40 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:34:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:34:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:34:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:34:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 14:34:44 Microsoft-Windows-Security-Auditing 4904: An attempt was made to register a security event source. Subject : Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0xdc8 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x6c384 Security Audit Success 13568 2013-08-19 14:34:44 Microsoft-Windows-Security-Auditing 4905: An attempt was made to unregister a security event source. Subject Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0xdc8 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x6c384 Security Audit Success 12544 2013-08-19 14:41:46 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:41:46 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:57:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:57:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:57:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:57:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 14:57:40 Microsoft-Windows-Security-Auditing 4904: An attempt was made to register a security event source. Subject : Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0xfb4 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x195dc2 Security Audit Success 13568 2013-08-19 14:57:40 Microsoft-Windows-Security-Auditing 4905: An attempt was made to unregister a security event source. Subject Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0xfb4 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x195dc2 Security Audit Success 12544 2013-08-19 15:03:56 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:03:56 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:03:56 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:03:56 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 15:04:10 Microsoft-Windows-Security-Auditing 4904: An attempt was made to register a security event source. Subject : Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0xf0c Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x2b5f00 Security Audit Success 13568 2013-08-19 15:04:10 Microsoft-Windows-Security-Auditing 4905: An attempt was made to unregister a security event source. Subject Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0xf0c Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x2b5f00 Security Audit Success 12544 2013-08-19 15:07:37 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:07:37 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:13:44 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:13:44 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:13:45 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:13:45 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:13:45 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:13:45 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 15:14:14 Microsoft-Windows-Security-Auditing 4904: An attempt was made to register a security event source. Subject : Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0x748 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x39fcb0 Security Audit Success 13568 2013-08-19 15:14:14 Microsoft-Windows-Security-Auditing 4905: An attempt was made to unregister a security event source. Subject Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0x748 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x39fcb0 Security Audit Success 12545 2013-08-19 15:17:36 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x101dc T his event is generated when a logoff is initiated. No further user-initiated act ivity can occur. This event can be interpreted as a logoff event. Security Audit Success 103 2013-08-19 15:17:43 Microsoft-Windows-Eventlog 1100: The event logging service has shut down. Security Audit Success 12288 2013-08-19 15:18:36 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 15:18:36 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: - Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 13568 2013-08-19 15:18:36 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x6e12 Security Audit Success 12544 2013-08-19 15:18:54 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1d8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:18:54 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1d8 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: - Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:18:54 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1d8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:18:54 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:18:54 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:18:54 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:18:55 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {00000000- 0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x1e4 Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that accounts credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 15:18:55 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xaf8a Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 1e4 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12548 2013-08-19 15:18:55 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0xaf8a Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebu gPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12545 2013-08-19 15:25:13 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xaf8a Th is event is generated when a logoff is initiated. No further user-initiated acti vity can occur. This event can be interpreted as a logoff event. Security Audit Success 12288 2013-08-19 15:25:52 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 15:25:52 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: - Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 13568 2013-08-19 15:25:52 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x7563 Security Audit Success 12544 2013-08-19 15:25:53 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:25:53 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: - Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:25:53 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:25:53 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:25:53 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:25:53 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:25:53 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:25:53 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:25:57 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {00000000- 0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x20c Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that accounts credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 15:25:57 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xb5e1 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 20c Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12548 2013-08-19 15:25:57 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0xb5e1 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebu gPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12545 2013-08-19 15:28:47 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xb5e1 Th is event is generated when a logoff is initiated. No further user-initiated acti vity can occur. This event can be interpreted as a logoff event. Security Audit Success 12288 2013-08-19 15:29:26 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 15:29:26 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: - Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 13568 2013-08-19 15:29:26 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x743b Security Audit Success 12544 2013-08-19 15:29:27 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:29:27 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: - Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:29:27 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:29:27 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:29:27 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:29:27 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:29:27 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:29:27 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:29:27 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:29:27 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12290 2013-08-19 15:29:28 Microsoft-Windows-Security-Auditing 5056: A cryptographic self test was performed. Subject: Security ID: S-1-5-18 Account Name: EMOVH ICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Module: ncrypt.dll Return Code: 0x0 Security Audit Success 12544 2013-08-19 15:29:31 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:29:31 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 15:29:32 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12292 2013-08-19 15:29:35 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 15:29:35 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {00000000- 0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x21c Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that accounts credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 15:29:35 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x12fed Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0 x21c Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentic ation Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It i s generated on the computer that was accessed. The subject fields indicate th e account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fie lds indicate the account for whom the new logon was created, i.e. the account th at was logged on. The network fields indicate where a remote logon request or iginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information ab out this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicat e which intermediate services have participated in this logon request. - Packa ge name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no s ession key was requested. Security Audit Success 12548 2013-08-19 15:29:35 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0x12fed Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDeb ugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:29:37 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x14117 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: - Network Information: Wor kstation Name: Source Network Address: - Source Port: - Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 15:29:52 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:29:52 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:30:02 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:30:02 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:31:32 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:31:32 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:35:48 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:35:48 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:35:48 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:35:48 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 15:36:46 Microsoft-Windows-Security-Auditing 4904: An attempt was made to register a security event source. Subject : Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0x8e8 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0xa5a8a Security Audit Success 13568 2013-08-19 15:36:46 Microsoft-Windows-Security-Auditing 4905: An attempt was made to unregister a security event source. Subject Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0x8e8 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0xa5a8a Security Audit Success 12545 2013-08-19 15:45:07 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x12fed T his event is generated when a logoff is initiated. No further user-initiated act ivity can occur. This event can be interpreted as a logoff event. Security Audit Success 103 2013-08-19 15:45:10 Microsoft-Windows-Eventlog 1100: The event logging service has shut down. Security Audit Success 12288 2013-08-19 15:46:10 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 15:46:10 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: - Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 13568 2013-08-19 15:46:10 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x6e49 Security Audit Success 12544 2013-08-19 15:46:21 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:46:21 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: - Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:46:21 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:46:21 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:46:21 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:46:21 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:46:22 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:46:22 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:46:22 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:46:22 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12290 2013-08-19 15:46:24 Microsoft-Windows-Security-Auditing 5056: A cryptographic self test was performed. Subject: Security ID: S-1-5-18 Account Name: EMOVH ICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Module: ncrypt.dll Return Code: 0x0 Security Audit Success 12544 2013-08-19 15:46:24 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {00000000- 0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x1d0 Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that accounts credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 15:46:24 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xfdaf Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 1d0 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12548 2013-08-19 15:46:24 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0xfdaf Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebu gPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:46:25 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:46:25 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 15:46:26 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12292 2013-08-19 15:46:27 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 15:46:31 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x1ac42 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: - Network Information: Wor kstation Name: Source Network Address: - Source Port: - Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 15:46:43 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:46:43 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:46:43 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:46:43 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:48:25 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:48:25 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:49:31 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:49:31 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:49:32 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:49:32 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 15:50:00 Microsoft-Windows-Security-Auditing 4904: An attempt was made to register a security event source. Subject : Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0x924 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x7fdf4 Security Audit Success 13568 2013-08-19 15:50:00 Microsoft-Windows-Security-Auditing 4905: An attempt was made to unregister a security event source. Subject Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0x924 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x7fdf4 Security Audit Success 12544 2013-08-19 15:54:56 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:54:56 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:56:33 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:56:33 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:56:33 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:56:33 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 15:57:07 Microsoft-Windows-Security-Auditing 4904: An attempt was made to register a security event source. Subject : Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0x568 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0xec296 Security Audit Success 13568 2013-08-19 15:57:07 Microsoft-Windows-Security-Auditing 4905: An attempt was made to unregister a security event source. Subject Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0x568 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0xec296 Security Audit Success 12544 2013-08-19 16:01:53 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:01:53 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:02:52 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:02:52 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:10:04 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:10:04 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:10:05 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:10:05 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 16:10:32 Microsoft-Windows-Security-Auditing 4904: An attempt was made to register a security event source. Subject : Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0xa9c Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x1f1855 Security Audit Success 13568 2013-08-19 16:10:32 Microsoft-Windows-Security-Auditing 4905: An attempt was made to unregister a security event source. Subject Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0xa9c Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x1f1855 Security Audit Success 12545 2013-08-19 16:11:01 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xfdaf Th is event is generated when a logoff is initiated. No further user-initiated acti vity can occur. This event can be interpreted as a logoff event. Security Audit Success 103 2013-08-19 16:11:08 Microsoft-Windows-Eventlog 1100: The event logging service has shut down. Security Audit Success 12288 2013-08-19 16:12:13 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 16:12:13 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: - Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 13568 2013-08-19 16:12:13 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x6e2e Security Audit Success 12544 2013-08-19 16:12:23 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:12:23 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:12:24 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: - Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 16:12:24 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 16:12:24 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:12:24 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 16:12:24 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 16:12:24 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12290 2013-08-19 16:12:25 Microsoft-Windows-Security-Auditing 5056: A cryptographic self test was performed. Subject: Security ID: S-1-5-18 Account Name: EMOVH ICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Module: ncrypt.dll Return Code: 0x0 Security Audit Success 12544 2013-08-19 16:12:25 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:12:25 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:12:26 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {00000000- 0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x1d0 Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that accounts credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 16:12:26 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x10897 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0 x1d0 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentic ation Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It i s generated on the computer that was accessed. The subject fields indicate th e account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fie lds indicate the account for whom the new logon was created, i.e. the account th at was logged on. The network fields indicate where a remote logon request or iginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information ab out this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicat e which intermediate services have participated in this logon request. - Packa ge name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no s ession key was requested. Security Audit Success 12548 2013-08-19 16:12:26 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0x10897 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDeb ugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 16:12:27 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12544 2013-08-19 16:12:27 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:12:27 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 16:12:28 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 16:12:34 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x1a632 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: - Network Information: Wor kstation Name: Source Network Address: - Source Port: - Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 16:12:53 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 16:12:53 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:12:53 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 16:12:53 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:13:02 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:13:02 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:14:09 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 16:14:09 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:14:09 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 16:14:09 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 16:14:34 Microsoft-Windows-Security-Auditing 4904: An attempt was made to register a security event source. Subject : Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0xab8 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x4db66 Security Audit Success 13568 2013-08-19 16:14:34 Microsoft-Windows-Security-Auditing 4905: An attempt was made to unregister a security event source. Subject Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0xab8 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x4db66 Security Audit Success 12544 2013-08-19 16:20:13 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:20:13 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12545 2013-08-19 16:41:06 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x10897 T his event is generated when a logoff is initiated. No further user-initiated act ivity can occur. This event can be interpreted as a logoff event. Security Audit Success 103 2013-08-19 16:41:12 Microsoft-Windows-Eventlog 1100: The event logging service has shut down. Security Audit Success 12288 2013-08-19 16:42:15 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 16:42:15 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: - Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 13568 2013-08-19 16:42:15 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x780b Security Audit Success 12544 2013-08-19 16:42:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1f8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 16:42:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1f8 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: - Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 16:42:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x1f8 Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:42:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 16:42:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 16:42:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:42:17 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1f8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 16:42:17 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1f8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:42:17 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 16:42:17 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12290 2013-08-19 16:42:18 Microsoft-Windows-Security-Auditing 5056: A cryptographic self test was performed. Subject: Security ID: S-1-5-18 Account Name: EMOVH ICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Module: ncrypt.dll Return Code: 0x0 Security Audit Success 12544 2013-08-19 16:42:18 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {00000000- 0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x1cc Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that accounts credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 16:42:18 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xfd59 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 1cc Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12548 2013-08-19 16:42:18 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0xfd59 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebu gPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:42:19 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1f8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:42:19 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 16:42:20 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12292 2013-08-19 16:42:21 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 16:42:24 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x19a4a Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: - Network Information: Wor kstation Name: Source Network Address: - Source Port: - Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 16:42:32 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1f8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:42:32 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:42:37 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1f8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:42:37 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:55:12 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1f8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:55:12 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12545 2013-08-19 16:55:14 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xfd59 Th is event is generated when a logoff is initiated. No further user-initiated acti vity can occur. This event can be interpreted as a logoff event. Security Audit Success 103 2013-08-19 16:55:15 Microsoft-Windows-Eventlog 1100: The event logging service has shut down. Security Audit Success 12288 2013-08-19 16:56:14 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 16:56:14 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: - Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 16:56:14 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x200 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:56:14 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 16:56:14 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x7415 Security Audit Success 12544 2013-08-19 16:56:15 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x200 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: - Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 16:56:15 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x200 Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:56:15 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 16:56:15 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:56:17 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x200 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 16:56:17 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x200 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:56:17 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 16:56:17 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12290 2013-08-19 16:56:18 Microsoft-Windows-Security-Auditing 5056: A cryptographic self test was performed. Subject: Security ID: S-1-5-18 Account Name: EMOVH ICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Module: ncrypt.dll Return Code: 0x0 Security Audit Success 12544 2013-08-19 16:56:19 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {00000000- 0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x1d4 Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that accounts credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 16:56:19 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x103f7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0 x1d4 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentic ation Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It i s generated on the computer that was accessed. The subject fields indicate th e account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fie lds indicate the account for whom the new logon was created, i.e. the account th at was logged on. The network fields indicate where a remote logon request or iginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information ab out this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicat e which intermediate services have participated in this logon request. - Packa ge name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no s ession key was requested. Security Audit Success 12548 2013-08-19 16:56:19 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0x103f7 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDeb ugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:56:20 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x200 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:56:20 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 16:56:21 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12292 2013-08-19 16:56:23 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 16:56:24 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x1a222 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: - Network Information: Wor kstation Name: Source Network Address: - Source Port: - Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 16:56:31 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x200 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:56:31 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:56:37 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x200 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:56:37 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:56:40 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x200 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:56:40 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12545 2013-08-19 16:58:02 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x103f7 T his event is generated when a logoff is initiated. No further user-initiated act ivity can occur. This event can be interpreted as a logoff event. Security Audit Success 103 2013-08-19 16:58:04 Microsoft-Windows-Eventlog 1100: The event logging service has shut down. Security Audit Success 12288 2013-08-19 17:45:43 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 17:45:43 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: - Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 13568 2013-08-19 17:45:44 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x86b5 Security Audit Success 12544 2013-08-19 17:45:47 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 17:45:47 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 17:45:52 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: - Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 17:45:52 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12290 2013-08-19 17:45:53 Microsoft-Windows-Security-Auditing 5056: A cryptographic self test was performed. Subject: Security ID: S-1-5-18 Account Name: EMOVH ICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Module: ncrypt.dll Return Code: 0x0 Security Audit Success 12544 2013-08-19 17:45:53 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 17:45:53 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 17:45:53 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 17:45:53 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 17:45:53 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 17:45:53 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 17:45:56 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {00000000- 0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x24c Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that accounts credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 17:45:56 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x114a7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0 x24c Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentic ation Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It i s generated on the computer that was accessed. The subject fields indicate th e account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fie lds indicate the account for whom the new logon was created, i.e. the account th at was logged on. The network fields indicate where a remote logon request or iginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information ab out this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicat e which intermediate services have participated in this logon request. - Packa ge name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no s ession key was requested. Security Audit Success 12548 2013-08-19 17:45:56 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0x114a7 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeImp ersonatePrivilege Security Audit Success 12544 2013-08-19 17:46:09 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 17:46:09 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 17:46:16 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12292 2013-08-19 17:46:35 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 17:46:40 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x202db Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: - Network Information: Wor kstation Name: Source Network Address: - Source Port: - Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 17:46:42 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 17:46:42 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 17:46:51 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 17:46:51 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 17:46:56 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 17:46:56 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 18:49:09 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 18:49:09 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 18:49:11 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: - Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 18:49:11 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 18:50:11 Microsoft-Windows-Security-Auditing 4904: An attempt was made to register a security event source. Subject : Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0x574 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x10c180 Security Audit Success 13568 2013-08-19 18:50:11 Microsoft-Windows-Security-Auditing 4905: An attempt was made to unregister a security event source. Subject Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0x574 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x10c180 System Information None 2010-11-21 05:57:42 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2010-11-21 05:57:42 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information None 2010-11-21 05:57:42 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2010-11-21 05:57:42 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2010-11-21 05:57:42 Service Control Manager 7036: The Windows Modules Insta ller service entered the stopped state. System Information None 2010-11-21 05:57:42 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Information 7010 2010-11-21 05:57:42 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Information 103 2010-11-21 05:57:43 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2010-11-21 05:57:46 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 14:02:18 SYSTEM Microsoft-Windows-Kernel-General 1: Incorrect function. System Information None 2013-08-19 14:03:03 SYSTEM USER32 1074: The process C:\Windows\sy stem32\shutdown.exe (WIN-LQ1FLH44Q2B) has initiated the restart of computer EMOV HICRN on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title f or this reason could be found Reason Code: 0x800000ff Shutdown Type: resta rt Comment: System Information 1101 2013-08-19 14:03:13 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information None 2013-08-19 14:03:16 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 14:03:18 Vic Tiangco Microsoft-Windows-GroupPolicy 1501: The Group Policy settings for the user were processed successfully. There were no changes detected since the last successful processing of Group Policy. System Information None 2013-08-19 14:03:21 Service Control Manager 7036: The Application Informati on service entered the running state. System Information 7005 2013-08-19 14:03:28 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service AsyncMac for Device Instance ID SW\{EEAB7790- C514-11D1-B42B-00805FC1270E}\ASYNCMAC with the following status: 0. System Information None 2013-08-19 14:03:29 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 14:03:30 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 14:03:30 Service Control Manager 7036: The Power service entered the stopped state. System Information None 2013-08-19 14:03:30 Service Control Manager 7036: The DHCP Client service e ntered the stopped state. System Information None 2013-08-19 14:03:30 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the stopped state. System Information None 2013-08-19 14:03:30 Service Control Manager 7036: The Distributed Link Trac king Client service entered the stopped state. System Information None 2013-08-19 14:03:30 Service Control Manager 7036: The Diagnostic Service Ho st service entered the stopped state. System Information 4 2013-08-19 14:03:30 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51047: DHCPv6 client service i s stopped. ShutDown Flag value is 1 System Information 4 2013-08-19 14:03:30 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50037: DHCPv4 client service is stopped. ShutDown Flag value is 1 System Information 7005 2013-08-19 14:03:30 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver for Device Instance ID SW\{EEAB7790-C514-11D1 -B42B-00805FC1270E}\ASYNCMAC with the following status: 0x0. System Information None 2013-08-19 14:03:31 EventLog 6006: The Event log service was stopped. System Information None 2013-08-19 14:03:31 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 14:03:31 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the stopped state. System Information None 2013-08-19 14:03:31 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 14:03:31 Service Control Manager 7036: The Windows Management In strumentation service entered the stopped state. System Information None 2013-08-19 14:03:31 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information 1102 2013-08-19 14:03:31 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information 7010 2013-08-19 14:03:31 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Information None 2013-08-19 14:03:32 Service Control Manager 7036: The Superfetch service en tered the stopped state. System Information None 2013-08-19 14:03:32 Service Control Manager 7036: The Windows Modules Insta ller service entered the stopped state. System Information None 2013-08-19 14:03:32 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Information None 2013-08-19 14:03:32 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 14:03:32 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Information 103 2013-08-19 14:03:32 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 14:03:36 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 14:03:55 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 14:03:55 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 86 2013-08-19 14:04:09 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information 4 2013-08-19 14:04:10 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Warning None 2013-08-19 14:04:15 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 14:04:22 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 14:04:22 Service Control Manager 7036: The Power service entered the running state. System Information 7010 2013-08-19 14:04:22 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Information None 2013-08-19 14:04:23 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 14:04:23 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 14:04:23 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 14:04:23 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information None 2013-08-19 14:04:24 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 14:04:24 EventLog 6005: The Event log service was started. System Information None 2013-08-19 14:04:24 EventLog 6013: The system uptime is 28 s econds. System Information None 2013-08-19 14:04:24 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 14:04:24 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 14:04:25 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 14:04:25 Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 14:04:27 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 14:04:27 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 14:04:27 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 14:04:27 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 14:04:27 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 14:04:27 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 14:04:27 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 14:04:27 Service Control Manager 7036: The Security Accounts Man ager service entered the running state. System Information None 2013-08-19 14:04:28 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 14:04:28 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information 4 2013-08-19 14:04:28 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started System Information None 2013-08-19 14:04:29 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information None 2013-08-19 14:04:29 Service Control Manager 7036: The DNS Client service en tered the running state. System Information None 2013-08-19 14:04:29 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information 4 2013-08-19 14:04:29 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i s started System Information None 2013-08-19 14:04:31 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 14:04:32 Service Control Manager 7036: The Print Spooler service entered the running state. System Information None 2013-08-19 14:04:33 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information None 2013-08-19 14:04:34 Service Control Manager 7036: The Windows Firewall serv ice entered the running state. System Information 1101 2013-08-19 14:04:34 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information None 2013-08-19 14:04:35 Service Control Manager 7036: The Workstation service e ntered the running state. System Information None 2013-08-19 14:04:35 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the running state. System Information None 2013-08-19 14:04:37 Service Control Manager 7036: The Cryptographic Service s service entered the running state. System Information None 2013-08-19 14:04:38 Service Control Manager 7036: The Superfetch service en tered the running state. System Information None 2013-08-19 14:04:39 Service Control Manager 7036: The Distributed Link Trac king Client service entered the running state. System Information None 2013-08-19 14:04:39 Service Control Manager 7036: The Network Location Awar eness service entered the running state. System Information None 2013-08-19 14:04:40 Service Control Manager 7036: The Windows Management In strumentation service entered the running state. System Information None 2013-08-19 14:04:43 Service Control Manager 7036: The IP Helper service ent ered the running state. System Information None 2013-08-19 14:04:46 Service Control Manager 7036: The Server service entere d the running state. System Information None 2013-08-19 14:04:46 Service Control Manager 7036: The Diagnostic Service Ho st service entered the running state. System Information None 2013-08-19 14:04:47 Service Control Manager 7036: The Diagnostic System Hos t service entered the running state. System Information None 2013-08-19 14:04:48 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 14:04:48 Service Control Manager 7036: The Network List Service service entered the running state. System Information None 2013-08-19 14:04:57 Service Control Manager 7036: The Protected Storage ser vice entered the running state. System Information None 2013-08-19 14:05:03 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 14:05:11 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 14:05:26 Service Control Manager 7036: The Network Connections s ervice entered the running state. System Information None 2013-08-19 14:06:46 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the running state. System Information None 2013-08-19 14:06:47 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the running state. System Information None 2013-08-19 14:06:47 Service Control Manager 7036: The SSDP Discovery servic e entered the running state. System Information None 2013-08-19 14:06:48 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 14:06:48 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 14:06:49 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 14:06:50 Service Control Manager 7036: The Windows Defender serv ice entered the running state. System Information None 2013-08-19 14:06:50 Service Control Manager 7036: The Security Center servi ce entered the running state. System Information None 2013-08-19 14:06:53 Service Control Manager 7036: The Windows Update servic e entered the running state. System Information None 2013-08-19 14:07:03 Service Control Manager 7036: The Application Informati on service entered the running state. System Information None 2013-08-19 14:09:24 Service Control Manager 7036: The Multimedia Class Sche duler service entered the stopped state. System Information None 2013-08-19 14:11:58 Vic Tiangco Microsoft-Windows-GroupPolicy 1503: The Group Policy settings for the user were processed successfully. New settings from 1 Group Policy obje cts were detected and applied. System Information None 2013-08-19 14:11:59 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 14:12:45 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 14:13:32 SYSTEM Microsoft-Windows-GroupPolicy 1502: The Group Policy settings for the computer were processed successfully. New settings from 1 Group Policy objects were detected and applied. System Information None 2013-08-19 14:13:33 SYSTEM Microsoft-Windows-GroupPolicy 1500: The Group Policy settings for the computer were processed successfully. There were no changes detected si nce the last successful processing of Group Policy. System Information None 2013-08-19 14:14:02 Vic Tiangco USER32 1074: The process Explorer.EXE has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: Other (Unplanned) Reason Code: 0x0 Shutd own Type: restart Comment: System Information None 2013-08-19 14:14:03 Service Control Manager 7036: The Windows Update servic e entered the stopped state. System Information None 2013-08-19 14:14:03 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 14:14:03 Vic Tiangco USER32 1074: The process C:\Windows\sy stem32\winlogon.exe (EMOVHICRN) has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: No title for t his reason could be found Reason Code: 0x500ff Shutdown Type: restart C omment: System Information 1102 2013-08-19 14:14:03 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information None 2013-08-19 14:14:04 EventLog 6006: The Event log service was stopped. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The DHCP Client service e ntered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Power service entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Windows Defender serv ice entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Diagnostic Service Ho st service entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Distributed Link Trac king Client service entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The SSDP Discovery servic e entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Security Center servi ce entered the stopped state. System Information 4 2013-08-19 14:14:04 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51047: DHCPv6 client service i s stopped. ShutDown Flag value is 1 System Information 4 2013-08-19 14:14:04 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50037: DHCPv4 client service is stopped. ShutDown Flag value is 1 System Information 7010 2013-08-19 14:14:04 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Information None 2013-08-19 14:14:05 Service Control Manager 7036: The Windows Management In strumentation service entered the stopped state. System Information None 2013-08-19 14:14:05 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the stopped state. System Information None 2013-08-19 14:14:05 Service Control Manager 7036: The Superfetch service en tered the stopped state. System Information None 2013-08-19 14:14:05 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Information None 2013-08-19 14:14:06 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Information 103 2013-08-19 14:14:07 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 14:14:11 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 14:14:29 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 14:14:29 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 86 2013-08-19 14:14:35 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information 4 2013-08-19 14:14:36 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Warning None 2013-08-19 14:14:41 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 14:14:45 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 14:14:45 EventLog 6005: The Event log service was started. System Information None 2013-08-19 14:14:45 EventLog 6013: The system uptime is 15 s econds. System Information None 2013-08-19 14:14:45 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 14:14:45 Service Control Manager 7036: The Power service entered the running state. System Information None 2013-08-19 14:14:45 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 14:14:45 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 14:14:45 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 14:14:45 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 14:14:45 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 14:14:45 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information 7010 2013-08-19 14:14:45 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The Security Accounts Man ager service entered the running state. System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 14:14:47 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information None 2013-08-19 14:14:47 Service Control Manager 7036: The DNS Client service en tered the running state. System Information None 2013-08-19 14:14:47 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information None 2013-08-19 14:14:47 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information 4 2013-08-19 14:14:47 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started System Information 4 2013-08-19 14:14:47 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i s started System Information None 2013-08-19 14:14:48 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 14:14:48 Service Control Manager 7036: The Print Spooler service entered the running state. System Information None 2013-08-19 14:14:49 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information None 2013-08-19 14:14:49 Service Control Manager 7036: The Windows Firewall serv ice entered the running state. System Information None 2013-08-19 14:14:49 Service Control Manager 7036: The Workstation service e ntered the running state. System Information 1101 2013-08-19 14:14:49 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information None 2013-08-19 14:14:50 Service Control Manager 7036: The Cryptographic Service s service entered the running state. System Information None 2013-08-19 14:14:50 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the running state. System Information None 2013-08-19 14:14:50 Service Control Manager 7036: The Network Location Awar eness service entered the running state. System Information None 2013-08-19 14:14:50 Service Control Manager 7036: The Superfetch service en tered the running state. System Information None 2013-08-19 14:14:50 Service Control Manager 7036: The Distributed Link Trac king Client service entered the running state. System Information None 2013-08-19 14:14:50 Service Control Manager 7036: The Windows Management In strumentation service entered the running state. System Information None 2013-08-19 14:14:51 Service Control Manager 7036: The IP Helper service ent ered the running state. System Information None 2013-08-19 14:14:52 Service Control Manager 7036: The Server service entere d the running state. System Information None 2013-08-19 14:14:52 Service Control Manager 7036: The Diagnostic Service Ho st service entered the running state. System Information None 2013-08-19 14:14:52 Service Control Manager 7036: The Network List Service service entered the running state. System Information None 2013-08-19 14:14:53 Service Control Manager 7036: The Windows Defender serv ice entered the running state. System Information None 2013-08-19 14:14:53 Service Control Manager 7036: The Diagnostic System Hos t service entered the running state. System Information None 2013-08-19 14:14:54 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 14:15:05 Service Control Manager 7036: The Network Connections s ervice entered the running state. System Information None 2013-08-19 14:15:06 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 14:16:05 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 14:16:26 Service Control Manager 7036: The Application Informati on service entered the running state. System Information None 2013-08-19 14:16:30 Service Control Manager 7036: The Secondary Logon servi ce entered the running state. System Information None 2013-08-19 14:16:39 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 14:16:39 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Information None 2013-08-19 14:16:54 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 14:16:56 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the running state. System Information None 2013-08-19 14:16:57 Service Control Manager 7036: The SSDP Discovery servic e entered the running state. System Information None 2013-08-19 14:16:58 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the running state. System Information None 2013-08-19 14:17:01 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 14:17:07 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 14:17:09 Service Control Manager 7036: The Security Center servi ce entered the running state. System Information None 2013-08-19 14:18:03 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 14:18:03 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 63 2013-08-19 14:18:08 SYSTEM Microsoft-Windows-Kernel-Power 41: The system has rebooted wit hout cleanly shutting down first. This error could be caused if the system stopp ed responding, crashed, or lost power unexpectedly. System Information 4 2013-08-19 14:18:10 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Information 86 2013-08-19 14:18:10 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information None 2013-08-19 14:18:16 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 14:18:16 EventLog 6005: The Event log service was started. System Information None 2013-08-19 14:18:16 EventLog 6013: The system uptime is 12 s econds. System Information None 2013-08-19 14:18:16 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 14:18:16 Service Control Manager 7036: The Power service entered the running state. System Information None 2013-08-19 14:18:16 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 14:18:16 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 14:18:16 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 14:18:16 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 14:18:16 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 14:18:16 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information 7010 2013-08-19 14:18:16 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Warning None 2013-08-19 14:18:16 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The Security Accounts Man ager service entered the running state. System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 14:18:18 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information None 2013-08-19 14:18:18 Service Control Manager 7036: The DNS Client service en tered the running state. System Information None 2013-08-19 14:18:18 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information None 2013-08-19 14:18:18 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information 4 2013-08-19 14:18:18 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started System Information 4 2013-08-19 14:18:18 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i s started System Information None 2013-08-19 14:18:19 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 14:18:19 Service Control Manager 7036: The Print Spooler service entered the running state. System Information None 2013-08-19 14:18:20 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information None 2013-08-19 14:18:20 Service Control Manager 7036: The Windows Firewall serv ice entered the running state. System Information None 2013-08-19 14:18:20 Service Control Manager 7036: The Workstation service e ntered the running state. System Information 1101 2013-08-19 14:18:20 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information None 2013-08-19 14:18:21 Service Control Manager 7036: The Cryptographic Service s service entered the running state. System Information None 2013-08-19 14:18:21 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the running state. System Information None 2013-08-19 14:18:21 Service Control Manager 7036: The Network Location Awar eness service entered the running state. System Information None 2013-08-19 14:18:21 Service Control Manager 7036: The Superfetch service en tered the running state. System Information None 2013-08-19 14:18:21 Service Control Manager 7036: The Distributed Link Trac king Client service entered the running state. System Information None 2013-08-19 14:18:21 Service Control Manager 7036: The Windows Management In strumentation service entered the running state. System Information None 2013-08-19 14:18:21 Service Control Manager 7036: The IP Helper service ent ered the running state. System Information None 2013-08-19 14:18:23 Service Control Manager 7036: The Server service entere d the running state. System Information None 2013-08-19 14:18:23 Service Control Manager 7036: The Diagnostic Service Ho st service entered the running state. System Information None 2013-08-19 14:18:23 Service Control Manager 7036: The Network List Service service entered the running state. System Information None 2013-08-19 14:18:23 Service Control Manager 7036: The Windows Defender serv ice entered the running state. System Information None 2013-08-19 14:18:23 Service Control Manager 7036: The Diagnostic System Hos t service entered the running state. System Information None 2013-08-19 14:18:23 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 14:18:33 Service Control Manager 7036: The Network Connections s ervice entered the running state. System Information None 2013-08-19 14:18:33 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 14:19:20 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 14:19:43 Service Control Manager 7036: The Application Informati on service entered the running state. System Information None 2013-08-19 14:19:47 Service Control Manager 7036: The Secondary Logon servi ce entered the running state. System Information None 2013-08-19 14:19:53 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 14:19:53 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Information None 2013-08-19 14:20:23 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the running state. System Information None 2013-08-19 14:20:23 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 14:20:24 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the running state. System Information None 2013-08-19 14:20:25 Service Control Manager 7036: The SSDP Discovery servic e entered the running state. System Information None 2013-08-19 14:20:25 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 14:20:26 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 14:20:26 Service Control Manager 7036: The Security Center servi ce entered the running state. System Information None 2013-08-19 14:20:28 Service Control Manager 7036: The Windows Update servic e entered the running state. System Information None 2013-08-19 14:20:58 SYSTEM Service Control Manager 7040: The start type of the pcm cia service was changed from boot start to demand start. System Information None 2013-08-19 14:20:58 SYSTEM Service Control Manager 7040: The start type of the pcm cia service was changed from demand start to boot start. System Information 7005 2013-08-19 14:20:58 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service pci for Device Instance ID PCI\VEN_1524&DEV_1 410&SUBSYS_30C4103C&REV_01\4&22BBBD73&0&30F0 with the following status: 0. System Information 7005 2013-08-19 14:20:58 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service pcmcia for Device Instance ID PCI\VEN_1524&DE V_1410&SUBSYS_30C4103C&REV_01\4&22BBBD73&0&30F0 with the following status: 0. System Information 7005 2013-08-19 14:20:59 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\ecb2kxp.inf_x86_neutral_696cf14 6fd471338\ecb2kxp.inf for Device Instance ID PCI\VEN_1524&DEV_1410&SUBSYS_30C410 3C&REV_01\4&22BBBD73&0&30F0 with the following status: 0x0. System Information 7005 2013-08-19 14:21:07 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\ich6usb.inf_x86_neutral_55333de 56c472d6f\ich6usb.inf for Device Instance ID PCI\VEN_8086&DEV_2658&SUBSYS_30C410 3C&REV_03\3&21436425&0&E8 with the following status: 0x0. System Information 7005 2013-08-19 14:21:09 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service usbehci for Device Instance ID PCI\VEN_8086&D EV_265C&SUBSYS_30C4103C&REV_03\3&21436425&0&EF with the following status: 0. System Information 7005 2013-08-19 14:21:09 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\ich6usb.inf_x86_neutral_55333de 56c472d6f\ich6usb.inf for Device Instance ID PCI\VEN_8086&DEV_265C&SUBSYS_30C410 3C&REV_03\3&21436425&0&EF with the following status: 0x0. System Information 7005 2013-08-19 14:21:12 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service intelide for Device Instance ID PCI\VEN_8086& DEV_266F&SUBSYS_30C4103C&REV_03\3&21436425&0&F9 with the following status: 0. System Information 7005 2013-08-19 14:21:12 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service intelide for Device Instance ID PCI\VEN_8086& DEV_266F&SUBSYS_30C4103C&REV_03\3&21436425&0&F9 with the following status: 0. System Information 7005 2013-08-19 14:21:32 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\ich6id2.inf_x86_neutral_3dfe645 033cbc187\ich6id2.inf for Device Instance ID PCI\VEN_8086&DEV_266F&SUBSYS_30C410 3C&REV_03\3&21436425&0&F9 with the following status: 0x0. System Information 7005 2013-08-19 14:21:35 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\915m.inf_x86_neutral_11dcda8552 c338a2\915m.inf for Device Instance ID PCI\VEN_8086&DEV_2590&SUBSYS_30C4103C&REV _03\3&21436425&0&00 with the following status: 0x0. System Information 7005 2013-08-19 14:21:38 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service msisadrv for Device Instance ID PCI\VEN_8086& DEV_2641&SUBSYS_30C4103C&REV_03\3&21436425&0&F8 with the following status: 0. System Information 7005 2013-08-19 14:21:38 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service msisadrv for Device Instance ID PCI\VEN_8086& DEV_2641&SUBSYS_30C4103C&REV_03\3&21436425&0&F8 with the following status: 0. System Information 7005 2013-08-19 14:21:38 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\ich6core.inf_x86_neutral_de120f 06592fa8da\ich6core.inf for Device Instance ID PCI\VEN_8086&DEV_2641&SUBSYS_30C4 103C&REV_03\3&21436425&0&F8 with the following status: 0x0. System Information None 2013-08-19 14:21:55 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: smserial Service File Name: system32\DRIVERS\s mserial.sys Service Type: kernel mode driver Service Start Type: demand star t Service Account: System Information 7005 2013-08-19 14:21:55 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service smserial for Device Instance ID PCI\VEN_8086& DEV_266D&SUBSYS_30C4103C&REV_03\3&21436425&0&F3 with the following status: 0. System Information None 2013-08-19 14:22:03 Service Control Manager 7036: The Telephony service ent ered the running state. System Information 7005 2013-08-19 14:22:18 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\smserial.inf_x86_neutral_81523e db05aecafc\smserial.inf for Device Instance ID PCI\VEN_8086&DEV_266D&SUBSYS_30C4 103C&REV_03\3&21436425&0&F3 with the following status: 0x0. System Information None 2013-08-19 14:22:23 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: HP Hotkey Device Service File Name: system32\D RIVERS\cpqbttn.sys Service Type: kernel mode driver Service Start Type: dema nd start Service Account: System Information 7005 2013-08-19 14:22:24 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service HBtnKey for Device Instance ID ACPI\HPQ0006\2 &DABA3FF&2 with the following status: 0. System Information 7005 2013-08-19 14:22:24 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\hphkbuttn.inf_x86_neutral_49b05 e758052cd95\hphkbuttn.inf for Device Instance ID ACPI\HPQ0006\2&DABA3FF&2 with t he following status: 0x0. System Information 7005 2013-08-19 14:22:27 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\input.inf_x86_neutral_9e1eba572 4be176f\input.inf for Device Instance ID HID\HPQ0006&COL01\3&2AD7045C&0&0000 wit h the following status: 0x0. System Information 7005 2013-08-19 14:22:28 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service kbdhid for Device Instance ID HID\HPQ0006&COL 02\3&2AD7045C&0&0001 with the following status: 0. System Information 7005 2013-08-19 14:22:29 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service kbdclass for Device Instance ID HID\HPQ0006&C OL02\3&2AD7045C&0&0001 with the following status: 0. System Information 7005 2013-08-19 14:22:29 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\keyboard.inf_x86_neutral_50ad65 9974198591\keyboard.inf for Device Instance ID HID\HPQ0006&COL02\3&2AD7045C&0&00 01 with the following status: 0x0. System Information None 2013-08-19 14:23:05 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows XP Service File Name: system32\DRIVERS\w29n51.sys Service Type: kernel mode driver Service Start Type: demand start Service Account:

System Information 7005 2013-08-19 14:23:05 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service w29n51 for Device Instance ID PCI\VEN_8086&DE V_4220&SUBSYS_12F6103C&REV_05\4&22BBBD73&0&20F0 with the following status: 0. System Information None 2013-08-19 14:23:07 SYSTEM Service Control Manager 7040: The start type of the WLA N AutoConfig service was changed from demand start to auto start. System Information None 2013-08-19 14:23:08 Service Control Manager 7036: The CNG Key Isolation ser vice entered the running state. System Information None 2013-08-19 14:23:08 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the running state. System Information 7005 2013-08-19 14:23:08 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\w29n51.inf_x86_neutral_b409a608 3a818595\w29n51.inf for Device Instance ID PCI\VEN_8086&DEV_4220&SUBSYS_12F6103C &REV_05\4&22BBBD73&0&20F0 with the following status: 0x0. System Information 7005 2013-08-19 14:23:11 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service tunnel for Device Instance ID ROOT\*ISATAP\00 01 with the following status: 0. System Information None 2013-08-19 14:23:12 Service Control Manager 7036: The WinHTTP Web Proxy Aut o-Discovery Service service entered the running state. System Information None 2013-08-19 14:23:14 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the running state. System Information None 2013-08-19 14:23:14 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4000: WLAN AutoConfig servic e has successfully started. System Information None 2013-08-19 14:23:15 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the stopped state. System Information None 2013-08-19 14:23:15 SYSTEM Service Control Manager 7042: The TCP/IP NetBIOS Helper service was successfully sent a stop control. The reason specified was: 0x4 0030011 [Operating System: Network Connectivity (Planned)] Comment: None System Information None 2013-08-19 14:23:16 Service Control Manager 7036: The Multimedia Class Sche duler service entered the stopped state. System Information None 2013-08-19 14:23:36 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Intel(R) USB 3.0 Host Controller Switch Driver Service File Name: system32\DRIVERS\iusb3hcs.sys Service Type: kernel mode dr iver Service Start Type: boot start Service Account: System Information 7005 2013-08-19 14:23:37 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service iusb3hcs for Device Instance ID ACPI\PNP0A08\ 2&DABA3FF&2 with the following status: 0. System Information 7005 2013-08-19 14:23:37 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service pci for Device Instance ID ACPI\PNP0A08\2&DAB A3FF&2 with the following status: 0. System Information 7005 2013-08-19 14:23:39 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\iusb3hcs.inf_x86_neutral_a9efb8 78eb3021e2\iusb3hcs.inf for Device Instance ID ACPI\PNP0A08\2&DABA3FF&2 with the following status: 0x0. System Information None 2013-08-19 14:24:10 Service Control Manager 7036: The Telephony service ent ered the stopped state. System Information None 2013-08-19 14:24:30 Vic Tiangco USER32 1074: The process C:\Windows\Sy stem32\shutdown.exe (EMOVHICRN) has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: No title for t his reason could be found Reason Code: 0x800000ff Shutdown Type: restart Comment: System Information 1102 2013-08-19 14:24:32 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information None 2013-08-19 14:24:33 Service Control Manager 7036: The Windows Update servic e entered the stopped state. System Information None 2013-08-19 14:24:33 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 14:24:33 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the stopped state. System Information None 2013-08-19 14:24:34 EventLog 6006: The Event log service was stopped. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The DHCP Client service e ntered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Power service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Distributed Link Trac king Client service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Diagnostic Service Ho st service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The SSDP Discovery servic e entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Security Center servi ce entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Windows Management In strumentation service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Windows Defender serv ice entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Superfetch service en tered the stopped state. System Information 4 2013-08-19 14:24:34 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51047: DHCPv6 client service i s stopped. ShutDown Flag value is 1 System Information 4 2013-08-19 14:24:34 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50037: DHCPv4 client service is stopped. ShutDown Flag value is 1 System Information 7010 2013-08-19 14:24:34 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Warning None 2013-08-19 14:24:34 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4001: WLAN AutoConfig servic e has successfully stopped. System Information None 2013-08-19 14:24:35 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Information None 2013-08-19 14:24:35 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 14:24:35 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Information 103 2013-08-19 14:24:36 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 14:24:40 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 14:24:59 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 14:24:59 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 86 2013-08-19 14:25:06 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information 4 2013-08-19 14:25:13 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Information None 2013-08-19 14:25:17 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 14:25:17 EventLog 6005: The Event log service was started. System Information None 2013-08-19 14:25:17 EventLog 6013: The system uptime is 18 s econds. System Information None 2013-08-19 14:25:17 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 14:25:17 Service Control Manager 7036: The Power service entered the running state. System Information None 2013-08-19 14:25:17 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 14:25:17 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 14:25:17 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 14:25:17 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 14:25:17 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information 7010 2013-08-19 14:25:17 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The Security Accounts Man ager service entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The CNG Key Isolation ser vice entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The DNS Client service en tered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the running state. System Information 4 2013-08-19 14:25:18 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started System Information 4 2013-08-19 14:25:18 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i s started System Warning None 2013-08-19 14:25:18 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 14:25:19 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the running state. System Information None 2013-08-19 14:25:19 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4000: WLAN AutoConfig servic e has successfully started. System Information None 2013-08-19 14:25:22 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information None 2013-08-19 14:25:23 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 14:25:23 Service Control Manager 7036: The Print Spooler service entered the running state. System Information None 2013-08-19 14:25:23 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information None 2013-08-19 14:25:23 Service Control Manager 7036: The Windows Firewall serv ice entered the running state. System Information None 2013-08-19 14:25:23 Service Control Manager 7036: The Workstation service e ntered the running state. System Information None 2013-08-19 14:25:23 Service Control Manager 7036: The Cryptographic Service s service entered the running state. System Information 1101 2013-08-19 14:25:23 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information None 2013-08-19 14:25:24 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the running state. System Information None 2013-08-19 14:25:24 Service Control Manager 7036: The Network Location Awar eness service entered the running state. System Information None 2013-08-19 14:25:24 Service Control Manager 7036: The Superfetch service en tered the running state. System Information None 2013-08-19 14:25:24 Service Control Manager 7036: The Distributed Link Trac king Client service entered the running state. System Information None 2013-08-19 14:25:24 Service Control Manager 7036: The Windows Management In strumentation service entered the running state. System Information None 2013-08-19 14:25:24 Service Control Manager 7036: The IP Helper service ent ered the running state. System Information None 2013-08-19 14:25:25 Service Control Manager 7036: The Server service entere d the running state. System Information None 2013-08-19 14:25:25 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the stopped state. System Information None 2013-08-19 14:25:25 Service Control Manager 7036: The Diagnostic Service Ho st service entered the running state. System Information None 2013-08-19 14:25:25 Service Control Manager 7036: The Network List Service service entered the running state. System Information None 2013-08-19 14:25:25 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 14:25:25 Service Control Manager 7036: The Diagnostic System Hos t service entered the running state. System Information None 2013-08-19 14:25:25 Service Control Manager 7036: The Windows Defender serv ice entered the running state. System Information None 2013-08-19 14:25:25 SYSTEM Service Control Manager 7042: The TCP/IP NetBIOS Helper service was successfully sent a stop control. The reason specified was: 0x4 0030011 [Operating System: Network Connectivity (Planned)] Comment: None System Information None 2013-08-19 14:25:29 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 14:25:32 Service Control Manager 7036: The Network Connections s ervice entered the running state. System Information None 2013-08-19 14:25:33 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 14:26:23 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 14:26:23 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Information None 2013-08-19 14:26:46 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: ialm Service File Name: system32\DRIVERS\igxpm p32.sys Service Type: kernel mode driver Service Start Type: demand start S ervice Account: System Information 7005 2013-08-19 14:26:48 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service ialm for Device Instance ID PCI\VEN_8086&DEV_ 2592&SUBSYS_30C4103C&REV_03\3&21436425&0&10 with the following status: 0. System Information 7005 2013-08-19 14:26:49 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\igxp32.inf_x86_neutral_4520f25b da852aac\igxp32.inf for Device Instance ID PCI\VEN_8086&DEV_2592&SUBSYS_30C4103C &REV_03\3&21436425&0&10 with the following status: 0x0. System Information 7005 2013-08-19 14:26:52 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service ialm for Device Instance ID PCI\VEN_8086&DEV_ 2792&SUBSYS_30C4103C&REV_03\3&21436425&0&11 with the following status: 0. System Information 7005 2013-08-19 14:26:56 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service ialm for Device Instance ID PCI\VEN_8086&DEV_ 2592&SUBSYS_30C4103C&REV_03\3&21436425&0&10 with the following status: 0. System Information 7005 2013-08-19 14:26:57 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\igxp32.inf_x86_neutral_4520f25b da852aac\igxp32.inf for Device Instance ID PCI\VEN_8086&DEV_2792&SUBSYS_30C4103C &REV_03\3&21436425&0&11 with the following status: 0x0. System Information None 2013-08-19 14:27:25 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 14:27:25 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the running state. System Information None 2013-08-19 14:27:25 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the running state. System Information None 2013-08-19 14:27:26 Service Control Manager 7036: The SSDP Discovery servic e entered the running state. System Information None 2013-08-19 14:27:27 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 14:27:27 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 14:27:28 Service Control Manager 7036: The Security Center servi ce entered the running state. System Information None 2013-08-19 14:27:29 Service Control Manager 7036: The Windows Update servic e entered the running state. System Information None 2013-08-19 14:28:20 SYSTEM Microsoft-Windows-Application-Experience 206: The Program Comp atibility Assistant service successfully performed phase two initialization. System Information None 2013-08-19 14:28:45 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Conexant AMC Audio Service File Name: system32 \drivers\camc6aud.sys Service Type: kernel mode driver Service Start Type: d emand start Service Account: System Information None 2013-08-19 14:28:46 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: CAMCHALA Service File Name: system32\drivers\c amc6hal.sys Service Type: kernel mode driver Service Start Type: demand star t Service Account: System Information 7005 2013-08-19 14:28:46 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service CAMCAUD for Device Instance ID PCI\VEN_8086&D EV_266E&SUBSYS_30C4103C&REV_03\3&21436425&0&F2 with the following status: 0. System Information 7005 2013-08-19 14:28:47 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service CAMCHALA for Device Instance ID PCI\VEN_8086& DEV_266E&SUBSYS_30C4103C&REV_03\3&21436425&0&F2 with the following status: 0. System Information 7005 2013-08-19 14:28:49 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\vlg103ca.inf_x86_neutral_c4c16f 781df119e8\vlg103ca.inf for Device Instance ID PCI\VEN_8086&DEV_266E&SUBSYS_30C4 103C&REV_03\3&21436425&0&F2 with the following status: 0x0. System Information None 2013-08-19 14:28:50 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Microsoft Streaming Service Proxy Service File Name: system32\drivers\MSKSSRV.sys Service Type: kernel mode driver Service Start Type: demand start Service Account: System Information None 2013-08-19 14:28:51 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Microsoft Streaming Quality Manager Proxy Servi ce File Name: system32\drivers\MSPQM.sys Service Type: kernel mode driver Se rvice Start Type: demand start Service Account: System Information 7005 2013-08-19 14:28:51 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service MSKSSRV for Device Instance ID SW\{96E080C7-1 43C-11D1-B40F-00A0C9223196}\{3C0D501A-140B-11D1-B40F-00A0C9223196} with the foll owing status: 0. System Information 7005 2013-08-19 14:28:51 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\ksfilter.inf_x86_neutral_92aac3 fbbef4a5e4\ksfilter.inf for Device Instance ID SW\{96E080C7-143C-11D1-B40F-00A0C 9223196}\{3C0D501A-140B-11D1-B40F-00A0C9223196} with the following status: 0x0.

System Information None 2013-08-19 14:28:52 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Microsoft Streaming Clock Proxy Service File Na me: system32\drivers\MSPCLOCK.sys Service Type: kernel mode driver Service S tart Type: demand start Service Account: System Information 7005 2013-08-19 14:28:52 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service MSPQM for Device Instance ID SW\{DDF4358E-BB2 C-11D0-A42F-00A0C9223196}\{97EBAACB-95BD-11D0-A3EA-00A0C9223196} with the follow ing status: 0. System Information 7005 2013-08-19 14:28:52 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\ksfilter.inf_x86_neutral_92aac3 fbbef4a5e4\ksfilter.inf for Device Instance ID SW\{DDF4358E-BB2C-11D0-A42F-00A0C 9223196}\{97EBAACB-95BD-11D0-A3EA-00A0C9223196} with the following status: 0x0.

System Information None 2013-08-19 14:28:53 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Microsoft Streaming Tee/Sink-to-Sink Converter Service File Name: system32\drivers\MSTEE.sys Service Type: kernel mode drive r Service Start Type: demand start Service Account: System Information 7005 2013-08-19 14:28:53 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service MSPCLOCK for Device Instance ID SW\{97EBAACC- 95BD-11D0-A3EA-00A0C9223196}\{53172480-4791-11D0-A5D6-28DB04C10000} with the fol lowing status: 0. System Information 7005 2013-08-19 14:28:53 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\ksfilter.inf_x86_neutral_92aac3 fbbef4a5e4\ksfilter.inf for Device Instance ID SW\{97EBAACC-95BD-11D0-A3EA-00A0C 9223196}\{53172480-4791-11D0-A5D6-28DB04C10000} with the following status: 0x0.

System Information 7005 2013-08-19 14:28:54 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service MSTEE for Device Instance ID SW\{CFD669F1-9BC 2-11D0-8299-0000F822FE8A}\{CF1DDA2C-9743-11D0-A3EE-00A0C9223196} with the follow ing status: 0. System Information 7005 2013-08-19 14:28:54 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\ksfilter.inf_x86_neutral_92aac3 fbbef4a5e4\ksfilter.inf for Device Instance ID SW\{CFD669F1-9BC2-11D0-8299-0000F 822FE8A}\{CF1DDA2C-9743-11D0-A3EE-00A0C9223196} with the following status: 0x0.

System Information None 2013-08-19 14:28:55 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Microsoft Trusted Audio Drivers Service File Na me: system32\drivers\drmkaud.sys Service Type: kernel mode driver Service St art Type: demand start Service Account: System Information 7005 2013-08-19 14:28:55 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service MSTEE for Device Instance ID SW\{CFD669F1-9BC 2-11D0-8299-0000F822FE8A}\{0A4252A0-7E70-11D0-A5D6-28DB04C10000} with the follow ing status: 0. System Information 7005 2013-08-19 14:28:55 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\ksfilter.inf_x86_neutral_92aac3 fbbef4a5e4\ksfilter.inf for Device Instance ID SW\{CFD669F1-9BC2-11D0-8299-0000F 822FE8A}\{0A4252A0-7E70-11D0-A5D6-28DB04C10000} with the following status: 0x0.

System Information 7005 2013-08-19 14:28:56 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service drmkaud for Device Instance ID SW\{EEC12DB6-A D9C-4168-8658-B03DAEF417FE}\{ABD61E00-9350-47E2-A632-4438B90C6641} with the foll owing status: 0. System Information 7005 2013-08-19 14:28:56 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\wdmaudio.inf_x86_neutral_aed2a4 456700dfde\wdmaudio.inf for Device Instance ID SW\{EEC12DB6-AD9C-4168-8658-B03DA EF417FE}\{ABD61E00-9350-47E2-A632-4438B90C6641} with the following status: 0x0.

System Information None 2013-08-19 14:29:43 Vic Tiangco USER32 1074: The process Explorer.EXE has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: Other (Unplanned) Reason Code: 0x0 Shutd own Type: restart Comment: System Information None 2013-08-19 14:29:46 Vic Tiangco USER32 1074: The process C:\Windows\sy stem32\winlogon.exe (EMOVHICRN) has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: No title for t his reason could be found Reason Code: 0x500ff Shutdown Type: restart C omment: System Information 1102 2013-08-19 14:29:46 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information None 2013-08-19 14:29:47 Service Control Manager 7036: The Windows Update servic e entered the stopped state. System Information None 2013-08-19 14:29:47 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 14:29:48 EventLog 6006: The Event log service was stopped. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Power service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The DHCP Client service e ntered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Distributed Link Trac king Client service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Windows Defender serv ice entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Diagnostic Service Ho st service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The SSDP Discovery servic e entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Security Center servi ce entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Windows Management In strumentation service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the stopped state. System Information 4 2013-08-19 14:29:48 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51047: DHCPv6 client service i s stopped. ShutDown Flag value is 1 System Information 4 2013-08-19 14:29:48 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50037: DHCPv4 client service is stopped. ShutDown Flag value is 1 System Information 7010 2013-08-19 14:29:48 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Warning None 2013-08-19 14:29:48 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4001: WLAN AutoConfig servic e has successfully stopped. System Information None 2013-08-19 14:29:49 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 14:29:49 Service Control Manager 7036: The Superfetch service en tered the stopped state. System Information None 2013-08-19 14:29:49 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Information None 2013-08-19 14:29:49 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Information 103 2013-08-19 14:29:49 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 14:29:54 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 14:30:12 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 14:30:12 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 86 2013-08-19 14:30:19 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information 4 2013-08-19 14:30:28 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Warning None 2013-08-19 14:30:33 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 14:30:40 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 14:30:40 EventLog 6005: The Event log service was started. System Information None 2013-08-19 14:30:40 EventLog 6013: The system uptime is 27 s econds. System Information None 2013-08-19 14:30:40 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 14:30:40 Service Control Manager 7036: The Power service entered the running state. System Information None 2013-08-19 14:30:40 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 14:30:40 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 14:30:40 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 14:30:40 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 14:30:40 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information 7010 2013-08-19 14:30:40 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The Security Accounts Man ager service entered the running state. System Information None 2013-08-19 14:30:42 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information None 2013-08-19 14:30:42 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 14:30:42 Service Control Manager 7036: The CNG Key Isolation ser vice entered the running state. System Information None 2013-08-19 14:30:42 Service Control Manager 7036: The DNS Client service en tered the running state. System Information None 2013-08-19 14:30:42 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information 1101 2013-08-19 14:30:42 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information 4 2013-08-19 14:30:42 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started System Information 4 2013-08-19 14:30:42 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i s started System Information None 2013-08-19 14:30:43 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the running state. System Information None 2013-08-19 14:30:43 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the running state. System Information None 2013-08-19 14:30:43 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information None 2013-08-19 14:30:43 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4000: WLAN AutoConfig servic e has successfully started. System Information None 2013-08-19 14:30:44 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 14:30:44 Service Control Manager 7036: The Print Spooler service entered the running state. System Information None 2013-08-19 14:30:44 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information None 2013-08-19 14:30:44 Service Control Manager 7036: The Windows Firewall serv ice entered the running state. System Information None 2013-08-19 14:30:44 Service Control Manager 7036: The Workstation service e ntered the running state. System Information None 2013-08-19 14:30:44 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Cryptographic Service s service entered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Superfetch service en tered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Distributed Link Trac king Client service entered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Windows Management In strumentation service entered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Network Location Awar eness service entered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The IP Helper service ent ered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Server service entere d the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the stopped state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Diagnostic Service Ho st service entered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Network List Service service entered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Windows Defender serv ice entered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Diagnostic System Hos t service entered the running state. System Information None 2013-08-19 14:30:45 SYSTEM Service Control Manager 7042: The TCP/IP NetBIOS Helper service was successfully sent a stop control. The reason specified was: 0x4 0030011 [Operating System: Network Connectivity (Planned)] Comment: None System Information None 2013-08-19 14:30:52 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 14:30:53 Service Control Manager 7036: The Network Connections s ervice entered the running state. System Information 7005 2013-08-19 14:30:56 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service monitor for Device Instance ID DISPLAY\CMO152 6\4&36585A91&0&80871400&00&22 with the following status: 0. System Information 7005 2013-08-19 14:30:56 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\monitor.inf_x86_neutral_f7168ca 1d7f8ec24\monitor.inf for Device Instance ID DISPLAY\CMO1526\4&36585A91&0&808714 00&00&22 with the following status: 0x0. System Information 7005 2013-08-19 14:30:57 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service monitor for Device Instance ID DISPLAY\CMO152 6\4&7DA7843&0&80861500&00&02 with the following status: 0. System Information 7005 2013-08-19 14:30:57 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\monitor.inf_x86_neutral_f7168ca 1d7f8ec24\monitor.inf for Device Instance ID DISPLAY\CMO1526\4&7DA7843&0&8086150 0&00&02 with the following status: 0x0. System Information 7005 2013-08-19 14:30:58 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service monitor for Device Instance ID DISPLAY\CMO152 6\4&7DA7843&0&00000400&00&02 with the following status: 0. System Information 7005 2013-08-19 14:30:58 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\monitor.inf_x86_neutral_f7168ca 1d7f8ec24\monitor.inf for Device Instance ID DISPLAY\CMO1526\4&7DA7843&0&0000040 0&00&02 with the following status: 0x0. System Information None 2013-08-19 14:32:45 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the running state. System Information None 2013-08-19 14:32:45 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 14:32:46 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the running state. System Information None 2013-08-19 14:32:47 Service Control Manager 7036: The SSDP Discovery servic e entered the running state. System Information None 2013-08-19 14:32:47 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 14:32:47 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 14:32:48 Service Control Manager 7036: The Security Center servi ce entered the running state. System Information None 2013-08-19 14:32:50 Service Control Manager 7036: The Windows Update servic e entered the running state. System Information None 2013-08-19 14:33:32 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 14:33:32 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Information None 2013-08-19 14:33:32 SYSTEM Microsoft-Windows-Application-Experience 206: The Program Comp atibility Assistant service successfully performed phase two initialization. System Information None 2013-08-19 14:33:40 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the running state. System Information None 2013-08-19 14:34:16 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the running state. System Information None 2013-08-19 14:34:16 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the running state. System Information 7005 2013-08-19 14:34:28 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\volsnap.inf_x86_neutral_42f862e 05fcb0306\volsnap.inf for Device Instance ID STORAGE\VOLUMESNAPSHOT\HARDDISKVOLU MESNAPSHOT1 with the following status: 0x0. System Information None 2013-08-19 14:35:40 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the stopped state. System Information None 2013-08-19 14:37:44 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2013-08-19 14:37:50 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 14:40:44 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the stopped state. System Information None 2013-08-19 14:41:46 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the running state. System Information None 2013-08-19 14:43:47 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the stopped state. System Information None 2013-08-19 14:45:56 Service Control Manager 7036: The WinHTTP Web Proxy Aut o-Discovery Service service entered the running state. System Information None 2013-08-19 14:46:14 Service Control Manager 7036: The Windows Image Acquisi tion (WIA) service entered the running state. System Information None 2013-08-19 14:46:34 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: Canon Inkjet Printer/Scanner/Fax Extended Survey Program Service File Name: C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE Service Type: user mode service Service Start Type: auto start Service Account: Lo calSystem System Information None 2013-08-19 14:46:36 Service Control Manager 7036: The Canon Inkjet Printer/ Scanner/Fax Extended Survey Program service entered the running state. System Information None 2013-08-19 14:46:45 Service Control Manager 7036: The Windows Image Acquisi tion (WIA) service entered the stopped state. System Information None 2013-08-19 14:47:03 Service Control Manager 7036: The Windows Image Acquisi tion (WIA) service entered the running state. System Information None 2013-08-19 14:47:34 Service Control Manager 7036: The Windows Image Acquisi tion (WIA) service entered the stopped state. System Information None 2013-08-19 14:51:31 Application Popup 26: Application popup: Cool Edi t Pro: coolpro2.exe - System Error : The program can't start because WMVCore2.DL L is missing from your computer. Try reinstalling the program to fix this proble m. System Information None 2013-08-19 14:52:10 Application Popup 26: Application popup: Cool Edi t Pro: coolpro2.exe - System Error : The program can't start because WMVCore2.DL L is missing from your computer. Try reinstalling the program to fix this proble m. System Information None 2013-08-19 14:57:16 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the running state. System Information None 2013-08-19 14:57:16 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the running state. System Information 7005 2013-08-19 14:57:24 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\volsnap.inf_x86_neutral_42f862e 05fcb0306\volsnap.inf for Device Instance ID STORAGE\VOLUMESNAPSHOT\HARDDISKVOLU MESNAPSHOT2 with the following status: 0x0. System Information None 2013-08-19 14:57:36 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: DAEMON Tools Virtual Bus Driver Service File Na me: system32\DRIVERS\dtsoftbus01.sys Service Type: kernel mode driver Servic e Start Type: demand start Service Account: System Information 7005 2013-08-19 14:57:37 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service dtsoftbus01 for Device Instance ID ROOT\SYSTE M\0001 with the following status: 0. System Information 7005 2013-08-19 14:57:39 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\dtsoftbus01.inf_x86_neutral_69c 903f7faf9ade2\dtsoftbus01.inf for Device Instance ID ROOT\SYSTEM\0001 with the f ollowing status: 0x0. System Information 7005 2013-08-19 14:57:43 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service cdrom for Device Instance ID DTSOFTBUS&REV1\D TCDROM&REV1\1&79F5D87&0&00 with the following status: 0. System Information 7005 2013-08-19 14:57:44 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\cdrom.inf_x86_neutral_6381e0967 5524225\cdrom.inf for Device Instance ID DTSOFTBUS&REV1\DTCDROM&REV1\1&79F5D87&0 &00 with the following status: 0x0. System Information None 2013-08-19 14:57:46 Service Control Manager 7036: The Secondary Logon servi ce entered the running state. System Information None 2013-08-19 15:00:40 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2013-08-19 15:01:36 Service Control Manager 7036: The Application Managemen t service entered the running state. System Information None 2013-08-19 15:03:18 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: Adobe Flash Player Update Service Service File Name: C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe Service Type: user mode service Service Start Type: demand start Service Account: L ocalSystem System Information None 2013-08-19 15:03:40 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the stopped state. System Information None 2013-08-19 15:03:56 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the running state. System Information None 2013-08-19 15:03:57 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the running state. System Information 7005 2013-08-19 15:04:02 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\volsnap.inf_x86_neutral_42f862e 05fcb0306\volsnap.inf for Device Instance ID STORAGE\VOLUMESNAPSHOT\HARDDISKVOLU MESNAPSHOT3 with the following status: 0x0. System Information None 2013-08-19 15:07:10 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2013-08-19 15:07:37 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the running state. System Information None 2013-08-19 15:09:13 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: WinRing0_1_2_0 Service File Name: C:\Program F iles\IObit\Game Booster 3\Driver\WinRing0.sys Service Type: kernel mode driver Service Start Type: demand start Service Account: System Information None 2013-08-19 15:09:37 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the stopped state. System Information None 2013-08-19 15:09:47 Service Control Manager 7036: The Application Experienc e service entered the stopped state. System Information None 2013-08-19 15:09:47 Service Control Manager 7036: The Application Managemen t service entered the stopped state. System Information None 2013-08-19 15:09:47 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the stopped state. System Information None 2013-08-19 15:09:47 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 15:09:48 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the stopped state. System Information None 2013-08-19 15:09:48 Service Control Manager 7036: The Diagnostic Service Ho st service entered the stopped state. System Information None 2013-08-19 15:09:48 Service Control Manager 7036: The Offline Files service entered the stopped state. System Information None 2013-08-19 15:09:48 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the stopped state. System Information None 2013-08-19 15:09:48 Service Control Manager 7036: The Print Spooler service entered the stopped state. System Information None 2013-08-19 15:09:48 Service Control Manager 7036: The SSDP Discovery servic e entered the stopped state. System Information None 2013-08-19 15:09:48 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the stopped state. System Information None 2013-08-19 15:09:48 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the stopped state. System Information None 2013-08-19 15:09:48 SYSTEM Microsoft-Windows-Application-Experience 200: The Program Comp atibility Assistant service was stopped successfully. System Information None 2013-08-19 15:09:49 Service Control Manager 7036: The Themes service entere d the stopped state. System Information None 2013-08-19 15:09:49 Service Control Manager 7036: The Distributed Link Trac king Client service entered the stopped state. System Information None 2013-08-19 15:09:49 Service Control Manager 7036: The WinHTTP Web Proxy Aut o-Discovery Service service entered the stopped state. System Information None 2013-08-19 15:09:49 Service Control Manager 7036: The Canon Inkjet Printer/ Scanner/Fax Extended Survey Program service entered the stopped state. System Information None 2013-08-19 15:09:49 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the stopped state. System Information None 2013-08-19 15:09:50 Service Control Manager 7036: The IP Helper service ent ered the stopped state. System Information None 2013-08-19 15:10:07 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 15:10:13 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 15:10:13 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Information None 2013-08-19 15:11:17 Vic Tiangco Service Control Manager 7040: The start type of the Vol ume Shadow Copy service was changed from demand start to disabled. System Information None 2013-08-19 15:11:24 Vic Tiangco Service Control Manager 7040: The start type of the Vol ume Shadow Copy service was changed from disabled to demand start. System Information None 2013-08-19 15:11:25 Service Control Manager 7036: The Telephony service ent ered the running state. System Information None 2013-08-19 15:11:25 Service Control Manager 7036: The Secure Socket Tunneli ng Protocol Service service entered the running state. System Information None 2013-08-19 15:11:30 Service Control Manager 7036: The Remote Access Connect ion Manager service entered the running state. System Information None 2013-08-19 15:11:46 SYSTEM Microsoft-Windows-Application-Experience 206: The Program Comp atibility Assistant service successfully performed phase two initialization. System Information None 2013-08-19 15:12:01 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: IDMWFP Service File Name: system32\DRIVERS\idm wfp.sys Service Type: kernel mode driver Service Start Type: auto start Ser vice Account: System Information None 2013-08-19 15:12:07 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 15:13:44 Service Control Manager 7036: The Windows Installer ser vice entered the running state. System Information None 2013-08-19 15:13:45 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the running state. System Information None 2013-08-19 15:13:45 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the running state. System Information 7005 2013-08-19 15:13:52 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\volsnap.inf_x86_neutral_42f862e 05fcb0306\volsnap.inf for Device Instance ID STORAGE\VOLUMESNAPSHOT\HARDDISKVOLU MESNAPSHOT4 with the following status: 0x0. System Information None 2013-08-19 15:16:08 Vic Tiangco Service Control Manager 7040: The start type of the Can on Inkjet Printer/Scanner/Fax Extended Survey Program service was changed from a uto start to disabled. System Information None 2013-08-19 15:16:09 Vic Tiangco Service Control Manager 7040: The start type of the WWA N AutoConfig service was changed from demand start to disabled. System Information None 2013-08-19 15:16:09 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Driver Foundation - User-mode Driver Framework service was changed from dem and start to disabled. System Information None 2013-08-19 15:16:10 Vic Tiangco Service Control Manager 7040: The start type of the Por table Device Enumerator Service service was changed from demand start to disable d. System Information None 2013-08-19 15:16:10 Vic Tiangco Service Control Manager 7040: The start type of the Par ental Controls service was changed from demand start to disabled. System Information None 2013-08-19 15:16:10 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Media Player Network Sharing Service service was changed from demand start to disabled. System Information None 2013-08-19 15:16:11 Vic Tiangco Service Control Manager 7040: The start type of the WMI Performance Adapter service was changed from demand start to disabled. System Information None 2013-08-19 15:16:11 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Remote Management (WS-Management) service was changed from demand start to disabled. System Information None 2013-08-19 15:16:12 Vic Tiangco Service Control Manager 7040: The start type of the Win HTTP Web Proxy Auto-Discovery Service service was changed from demand start to d isabled. System Information None 2013-08-19 15:16:12 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Error Reporting Service service was changed from demand start to disabled.

System Information None 2013-08-19 15:16:13 Vic Tiangco Service Control Manager 7040: The start type of the Pro blem Reports and Solutions Control Panel Support service was changed from demand start to disabled. System Information None 2013-08-19 15:16:13 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Event Collector service was changed from demand start to disabled. System Information None 2013-08-19 15:16:13 Vic Tiangco Service Control Manager 7040: The start type of the Web Client service was changed from demand start to disabled. System Information None 2013-08-19 15:16:14 Vic Tiangco Service Control Manager 7040: The start type of the Dia gnostic System Host service was changed from demand start to disabled. System Information None 2013-08-19 15:16:14 Vic Tiangco Service Control Manager 7040: The start type of the Dia gnostic Service Host service was changed from demand start to disabled. System Information None 2013-08-19 15:16:15 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Color System service was changed from demand start to disabled. System Information None 2013-08-19 15:16:15 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Connect Now - Config Registrar service was changed from demand start to dis abled. System Information None 2013-08-19 15:16:16 Vic Tiangco Service Control Manager 7040: The start type of the Blo ck Level Backup Engine Service service was changed from demand start to disabled . System Information None 2013-08-19 15:16:16 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Biometric Service service was changed from demand start to disabled. System Information None 2013-08-19 15:16:17 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Time service was changed from demand start to disabled. System Information None 2013-08-19 15:16:17 Vic Tiangco Service Control Manager 7040: The start type of the Vir tual Disk service was changed from demand start to disabled. System Information None 2013-08-19 15:16:17 Vic Tiangco Service Control Manager 7040: The start type of the Cre dential Manager service was changed from demand start to disabled. System Information None 2013-08-19 15:16:18 Vic Tiangco Service Control Manager 7040: The start type of the Des ktop Window Manager Session Manager service was changed from auto start to disab led. System Information None 2013-08-19 15:16:18 Vic Tiangco Service Control Manager 7040: The start type of the UPn P Device Host service was changed from demand start to disabled. System Information None 2013-08-19 15:16:19 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Desktop Services UserMode Port Redirector service was changed from demand st art to disabled. System Information None 2013-08-19 15:16:19 Vic Tiangco Service Control Manager 7040: The start type of the Int eractive Services Detection service was changed from demand start to disabled. System Information None 2013-08-19 15:16:20 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Modules Installer service was changed from demand start to disabled. System Information None 2013-08-19 15:16:20 Vic Tiangco Service Control Manager 7040: The start type of the Dis tributed Link Tracking Client service was changed from auto start to disabled. System Information None 2013-08-19 15:16:21 Vic Tiangco Service Control Manager 7040: The start type of the Thr ead Ordering Server service was changed from demand start to disabled. System Information None 2013-08-19 15:16:21 Vic Tiangco Service Control Manager 7040: The start type of the The mes service was changed from auto start to disabled. System Information None 2013-08-19 15:16:21 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Desktop Services service was changed from demand start to disabled. System Information None 2013-08-19 15:16:22 Vic Tiangco Service Control Manager 7040: The start type of the TPM Base Services service was changed from demand start to disabled. System Information None 2013-08-19 15:16:22 Vic Tiangco Service Control Manager 7040: The start type of the Tab let PC Input Service service was changed from demand start to disabled. System Information None 2013-08-19 15:16:23 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Image Acquisition (WIA) service was changed from demand start to disabled.

System Information None 2013-08-19 15:16:23 Vic Tiangco Service Control Manager 7040: The start type of the SSD P Discovery service was changed from demand start to disabled. System Information None 2013-08-19 15:16:24 Vic Tiangco Service Control Manager 7040: The start type of the SPP Notification Service service was changed from demand start to disabled. System Information None 2013-08-19 15:16:24 Vic Tiangco Service Control Manager 7040: The start type of the Pri nt Spooler service was changed from auto start to disabled. System Information None 2013-08-19 15:16:24 Vic Tiangco Service Control Manager 7040: The start type of the SNM P Trap service was changed from demand start to disabled. System Information None 2013-08-19 15:16:25 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Desktop Configuration service was changed from demand start to disabled. System Information None 2013-08-19 15:16:25 Vic Tiangco Service Control Manager 7040: The start type of the Ada ptive Brightness service was changed from demand start to disabled. System Information None 2013-08-19 15:16:26 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Backup service was changed from demand start to disabled. System Information None 2013-08-19 15:16:26 Vic Tiangco Service Control Manager 7040: The start type of the Sma rt Card Removal Policy service was changed from demand start to disabled. System Information None 2013-08-19 15:16:27 Vic Tiangco Service Control Manager 7040: The start type of the Sma rt Card service was changed from demand start to disabled. System Information None 2013-08-19 15:16:27 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Procedure Call (RPC) Locator service was changed from demand start to disabl ed. System Information None 2013-08-19 15:16:27 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Registry service was changed from demand start to disabled. System Information None 2013-08-19 15:16:28 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Access Auto Connection Manager service was changed from demand start to disa bled. System Information None 2013-08-19 15:16:28 Vic Tiangco Service Control Manager 7040: The start type of the Qua lity Windows Audio Video Experience service was changed from demand start to dis abled. System Information None 2013-08-19 15:16:29 Vic Tiangco Service Control Manager 7040: The start type of the Pro tected Storage service was changed from demand start to disabled. System Information None 2013-08-19 15:16:29 Vic Tiangco Service Control Manager 7040: The start type of the IPs ec Policy Agent service was changed from demand start to disabled. System Information None 2013-08-19 15:16:29 Vic Tiangco Service Control Manager 7040: The start type of the Pee r Name Resolution Protocol service was changed from demand start to disabled. System Information None 2013-08-19 15:16:30 Vic Tiangco Service Control Manager 7040: The start type of the PNR P Machine Name Publication Service service was changed from demand start to disa bled. System Information None 2013-08-19 15:16:30 Vic Tiangco Service Control Manager 7040: The start type of the Per formance Logs & Alerts service was changed from demand start to disabled. System Information None 2013-08-19 15:16:31 Vic Tiangco Service Control Manager 7040: The start type of the Bra nchCache service was changed from demand start to disabled. System Information None 2013-08-19 15:16:31 Vic Tiangco Service Control Manager 7040: The start type of the Pee r Networking Grouping service was changed from demand start to disabled. System Information None 2013-08-19 15:16:32 Vic Tiangco Service Control Manager 7040: The start type of the Pee r Networking Identity Manager service was changed from demand start to disabled.

System Information None 2013-08-19 15:16:32 Vic Tiangco Service Control Manager 7040: The start type of the Net logon service was changed from demand start to disabled. System Information None 2013-08-19 15:16:33 Vic Tiangco Service Control Manager 7040: The start type of the Net work Access Protection Agent service was changed from demand start to disabled.

System Information None 2013-08-19 15:16:33 Vic Tiangco Service Control Manager 7040: The start type of the Mic rosoft iSCSI Initiator Service service was changed from demand start to disabled . System Information None 2013-08-19 15:16:33 Vic Tiangco Service Control Manager 7040: The start type of the Dis tributed Transaction Coordinator service was changed from demand start to disabl ed. System Information None 2013-08-19 15:16:34 Vic Tiangco Service Control Manager 7040: The start type of the TCP /IP NetBIOS Helper service was changed from auto start to disabled. System Information None 2013-08-19 15:16:34 Vic Tiangco Service Control Manager 7040: The start type of the Lin k-Layer Topology Discovery Mapper service was changed from demand start to disab led. System Information None 2013-08-19 15:16:35 Vic Tiangco Service Control Manager 7040: The start type of the Ktm Rm for Distributed Transaction Coordinator service was changed from demand start to disabled. System Information None 2013-08-19 15:16:35 Vic Tiangco Service Control Manager 7040: The start type of the IP Helper service was changed from auto start to disabled. System Information None 2013-08-19 15:16:36 Vic Tiangco Service Control Manager 7040: The start type of the PnP -X IP Bus Enumerator service was changed from demand start to disabled. System Information None 2013-08-19 15:16:36 Vic Tiangco Service Control Manager 7040: The start type of the IKE and AuthIP IPsec Keying Modules service was changed from demand start to disabl ed. System Information None 2013-08-19 15:16:36 Vic Tiangco Service Control Manager 7040: The start type of the Win dows CardSpace service was changed from demand start to disabled. System Information None 2013-08-19 15:16:37 Vic Tiangco Service Control Manager 7040: The start type of the Hom eGroup Provider service was changed from demand start to disabled. System Information None 2013-08-19 15:16:37 Vic Tiangco Service Control Manager 7040: The start type of the Hom eGroup Listener service was changed from demand start to disabled. System Information None 2013-08-19 15:16:38 Vic Tiangco Service Control Manager 7040: The start type of the Hea lth Key and Certificate Management service was changed from demand start to disa bled. System Information None 2013-08-19 15:16:38 Vic Tiangco Service Control Manager 7040: The start type of the Hum an Interface Device Access service was changed from demand start to disabled. System Information None 2013-08-19 15:16:38 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Presentation Foundation Font Cache 3.0.0.0 service was changed from demand start to disabled. System Information None 2013-08-19 15:16:39 Vic Tiangco Service Control Manager 7040: The start type of the Fun ction Discovery Resource Publication service was changed from demand start to di sabled. System Information None 2013-08-19 15:16:39 Vic Tiangco Service Control Manager 7040: The start type of the Fun ction Discovery Provider Host service was changed from demand start to disabled.

System Information None 2013-08-19 15:16:40 Vic Tiangco Service Control Manager 7040: The start type of the Fax service was changed from demand start to disabled. System Information None 2013-08-19 15:16:40 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Media Center Scheduler Service service was changed from demand start to dis abled. System Information None 2013-08-19 15:16:40 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Media Center Receiver Service service was changed from demand start to disa bled. System Information None 2013-08-19 15:16:41 Vic Tiangco Service Control Manager 7040: The start type of the Enc rypting File System (EFS) service was changed from demand start to disabled. System Information None 2013-08-19 15:16:41 Vic Tiangco Service Control Manager 7040: The start type of the Dia gnostic Policy Service service was changed from auto start to disabled. System Information None 2013-08-19 15:16:42 Vic Tiangco Service Control Manager 7040: The start type of the Wir ed AutoConfig service was changed from demand start to disabled. System Information None 2013-08-19 15:16:42 Vic Tiangco Service Control Manager 7040: The start type of the Dis k Defragmenter service was changed from demand start to disabled. System Information None 2013-08-19 15:16:43 Vic Tiangco Service Control Manager 7040: The start type of the Off line Files service was changed from auto start to disabled. System Information None 2013-08-19 15:16:43 Vic Tiangco Service Control Manager 7040: The start type of the COM + System Application service was changed from demand start to disabled. System Information None 2013-08-19 15:16:43 Vic Tiangco Service Control Manager 7040: The start type of the Cer tificate Propagation service was changed from demand start to disabled. System Information None 2013-08-19 15:16:44 Vic Tiangco Service Control Manager 7040: The start type of the Blu etooth Support Service service was changed from demand start to disabled. System Information None 2013-08-19 15:16:44 Vic Tiangco Service Control Manager 7040: The start type of the Com puter Browser service was changed from demand start to disabled. System Information None 2013-08-19 15:16:45 Vic Tiangco Service Control Manager 7040: The start type of the Bac kground Intelligent Transfer Service service was changed from auto start to disa bled. System Information None 2013-08-19 15:16:45 Vic Tiangco Service Control Manager 7040: The start type of the Bit Locker Drive Encryption Service service was changed from demand start to disable d. System Information None 2013-08-19 15:16:46 Vic Tiangco Service Control Manager 7040: The start type of the Act iveX Installer (AxInstSV) service was changed from demand start to disabled. System Information None 2013-08-19 15:16:46 Vic Tiangco Service Control Manager 7040: The start type of the App lication Management service was changed from demand start to disabled. System Information None 2013-08-19 15:16:46 Vic Tiangco Service Control Manager 7040: The start type of the App lication Identity service was changed from demand start to disabled. System Information None 2013-08-19 15:16:47 Vic Tiangco Service Control Manager 7040: The start type of the App lication Layer Gateway Service service was changed from demand start to disabled . System Information None 2013-08-19 15:16:47 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Update service was changed from auto start to disabled. System Information None 2013-08-19 15:16:48 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Search service was changed from auto start to disabled. System Information None 2013-08-19 15:16:48 Vic Tiangco Service Control Manager 7040: The start type of the Sec urity Center service was changed from auto start to disabled. System Information None 2013-08-19 15:16:48 Vic Tiangco Service Control Manager 7040: The start type of the WLA N AutoConfig service was changed from auto start to disabled. System Information None 2013-08-19 15:16:49 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Management Instrumentation service was changed from auto start to disabled.

System Information None 2013-08-19 15:16:49 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Defender service was changed from auto start to disabled. System Information None 2013-08-19 15:16:50 Vic Tiangco Service Control Manager 7040: The start type of the Vol ume Shadow Copy service was changed from demand start to disabled. System Information None 2013-08-19 15:16:50 Vic Tiangco Service Control Manager 7040: The start type of the Tel ephony service was changed from demand start to disabled. System Information None 2013-08-19 15:16:51 Vic Tiangco Service Control Manager 7040: The start type of the Sup erfetch service was changed from auto start to disabled. System Information None 2013-08-19 15:16:51 Vic Tiangco Service Control Manager 7040: The start type of the Mic rosoft Software Shadow Copy Provider service was changed from demand start to di sabled. System Information None 2013-08-19 15:16:51 Vic Tiangco Service Control Manager 7040: The start type of the Sec ure Socket Tunneling Protocol Service service was changed from demand start to d isabled. System Information None 2013-08-19 15:16:52 Vic Tiangco Service Control Manager 7040: The start type of the She ll Hardware Detection service was changed from auto start to disabled. System Information None 2013-08-19 15:16:52 Vic Tiangco Service Control Manager 7040: The start type of the Sys tem Event Notification Service service was changed from auto start to disabled.

System Information None 2013-08-19 15:16:53 Vic Tiangco Service Control Manager 7040: The start type of the Sec ondary Logon service was changed from demand start to disabled. System Information None 2013-08-19 15:16:53 Vic Tiangco Service Control Manager 7040: The start type of the Sec urity Accounts Manager service was changed from auto start to disabled. System Information None 2013-08-19 15:16:54 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Access Connection Manager service was changed from demand start to disabled.

System Information None 2013-08-19 15:16:54 Vic Tiangco Service Control Manager 7040: The start type of the Pow er service was changed from auto start to disabled. System Information None 2013-08-19 15:16:54 Vic Tiangco Service Control Manager 7040: The start type of the Pro gram Compatibility Assistant Service service was changed from demand start to di sabled. System Information None 2013-08-19 15:16:55 Vic Tiangco Service Control Manager 7040: The start type of the Net work Store Interface Service service was changed from auto start to disabled. System Information None 2013-08-19 15:16:55 Vic Tiangco Service Control Manager 7040: The start type of the Net work Location Awareness service was changed from auto start to disabled. System Information None 2013-08-19 15:16:56 Vic Tiangco Service Control Manager 7040: The start type of the Net work List Service service was changed from demand start to disabled. System Information None 2013-08-19 15:16:56 Vic Tiangco Service Control Manager 7040: The start type of the Net work Connections service was changed from demand start to disabled. System Information None 2013-08-19 15:16:57 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Installer service was changed from demand start to disabled. System Information None 2013-08-19 15:16:57 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Firewall service was changed from auto start to disabled. System Information None 2013-08-19 15:16:57 Vic Tiangco Service Control Manager 7040: The start type of the Mul timedia Class Scheduler service was changed from auto start to disabled. System Information None 2013-08-19 15:16:58 Vic Tiangco Service Control Manager 7040: The start type of the Wor kstation service was changed from auto start to disabled. System Information None 2013-08-19 15:16:59 Vic Tiangco Service Control Manager 7040: The start type of the Ser ver service was changed from auto start to disabled. System Information None 2013-08-19 15:16:59 Vic Tiangco Service Control Manager 7040: The start type of the CNG Key Isolation service was changed from demand start to disabled. System Information None 2013-08-19 15:16:59 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Font Cache Service service was changed from auto start to disabled. System Information None 2013-08-19 15:17:00 Vic Tiangco Service Control Manager 7040: The start type of the COM + Event System service was changed from auto start to disabled. System Information None 2013-08-19 15:17:00 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Event Log service was changed from auto start to disabled. System Information None 2013-08-19 15:17:01 Vic Tiangco Service Control Manager 7040: The start type of the Ext ensible Authentication Protocol service was changed from demand start to disable d. System Information None 2013-08-19 15:17:01 Vic Tiangco Service Control Manager 7040: The start type of the DNS Client service was changed from auto start to disabled. System Information None 2013-08-19 15:17:01 Vic Tiangco Service Control Manager 7040: The start type of the DHC P Client service was changed from auto start to disabled. System Information None 2013-08-19 15:17:02 Vic Tiangco Service Control Manager 7040: The start type of the Cry ptographic Services service was changed from auto start to disabled. System Information None 2013-08-19 15:17:02 Vic Tiangco Service Control Manager 7040: The start type of the Mic rosoft .NET Framework NGEN v2.0.50727_X86 service was changed from auto start to disabled. System Information None 2013-08-19 15:17:03 Vic Tiangco Service Control Manager 7040: The start type of the Bas e Filtering Engine service was changed from auto start to disabled. System Information None 2013-08-19 15:17:03 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Audio service was changed from auto start to disabled. System Information None 2013-08-19 15:17:04 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Audio Endpoint Builder service was changed from auto start to disabled. System Information None 2013-08-19 15:17:04 Vic Tiangco Service Control Manager 7040: The start type of the App lication Experience service was changed from demand start to disabled. System Information None 2013-08-19 15:17:14 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2013-08-19 15:17:32 Vic Tiangco USER32 1074: The process C:\Windows\sy stem32\msconfig.exe (EMOVHICRN) has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: No title for t his reason could be found Reason Code: 0x40000 Shutdown Type: restart C omment: System Information 1102 2013-08-19 15:17:37 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information None 2013-08-19 15:17:38 Service Control Manager 7036: The Windows Update servic e entered the stopped state. System Information None 2013-08-19 15:17:38 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 15:17:39 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the stopped state. System Information None 2013-08-19 15:17:39 Service Control Manager 7036: The Windows Installer ser vice entered the stopped state. System Information None 2013-08-19 15:17:39 SYSTEM Service Control Manager 7040: The start type of the Mic rosoft .NET Framework NGEN v2.0.50727_X86 service was changed from disabled to a uto start. System Information None 2013-08-19 15:17:40 Service Control Manager 7036: The Power service entered the stopped state. System Information None 2013-08-19 15:17:40 Service Control Manager 7036: The Secure Socket Tunneli ng Protocol Service service entered the stopped state. System Information None 2013-08-19 15:17:40 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the stopped state. System Information None 2013-08-19 15:17:40 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 15:17:40 Service Control Manager 7036: The Remote Access Connect ion Manager service entered the stopped state. System Information None 2013-08-19 15:17:40 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information 4 2013-08-19 15:17:40 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51047: DHCPv6 client service i s stopped. ShutDown Flag value is 1 System Information 4 2013-08-19 15:17:40 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50037: DHCPv4 client service is stopped. ShutDown Flag value is 1 System Information 7010 2013-08-19 15:17:40 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Information None 2013-08-19 15:17:41 Service Control Manager 7036: The DHCP Client service e ntered the stopped state. System Information None 2013-08-19 15:17:41 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the stopped state. System Information None 2013-08-19 15:17:42 Service Control Manager 7036: The Security Center servi ce entered the stopped state. System Information None 2013-08-19 15:17:42 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the stopped state. System Information None 2013-08-19 15:17:42 Service Control Manager 7036: The Windows Management In strumentation service entered the stopped state. System Information None 2013-08-19 15:17:43 EventLog 6006: The Event log service was stopped. System Information None 2013-08-19 15:17:43 Service Control Manager 7036: The Superfetch service en tered the stopped state. System Information None 2013-08-19 15:17:44 Service Control Manager 7036: The Windows Defender serv ice entered the stopped state. System Information None 2013-08-19 15:17:44 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Information None 2013-08-19 15:17:45 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information None 2013-08-19 15:17:45 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the stopped state. System Information 103 2013-08-19 15:17:45 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Warning None 2013-08-19 15:17:45 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4001: WLAN AutoConfig servic e has successfully stopped. System Information None 2013-08-19 15:17:50 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Information None 2013-08-19 15:17:53 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 15:18:10 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 15:18:10 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 86 2013-08-19 15:18:18 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information 4 2013-08-19 15:18:19 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Information None 2013-08-19 15:18:54 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 15:18:54 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 15:18:54 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 15:18:54 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 15:18:54 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information 7010 2013-08-19 15:18:54 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Error None 2013-08-19 15:18:55 Service Control Manager 7001: The Task Scheduler servic e depends on the Windows Event Log service which failed to start because of the following error: %%1058 System Information None 2013-08-19 15:18:55 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 15:18:55 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 15:18:55 SYSTEM Microsoft-Windows-GroupPolicy 1502: The Group Policy settings for the computer were processed successfully. New settings from 1 Group Policy objects were detected and applied. System Information 1101 2013-08-19 15:18:55 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Warning None 2013-08-19 15:18:55 SYSTEM Microsoft-Windows-GroupPolicy 1090: Windows failed to record Resultant Set of Policy (RSoP) information, which describes the scope of Group P olicy objects applied to the computer or user. This could be caused by Windows M anagement Instrumentation (WMI) service being disabled, stopped, or other WMI er rors. Group Policy settings successfully applied to the computer or user; howeve r, management tools may not report accurately. System Information None 2013-08-19 15:20:53 Vic Tiangco Service Control Manager 7040: The start type of the Cry ptographic Services service was changed from disabled to demand start. System Information None 2013-08-19 15:20:57 Service Control Manager 7036: The Cryptographic Service s service entered the running state. System Information None 2013-08-19 15:20:57 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the running state. System Information None 2013-08-19 15:20:58 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 15:21:38 Vic Tiangco Service Control Manager 7040: The start type of the Cry ptographic Services service was changed from demand start to disabled. System Information None 2013-08-19 15:21:38 Vic Tiangco Service Control Manager 7040: The start type of the Mic rosoft .NET Framework NGEN v2.0.50727_X86 service was changed from auto start to disabled. System Information None 2013-08-19 15:21:38 Vic Tiangco Service Control Manager 7040: The start type of the Bac kground Intelligent Transfer Service service was changed from disabled to auto s tart. System Information None 2013-08-19 15:21:39 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Audio service was changed from disabled to auto start. System Information None 2013-08-19 15:21:39 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Audio Endpoint Builder service was changed from disabled to auto start. System Information None 2013-08-19 15:25:08 Vic Tiangco Service Control Manager 7040: The start type of the Net work Connections service was changed from disabled to demand start. System Information None 2013-08-19 15:25:14 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 15:25:14 SYSTEM Service Control Manager 7040: The start type of the Mic rosoft .NET Framework NGEN v2.0.50727_X86 service was changed from disabled to a uto start. System Information 1102 2013-08-19 15:25:14 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information None 2013-08-19 15:25:15 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the stopped state. System Information None 2013-08-19 15:25:15 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 15:25:15 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 15:25:15 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 15:25:15 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Information 7010 2013-08-19 15:25:15 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Information 103 2013-08-19 15:25:16 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 15:25:20 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 15:25:38 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 15:25:38 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 86 2013-08-19 15:25:46 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information 4 2013-08-19 15:25:47 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Error None 2013-08-19 15:25:53 Service Control Manager 7001: The Windows Audio service depends on the Multimedia Class Scheduler service which failed to start because of the following error: %%1058 System Error None 2013-08-19 15:25:53 Service Control Manager 7023: The Windows Audio Endpoin t Builder service terminated with the following error: %%1722 System Information None 2013-08-19 15:25:53 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 15:25:53 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 15:25:53 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 15:25:53 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 15:25:53 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the stopped state. System Information None 2013-08-19 15:25:53 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information 7010 2013-08-19 15:25:53 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Error None 2013-08-19 15:25:54 Service Control Manager 7001: The Task Scheduler servic e depends on the Windows Event Log service which failed to start because of the following error: %%1058 System Information None 2013-08-19 15:25:54 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 15:25:54 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 15:25:58 SYSTEM Microsoft-Windows-GroupPolicy 1502: The Group Policy settings for the computer were processed successfully. New settings from 1 Group Policy objects were detected and applied. System Warning None 2013-08-19 15:25:58 SYSTEM Microsoft-Windows-GroupPolicy 1090: Windows failed to record Resultant Set of Policy (RSoP) information, which describes the scope of Group P olicy objects applied to the computer or user. This could be caused by Windows M anagement Instrumentation (WMI) service being disabled, stopped, or other WMI er rors. Group Policy settings successfully applied to the computer or user; howeve r, management tools may not report accurately. System Information 1101 2013-08-19 15:25:59 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Error None 2013-08-19 15:26:14 Service Control Manager 7001: The Network Connections s ervice depends on the Network Store Interface Service service which failed to st art because of the following error: %%1058 System Information None 2013-08-19 15:27:30 Vic Tiangco Service Control Manager 7040: The start type of the WWA N AutoConfig service was changed from disabled to demand start. System Information None 2013-08-19 15:27:31 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Driver Foundation - User-mode Driver Framework service was changed from dis abled to demand start. System Information None 2013-08-19 15:27:32 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Update service was changed from disabled to auto start. System Information None 2013-08-19 15:27:32 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Search service was changed from disabled to auto start. System Information None 2013-08-19 15:27:32 Vic Tiangco Service Control Manager 7040: The start type of the Sec urity Center service was changed from disabled to auto start. System Information None 2013-08-19 15:27:33 Vic Tiangco Service Control Manager 7040: The start type of the Por table Device Enumerator Service service was changed from disabled to demand star t. System Information None 2013-08-19 15:27:33 Vic Tiangco Service Control Manager 7040: The start type of the Par ental Controls service was changed from disabled to demand start. System Information None 2013-08-19 15:27:34 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Media Player Network Sharing Service service was changed from disabled to d emand start. System Information None 2013-08-19 15:27:34 Vic Tiangco Service Control Manager 7040: The start type of the WMI Performance Adapter service was changed from disabled to demand start. System Information None 2013-08-19 15:27:35 Vic Tiangco Service Control Manager 7040: The start type of the WLA N AutoConfig service was changed from disabled to auto start. System Information None 2013-08-19 15:27:35 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Remote Management (WS-Management) service was changed from disabled to dema nd start. System Information None 2013-08-19 15:27:35 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Management Instrumentation service was changed from disabled to auto start.

System Information None 2013-08-19 15:27:36 Vic Tiangco Service Control Manager 7040: The start type of the Win HTTP Web Proxy Auto-Discovery Service service was changed from disabled to deman d start. System Information None 2013-08-19 15:27:36 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Defender service was changed from disabled to auto start. System Information None 2013-08-19 15:27:37 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Error Reporting Service service was changed from disabled to demand start.

System Information None 2013-08-19 15:27:37 Vic Tiangco Service Control Manager 7040: The start type of the Pro blem Reports and Solutions Control Panel Support service was changed from disabl ed to demand start. System Information None 2013-08-19 15:27:38 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Event Collector service was changed from disabled to demand start. System Information None 2013-08-19 15:27:38 Vic Tiangco Service Control Manager 7040: The start type of the Web Client service was changed from disabled to demand start. System Information None 2013-08-19 15:27:38 Vic Tiangco Service Control Manager 7040: The start type of the Dia gnostic System Host service was changed from disabled to demand start. System Information None 2013-08-19 15:27:39 Vic Tiangco Service Control Manager 7040: The start type of the Dia gnostic Service Host service was changed from disabled to demand start. System Information None 2013-08-19 15:27:39 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Color System service was changed from disabled to demand start. System Information None 2013-08-19 15:27:40 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Connect Now - Config Registrar service was changed from disabled to demand start. System Information None 2013-08-19 15:27:40 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Biometric Service service was changed from disabled to demand start. System Information None 2013-08-19 15:27:41 Vic Tiangco Service Control Manager 7040: The start type of the Blo ck Level Backup Engine Service service was changed from disabled to demand start . System Information None 2013-08-19 15:27:41 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Time service was changed from disabled to demand start. System Information None 2013-08-19 15:27:41 Vic Tiangco Service Control Manager 7040: The start type of the Vol ume Shadow Copy service was changed from disabled to demand start. System Information None 2013-08-19 15:27:42 Vic Tiangco Service Control Manager 7040: The start type of the Vir tual Disk service was changed from disabled to demand start. System Information None 2013-08-19 15:27:42 Vic Tiangco Service Control Manager 7040: The start type of the Cre dential Manager service was changed from disabled to demand start. System Information None 2013-08-19 15:27:43 Vic Tiangco Service Control Manager 7040: The start type of the Des ktop Window Manager Session Manager service was changed from disabled to auto st art. System Information None 2013-08-19 15:27:43 Vic Tiangco Service Control Manager 7040: The start type of the UPn P Device Host service was changed from disabled to demand start. System Information None 2013-08-19 15:27:44 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Desktop Services UserMode Port Redirector service was changed from disabled to demand start. System Information None 2013-08-19 15:27:44 Vic Tiangco Service Control Manager 7040: The start type of the Int eractive Services Detection service was changed from disabled to demand start. System Information None 2013-08-19 15:27:44 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Modules Installer service was changed from disabled to demand start. System Information None 2013-08-19 15:27:45 Vic Tiangco Service Control Manager 7040: The start type of the Dis tributed Link Tracking Client service was changed from disabled to auto start. System Information None 2013-08-19 15:27:45 Vic Tiangco Service Control Manager 7040: The start type of the Thr ead Ordering Server service was changed from disabled to demand start. System Information None 2013-08-19 15:27:46 Vic Tiangco Service Control Manager 7040: The start type of the The mes service was changed from disabled to auto start. System Information None 2013-08-19 15:27:46 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Desktop Services service was changed from disabled to demand start. System Information None 2013-08-19 15:27:46 Vic Tiangco Service Control Manager 7040: The start type of the TPM Base Services service was changed from disabled to demand start. System Information None 2013-08-19 15:27:47 Vic Tiangco Service Control Manager 7040: The start type of the Tel ephony service was changed from disabled to demand start. System Information None 2013-08-19 15:27:47 Vic Tiangco Service Control Manager 7040: The start type of the Tab let PC Input Service service was changed from disabled to demand start. System Information None 2013-08-19 15:27:48 Vic Tiangco Service Control Manager 7040: The start type of the Sup erfetch service was changed from disabled to auto start. System Information None 2013-08-19 15:27:48 Vic Tiangco Service Control Manager 7040: The start type of the Mic rosoft Software Shadow Copy Provider service was changed from disabled to demand start. System Information None 2013-08-19 15:27:49 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Image Acquisition (WIA) service was changed from disabled to demand start.

System Information None 2013-08-19 15:27:49 Vic Tiangco Service Control Manager 7040: The start type of the Sec ure Socket Tunneling Protocol Service service was changed from disabled to deman d start. System Information None 2013-08-19 15:27:50 Vic Tiangco Service Control Manager 7040: The start type of the SSD P Discovery service was changed from disabled to demand start. System Information None 2013-08-19 15:27:50 Vic Tiangco Service Control Manager 7040: The start type of the SPP Notification Service service was changed from disabled to demand start. System Information None 2013-08-19 15:27:51 Vic Tiangco Service Control Manager 7040: The start type of the Pri nt Spooler service was changed from disabled to auto start. System Information None 2013-08-19 15:27:51 Vic Tiangco Service Control Manager 7040: The start type of the SNM P Trap service was changed from disabled to demand start. System Information None 2013-08-19 15:27:51 Vic Tiangco Service Control Manager 7040: The start type of the She ll Hardware Detection service was changed from disabled to auto start. System Information None 2013-08-19 15:27:52 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Desktop Configuration service was changed from disabled to demand start. System Information None 2013-08-19 15:27:52 Vic Tiangco Service Control Manager 7040: The start type of the Ada ptive Brightness service was changed from disabled to demand start. System Information None 2013-08-19 15:27:53 Vic Tiangco Service Control Manager 7040: The start type of the Sys tem Event Notification Service service was changed from disabled to auto start.

System Information None 2013-08-19 15:27:53 Vic Tiangco Service Control Manager 7040: The start type of the Sec ondary Logon service was changed from disabled to demand start. System Information None 2013-08-19 15:27:54 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Backup service was changed from disabled to demand start. System Information None 2013-08-19 15:27:54 Vic Tiangco Service Control Manager 7040: The start type of the Sma rt Card Removal Policy service was changed from disabled to demand start. System Error None 2013-08-19 15:27:55 Service Control Manager 7001: The Background Intelligen t Transfer Service service depends on the COM+ Event System service which failed to start because of the following error: %%1058 System Information None 2013-08-19 15:27:55 Vic Tiangco Service Control Manager 7040: The start type of the Sma rt Card service was changed from disabled to demand start. System Information None 2013-08-19 15:27:55 Vic Tiangco Service Control Manager 7040: The start type of the Sec urity Accounts Manager service was changed from disabled to auto start. System Information None 2013-08-19 15:27:56 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the running state. System Information None 2013-08-19 15:27:56 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Procedure Call (RPC) Locator service was changed from disabled to demand sta rt. System Information None 2013-08-19 15:27:57 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 15:27:57 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Registry service was changed from disabled to demand start. System Information None 2013-08-19 15:27:57 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Access Connection Manager service was changed from disabled to demand start.

System Information None 2013-08-19 15:27:57 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Access Auto Connection Manager service was changed from disabled to demand s tart. System Information None 2013-08-19 15:27:58 Vic Tiangco Service Control Manager 7040: The start type of the Qua lity Windows Audio Video Experience service was changed from disabled to demand start. System Information None 2013-08-19 15:27:58 Vic Tiangco Service Control Manager 7040: The start type of the Pro tected Storage service was changed from disabled to demand start. System Information None 2013-08-19 15:27:59 Vic Tiangco Service Control Manager 7040: The start type of the Pow er service was changed from disabled to auto start. System Information None 2013-08-19 15:27:59 Vic Tiangco Service Control Manager 7040: The start type of the IPs ec Policy Agent service was changed from disabled to demand start. System Information None 2013-08-19 15:28:00 Vic Tiangco Service Control Manager 7040: The start type of the Pee r Name Resolution Protocol service was changed from disabled to demand start. System Information None 2013-08-19 15:28:00 Vic Tiangco Service Control Manager 7040: The start type of the PNR P Machine Name Publication Service service was changed from disabled to demand s tart. System Information None 2013-08-19 15:28:01 Vic Tiangco Service Control Manager 7040: The start type of the Per formance Logs & Alerts service was changed from disabled to demand start. System Information None 2013-08-19 15:28:01 Vic Tiangco Service Control Manager 7040: The start type of the Bra nchCache service was changed from disabled to demand start. System Information None 2013-08-19 15:28:01 Vic Tiangco Service Control Manager 7040: The start type of the Pro gram Compatibility Assistant Service service was changed from disabled to demand start. System Information None 2013-08-19 15:28:02 Vic Tiangco Service Control Manager 7040: The start type of the Pee r Networking Grouping service was changed from disabled to demand start. System Information None 2013-08-19 15:28:02 Vic Tiangco Service Control Manager 7040: The start type of the Pee r Networking Identity Manager service was changed from disabled to demand start.

System Information None 2013-08-19 15:28:03 Vic Tiangco Service Control Manager 7040: The start type of the Net work Store Interface Service service was changed from disabled to auto start. System Information None 2013-08-19 15:28:03 Vic Tiangco Service Control Manager 7040: The start type of the Net work Location Awareness service was changed from disabled to auto start. System Information None 2013-08-19 15:28:04 Vic Tiangco Service Control Manager 7040: The start type of the Net work List Service service was changed from disabled to demand start. System Information None 2013-08-19 15:28:04 Vic Tiangco Service Control Manager 7040: The start type of the Net logon service was changed from disabled to demand start. System Information None 2013-08-19 15:28:04 Vic Tiangco Service Control Manager 7040: The start type of the Net work Access Protection Agent service was changed from disabled to demand start.

System Information None 2013-08-19 15:28:05 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Installer service was changed from disabled to demand start. System Information None 2013-08-19 15:28:05 Vic Tiangco Service Control Manager 7040: The start type of the Mic rosoft iSCSI Initiator Service service was changed from disabled to demand start . System Information None 2013-08-19 15:28:06 Vic Tiangco Service Control Manager 7040: The start type of the Dis tributed Transaction Coordinator service was changed from disabled to demand sta rt. System Information None 2013-08-19 15:28:06 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Firewall service was changed from disabled to auto start. System Information None 2013-08-19 15:28:07 Vic Tiangco Service Control Manager 7040: The start type of the Mul timedia Class Scheduler service was changed from disabled to auto start. System Information None 2013-08-19 15:28:07 Vic Tiangco Service Control Manager 7040: The start type of the TCP /IP NetBIOS Helper service was changed from disabled to auto start. System Information None 2013-08-19 15:28:07 Vic Tiangco Service Control Manager 7040: The start type of the Lin k-Layer Topology Discovery Mapper service was changed from disabled to demand st art. System Information None 2013-08-19 15:28:08 Vic Tiangco Service Control Manager 7040: The start type of the Wor kstation service was changed from disabled to auto start. System Information None 2013-08-19 15:28:08 Vic Tiangco Service Control Manager 7040: The start type of the Ser ver service was changed from disabled to auto start. System Information None 2013-08-19 15:28:09 Vic Tiangco Service Control Manager 7040: The start type of the Ktm Rm for Distributed Transaction Coordinator service was changed from disabled to demand start. System Information None 2013-08-19 15:28:09 Vic Tiangco Service Control Manager 7040: The start type of the CNG Key Isolation service was changed from disabled to demand start. System Information None 2013-08-19 15:28:09 Vic Tiangco Service Control Manager 7040: The start type of the IP Helper service was changed from disabled to auto start. System Information None 2013-08-19 15:28:10 Vic Tiangco Service Control Manager 7040: The start type of the PnP -X IP Bus Enumerator service was changed from disabled to demand start. System Information None 2013-08-19 15:28:10 Vic Tiangco Service Control Manager 7040: The start type of the IKE and AuthIP IPsec Keying Modules service was changed from disabled to demand sta rt. System Information None 2013-08-19 15:28:11 Vic Tiangco Service Control Manager 7040: The start type of the Can on Inkjet Printer/Scanner/Fax Extended Survey Program service was changed from d isabled to auto start. System Information None 2013-08-19 15:28:11 Vic Tiangco Service Control Manager 7040: The start type of the Win dows CardSpace service was changed from disabled to demand start. System Information None 2013-08-19 15:28:12 Vic Tiangco Service Control Manager 7040: The start type of the Hom eGroup Provider service was changed from disabled to demand start. System Information None 2013-08-19 15:28:12 Vic Tiangco Service Control Manager 7040: The start type of the Hom eGroup Listener service was changed from disabled to demand start. System Information None 2013-08-19 15:28:12 Vic Tiangco Service Control Manager 7040: The start type of the Hea lth Key and Certificate Management service was changed from disabled to demand s tart. System Information None 2013-08-19 15:28:13 Vic Tiangco Service Control Manager 7040: The start type of the Hum an Interface Device Access service was changed from disabled to demand start. System Information None 2013-08-19 15:28:13 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Presentation Foundation Font Cache 3.0.0.0 service was changed from disable d to demand start. System Information None 2013-08-19 15:28:14 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Font Cache Service service was changed from disabled to auto start. System Information None 2013-08-19 15:28:14 Vic Tiangco Service Control Manager 7040: The start type of the Fun ction Discovery Resource Publication service was changed from disabled to demand start. System Information None 2013-08-19 15:28:15 Vic Tiangco Service Control Manager 7040: The start type of the Fun ction Discovery Provider Host service was changed from disabled to demand start.

System Information None 2013-08-19 15:28:15 Vic Tiangco Service Control Manager 7040: The start type of the Fax service was changed from disabled to demand start. System Information None 2013-08-19 15:28:16 Vic Tiangco Service Control Manager 7040: The start type of the COM + Event System service was changed from disabled to auto start. System Information None 2013-08-19 15:28:16 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Event Log service was changed from disabled to auto start. System Information None 2013-08-19 15:28:16 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Media Center Scheduler Service service was changed from disabled to demand start. System Information None 2013-08-19 15:28:17 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Media Center Receiver Service service was changed from disabled to demand s tart. System Information None 2013-08-19 15:28:17 Vic Tiangco Service Control Manager 7040: The start type of the Enc rypting File System (EFS) service was changed from disabled to demand start. System Information None 2013-08-19 15:28:18 Vic Tiangco Service Control Manager 7040: The start type of the Ext ensible Authentication Protocol service was changed from disabled to demand star t. System Information None 2013-08-19 15:28:18 Vic Tiangco Service Control Manager 7040: The start type of the Dia gnostic Policy Service service was changed from disabled to auto start. System Information None 2013-08-19 15:28:19 Vic Tiangco Service Control Manager 7040: The start type of the Wir ed AutoConfig service was changed from disabled to demand start. System Information None 2013-08-19 15:28:19 Vic Tiangco Service Control Manager 7040: The start type of the DNS Client service was changed from disabled to auto start. System Information None 2013-08-19 15:28:19 Vic Tiangco Service Control Manager 7040: The start type of the DHC P Client service was changed from disabled to auto start. System Information None 2013-08-19 15:28:20 Vic Tiangco Service Control Manager 7040: The start type of the Dis k Defragmenter service was changed from disabled to demand start. System Information None 2013-08-19 15:28:20 Vic Tiangco Service Control Manager 7040: The start type of the Off line Files service was changed from disabled to auto start. System Information None 2013-08-19 15:28:21 Vic Tiangco Service Control Manager 7040: The start type of the Cry ptographic Services service was changed from disabled to demand start. System Information None 2013-08-19 15:28:21 Vic Tiangco Service Control Manager 7040: The start type of the COM + System Application service was changed from disabled to demand start. System Information None 2013-08-19 15:28:21 Vic Tiangco Service Control Manager 7040: The start type of the Cer tificate Propagation service was changed from disabled to demand start. System Information None 2013-08-19 15:28:22 Vic Tiangco Service Control Manager 7040: The start type of the Blu etooth Support Service service was changed from disabled to demand start. System Information None 2013-08-19 15:28:22 Vic Tiangco Service Control Manager 7040: The start type of the Com puter Browser service was changed from disabled to demand start. System Information None 2013-08-19 15:28:23 Vic Tiangco Service Control Manager 7040: The start type of the Bas e Filtering Engine service was changed from disabled to auto start. System Information None 2013-08-19 15:28:23 Vic Tiangco Service Control Manager 7040: The start type of the Bit Locker Drive Encryption Service service was changed from disabled to demand star t. System Information None 2013-08-19 15:28:24 Vic Tiangco Service Control Manager 7040: The start type of the Act iveX Installer (AxInstSV) service was changed from disabled to demand start. System Information None 2013-08-19 15:28:24 Vic Tiangco Service Control Manager 7040: The start type of the App lication Management service was changed from disabled to demand start. System Information None 2013-08-19 15:28:24 Vic Tiangco Service Control Manager 7040: The start type of the App lication Identity service was changed from disabled to demand start. System Information None 2013-08-19 15:28:25 Vic Tiangco Service Control Manager 7040: The start type of the App lication Layer Gateway Service service was changed from disabled to demand start . System Information None 2013-08-19 15:28:25 Vic Tiangco Service Control Manager 7040: The start type of the App lication Experience service was changed from disabled to demand start. System Information None 2013-08-19 15:28:42 Vic Tiangco Service Control Manager 7040: The start type of the Can on Inkjet Printer/Scanner/Fax Extended Survey Program service was changed from a uto start to disabled. System Information None 2013-08-19 15:28:46 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information 1102 2013-08-19 15:28:47 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information None 2013-08-19 15:28:48 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 15:28:48 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the stopped state. System Information None 2013-08-19 15:28:48 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 15:28:48 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 15:28:48 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information 7010 2013-08-19 15:28:48 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Information 103 2013-08-19 15:28:49 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 15:28:53 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 15:29:12 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 15:29:12 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 86 2013-08-19 15:29:19 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information 4 2013-08-19 15:29:21 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Information None 2013-08-19 15:29:27 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 15:29:27 EventLog 6005: The Event log service was started. System Information None 2013-08-19 15:29:27 EventLog 6013: The system uptime is 15 s econds. System Information None 2013-08-19 15:29:27 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 15:29:27 Service Control Manager 7036: The Power service entered the running state. System Information None 2013-08-19 15:29:27 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 15:29:27 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 15:29:27 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 15:29:27 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 15:29:27 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 15:29:27 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information 7010 2013-08-19 15:29:27 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Warning None 2013-08-19 15:29:27 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The Security Accounts Man ager service entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The CNG Key Isolation ser vice entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the running state. System Information None 2013-08-19 15:29:29 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information None 2013-08-19 15:29:29 Service Control Manager 7036: The DNS Client service en tered the running state. System Information None 2013-08-19 15:29:29 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information 4 2013-08-19 15:29:29 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started System Information 4 2013-08-19 15:29:29 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i s started System Information None 2013-08-19 15:29:30 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the running state. System Information None 2013-08-19 15:29:30 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information None 2013-08-19 15:29:30 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4000: WLAN AutoConfig servic e has successfully started. System Information None 2013-08-19 15:29:31 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 15:29:32 Service Control Manager 7036: The Print Spooler service entered the running state. System Information None 2013-08-19 15:29:32 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information None 2013-08-19 15:29:33 Service Control Manager 7036: The Windows Firewall serv ice entered the running state. System Information None 2013-08-19 15:29:33 Service Control Manager 7036: The Workstation service e ntered the running state. System Information None 2013-08-19 15:29:34 Service Control Manager 7036: The Network Location Awar eness service entered the running state. System Information None 2013-08-19 15:29:34 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the running state. System Information None 2013-08-19 15:29:34 Service Control Manager 7036: The Superfetch service en tered the running state. System Information None 2013-08-19 15:29:34 Service Control Manager 7036: The Distributed Link Trac king Client service entered the running state. System Information None 2013-08-19 15:29:35 Service Control Manager 7036: The Windows Management In strumentation service entered the running state. System Information None 2013-08-19 15:29:35 Service Control Manager 7036: The IP Helper service ent ered the running state. System Information 1101 2013-08-19 15:29:36 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information None 2013-08-19 15:29:38 Service Control Manager 7036: The Server service entere d the running state. System Information None 2013-08-19 15:29:38 Service Control Manager 7036: The Diagnostic Service Ho st service entered the running state. System Information None 2013-08-19 15:29:38 Service Control Manager 7036: The Network List Service service entered the running state. System Information None 2013-08-19 15:29:38 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 15:29:38 Service Control Manager 7036: The Diagnostic System Hos t service entered the running state. System Information None 2013-08-19 15:29:53 Service Control Manager 7036: The Network Connections s ervice entered the running state. System Information None 2013-08-19 15:30:01 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 15:30:02 Service Control Manager 7036: The Windows Defender serv ice entered the running state. System Information None 2013-08-19 15:30:02 Service Control Manager 7036: The Cryptographic Service s service entered the running state. System Information None 2013-08-19 15:30:03 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 15:30:39 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 15:30:39 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Information None 2013-08-19 15:31:30 Service Control Manager 7036: The Windows Update servic e entered the running state. System Information None 2013-08-19 15:31:33 Service Control Manager 7036: The Windows Installer ser vice entered the running state. System Information 1 2013-08-19 15:31:37 SYSTEM Microsoft-Windows-WindowsUpdateClient 27: Automatic Updates is now paused. System Information None 2013-08-19 15:31:41 Vic Tiangco Service Control Manager 7040: The start type of the Mic rosoft .NET Framework NGEN v2.0.50727_X86 service was changed from auto start to disabled. System Information None 2013-08-19 15:31:43 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the running state. System Information None 2013-08-19 15:31:43 SYSTEM Microsoft-Windows-Application-Experience 206: The Program Comp atibility Assistant service successfully performed phase two initialization. System Information None 2013-08-19 15:31:50 Service Control Manager 7036: The SSDP Discovery servic e entered the running state. System Information None 2013-08-19 15:31:56 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 15:32:02 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 15:32:03 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 15:32:11 Service Control Manager 7036: The Security Center servi ce entered the running state. System Information None 2013-08-19 15:33:03 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Net.Tcp Listener Adapter Service File Name: C: \Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe Service Type: user m ode service Service Start Type: disabled Service Account: NT AUTHORITY\Local Service System Information None 2013-08-19 15:33:54 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Net.Pipe Listener Adapter Service File Name: C :\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe Service Type: user mode service Service Start Type: disabled Service Account: NT AUTHORITY\Loca lService System Information None 2013-08-19 15:34:13 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Net.Msmq Listener Adapter Service File Name: " C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe" -NetMsmqActivator Service Type: user mode service Service Start Type: disabled Service Account : NT AUTHORITY\NetworkService System Information None 2013-08-19 15:34:33 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Microsoft .NET Framework NGEN v4.0.30319_X86 Se rvice File Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe Se rvice Type: user mode service Service Start Type: auto start Service Account : LocalSystem System Information None 2013-08-19 15:34:41 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: ASP.NET State Service Service File Name: %Syst emRoot%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe Service Type: user mode service Service Start Type: disabled Service Account: LocalSystem System Information None 2013-08-19 15:35:08 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v4.0.30319_X86 service entered the running state. System Information None 2013-08-19 15:35:48 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the running state. System Information None 2013-08-19 15:35:49 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the running state. System Information 7005 2013-08-19 15:36:26 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\volsnap.inf_x86_neutral_42f862e 05fcb0306\volsnap.inf for Device Instance ID STORAGE\VOLUMESNAPSHOT\HARDDISKVOLU MESNAPSHOT5 with the following status: 0x0. System Information None 2013-08-19 15:37:21 Service Control Manager 7036: The Windows Installer ser vice entered the stopped state. System Information 1 2013-08-19 15:37:26 SYSTEM Microsoft-Windows-WindowsUpdateClient 28: Automatic Updates is now resumed. System Information None 2013-08-19 15:39:42 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 15:39:46 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2013-08-19 15:40:16 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: TeamViewer 8 Service File Name: "C:\Program Fi les\TeamViewer\Version8\TeamViewer_Service.exe" Service Type: user mode servic e Service Start Type: auto start Service Account: LocalSystem System Information None 2013-08-19 15:40:49 Service Control Manager 7036: The TeamViewer 8 service entered the running state. System Information None 2013-08-19 15:40:51 Service Control Manager 7036: The WinHTTP Web Proxy Aut o-Discovery Service service entered the running state. System Error None 2013-08-19 15:41:04 Service Control Manager 7031: The TeamViewer 8 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 2000 milliseconds: Restart the service. System Information None 2013-08-19 15:41:06 Service Control Manager 7036: The TeamViewer 8 service entered the running state. System Information None 2013-08-19 15:42:34 volsnap 33: The oldest shadow copy of v olume C: was deleted to keep disk space usage for shadow copies of volume C: bel ow the user defined limit. System Information None 2013-08-19 15:42:46 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the stopped state. System Information None 2013-08-19 15:45:04 Vic Tiangco USER32 1074: The process Explorer.EXE has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: Other (Unplanned) Reason Code: 0x0 Shutd own Type: restart Comment: System Information None 2013-08-19 15:45:08 Vic Tiangco USER32 1074: The process C:\Windows\sy stem32\winlogon.exe (EMOVHICRN) has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: No title for t his reason could be found Reason Code: 0x500ff Shutdown Type: restart C omment: System Information 1102 2013-08-19 15:45:08 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information None 2013-08-19 15:45:09 Service Control Manager 7036: The Windows Update servic e entered the stopped state. System Information None 2013-08-19 15:45:09 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 15:45:09 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v4.0.30319_X86 service entered the stopped state. System Information None 2013-08-19 15:45:10 EventLog 6006: The Event log service was stopped. System Information None 2013-08-19 15:45:10 Service Control Manager 7036: The Power service entered the stopped state. System Information None 2013-08-19 15:45:10 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 15:45:10 Service Control Manager 7036: The DHCP Client service e ntered the stopped state. System Information None 2013-08-19 15:45:10 Service Control Manager 7036: The Distributed Link Trac king Client service entered the stopped state. System Information None 2013-08-19 15:45:10 Service Control Manager 7036: The Diagnostic Service Ho st service entered the stopped state. System Information None 2013-08-19 15:45:10 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the stopped state. System Information None 2013-08-19 15:45:10 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 15:45:10 Service Control Manager 7036: The TeamViewer 8 service entered the stopped state. System Information None 2013-08-19 15:45:10 Service Control Manager 7036: The SSDP Discovery servic e entered the stopped state. System Information None 2013-08-19 15:45:10 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information 4 2013-08-19 15:45:10 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51047: DHCPv6 client service i s stopped. ShutDown Flag value is 1 System Information 4 2013-08-19 15:45:10 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50037: DHCPv4 client service is stopped. ShutDown Flag value is 1 System Information 7010 2013-08-19 15:45:10 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Information None 2013-08-19 15:45:11 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the stopped state. System Information None 2013-08-19 15:45:12 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the stopped state. System Information None 2013-08-19 15:45:12 Service Control Manager 7036: The Security Center servi ce entered the stopped state. System Information None 2013-08-19 15:45:12 Service Control Manager 7036: The Windows Management In strumentation service entered the stopped state. System Information None 2013-08-19 15:45:12 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the stopped state. System Information None 2013-08-19 15:45:13 Service Control Manager 7036: The Windows Defender serv ice entered the stopped state. System Information None 2013-08-19 15:45:13 Service Control Manager 7036: The Superfetch service en tered the stopped state. System Information None 2013-08-19 15:45:14 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the stopped state. System Information None 2013-08-19 15:45:14 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Warning None 2013-08-19 15:45:14 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4001: WLAN AutoConfig servic e has successfully stopped. System Information None 2013-08-19 15:45:15 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information 103 2013-08-19 15:45:15 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 15:45:19 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Information None 2013-08-19 15:45:21 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 15:45:40 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 15:45:40 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 86 2013-08-19 15:45:49 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information 4 2013-08-19 15:45:51 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Warning None 2013-08-19 15:45:56 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 15:46:21 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 15:46:21 Service Control Manager 7036: The Power service entered the running state. System Information None 2013-08-19 15:46:21 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 15:46:21 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 15:46:21 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 15:46:21 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information 7010 2013-08-19 15:46:21 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Information None 2013-08-19 15:46:22 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 15:46:22 EventLog 6005: The Event log service was started. System Information None 2013-08-19 15:46:22 EventLog 6013: The system uptime is 41 s econds. System Information None 2013-08-19 15:46:22 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 15:46:22 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 15:46:23 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 15:46:23 Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 15:46:23 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 15:46:23 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 15:46:23 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 15:46:23 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 15:46:23 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 15:46:24 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 15:46:24 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 15:46:24 Service Control Manager 7036: The Security Accounts Man ager service entered the running state. System Information None 2013-08-19 15:46:24 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information None 2013-08-19 15:46:24 Service Control Manager 7036: The CNG Key Isolation ser vice entered the running state. System Information None 2013-08-19 15:46:24 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 15:46:24 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information None 2013-08-19 15:46:24 Service Control Manager 7036: The DNS Client service en tered the running state. System Information 1101 2013-08-19 15:46:24 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information 4 2013-08-19 15:46:24 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started System Information 4 2013-08-19 15:46:24 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i s started System Information None 2013-08-19 15:46:25 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the running state. System Information None 2013-08-19 15:46:25 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the running state. System Information None 2013-08-19 15:46:25 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information None 2013-08-19 15:46:25 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 15:46:25 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4000: WLAN AutoConfig servic e has successfully started. System Information None 2013-08-19 15:46:26 Service Control Manager 7036: The Print Spooler service entered the running state. System Information None 2013-08-19 15:46:26 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information None 2013-08-19 15:46:26 Service Control Manager 7036: The Windows Firewall serv ice entered the running state. System Information None 2013-08-19 15:46:26 Service Control Manager 7036: The Workstation service e ntered the running state. System Information None 2013-08-19 15:46:26 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the running state. System Information None 2013-08-19 15:46:27 Service Control Manager 7036: The Superfetch service en tered the running state. System Information None 2013-08-19 15:46:27 Service Control Manager 7036: The Network Location Awar eness service entered the running state. System Information None 2013-08-19 15:46:31 Service Control Manager 7036: The Distributed Link Trac king Client service entered the running state. System Information None 2013-08-19 15:46:31 Service Control Manager 7036: The Windows Management In strumentation service entered the running state. System Information None 2013-08-19 15:46:31 Service Control Manager 7036: The IP Helper service ent ered the running state. System Information None 2013-08-19 15:46:31 Service Control Manager 7036: The Server service entere d the running state. System Information None 2013-08-19 15:46:43 Service Control Manager 7036: The TeamViewer 8 service entered the running state. System Information None 2013-08-19 15:46:43 Service Control Manager 7036: The Diagnostic Service Ho st service entered the running state. System Information None 2013-08-19 15:46:43 Service Control Manager 7036: The Network List Service service entered the running state. System Information None 2013-08-19 15:46:43 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 15:46:43 Service Control Manager 7036: The Diagnostic System Hos t service entered the running state. System Information None 2013-08-19 15:46:43 Service Control Manager 7036: The Windows Defender serv ice entered the running state. System Information None 2013-08-19 15:46:44 Service Control Manager 7036: The Cryptographic Service s service entered the running state. System Information None 2013-08-19 15:46:44 Service Control Manager 7036: The Network Connections s ervice entered the running state. System Information None 2013-08-19 15:46:48 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 15:47:23 Service Control Manager 7036: The Application Managemen t service entered the running state. System Information None 2013-08-19 15:47:33 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 15:47:33 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Information None 2013-08-19 15:47:49 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 15:48:17 SYSTEM Microsoft-Windows-Application-Experience 206: The Program Comp atibility Assistant service successfully performed phase two initialization. System Information None 2013-08-19 15:48:25 Service Control Manager 7036: The Windows Installer ser vice entered the running state. System Information None 2013-08-19 15:48:42 Service Control Manager 7036: The Windows Update servic e entered the running state. System Information None 2013-08-19 15:48:43 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 15:48:49 Service Control Manager 7036: The WinHTTP Web Proxy Aut o-Discovery Service service entered the running state. System Information None 2013-08-19 15:48:50 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the running state. System Information None 2013-08-19 15:48:52 Service Control Manager 7036: The SSDP Discovery servic e entered the running state. System Information None 2013-08-19 15:48:56 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v4.0.30319_X86 service entered the running state. System Information None 2013-08-19 15:48:57 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 15:48:57 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 15:48:58 Service Control Manager 7036: The Security Center servi ce entered the running state. System Information None 2013-08-19 15:49:32 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the running state. System Information None 2013-08-19 15:49:32 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the running state. System Information None 2013-08-19 15:49:50 volsnap 33: The oldest shadow copy of v olume C: was deleted to keep disk space usage for shadow copies of volume C: bel ow the user defined limit. System Information None 2013-08-19 15:49:57 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Skype Updater Service File Name: "C:\Program F iles\Skype\Updater\Updater.exe" Service Type: user mode service Service Start Type: auto start Service Account: LocalSystem System Information None 2013-08-19 15:50:11 Service Control Manager 7036: The Skype Updater service entered the running state. System Information None 2013-08-19 15:51:12 Service Control Manager 7036: The Skype Updater service entered the stopped state. System Information 7005 2013-08-19 15:52:32 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service USBSTOR for Device Instance ID USB\VID_1058&P ID_1023\575844314132313233303135 with the following status: 0. System Information 7005 2013-08-19 15:52:33 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\usbstor.inf_x86_neutral_c77d41a 490bdc63d\usbstor.inf for Device Instance ID USB\VID_1058&PID_1023\5758443141323 13233303135 with the following status: 0x0. System Information 7005 2013-08-19 15:52:39 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service disk for Device Instance ID USBSTOR\DISK&VEN_ WD&PROD_ELEMENTS_1023&REV_2005\575844314132313233303135&0 with the following sta tus: 0. System Information 7005 2013-08-19 15:52:40 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\disk.inf_x86_neutral_b431b61a11 f8df6c\disk.inf for Device Instance ID USBSTOR\DISK&VEN_WD&PROD_ELEMENTS_1023&RE V_2005\575844314132313233303135&0 with the following status: 0x0. System Information None 2013-08-19 15:52:42 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information 7005 2013-08-19 15:52:46 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service volsnap for Device Instance ID STORAGE\VOLUME \{586D5B16-08A3-11E3-8D6F-0016D4BCCE11}#0000007186900000 with the following stat us: 0. System Information 7005 2013-08-19 15:52:46 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\volume.inf_x86_neutral_6dee0205 881d1a1d\volume.inf for Device Instance ID STORAGE\VOLUME\{586D5B16-08A3-11E3-8D 6F-0016D4BCCE11}#0000007186900000 with the following status: 0x0. System Information 7005 2013-08-19 15:52:52 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service volsnap for Device Instance ID STORAGE\VOLUME \{586D5B16-08A3-11E3-8D6F-0016D4BCCE11}#0000000000100000 with the following stat us: 0. System Information 7005 2013-08-19 15:52:52 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\volume.inf_x86_neutral_6dee0205 881d1a1d\volume.inf for Device Instance ID STORAGE\VOLUME\{586D5B16-08A3-11E3-8D 6F-0016D4BCCE11}#0000000000100000 with the following status: 0x0. System Information None 2013-08-19 15:53:00 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2013-08-19 15:54:27 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 15:54:42 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 15:54:56 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the running state. System Information None 2013-08-19 15:56:00 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the stopped state. System Information None 2013-08-19 15:56:33 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the running state. System Information None 2013-08-19 15:56:33 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the running state. System Information None 2013-08-19 15:56:48 volsnap 33: The oldest shadow copy of v olume C: was deleted to keep disk space usage for shadow copies of volume C: bel ow the user defined limit. System Information None 2013-08-19 15:56:56 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the stopped state. System Information None 2013-08-19 15:57:17 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Office Source Engine Service File Name: "C:\P rogram Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" Service Type: user mode service Service Start Type: demand start Service Account: LocalS ystem System Information None 2013-08-19 16:00:08 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2013-08-19 16:01:36 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Office Software Protection Platform Service Fil e Name: "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectio nPlatform\OSPPSVC.EXE" Service Type: user mode service Service Start Type: d emand start Service Account: NT AUTHORITY\NetworkService System Information None 2013-08-19 16:01:39 Service Control Manager 7036: The Office Software Prote ction Platform service entered the running state. System Information None 2013-08-19 16:01:57 Service Control Manager 7036: The Windows Modules Insta ller service entered the running state. System Information None 2013-08-19 16:02:10 Service Control Manager 7036: The Multimedia Class Sche duler service entered the stopped state. System Information None 2013-08-19 16:02:51 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Information None 2013-08-19 16:02:53 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 16:03:08 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the stopped state. System Information None 2013-08-19 16:08:07 Service Control Manager 7036: The Windows Image Acquisi tion (WIA) service entered the running state. System Information None 2013-08-19 16:08:25 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 16:08:38 Service Control Manager 7036: The Windows Image Acquisi tion (WIA) service entered the stopped state. System Information None 2013-08-19 16:09:21 volsnap 33: The oldest shadow copy of v olume C: was deleted to keep disk space usage for shadow copies of volume C: bel ow the user defined limit. System Information None 2013-08-19 16:10:05 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the running state. System Information None 2013-08-19 16:10:05 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the running state. System Information 1 2013-08-19 16:10:08 SYSTEM Microsoft-Windows-WindowsUpdateClient 27: Automatic Updates is now paused. System Information 1 2013-08-19 16:10:53 SYSTEM Microsoft-Windows-WindowsUpdateClient 27: Automatic Updates is now paused. System Information 1 2013-08-19 16:10:53 SYSTEM Microsoft-Windows-WindowsUpdateClient 27: Automatic Updates is now paused. System Information 1 2013-08-19 16:10:53 SYSTEM Microsoft-Windows-WindowsUpdateClient 28: Automatic Updates is now resumed. System Information None 2013-08-19 16:10:56 Vic Tiangco USER32 1074: The process setup.exe has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tia ngco for the following reason: No title for this reason could be found Reason Code: 0xffff Shutdown Type: restart Comment: System Information None 2013-08-19 16:11:05 Vic Tiangco USER32 1074: The process C:\Windows\sy stem32\winlogon.exe (EMOVHICRN) has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: No title for t his reason could be found Reason Code: 0x500ff Shutdown Type: restart C omment: System Information 1102 2013-08-19 16:11:05 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information None 2013-08-19 16:11:06 Service Control Manager 7036: The Windows Update servic e entered the stopped state. System Information None 2013-08-19 16:11:06 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 16:11:06 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v4.0.30319_X86 service entered the stopped state. System Information None 2013-08-19 16:11:06 Service Control Manager 7036: The Windows Installer ser vice entered the stopped state. System Information None 2013-08-19 16:11:08 Service Control Manager 7036: The Power service entered the stopped state. System Information None 2013-08-19 16:11:08 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the stopped state. System Information None 2013-08-19 16:11:08 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 16:11:08 Service Control Manager 7036: The DHCP Client service e ntered the stopped state. System Information None 2013-08-19 16:11:08 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 16:11:08 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the stopped state. System Information None 2013-08-19 16:11:08 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the stopped state. System Information 4 2013-08-19 16:11:08 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51047: DHCPv6 client service i s stopped. ShutDown Flag value is 1 System Information 4 2013-08-19 16:11:08 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50037: DHCPv4 client service is stopped. ShutDown Flag value is 1 System Information 7010 2013-08-19 16:11:08 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Information None 2013-08-19 16:11:09 EventLog 6006: The Event log service was stopped. System Information None 2013-08-19 16:11:09 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the stopped state. System Information None 2013-08-19 16:11:09 Service Control Manager 7036: The Distributed Link Trac king Client service entered the stopped state. System Information None 2013-08-19 16:11:09 Service Control Manager 7036: The SSDP Discovery servic e entered the stopped state. System Information None 2013-08-19 16:11:09 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 16:11:10 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2013-08-19 16:11:10 Service Control Manager 7036: The Office Software Prote ction Platform service entered the stopped state. System Information None 2013-08-19 16:11:10 Service Control Manager 7036: The Diagnostic Service Ho st service entered the stopped state. System Information None 2013-08-19 16:11:10 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the stopped state. System Information None 2013-08-19 16:11:10 Service Control Manager 7036: The Security Center servi ce entered the stopped state. System Information None 2013-08-19 16:11:11 Service Control Manager 7036: The Windows Management In strumentation service entered the stopped state. System Information None 2013-08-19 16:11:11 Service Control Manager 7036: The Superfetch service en tered the stopped state. System Information None 2013-08-19 16:11:12 Service Control Manager 7036: The Windows Defender serv ice entered the stopped state. System Information None 2013-08-19 16:11:13 Service Control Manager 7036: The TeamViewer 8 service entered the stopped state. System Information 103 2013-08-19 16:11:13 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 16:11:14 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Information None 2013-08-19 16:11:14 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the stopped state. System Warning None 2013-08-19 16:11:14 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4001: WLAN AutoConfig servic e has successfully stopped. System Information None 2013-08-19 16:11:15 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information None 2013-08-19 16:11:15 Service Control Manager 7036: The Windows Modules Insta ller service entered the stopped state. System Information None 2013-08-19 16:11:20 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Information None 2013-08-19 16:11:23 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 16:11:42 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 16:11:42 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 86 2013-08-19 16:11:50 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information 4 2013-08-19 16:11:52 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Warning None 2013-08-19 16:11:58 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 16:12:23 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 16:12:23 Service Control Manager 7036: The Power service entered the running state. System Information 7010 2013-08-19 16:12:23 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Information None 2013-08-19 16:12:24 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 16:12:24 EventLog 6005: The Event log service was started. System Information None 2013-08-19 16:12:24 EventLog 6013: The system uptime is 41 s econds. System Information None 2013-08-19 16:12:24 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 16:12:24 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 16:12:24 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 16:12:24 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 16:12:24 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The Security Accounts Man ager service entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The CNG Key Isolation ser vice entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the running state. System Information 4 2013-08-19 16:12:25 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started System Information 4 2013-08-19 16:12:25 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i s started System Information None 2013-08-19 16:12:26 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the running state. System Information None 2013-08-19 16:12:26 Service Control Manager 7036: The DNS Client service en tered the running state. System Information None 2013-08-19 16:12:26 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information None 2013-08-19 16:12:26 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4000: WLAN AutoConfig servic e has successfully started. System Information None 2013-08-19 16:12:27 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 16:12:27 Service Control Manager 7036: The Print Spooler service entered the running state. System Information None 2013-08-19 16:12:27 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information 1101 2013-08-19 16:12:27 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information None 2013-08-19 16:12:28 Service Control Manager 7036: The Windows Firewall serv ice entered the running state. System Information None 2013-08-19 16:12:28 Service Control Manager 7036: The Workstation service e ntered the running state. System Information None 2013-08-19 16:12:28 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the running state. System Information None 2013-08-19 16:12:28 Service Control Manager 7036: The Network Location Awar eness service entered the running state. System Information None 2013-08-19 16:12:29 Service Control Manager 7036: The Superfetch service en tered the running state. System Information None 2013-08-19 16:12:29 Service Control Manager 7036: The Skype Updater service entered the running state. System Information None 2013-08-19 16:12:34 Service Control Manager 7036: The Distributed Link Trac king Client service entered the running state. System Information None 2013-08-19 16:12:34 Service Control Manager 7036: The Windows Management In strumentation service entered the running state. System Information None 2013-08-19 16:12:34 Service Control Manager 7036: The IP Helper service ent ered the running state. System Information None 2013-08-19 16:12:34 Service Control Manager 7036: The Server service entere d the running state. System Information None 2013-08-19 16:12:53 Service Control Manager 7036: The TeamViewer 8 service entered the running state. System Information None 2013-08-19 16:12:53 Service Control Manager 7036: The Network List Service service entered the running state. System Information None 2013-08-19 16:12:53 Service Control Manager 7036: The Diagnostic Service Ho st service entered the running state. System Information None 2013-08-19 16:12:53 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 16:12:53 Service Control Manager 7036: The Diagnostic System Hos t service entered the running state. System Information None 2013-08-19 16:12:53 Service Control Manager 7036: The Windows Defender serv ice entered the running state. System Information None 2013-08-19 16:12:54 Service Control Manager 7036: The Cryptographic Service s service entered the running state. System Information None 2013-08-19 16:12:55 Service Control Manager 7036: The Network Connections s ervice entered the running state. System Information None 2013-08-19 16:12:57 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 16:13:02 Service Control Manager 7036: The Windows Installer ser vice entered the running state. System Information None 2013-08-19 16:14:09 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the running state. System Information None 2013-08-19 16:14:09 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the running state. System Information None 2013-08-19 16:14:29 volsnap 33: The oldest shadow copy of v olume C: was deleted to keep disk space usage for shadow copies of volume C: bel ow the user defined limit. System Information None 2013-08-19 16:14:30 Service Control Manager 7036: The Skype Updater service entered the stopped state. System Information None 2013-08-19 16:14:37 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 16:14:53 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the running state. System Information None 2013-08-19 16:14:53 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 16:14:54 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v4.0.30319_X86 service entered the running state. System Information None 2013-08-19 16:14:55 Service Control Manager 7036: The SSDP Discovery servic e entered the running state. System Information None 2013-08-19 16:14:55 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 16:14:59 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 16:15:02 Service Control Manager 7036: The Security Center servi ce entered the running state. System Information None 2013-08-19 16:15:14 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 16:15:14 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Information None 2013-08-19 16:16:06 Service Control Manager 7036: The Office Software Prote ction Platform service entered the running state. System Information None 2013-08-19 16:16:29 Service Control Manager 7036: The Windows Update servic e entered the running state. System Information None 2013-08-19 16:16:45 Service Control Manager 7036: The Windows Installer ser vice entered the stopped state. System Information None 2013-08-19 16:16:58 Service Control Manager 7036: The Office Software Prote ction Platform service entered the stopped state. System Information None 2013-08-19 16:17:01 Service Control Manager 7036: The Office Software Prote ction Platform service entered the running state. System Information None 2013-08-19 16:17:35 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2013-08-19 16:17:43 SYSTEM Microsoft-Windows-Application-Experience 206: The Program Comp atibility Assistant service successfully performed phase two initialization. System Information None 2013-08-19 16:20:13 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the running state. System Information None 2013-08-19 16:20:35 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the stopped state. System Information None 2013-08-19 16:21:03 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: ScsiAccess Service File Name: C:\Program Files \Photodex\ProShow Producer\ScsiAccess.exe Service Type: user mode service Ser vice Start Type: auto start Service Account: LocalSystem System Information None 2013-08-19 16:21:34 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 16:22:13 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the stopped state. System Information None 2013-08-19 16:28:01 Service Control Manager 7036: The Multimedia Class Sche duler service entered the stopped state. System Information None 2013-08-19 16:28:03 Service Control Manager 7036: The WinHTTP Web Proxy Aut o-Discovery Service service entered the running state. System Information None 2013-08-19 16:33:26 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 16:35:50 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 16:37:50 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 16:41:02 Vic Tiangco USER32 1074: The process Explorer.EXE has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: Other (Unplanned) Reason Code: 0x0 Shutd own Type: restart Comment: System Information None 2013-08-19 16:41:08 Vic Tiangco USER32 1074: The process C:\Windows\sy stem32\winlogon.exe (EMOVHICRN) has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: No title for t his reason could be found Reason Code: 0x500ff Shutdown Type: restart C omment: System Information 1102 2013-08-19 16:41:08 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information None 2013-08-19 16:41:09 Service Control Manager 7036: The Windows Update servic e entered the stopped state. System Information None 2013-08-19 16:41:09 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 16:41:10 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v4.0.30319_X86 service entered the stopped state. System Information None 2013-08-19 16:41:10 Service Control Manager 7036: The Office Software Prote ction Platform service entered the stopped state. System Information None 2013-08-19 16:41:10 Service Control Manager 7036: The Power service entered the stopped state. System Information 4 2013-08-19 16:41:10 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51047: DHCPv6 client service i s stopped. ShutDown Flag value is 1 System Information 4 2013-08-19 16:41:10 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50037: DHCPv4 client service is stopped. ShutDown Flag value is 1 System Information None 2013-08-19 16:41:11 Service Control Manager 7036: The DHCP Client service e ntered the stopped state. System Information None 2013-08-19 16:41:11 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the stopped state. System Information None 2013-08-19 16:41:11 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 16:41:11 Service Control Manager 7036: The SSDP Discovery servic e entered the stopped state. System Information None 2013-08-19 16:41:11 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 16:41:11 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 16:41:11 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the stopped state. System Information 7010 2013-08-19 16:41:11 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Information None 2013-08-19 16:41:12 EventLog 6006: The Event log service was stopped. System Information None 2013-08-19 16:41:12 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the stopped state. System Information None 2013-08-19 16:41:12 Service Control Manager 7036: The Distributed Link Trac king Client service entered the stopped state. System Information None 2013-08-19 16:41:12 Service Control Manager 7036: The Diagnostic Service Ho st service entered the stopped state. System Information None 2013-08-19 16:41:12 Service Control Manager 7036: The Superfetch service en tered the stopped state. System Information None 2013-08-19 16:41:13 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the stopped state. System Information None 2013-08-19 16:41:13 Service Control Manager 7036: The Security Center servi ce entered the stopped state. System Information None 2013-08-19 16:41:14 Service Control Manager 7036: The Windows Management In strumentation service entered the stopped state. System Information None 2013-08-19 16:41:14 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Information None 2013-08-19 16:41:16 Service Control Manager 7036: The Windows Defender serv ice entered the stopped state. System Information None 2013-08-19 16:41:16 Service Control Manager 7036: The TeamViewer 8 service entered the stopped state. System Information 103 2013-08-19 16:41:16 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 16:41:17 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information None 2013-08-19 16:41:17 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the stopped state. System Warning None 2013-08-19 16:41:17 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4001: WLAN AutoConfig servic e has successfully stopped. System Information None 2013-08-19 16:41:21 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Information None 2013-08-19 16:41:24 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 16:41:41 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 16:41:41 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 86 2013-08-19 16:41:48 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information 4 2013-08-19 16:41:50 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Warning None 2013-08-19 16:41:55 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 16:42:16 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 16:42:16 EventLog 6005: The Event log service was started. System Information None 2013-08-19 16:42:16 EventLog 6013: The system uptime is 35 s econds. System Information None 2013-08-19 16:42:16 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 16:42:16 Service Control Manager 7036: The Power service entered the running state. System Information None 2013-08-19 16:42:16 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 16:42:16 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 16:42:16 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 16:42:16 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 16:42:16 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information 7010 2013-08-19 16:42:16 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Information None 2013-08-19 16:42:17 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 16:42:17 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 16:42:17 Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 16:42:17 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 16:42:17 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 16:42:17 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 16:42:17 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 16:42:17 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 16:42:17 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 16:42:18 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 16:42:18 Service Control Manager 7036: The Security Accounts Man ager service entered the running state. System Information None 2013-08-19 16:42:18 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information None 2013-08-19 16:42:18 Service Control Manager 7036: The CNG Key Isolation ser vice entered the running state. System Information None 2013-08-19 16:42:18 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 16:42:18 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the running state. System Information 1101 2013-08-19 16:42:18 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information 4 2013-08-19 16:42:18 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started System Information 4 2013-08-19 16:42:18 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i s started System Information None 2013-08-19 16:42:19 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information None 2013-08-19 16:42:19 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the running state. System Information None 2013-08-19 16:42:19 Service Control Manager 7036: The DNS Client service en tered the running state. System Information None 2013-08-19 16:42:19 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information None 2013-08-19 16:42:19 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 16:42:19 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4000: WLAN AutoConfig servic e has successfully started. System Information None 2013-08-19 16:42:20 Service Control Manager 7036: The Print Spooler service entered the running state. System Information None 2013-08-19 16:42:20 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information None 2013-08-19 16:42:20 Service Control Manager 7036: The Windows Firewall serv ice entered the running state. System Information None 2013-08-19 16:42:20 Service Control Manager 7036: The Workstation service e ntered the running state. System Information None 2013-08-19 16:42:20 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the running state. System Information None 2013-08-19 16:42:20 Service Control Manager 7036: The Network Location Awar eness service entered the running state. System Information None 2013-08-19 16:42:21 Service Control Manager 7036: The ScsiAccess service en tered the running state. System Information None 2013-08-19 16:42:21 Service Control Manager 7036: The Superfetch service en tered the running state. System Information None 2013-08-19 16:42:21 Service Control Manager 7036: The Skype Updater service entered the running state. System Information None 2013-08-19 16:42:24 Service Control Manager 7036: The Distributed Link Trac king Client service entered the running state. System Information None 2013-08-19 16:42:24 Service Control Manager 7036: The Windows Management In strumentation service entered the running state. System Information None 2013-08-19 16:42:24 Service Control Manager 7036: The IP Helper service ent ered the running state. System Information None 2013-08-19 16:42:24 Service Control Manager 7036: The Server service entere d the running state. System Information None 2013-08-19 16:42:32 Service Control Manager 7036: The TeamViewer 8 service entered the running state. System Information None 2013-08-19 16:42:32 Service Control Manager 7036: The Diagnostic Service Ho st service entered the running state. System Information None 2013-08-19 16:42:32 Service Control Manager 7036: The Network List Service service entered the running state. System Information None 2013-08-19 16:42:32 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 16:42:32 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 16:42:32 Service Control Manager 7036: The Windows Defender serv ice entered the running state. System Information None 2013-08-19 16:42:32 Service Control Manager 7036: The Diagnostic System Hos t service entered the running state. System Information None 2013-08-19 16:42:43 Service Control Manager 7036: The Office Software Prote ction Platform service entered the running state. System Information None 2013-08-19 16:42:47 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 16:42:51 Service Control Manager 7036: The Cryptographic Service s service entered the running state. System Information None 2013-08-19 16:42:52 Service Control Manager 7036: The Network Connections s ervice entered the running state. System Information None 2013-08-19 16:42:53 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 16:44:22 Service Control Manager 7036: The Skype Updater service entered the stopped state. System Information None 2013-08-19 16:44:32 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the running state. System Information None 2013-08-19 16:44:32 Service Control Manager 7036: The SSDP Discovery servic e entered the running state. System Information None 2013-08-19 16:44:33 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v4.0.30319_X86 service entered the running state. System Information None 2013-08-19 16:44:34 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 16:44:35 Service Control Manager 7036: The Security Center servi ce entered the running state. System Information None 2013-08-19 16:44:39 Service Control Manager 7036: The Windows Update servic e entered the running state. System Information None 2013-08-19 16:44:41 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 16:44:41 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Information None 2013-08-19 16:45:27 Vic Tiangco Service Control Manager 7040: The start type of the Blu etooth Support Service service was changed from demand start to disabled. System Information None 2013-08-19 16:45:47 SYSTEM Microsoft-Windows-Application-Experience 206: The Program Comp atibility Assistant service successfully performed phase two initialization. System Information None 2013-08-19 16:46:10 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information 7005 2013-08-19 16:47:34 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service usbccgp for Device Instance ID USB\VID_1A2C&P ID_0023\5&25117D7C&0&1 with the following status: 0. System Information 7005 2013-08-19 16:47:34 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\usb.inf_x86_neutral_2620fd493ca d7d41\usb.inf for Device Instance ID USB\VID_1A2C&PID_0023\5&25117D7C&0&1 with t he following status: 0x0. System Information 7005 2013-08-19 16:47:35 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service HidUsb for Device Instance ID USB\VID_1A2C&PI D_0023&MI_00\6&7244335&0&0000 with the following status: 0. System Information 7005 2013-08-19 16:47:36 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\input.inf_x86_neutral_9e1eba572 4be176f\input.inf for Device Instance ID USB\VID_1A2C&PID_0023&MI_00\6&7244335&0 &0000 with the following status: 0x0. System Information 7005 2013-08-19 16:47:37 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service HidUsb for Device Instance ID USB\VID_1A2C&PI D_0023&MI_01\6&7244335&0&0001 with the following status: 0. System Information 7005 2013-08-19 16:47:37 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\input.inf_x86_neutral_9e1eba572 4be176f\input.inf for Device Instance ID USB\VID_1A2C&PID_0023&MI_01\6&7244335&0 &0001 with the following status: 0x0. System Information 7005 2013-08-19 16:47:38 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service kbdhid for Device Instance ID HID\VID_1A2C&PI D_0023&MI_00\7&29E72E7&0&0000 with the following status: 0. System Information None 2013-08-19 16:47:39 Service Control Manager 7036: The Human Interface Devic e Access service entered the running state. System Information 7005 2013-08-19 16:47:39 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service kbdclass for Device Instance ID HID\VID_1A2C& PID_0023&MI_00\7&29E72E7&0&0000 with the following status: 0. System Information 7005 2013-08-19 16:47:39 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\keyboard.inf_x86_neutral_50ad65 9974198591\keyboard.inf for Device Instance ID HID\VID_1A2C&PID_0023&MI_00\7&29E 72E7&0&0000 with the following status: 0x0. System Information 7005 2013-08-19 16:47:40 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\input.inf_x86_neutral_9e1eba572 4be176f\input.inf for Device Instance ID HID\VID_1A2C&PID_0023&MI_01&COL02\7&376 112C6&0&0001 with the following status: 0x0. System Information 7005 2013-08-19 16:47:41 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\hidserv.inf_x86_neutral_32c4c73 e5497e483\hidserv.inf for Device Instance ID HID\VID_1A2C&PID_0023&MI_01&COL01\7 &376112C6&0&0000 with the following status: 0x0. System Information None 2013-08-19 16:48:23 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Error None 2013-08-19 16:54:47 Service Control Manager 7030: The DFServ service is mar ked as an interactive service. However, the system is configured to not allow i nteractive services. This service may not function properly. System Information None 2013-08-19 16:54:47 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: DFServ Service File Name: C:\Program Files\Far onics\Deep Freeze\Install C-0\DFServ.exe Service Type: user mode service Serv ice Start Type: auto start Service Account: LocalSystem System Information None 2013-08-19 16:54:48 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: DeepFrz Service File Name: C:\Windows\system32 \drivers\DeepFrz.sys Service Type: kernel mode driver Service Start Type: bo ot start Service Account: System Information None 2013-08-19 16:55:12 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the running state. System Information None 2013-08-19 16:55:12 Vic Tiangco USER32 1074: The process FARONICS_DFS. exe has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\ Vic Tiangco for the following reason: Application: Installation (Planned) Rea son Code: 0x80040002 Shutdown Type: restart Comment: System Information None 2013-08-19 16:55:15 EventLog 6006: The Event log service was stopped. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Windows Update servic e entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v4.0.30319_X86 service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The DHCP Client service e ntered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Human Interface Devic e Access service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Power service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The TeamViewer 8 service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The SSDP Discovery servic e entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Distributed Link Trac king Client service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Office Software Prote ction Platform service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Diagnostic Service Ho st service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the stopped state. System Information None 2013-08-19 16:55:15 Vic Tiangco USER32 1074: The process C:\Windows\sy stem32\winlogon.exe (EMOVHICRN) has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: No title for t his reason could be found Reason Code: 0x500ff Shutdown Type: restart C omment: System Information 1102 2013-08-19 16:55:15 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information 4 2013-08-19 16:55:15 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51047: DHCPv6 client service i s stopped. ShutDown Flag value is 1 System Information 4 2013-08-19 16:55:15 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50037: DHCPv4 client service is stopped. ShutDown Flag value is 1 System Information 7010 2013-08-19 16:55:15 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Information None 2013-08-19 16:55:16 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information None 2013-08-19 16:55:16 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the stopped state. System Information None 2013-08-19 16:55:16 Service Control Manager 7036: The Security Center servi ce entered the stopped state. System Information None 2013-08-19 16:55:16 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the stopped state. System Information None 2013-08-19 16:55:16 Service Control Manager 7036: The Windows Management In strumentation service entered the stopped state. System Information None 2013-08-19 16:55:16 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the stopped state. System Information None 2013-08-19 16:55:16 Service Control Manager 7036: The Windows Defender serv ice entered the stopped state. System Information None 2013-08-19 16:55:16 Service Control Manager 7036: The Superfetch service en tered the stopped state. System Information None 2013-08-19 16:55:16 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Information None 2013-08-19 16:55:16 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Warning None 2013-08-19 16:55:16 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4001: WLAN AutoConfig servic e has successfully stopped. System Information 103 2013-08-19 16:55:17 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 16:55:21 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 16:55:39 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 16:55:39 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 4 2013-08-19 16:55:48 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Information 86 2013-08-19 16:55:48 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Warning None 2013-08-19 16:55:54 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 16:56:14 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 16:56:14 Service Control Manager 7036: The Power service entered the running state. System Information 7010 2013-08-19 16:56:14 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Information None 2013-08-19 16:56:15 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 16:56:15 EventLog 6005: The Event log service was started. System Information None 2013-08-19 16:56:15 EventLog 6013: The system uptime is 35 s econds. System Information None 2013-08-19 16:56:15 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 16:56:15 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 16:56:15 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 16:56:15 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 16:56:15 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information None 2013-08-19 16:56:17 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The Security Accounts Man ager service entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The CNG Key Isolation ser vice entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the running state. System Information 4 2013-08-19 16:56:18 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started System Information None 2013-08-19 16:56:19 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information None 2013-08-19 16:56:19 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the running state. System Information None 2013-08-19 16:56:19 Service Control Manager 7036: The DNS Client service en tered the running state. System Information None 2013-08-19 16:56:19 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information None 2013-08-19 16:56:19 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4000: WLAN AutoConfig servic e has successfully started. System Information 4 2013-08-19 16:56:19 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i s started System Information None 2013-08-19 16:56:20 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 16:56:20 Service Control Manager 7036: The Print Spooler service entered the running state. System Information 1101 2013-08-19 16:56:20 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information None 2013-08-19 16:56:21 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information None 2013-08-19 16:56:21 Service Control Manager 7036: The Windows Firewall serv ice entered the running state. System Information None 2013-08-19 16:56:21 Service Control Manager 7036: The Workstation service e ntered the running state. System Information None 2013-08-19 16:56:21 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the running state. System Information None 2013-08-19 16:56:21 Service Control Manager 7036: The Network Location Awar eness service entered the running state. System Information None 2013-08-19 16:56:22 Service Control Manager 7036: The ScsiAccess service en tered the running state. System Information None 2013-08-19 16:56:22 Service Control Manager 7036: The Superfetch service en tered the running state. System Information None 2013-08-19 16:56:22 Service Control Manager 7036: The Skype Updater service entered the running state. System Information None 2013-08-19 16:56:23 Service Control Manager 7036: The Distributed Link Trac king Client service entered the running state. System Information None 2013-08-19 16:56:23 Service Control Manager 7036: The Windows Management In strumentation service entered the running state. System Information None 2013-08-19 16:56:24 Service Control Manager 7036: The IP Helper service ent ered the running state. System Information None 2013-08-19 16:56:24 Service Control Manager 7036: The Server service entere d the running state. System Information None 2013-08-19 16:56:31 Service Control Manager 7036: The TeamViewer 8 service entered the running state. System Information None 2013-08-19 16:56:31 Service Control Manager 7036: The Diagnostic Service Ho st service entered the running state. System Information None 2013-08-19 16:56:31 Service Control Manager 7036: The Network List Service service entered the running state. System Information None 2013-08-19 16:56:31 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 16:56:32 Service Control Manager 7036: The Windows Defender serv ice entered the running state. System Information None 2013-08-19 16:56:32 Service Control Manager 7036: The Diagnostic System Hos t service entered the running state. System Information None 2013-08-19 16:56:32 Service Control Manager 7036: The Cryptographic Service s service entered the running state. System Information None 2013-08-19 16:56:35 Service Control Manager 7036: The Office Software Prote ction Platform service entered the running state. System Information None 2013-08-19 16:56:37 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the running state. System Information None 2013-08-19 16:56:40 Service Control Manager 7036: The Network Connections s ervice entered the running state. System Information None 2013-08-19 16:56:42 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 16:56:42 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 16:57:27 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 16:57:27 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Error None 2013-08-19 16:57:46 Service Control Manager 7030: The DFServ service is mar ked as an interactive service. However, the system is configured to not allow i nteractive services. This service may not function properly. System Information None 2013-08-19 16:57:46 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: DFServ Service File Name: C:\Program Files\Far onics\Deep Freeze\Install C-0\DFServ.exe Service Type: user mode service Serv ice Start Type: auto start Service Account: LocalSystem System Information None 2013-08-19 16:57:47 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: DeepFrz Service File Name: C:\Windows\system32 \drivers\DeepFrz.sys Service Type: kernel mode driver Service Start Type: bo ot start Service Account: System Information None 2013-08-19 16:58:00 Vic Tiangco USER32 1074: The process FARONICS_DFS. exe has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\ Vic Tiangco for the following reason: Application: Installation (Planned) Rea son Code: 0x80040002 Shutdown Type: restart Comment: System Information None 2013-08-19 16:58:03 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 16:58:03 Vic Tiangco USER32 1074: The process C:\Windows\sy stem32\winlogon.exe (EMOVHICRN) has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: No title for t his reason could be found Reason Code: 0x500ff Shutdown Type: restart C omment: System Information 1102 2013-08-19 16:58:03 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information None 2013-08-19 16:58:04 EventLog 6006: The Event log service was stopped. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The DHCP Client service e ntered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Power service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Office Software Prote ction Platform service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The TeamViewer 8 service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Windows Defender serv ice entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Diagnostic Service Ho st service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Distributed Link Trac king Client service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Windows Management In strumentation service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Superfetch service en tered the stopped state. System Information 4 2013-08-19 16:58:04 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51047: DHCPv6 client service i s stopped. ShutDown Flag value is 1 System Information 4 2013-08-19 16:58:04 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50037: DHCPv4 client service is stopped. ShutDown Flag value is 1 System Information 7010 2013-08-19 16:58:04 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Warning None 2013-08-19 16:58:04 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4001: WLAN AutoConfig servic e has successfully stopped. System Information None 2013-08-19 16:58:05 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Information None 2013-08-19 16:58:05 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Information 103 2013-08-19 16:58:05 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 16:58:10 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 17:45:22 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 17:45:22 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 4 2013-08-19 17:45:30 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Information 86 2013-08-19 17:45:36 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Warning None 2013-08-19 17:45:36 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 17:45:47 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 17:45:47 Service Control Manager 7036: The Power service entered the running state. System Information 7010 2013-08-19 17:45:47 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Information None 2013-08-19 17:45:52 Service Control Manager 7036: The DFServ service entere d the running state. System Information None 2013-08-19 17:45:52 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 17:45:52 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information None 2013-08-19 17:45:53 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 17:45:53 EventLog 6005: The Event log service was started. System Information None 2013-08-19 17:45:53 EventLog 6013: The system uptime is 30 s econds. System Information None 2013-08-19 17:45:53 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 17:45:53 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 17:45:53 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 17:45:53 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 17:45:53 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 17:45:53 Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 17:45:53 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 17:45:53 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 17:45:53 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 17:45:53 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 17:45:53 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 17:45:53 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 17:45:53 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 17:45:53 Service Control Manager 7036: The Security Accounts Man ager service entered the running state. System Information None 2013-08-19 17:45:53 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information None 2013-08-19 17:45:53 Service Control Manager 7036: The CNG Key Isolation ser vice entered the running state. System Information None 2013-08-19 17:45:53 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 17:45:53 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the running state. System Information None 2013-08-19 17:45:53 Service Control Manager 7036: The DNS Client service en tered the running state. System Information None 2013-08-19 17:45:53 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information 4 2013-08-19 17:45:53 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started System Information 4 2013-08-19 17:45:53 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i s started System Error None 2013-08-19 17:45:54 BugCheck System Information 1101 2013-08-19 17:45:56 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information None 2013-08-19 17:46:06 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the running state. System Information None 2013-08-19 17:46:06 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information None 2013-08-19 17:46:06 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4000: WLAN AutoConfig servic e has successfully started. System Information None 2013-08-19 17:46:08 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 17:46:10 Service Control Manager 7036: The Print Spooler service entered the running state. System Information None 2013-08-19 17:46:16 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information None 2013-08-19 17:46:16 Service Control Manager 7036: The Windows Firewall serv ice entered the running state. System Information None 2013-08-19 17:46:16 Service Control Manager 7036: The Workstation service e ntered the running state. System Information None 2013-08-19 17:46:17 Service Control Manager 7036: The ScsiAccess service en tered the running state. System Information None 2013-08-19 17:46:17 DeepFrz 1: Read from record ID 23. System Information None 2013-08-19 17:46:17 Service Control Manager 7036: The Skype Updater service entered the running state. System Information None 2013-08-19 17:46:25 Service Control Manager 7036: The TeamViewer 8 service entered the running state. System Information None 2013-08-19 17:46:25 Service Control Manager 7036: The Network Location Awar eness service entered the running state. System Information None 2013-08-19 17:46:27 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the running state. System Information None 2013-08-19 17:46:29 Service Control Manager 7036: The Superfetch service en tered the running state. System Information None 2013-08-19 17:46:29 Service Control Manager 7036: The Distributed Link Trac king Client service entered the running state. System Information None 2013-08-19 17:46:37 Service Control Manager 7036: The Windows Management In strumentation service entered the running state. System Information None 2013-08-19 17:46:37 Service Control Manager 7036: The IP Helper service ent ered the running state. System Information None 2013-08-19 17:46:42 Service Control Manager 7036: The Server service entere d the running state. System Information None 2013-08-19 17:46:42 Service Control Manager 7036: The Diagnostic Service Ho st service entered the running state. System Information None 2013-08-19 17:46:42 Service Control Manager 7036: The Network Connections s ervice entered the running state. System Information None 2013-08-19 17:46:42 Service Control Manager 7036: The Network List Service service entered the running state. System Information None 2013-08-19 17:46:51 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 17:46:51 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 17:46:51 Service Control Manager 7036: The Diagnostic System Hos t service entered the running state. System Information None 2013-08-19 17:46:51 Service Control Manager 7036: The Office Software Prote ction Platform service entered the running state. System Information None 2013-08-19 17:46:53 Service Control Manager 7036: The Windows Defender serv ice entered the running state. System Information None 2013-08-19 17:46:54 Service Control Manager 7036: The Cryptographic Service s service entered the running state. System Information None 2013-08-19 17:46:54 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 17:46:56 BugCheck System Information None 2013-08-19 17:46:56 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the running state. System Information None 2013-08-19 17:46:59 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 17:48:18 Service Control Manager 7036: The Skype Updater service entered the stopped state. System Information None 2013-08-19 17:48:42 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the running state. System Information None 2013-08-19 17:48:43 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v4.0.30319_X86 service entered the running state. System Information None 2013-08-19 17:48:43 Service Control Manager 7036: The SSDP Discovery servic e entered the running state. System Information None 2013-08-19 17:48:44 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 17:48:44 Service Control Manager 7036: The Security Center servi ce entered the running state. System Information None 2013-08-19 17:48:45 Service Control Manager 7036: The Windows Update servic e entered the running state. System Information None 2013-08-19 17:48:51 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 17:48:56 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the stopped state. System Information None 2013-08-19 17:51:41 Service Control Manager 7036: The Multimedia Class Sche duler service entered the stopped state. System Information None 2013-08-19 17:52:18 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 17:53:29 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information 7005 2013-08-19 17:53:33 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service USBSTOR for Device Instance ID USB\VID_14CD&P ID_6116\116AC2101219 with the following status: 0. System Information 7005 2013-08-19 17:53:33 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\usbstor.inf_x86_neutral_c77d41a 490bdc63d\usbstor.inf for Device Instance ID USB\VID_14CD&PID_6116\116AC2101219 with the following status: 0x0. System Information None 2013-08-19 17:53:35 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information 7005 2013-08-19 17:53:35 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service disk for Device Instance ID USBSTOR\DISK&VEN_ ___MASS&PROD_STORAGE_DEVICE&REV_\116AC2101219&0 with the following status: 0. System Information 7005 2013-08-19 17:53:35 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\disk.inf_x86_neutral_b431b61a11 f8df6c\disk.inf for Device Instance ID USBSTOR\DISK&VEN____MASS&PROD_STORAGE_DEV ICE&REV_\116AC2101219&0 with the following status: 0x0. System Information 7005 2013-08-19 17:53:36 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service volsnap for Device Instance ID STORAGE\VOLUME \{113933BC-08B4-11E3-A9A7-0016D4BCCE11}#0000000000007E00 with the following stat us: 0. System Information 7005 2013-08-19 17:53:36 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\volume.inf_x86_neutral_6dee0205 881d1a1d\volume.inf for Device Instance ID STORAGE\VOLUME\{113933BC-08B4-11E3-A9 A7-0016D4BCCE11}#0000000000007E00 with the following status: 0x0. System Information None 2013-08-19 17:54:03 Service Control Manager 7036: The Windows Time service entered the running state. System Warning None 2013-08-19 17:54:03 LOCAL SERVICE Microsoft-Windows-Time-Service 134: NtpClient was unable to se t a manual peer to use as a time source because of DNS resolution error on ''. N tpClient will try again in 3473457 minutes and double the reattempt interval the reafter. The error was: No such host is known. (0x80072AF9) System Information None 2013-08-19 17:54:04 Service Control Manager 7036: The WinHTTP Web Proxy Aut o-Discovery Service service entered the running state. System Information None 2013-08-19 17:54:07 LOCAL SERVICE Microsoft-Windows-Time-Service 37: The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|0.0 .0.0:123->65.55.56.206:123). System Information 7005 2013-08-19 17:54:08 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service tunnel for Device Instance ID ROOT\*TEREDO\00 00 with the following status: 0. System Information None 2013-08-19 17:54:12 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 17:54:12 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Information None 2013-08-19 17:55:35 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 18:02:17 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 18:06:34 Service Control Manager 7036: The Application Experienc e service entered the stopped state. System Information None 2013-08-19 18:07:18 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 18:08:05 SYSTEM Microsoft-Windows-Application-Experience 206: The Program Comp atibility Assistant service successfully performed phase two initialization. System Information None 2013-08-19 18:18:04 Service Control Manager 7036: The WinHTTP Web Proxy Aut o-Discovery Service service entered the stopped state. System Information None 2013-08-19 18:20:16 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 18:30:16 Service Control Manager 7036: The Application Experienc e service entered the stopped state. System Information None 2013-08-19 18:39:51 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v4.0.30319_X86 service entered the stopped state. System Information None 2013-08-19 18:41:27 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 18:49:10 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the running state. System Information None 2013-08-19 18:49:11 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the running state. System Information None 2013-08-19 18:49:32 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 18:49:35 volsnap 33: The oldest shadow copy of v olume C: was deleted to keep disk space usage for shadow copies of volume C: bel ow the user defined limit. System Information None 2013-08-19 18:49:37 volsnap 33: The oldest shadow copy of v olume C: was deleted to keep disk space usage for shadow copies of volume C: bel ow the user defined limit. System Information 1 2013-08-19 18:50:08 SYSTEM Microsoft-Windows-WindowsUpdateClient 19: Installation Success ful: Windows successfully installed the following update: Definition Update for Windows Defender - KB915597 (Definition 1.155.2386.0) System Information None 2013-08-19 18:53:11 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2013-08-19 18:56:11 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the stopped state. System Information None 2013-08-19 18:59:37 Service Control Manager 7036: The Application Experienc e service entered the stopped state. System Warning None 2013-08-19 20:27:22 NETWORK SERVICE Microsoft-Windows-DNS-Client 1014: Name resolution for the n ame www.youtube.com timed out after none of the configured DNS servers responded . System Information None 2013-08-19 20:39:03 SYSTEM Service Control Manager 7042: The TCP/IP NetBIOS Helper service was successfully sent a stop control. The reason specified was: 0x4 0030011 [Operating System: Network Connectivity (Planned)] Comment: None System Information None 2013-08-19 20:39:04 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the stopped state. System Information None 2013-08-19 20:40:26 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information 7005 2013-08-19 20:48:44 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service usbhub for Device Instance ID USB\VID_1A40&PI D_0101\5&25117D7C&0&2 with the following status: 0. System Information 7005 2013-08-19 20:48:45 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\usb.inf_x86_neutral_2620fd493ca d7d41\usb.inf for Device Instance ID USB\VID_1A40&PID_0101\5&25117D7C&0&2 with t he following status: 0x0. System Information 7005 2013-08-19 20:48:48 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service usbhub for Device Instance ID USB\VID_1A40&PI D_0101\6&138F37A&0&1 with the following status: 0. System Information 7005 2013-08-19 20:48:49 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\usb.inf_x86_neutral_2620fd493ca d7d41\usb.inf for Device Instance ID USB\VID_1A40&PID_0101\6&138F37A&0&1 with th e following status: 0x0. System Information 7005 2013-08-19 20:48:50 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service HidUsb for Device Instance ID USB\VID_1D57&PI D_0016\6&138F37A&0&4 with the following status: 0. System Information 7005 2013-08-19 20:48:50 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\input.inf_x86_neutral_9e1eba572 4be176f\input.inf for Device Instance ID USB\VID_1D57&PID_0016\6&138F37A&0&4 wit h the following status: 0x0. System Information 7005 2013-08-19 20:48:53 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service mouhid for Device Instance ID HID\VID_1D57&PI D_0016\7&39712D09&0&0000 with the following status: 0. System Information 7005 2013-08-19 20:48:53 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service mouclass for Device Instance ID HID\VID_1D57& PID_0016\7&39712D09&0&0000 with the following status: 0. System Information 7005 2013-08-19 20:48:54 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\msmouse.inf_x86_neutral_7a9084e 0177406eb\msmouse.inf for Device Instance ID HID\VID_1D57&PID_0016\7&39712D09&0& 0000 with the following status: 0x0. System Warning None 2013-08-19 20:49:30 Tcpip 4228: TCP/IP has chosen to rest rict the scale factor due to a network condition. This could be related to a p roblem in a network device and will cause degraded throughput. System Information 7005 2013-08-19 20:50:35 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\usb.inf_x86_neutral_2620fd493ca d7d41\usb.inf for Device Instance ID USB\VID_0000&PID_0000\6&138F37A&0&2 with th e following status: 0x0. System Warning None 2013-08-19 20:56:32 NETWORK SERVICE Microsoft-Windows-DNS-Client 1014: Name resolution for the n ame safebrowsing-cache.google.com timed out after none of the configured DNS ser vers responded. System Information None 2013-08-19 22:22:03 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 22:32:03 Service Control Manager 7036: The Application Experienc e service entered the stopped state. System Information 7005 2013-08-19 23:22:23 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service USBSTOR for Device Instance ID USB\VID_14CD&P ID_6116\M6116A016V20 with the following status: 0. System Information 7005 2013-08-19 23:22:24 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\usbstor.inf_x86_neutral_c77d41a 490bdc63d\usbstor.inf for Device Instance ID USB\VID_14CD&PID_6116\M6116A016V20 with the following status: 0x0. System Information 7005 2013-08-19 23:22:28 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service disk for Device Instance ID USBSTOR\DISK&VEN_ ST950032&PROD_5AS&REV_\M6116A016V20&0 with the following status: 0. System Information 7005 2013-08-19 23:22:29 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\disk.inf_x86_neutral_b431b61a11 f8df6c\disk.inf for Device Instance ID USBSTOR\DISK&VEN_ST950032&PROD_5AS&REV_\M 6116A016V20&0 with the following status: 0x0. System Information 7005 2013-08-19 23:22:32 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service volsnap for Device Instance ID STORAGE\VOLUME \{113933DF-08B4-11E3-A9A7-0016D4BCCE11}#0000000000100000 with the following stat us: 0. System Information 7005 2013-08-19 23:22:33 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\volume.inf_x86_neutral_6dee0205 881d1a1d\volume.inf for Device Instance ID STORAGE\VOLUME\{113933DF-08B4-11E3-A9 A7-0016D4BCCE11}#0000000000100000 with the following status: 0x0. System Information None 2013-08-19 23:22:34 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 23:22:57 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 23:23:29 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: Lavalys EVEREST Kernel Driver Service File Name : C:\Program Files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt Service Type: kernel mode driver Service Start Type: demand start Service Account: System Information None 2013-08-19 23:24:34 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 23:24:41 Service Control Manager 7036: The Software Protection s ervice entered the running state.

------[ Database Software ]------Database Drivers: Borland Database Engine - Borland InterBase Client - Easysoft ODBC-InterBase 6 - Easysoft ODBC-InterBase 7 - Firebird Client - Jet Engine 4.00.9756.0 MDAC 6.1.7601.17514 (win7sp1_ rtm.101119-1850) ODBC 6.1.7601.17514 (win7sp1_ rtm.101119-1850) MySQL Connector/ODBC - Oracle Client - PsqlODBC - Sybase ASE ODBC - Database Servers: Borland InterBase Server - Firebird Server - Microsoft SQL Server - Microsoft SQL Server Compact Edition - Microsoft SQL Server Express Edition - MySQL Server - Oracle Server - PostgreSQL Server - Sybase SQL Server -

------[ ODBC Drivers ]------Driver da Microsoft para arquivos texto (*.txt; *.csv) odbcjt32.dll *.,*.asc,*.csv,*.tab,*.txt,*.csv Driver do Microsoft Access (*.mdb) odbcjt32.dll *.mdb Driver do Microsoft dBase (*.dbf) odbcjt32.dll *.dbf,*.ndx,*.mdx Driver do Microsoft Excel(*.xls) odbcjt32.dll *.xls Driver do Microsoft Paradox (*.db ) odbcjt32.dll *.db Driver para o Microsoft Visual FoxPro vfpodbc.dll *.dbf,*.cdx,*.idx,*.fpt Microsoft Access dBASE Driver (*.dbf, *.ndx, *.mdx) aceodbc.dll 14.0.4732.1000 *.dbf, *.ndx, *.mdx Microsoft Access Driver (*.mdb) odbcjt32.dll *.mdb Microsoft Access Driver (*.mdb, *.accdb) aceodbc.dll 14.0.4732.1000 *.mdb,*.accdb Microsoft Access Text Driver (*.txt, *.csv) aceodbc.dll 14.0.4732.1000 *.txt, *.csv Microsoft Access-Treiber (*.mdb) odbcjt32.dll *.mdb Microsoft dBase Driver (*.dbf) odbcjt32.dll *.dbf,*.ndx,*.mdx Microsoft dBase VFP Driver (*.dbf) vfpodbc.dll *.dbf,*.cdx,*.idx,*.fpt Microsoft dBase-Treiber (*.dbf) odbcjt32.dll *.dbf,*.ndx,*.mdx Microsoft Excel Driver (*.xls) odbcjt32.dll *.xls Microsoft Excel Driver (*.xls, *.xlsx, *.xlsm, *.xlsb) aceodbc.dll 14.0.4732.1000 *.xls,*.xlsx, *.xlsb Microsoft Excel-Treiber (*.xls) odbcjt32.dll *.xls Microsoft FoxPro VFP Driver (*.dbf) vfpodbc.dll *.dbf,*.cdx,*.idx,*.fpt Microsoft ODBC for Oracle msorcl32.dll

Microsoft Paradox Driver (*.db ) odbcjt32.dll *.db Microsoft Paradox-Treiber (*.db ) odbcjt32.dll *.db Microsoft Text Driver (*.txt; *.csv) odbcjt32.dll *.,*.asc,*.csv,*.tab,*.txt,*.csv Microsoft Text-Treiber (*.txt; *.csv) odbcjt32.dll *.,*.asc,*.csv,*.tab,*.txt,*.csv Microsoft Visual FoxPro Driver vfpodbc.dll *.dbf,*.cdx,*.idx,*.fpt Microsoft Visual FoxPro-Treiber vfpodbc.dll *.dbf,*.cdx,*.idx,*.fpt SQL Server sqlsrv32.dll

------[ ODBC Data Sources ]------dBASE Files Microsoft Access dBASE Driver (*.dbf, *.ndx, * .mdx) User aceodbc.dll Excel Files Microsoft Excel Driver (*.xls, *.xlsx, *.xlsm, *.xlsb) User aceodbc.dll MS Access Database Microsoft Access Driver (*.mdb, *.accdb) User aceodbc.dll

------[ Memory Read ]------Core i7 Extreme 965 3333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 9-9-9- 24 CR1 14045 MB/s Athlon64 X2 Black 6400+ 3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800 4-4 -4-11 CR1 8889 MB/s Pentium EE 955 3466 MHz Intel D955XBK i955X Dual DDR2-667 4-4-4- 11 8025 MB/s P4EE 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667 5-5-5- 15 7895 MB/s Phenom II X4 Black 940 3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5-5- 5-18 CR2 7667 MB/s Core 2 Extreme QX9650 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066 8-8-8 -20 CR2 7174 MB/s Core 2 Duo E6700 2666 MHz Abit AB9 P965 Dual DDR2-800 5-5-5- 18 CR2 6924 MB/s Core 2 Extreme QX6700 2666 MHz Intel D975XBX2 i975X Dual DDR2-667 5-5-5 -15 6717 MB/s Athlon64 X2 4000+ 2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 5-5-5- 18 CR2 6264 MB/s Athlon64 3200+ 2000 MHz ASRock 939S56-M SiS756 Dual DDR400 2.5-3- 3-8 CR2 5987 MB/s Core 2 Duo P8400 2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 5-5-5- 15 5850 MB/s Opteron 2378 2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 5029 MB/s Phenom X4 9500 2200 MHz Asus M3A AMD770 Ganged Dual DDR2-800 5-5-5- 18 CR2 5019 MB/s Celeron 420 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 5-5-5- 15 4960 MB/s Core 2 Duo T5600 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 5-5-5- 15 4594 MB/s Xeon 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 2.5-3- 3-7 4585 MB/s P4EE 3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 3-3-3- 8 CR2 4352 MB/s Celeron D 326 2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 4-4-4- 11 4012 MB/s Core Duo T2500 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 5-5-5- 15 3976 MB/s Opteron 248 2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 2-3-3- 6 CR1 3938 MB/s Xeon 3066 MHz Asus PCH-DL i875P + PAT Dual DDR333 2-2-2- 5 3806 MB/s Pentium M 730 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 4-4-4- 12 3654 MB/s Atom 230 1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 4-4-4- 12 3540 MB/s Xeon E5462 2800 MHz Intel S5400SF i5400 Quad DDR2-640FB 5-5-5- 15 3540 MB/s Opteron 240 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 3-4-4- 8 CR1 3529 MB/s Nano L2200 1600 MHz VIA VB8001 CN896 Int. DDR2-667 SDRAM 5-5-5- 12 CR2 3515 MB/s P4 2400 MHz Abit SI7 SiSR658 Dual PC1066 RDRAM - 3408 MB/s Xeon 5140 2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 5-5-5- 15 3348 MB/s Pentium M 770 2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A A#ABU) i915GM Int. DDR2-533 SDRAM 4-4-4- 12 3165 MB/s Xeon L5320 1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 4-4-4- 12 3155 MB/s P4 2800 MHz MSI 848P -S i848P DDR400 SDRAM 2.5-3- 3-8 2983 MB/s Sempron 2600+ 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 2.5-3- 3-8 CR2 2832 MB/s Celeron 2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 2-2-4- 6 CR1 2769 MB/s P4 1600 MHz Abit TH7II i850 Dual PC800 RDRAM - 2754 MB/s Opteron HE 2344 1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 2737 MB/s Celeron 215 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 5-4-4- 12 2693 MB/s Celeron M 320 1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 2.5-3- 3-7 2435 MB/s Duron 1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 2.5-2- 2-6 CR2 1601 MB/s Efficeon 8600 1000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM 1540 MB/s Athlon 1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 2-3-3- 7 1302 MB/s Duron 600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 2-2-2- 5 1134 MB/s C7 1500 MHz VIA EPIA EN CN700 Int. DDR2-533 SDRAM 4-4-4- 12 CR2 1061 MB/s Celeron 1700 MHz Asus P4B i845 PC133 SDRAM 3-3-3- 6 1051 MB/s PIII-E 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 3-3-3- 6 1046 MB/s PIII-S 1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 2-3-3- 6 CR2 1041 MB/s AthlonXP 1600+ 1400 MHz Acorp 7KMM1 KM133A Int. PC133 SDRAM 3-3-3- 6 954 MB/s Crusoe 5800 1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 841 MB/s Athlon 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 3-3-3- 6 767 MB/s C3 1333 MHz VIA EPIA SP CN400 Int. DDR400 SDRAM 3-3-3- 8 CR2 690 MB/s C3 800 MHz VIA EPIA PLE133 Int. PC133 SDRAM 3-3-3- 6 635 MB/s PIII 500 MHz Epox KP6-BS i440BX PC100R SDRAM 3-3-3- ? 620 MB/s PIII 450 MHz Asus P3C-S i820 PC600 RDRAM - 524 MB/s PII 333 MHz Intel DK440LX i440LX PC66 SDRAM 3-2-2- ? 371 MB/s Celeron 266 MHz Epox P2-100B ApolloPro PC66 SDRAM 3-2-2- 5 360 MB/s K6-III 400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 2-2-2- 5 262 MB/s PentiumPro 200 MHz Compaq ProLiant 800 i440FX Dual EDO - 258 MB/s Pentium 166 MHz Asus TX97-X i430TX PC66 SDRAM 2-2-3- 4 228 MB/s MediaGXm 233 MHz ALD NPC6836 Cx5520 PC60 SDRAM 3-3-3- 6 222 MB/s PentiumMMX 200 MHz Gigabyte GA-586DX i430HX Dual EDO - 188 MB/s K5 PR166 116 MHz Asus P5A ALADDiN5 PC66 SDRAM 2-2-2- 6 167 MB/s K6-2 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM 3-3-3- 6 150 MB/s Celeron 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 3-3-3- 6 117 MB/s

------[ Memory Write ]------Core i7 Extreme 965 3333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 9-9-9- 24 CR1 12038 MB/s Athlon64 X2 Black 6400+ 3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800 4-4 -4-11 CR1 8814 MB/s Core 2 Extreme QX9650 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066 8-8-8 -20 CR2 7086 MB/s Xeon E5462 2800 MHz Intel S5400SF i5400 Quad DDR2-640FB 5-5-5- 15 6712 MB/s Phenom II X4 Black 940 3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5-5- 5-18 CR2 5915 MB/s Pentium EE 955 3466 MHz Intel D955XBK i955X Dual DDR2-667 4-4-4- 11 5636 MB/s P4EE 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667 5-5-5- 15 5618 MB/s Core 2 Duo P8400 2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 5-5-5- 15 5522 MB/s Athlon64 X2 4000+ 2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 5-5-5- 18 CR2 5484 MB/s P4EE 3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 3-3-3- 8 CR2 5378 MB/s Core 2 Extreme QX6700 2666 MHz Intel D975XBX2 i975X Dual DDR2-667 5-5-5 -15 4853 MB/s Core 2 Duo E6700 2666 MHz Abit AB9 P965 Dual DDR2-800 5-5-5- 18 CR2 4842 MB/s Xeon 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 2.5-3- 3-7 4199 MB/s Athlon64 3200+ 2000 MHz ASRock 939S56-M SiS756 Dual DDR400 2.5-3- 3-8 CR2 4083 MB/s Opteron 2378 2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 3940 MB/s Phenom X4 9500 2200 MHz Asus M3A AMD770 Ganged Dual DDR2-800 5-5-5- 18 CR2 3861 MB/s Opteron 248 2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 2-3-3- 6 CR1 3824 MB/s Celeron 420 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 5-5-5- 15 3584 MB/s Core Duo T2500 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 5-5-5- 15 3410 MB/s Nano L2200 1600 MHz VIA VB8001 CN896 Int. DDR2-667 SDRAM 5-5-5- 12 CR2 3160 MB/s P4 2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM 2.5-3- 3-8 3112 MB/s Core 2 Duo T5600 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 5-5-5- 15 3007 MB/s Xeon 3066 MHz Asus PCH-DL i875P + PAT Dual DDR333 2-2-2- 5 2840 MB/s P4 2400 MHz Abit SI7 SiSR658 Dual PC1066 RDRAM - 2838 MB/s Pentium M 730 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 4-4-4- 12 2834 MB/s Atom 230 1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 4-4-4- 12 2832 MB/s Celeron D 326 2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 4-4-4- 11 2785 MB/s Pentium M 770 2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A A#ABU) i915GM Int. DDR2-533 SDRAM 4-4-4- 12 2763 MB/s Xeon 5140 2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 5-5-5- 15 2487 MB/s Xeon L5320 1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 4-4-4- 12 2315 MB/s Opteron 240 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 3-4-4- 8 CR1 2287 MB/s Sempron 2600+ 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 2.5-3- 3-8 CR2 2267 MB/s Opteron HE 2344 1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 2208 MB/s Celeron 2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 2-2-4- 6 CR1 2148 MB/s Celeron M 320 1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 2.5-3- 3-7 2128 MB/s P4 1600 MHz Abit TH7II i850 Dual PC800 RDRAM - 2127 MB/s C7 1500 MHz VIA EPIA EN CN700 Int. DDR2-533 SDRAM 4-4-4- 12 CR2 2067 MB/s Celeron 215 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 5-4-4- 12 1876 MB/s Duron 1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 2.5-2- 2-6 CR2 1571 MB/s Athlon 1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 2-3-3- 7 1332 MB/s Duron 600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 2-2-2- 5 1204 MB/s C3 1333 MHz VIA EPIA SP CN400 Int. DDR400 SDRAM 3-3-3- 8 CR2 1057 MB/s PIII-S 1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 2-3-3- 6 CR2 1054 MB/s Celeron 1700 MHz Asus P4B i845 PC133 SDRAM 3-3-3- 6 1049 MB/s Athlon 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 3-3-3- 6 1034 MB/s AthlonXP 1600+ 1400 MHz Acorp 7KMM1 KM133A Int. PC133 SDRAM 3-3-3- 6 952 MB/s PIII-E 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 3-3-3- 6 848 MB/s PIII 500 MHz Epox KP6-BS i440BX PC100R SDRAM 3-3-3- ? 781 MB/s PIII 450 MHz Asus P3C-S i820 PC600 RDRAM - 761 MB/s Pentium 166 MHz Asus TX97-X i430TX PC66 SDRAM 2-2-3- 4 692 MB/s PentiumMMX 200 MHz Gigabyte GA-586DX i430HX Dual EDO - 690 MB/s MediaGXm 233 MHz ALD NPC6836 Cx5520 PC60 SDRAM 3-3-3- 6 588 MB/s Efficeon 8600 1000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM 549 MB/s K5 PR166 116 MHz Asus P5A ALADDiN5 PC66 SDRAM 2-2-2- 6 500 MB/s Crusoe 5800 1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 355 MB/s C3 800 MHz VIA EPIA PLE133 Int. PC133 SDRAM 3-3-3- 6 250 MB/s PII 333 MHz Intel DK440LX i440LX PC66 SDRAM 3-2-2- ? 177 MB/s Celeron 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 3-3-3- 6 171 MB/s Celeron 266 MHz Epox P2-100B ApolloPro PC66 SDRAM 3-2-2- 5 139 MB/s K6-III 400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 2-2-2- 5 128 MB/s PentiumPro 200 MHz Compaq ProLiant 800 i440FX Dual EDO - 87 MB/s K6-2 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM 3-3-3- 6 77 MB/s

------[ Memory Copy ]------Core i7 Extreme 965 3333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 9-9-9- 24 CR1 14153 MB/s Phenom II X4 Black 940 3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5-5- 5-18 CR2 8444 MB/s Athlon64 X2 Black 6400+ 3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800 4-4 -4-11 CR1 7241 MB/s Opteron 2378 2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 6833 MB/s Athlon64 X2 4000+ 2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 5-5-5- 18 CR2 6567 MB/s Core 2 Extreme QX9650 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066 8-8-8 -20 CR2 6225 MB/s Pentium EE 955 3466 MHz Intel D955XBK i955X Dual DDR2-667 4-4-4- 11 6206 MB/s P4EE 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667 5-5-5- 15 6135 MB/s Xeon E5462 2800 MHz Intel S5400SF i5400 Quad DDR2-640FB 5-5-5- 15 5470 MB/s Phenom X4 9500 2200 MHz Asus M3A AMD770 Ganged Dual DDR2-800 5-5-5- 18 CR2 5429 MB/s Core 2 Duo E6700 2666 MHz Abit AB9 P965 Dual DDR2-800 5-5-5- 18 CR2 5362 MB/s Core 2 Duo P8400 2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 5-5-5- 15 5146 MB/s Athlon64 3200+ 2000 MHz ASRock 939S56-M SiS756 Dual DDR400 2.5-3- 3-8 CR2 4653 MB/s Core 2 Extreme QX6700 2666 MHz Intel D975XBX2 i975X Dual DDR2-667 5-5-5 -15 4627 MB/s Xeon 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 2.5-3- 3-7 4149 MB/s Celeron 420 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 5-5-5- 15 4018 MB/s Opteron 248 2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 2-3-3- 6 CR1 3714 MB/s Opteron HE 2344 1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 3373 MB/s P4EE 3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 3-3-3- 8 CR2 3179 MB/s Core 2 Duo T5600 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 5-5-5- 15 3172 MB/s Xeon 3066 MHz Asus PCH-DL i875P + PAT Dual DDR333 2-2-2- 5 3161 MB/s Celeron D 326 2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 4-4-4- 11 3144 MB/s Core Duo T2500 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 5-5-5- 15 3103 MB/s Xeon 5140 2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 5-5-5- 15 3000 MB/s Xeon L5320 1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 4-4-4- 12 2905 MB/s Nano L2200 1600 MHz VIA VB8001 CN896 Int. DDR2-667 SDRAM 5-5-5- 12 CR2 2850 MB/s P4 2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM 2.5-3- 3-8 2645 MB/s P4 2400 MHz Abit SI7 SiSR658 Dual PC1066 RDRAM - 2542 MB/s Sempron 2600+ 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 2.5-3- 3-8 CR2 2511 MB/s Pentium M 730 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 4-4-4- 12 2459 MB/s Atom 230 1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 4-4-4- 12 2397 MB/s Opteron 240 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 3-4-4- 8 CR1 2386 MB/s Pentium M 770 2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A A#ABU) i915GM Int. DDR2-533 SDRAM 4-4-4- 12 2311 MB/s P4 1600 MHz Abit TH7II i850 Dual PC800 RDRAM - 2211 MB/s Celeron 2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 2-2-4- 6 CR1 2023 MB/s Celeron 215 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 5-4-4- 12 1963 MB/s Celeron M 320 1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 2.5-3- 3-7 1729 MB/s Duron 1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 2.5-2- 2-6 CR2 1571 MB/s C7 1500 MHz VIA EPIA EN CN700 Int. DDR2-533 SDRAM 4-4-4- 12 CR2 1394 MB/s Athlon 1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 2-3-3- 7 1255 MB/s Duron 600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 2-2-2- 5 1184 MB/s AthlonXP 1600+ 1400 MHz Acorp 7KMM1 KM133A Int. PC133 SDRAM 3-3-3- 6 950 MB/s PIII-S 1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 2-3-3- 6 CR2 907 MB/s Celeron 1700 MHz Asus P4B i845 PC133 SDRAM 3-3-3- 6 886 MB/s PIII-E 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 3-3-3- 6 865 MB/s C3 1333 MHz VIA EPIA SP CN400 Int. DDR400 SDRAM 3-3-3- 8 CR2 784 MB/s Efficeon 8600 1000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM 623 MB/s Athlon 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 3-3-3- 6 574 MB/s PIII 500 MHz Epox KP6-BS i440BX PC100R SDRAM 3-3-3- ? 526 MB/s PIII 450 MHz Asus P3C-S i820 PC600 RDRAM - 504 MB/s Crusoe 5800 1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 476 MB/s C3 800 MHz VIA EPIA PLE133 Int. PC133 SDRAM 3-3-3- 6 311 MB/s PII 333 MHz Intel DK440LX i440LX PC66 SDRAM 3-2-2- ? 245 MB/s Pentium 166 MHz Asus TX97-X i430TX PC66 SDRAM 2-2-3- 4 182 MB/s PentiumMMX 200 MHz Gigabyte GA-586DX i430HX Dual EDO - 181 MB/s K6-III 400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 2-2-2- 5 164 MB/s Celeron 266 MHz Epox P2-100B ApolloPro PC66 SDRAM 3-2-2- 5 142 MB/s Celeron 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 3-3-3- 6 133 MB/s PentiumPro 200 MHz Compaq ProLiant 800 i440FX Dual EDO - 111 MB/s K6-2 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM 3-3-3- 6 100 MB/s MediaGXm 233 MHz ALD NPC6836 Cx5520 PC60 SDRAM 3-3-3- 6 83 MB/s K5 PR166 116 MHz Asus P5A ALADDiN5 PC66 SDRAM 2-2-2- 6 81 MB/s

------[ Memory Latency ]------Athlon64 X2 Black 6400+ 3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800 4-4 -4-11 CR1 47.2 ns Athlon64 3200+ 2000 MHz ASRock 939S56-M SiS756 Dual DDR400 2.5-3- 3-8 CR2 55.2 ns Core i7 Extreme 965 3333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 9-9-9- 24 CR1 59.3 ns Sempron 2600+ 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 2.5-3- 3-8 CR2 59.8 ns Phenom II X4 Black 940 3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5-5- 5-18 CR2 61.3 ns Athlon64 X2 4000+ 2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 5-5-5- 18 CR2 62.1 ns Core 2 Duo E6700 2666 MHz Abit AB9 P965 Dual DDR2-800 5-5-5- 18 CR2 69.3 ns Core 2 Extreme QX6700 2666 MHz Intel D975XBX2 i975X Dual DDR2-667 5-5-5 -15 70.9 ns Core 2 Extreme QX9650 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066 8-8-8 -20 CR2 74.7 ns Pentium EE 955 3466 MHz Intel D955XBK i955X Dual DDR2-667 4-4-4- 11 80.3 ns Opteron 248 2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 2-3-3- 6 CR1 80.4 ns Core 2 Duo P8400 2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 5-5-5- 15 85.0 ns P4EE 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667 5-5-5- 15 85.3 ns Pentium M 730 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 4-4-4- 12 90.1 ns Celeron 420 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 5-5-5- 15 91.8 ns Opteron 2378 2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 95.3 ns Celeron M 320 1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 2.5-3- 3-7 95.8 ns Opteron 240 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 3-4-4- 8 CR1 97.9 ns Core Duo T2500 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 5-5-5- 15 99.6 ns Atom 230 1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 4-4-4- 12 103.5 ns Pentium M 770 2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A A#ABU) i915GM Int. DDR2-533 SDRAM 4-4-4- 12 104.0 ns Xeon 3066 MHz Asus PCH-DL i875P + PAT Dual DDR333 2-2-2- 5 106.0 ns PIII-S 1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 2-3-3- 6 CR2 108.1 ns Xeon 5140 2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 5-5-5- 15 109.0 ns Xeon E5462 2800 MHz Intel S5400SF i5400 Quad DDR2-640FB 5-5-5- 15 110.6 ns Phenom X4 9500 2200 MHz Asus M3A AMD770 Ganged Dual DDR2-800 5-5-5- 18 CR2 112.6 ns P4 2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM 2.5-3- 3-8 112.8 ns Nano L2200 1600 MHz VIA VB8001 CN896 Int. DDR2-667 SDRAM 5-5-5- 12 CR2 113.4 ns Core 2 Duo T5600 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 5-5-5- 15 113.7 ns PIII-E 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 3-3-3- 6 117.7 ns P4EE 3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 3-3-3- 8 CR2 124.8 ns Crusoe 5800 1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 125.5 ns Xeon L5320 1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 4-4-4- 12 126.1 ns K6-III 400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 2-2-2- 5 139.2 ns Xeon 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 2.5-3- 3-7 145.2 ns P4 2400 MHz Abit SI7 SiSR658 Dual PC1066 RDRAM - 147.1 ns C7 1500 MHz VIA EPIA EN CN700 Int. DDR2-533 SDRAM 4-4-4- 12 CR2 147.2 ns Celeron D 326 2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 4-4-4- 11 147.8 ns C3 800 MHz VIA EPIA PLE133 Int. PC133 SDRAM 3-3-3- 6 154.8 ns C3 1333 MHz VIA EPIA SP CN400 Int. DDR400 SDRAM 3-3-3- 8 CR2 156.0 ns Celeron 1700 MHz Asus P4B i845 PC133 SDRAM 3-3-3- 6 159.7 ns Celeron 2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 2-2-4- 6 CR1 161.4 ns MediaGXm 233 MHz ALD NPC6836 Cx5520 PC60 SDRAM 3-3-3- 6 162.2 ns P4 1600 MHz Abit TH7II i850 Dual PC800 RDRAM - 162.9 ns Efficeon 8600 1000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM 163.2 ns Duron 1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 2.5-2- 2-6 CR2 163.8 ns Celeron 215 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 5-4-4- 12 166.2 ns PIII 500 MHz Epox KP6-BS i440BX PC100R SDRAM 3-3-3- ? 166.3 ns PentiumMMX 200 MHz Gigabyte GA-586DX i430HX Dual EDO - 167.2 ns AthlonXP 1600+ 1400 MHz Acorp 7KMM1 KM133A Int. PC133 SDRAM 3-3-3- 6 170.6 ns Athlon 1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 2-3-3- 7 175.7 ns Duron 600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 2-2-2- 5 183.8 ns K6-2 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM 3-3-3- 6 201.8 ns Opteron HE 2344 1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 205.3 ns Athlon 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 3-3-3- 6 207.1 ns PIII 450 MHz Asus P3C-S i820 PC600 RDRAM - 215.2 ns PentiumPro 200 MHz Compaq ProLiant 800 i440FX Dual EDO - 233.6 ns Pentium 166 MHz Asus TX97-X i430TX PC66 SDRAM 2-2-3- 4 234.9 ns PII 333 MHz Intel DK440LX i440LX PC66 SDRAM 3-2-2- ? 248.9 ns K5 PR166 116 MHz Asus P5A ALADDiN5 PC66 SDRAM 2-2-2- 6 266.1 ns Celeron 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 3-3-3- 6 275.6 ns Celeron 266 MHz Epox P2-100B ApolloPro PC66 SDRAM 3-2-2- 5 317.4 ns

------[ CPU Queen ]------4x Core i7 Extreme 965 HT 3333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 9 -9-9-24 CR1 30786 8x Xeon E5462 2800 MHz Intel S5400SF i5400 Quad DDR2-640FB 5-5-5- 15 30472 8x Opteron 2378 2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 22769 4x Core 2 Extreme QX9650 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066 8- 8-8-20 CR2 21421 8x Xeon L5320 1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 4-4-4- 12 20452 4x Core 2 Extreme QX6700 2666 MHz Intel D975XBX2 i975X Dual DDR2-667 5- 5-5-15 19166 4x Phenom II X4 Black 940 3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5 -5-5-18 CR2 18636 4x Xeon 5140 2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 5-5-5- 15 16729 8x Opteron HE 2344 1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 16146 4x Phenom X4 9500 2200 MHz Asus M3A AMD770 Ganged Dual DDR2-800 5-5-5- 18 CR2 13693 2x Core 2 Duo E6700 2666 MHz Abit AB9 P965 Dual DDR2-800 5-5-5- 18 CR2 11406 2x Athlon64 X2 Black 6400+ 3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800 4-4-4-11 CR1 11169 2x Core 2 Duo P8400 2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 5-5-5- 15 9578 2x Core Duo T2500 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 5-5-5- 15 7793 2x Core 2 Duo T5600 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 5-5-5- 15 7717 2x Athlon64 X2 4000+ 2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 5-5-5- 18 CR2 7280 2x Pentium EE 955 HT 3466 MHz Intel D955XBK i955X Dual DDR2-667 4-4-4- 11 7098 2x Xeon HT 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 2.5-3- 3-7 6953 2x Xeon 3066 MHz Asus PCH-DL i875P + PAT Dual DDR333 2-2-2- 5 6188 2x Opteron 240 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 3-4-4- 8 CR1 4863 2x PIII-S 1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 2-3-3- 6 CR2 4857 P4EE HT 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667 5-5-5- 15 4210 Pentium M 770 2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A A#ABU) i915GM Int. DDR2-533 SDRAM 4-4-4- 12 3968 Opteron 248 2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 2-3-3- 6 CR1 3851 Atom 230 HT 1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 4-4-4- 12 3779 P4EE 3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 3-3-3- 8 CR2 3516 Athlon64 3200+ 2000 MHz ASRock 939S56-M SiS756 Dual DDR400 2.5-3- 3-8 CR2 3497 Celeron 420 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 5-5-5- 15 3375 Pentium M 730 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 4-4-4- 12 3124 2x PIII-E 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 3-3-3- 6 2811 Sempron 2600+ 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 2.5-3- 3-8 CR2 2808 P4 2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM 2.5-3- 3-8 2804 Celeron 215 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 5-4-4- 12 2607 Nano L2200 1600 MHz VIA VB8001 CN896 Int. DDR2-667 SDRAM 5-5-5- 12 CR2 2583 Celeron M 320 1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 2.5-3- 3-7 2544 Duron 1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 2.5-2- 2-6 CR2 2537 P4 2400 MHz Abit SI7 SiSR658 Dual PC1066 RDRAM - 2434 Athlon 1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 2-3-3- 7 2218 AthlonXP 1600+ 1400 MHz Acorp 7KMM1 KM133A Int. PC133 SDRAM 3-3-3- 6 2210 Celeron 2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 2-2-4- 6 CR1 2031 2x PIII 500 MHz Epox KP6-BS i440BX PC100R SDRAM 3-3-3- ? 1927 Celeron D 326 2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 4-4-4- 11 1900 Celeron 1700 MHz Asus P4B i845 PC133 SDRAM 3-3-3- 6 1723 P4 1600 MHz Abit TH7II i850 Dual PC800 RDRAM - 1624 C7 1500 MHz VIA EPIA EN CN700 Int. DDR2-533 SDRAM 4-4-4- 12 CR2 1560 Efficeon 8600 1000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM 1461 Celeron 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 3-3-3- 6 1349 Athlon 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 3-3-3- 6 1188 2x PII 333 MHz Intel DK440LX i440LX PC66 SDRAM 3-2-2- ? 1145 C3 1333 MHz VIA EPIA SP CN400 Int. DDR400 SDRAM 3-3-3- 8 CR2 1099 Duron 600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 2-2-2- 5 953 Crusoe 5800 1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 885 PIII 450 MHz Asus P3C-S i820 PC600 RDRAM - 873 K6-III 400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 2-2-2- 5 814 K6-2 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM 3-3-3- 6 696 2x PentiumMMX 200 MHz Gigabyte GA-586DX i430HX Dual EDO - 664 C3 800 MHz VIA EPIA PLE133 Int. PC133 SDRAM 3-3-3- 6 575 2x PentiumPro 200 MHz Compaq ProLiant 800 i440FX Dual EDO - 534 Celeron 266 MHz Epox P2-100B ApolloPro PC66 SDRAM 3-2-2- 5 459 Pentium 166 MHz Asus TX97-X i430TX PC66 SDRAM 2-2-3- 4 232 K5 PR166 116 MHz Asus P5A ALADDiN5 PC66 SDRAM 2-2-2- 6 200 MediaGXm 233 MHz ALD NPC6836 Cx5520 PC60 SDRAM 3-3-3- 6 185

------[ CPU PhotoWorxx ]------4x Core i7 Extreme 965 HT 3333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 9 -9-9-24 CR1 35393 8x Xeon E5462 2800 MHz Intel S5400SF i5400 Quad DDR2-640FB 5-5-5- 15 25575 4x Phenom II X4 Black 940 3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5 -5-5-18 CR2 19168 4x Core 2 Extreme QX9650 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066 8- 8-8-20 CR2 17431 8x Opteron 2378 2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 15896 2x Core 2 Duo E6700 2666 MHz Abit AB9 P965 Dual DDR2-800 5-5-5- 18 CR2 11922 4x Core 2 Extreme QX6700 2666 MHz Intel D975XBX2 i975X Dual DDR2-667 5- 5-5-15 11706 8x Xeon L5320 1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 4-4-4- 12 9621 4x Xeon 5140 2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 5-5-5- 15 8626 2x Athlon64 X2 Black 6400+ 3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800 4-4-4-11 CR1 7653 2x Core 2 Duo P8400 2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 5-5-5- 15 7534 8x Opteron HE 2344 1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 6622 4x Phenom X4 9500 2200 MHz Asus M3A AMD770 Ganged Dual DDR2-800 5-5-5- 18 CR2 6532 2x Athlon64 X2 4000+ 2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 5-5-5- 18 CR2 6419 2x Pentium EE 955 HT 3466 MHz Intel D955XBK i955X Dual DDR2-667 4-4-4- 11 6058 2x Opteron 240 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 3-4-4- 8 CR1 5645 2x Core Duo T2500 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 5-5-5- 15 5053 2x Core 2 Duo T5600 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 5-5-5- 15 5027 P4EE HT 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667 5-5-5- 15 4621 2x Xeon HT 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 2.5-3- 3-7 4031 Celeron 420 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 5-5-5- 15 3844 Athlon64 3200+ 2000 MHz ASRock 939S56-M SiS756 Dual DDR400 2.5-3- 3-8 CR2 3724 Opteron 248 2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 2-3-3- 6 CR1 3406 2x Xeon 3066 MHz Asus PCH-DL i875P + PAT Dual DDR333 2-2-2- 5 3339 Pentium M 770 2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A A#ABU) i915GM Int. DDR2-533 SDRAM 4-4-4- 12 2822 Pentium M 730 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 4-4-4- 12 2801 Sempron 2600+ 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 2.5-3- 3-8 CR2 2780 P4EE 3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 3-3-3- 8 CR2 2424 Celeron D 326 2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 4-4-4- 11 2262 Celeron 215 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 5-4-4- 12 2198 Atom 230 HT 1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 4-4-4- 12 2163 Nano L2200 1600 MHz VIA VB8001 CN896 Int. DDR2-667 SDRAM 5-5-5- 12 CR2 1975 P4 2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM 2.5-3- 3-8 1967 P4 2400 MHz Abit SI7 SiSR658 Dual PC1066 RDRAM - 1883 Celeron M 320 1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 2.5-3- 3-7 1854 Celeron 2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 2-2-4- 6 CR1 1599 Duron 1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 2.5-2- 2-6 CR2 1413 P4 1600 MHz Abit TH7II i850 Dual PC800 RDRAM - 1385 2x PIII-S 1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 2-3-3- 6 CR2 1299 C7 1500 MHz VIA EPIA EN CN700 Int. DDR2-533 SDRAM 4-4-4- 12 CR2 1219 2x PIII-E 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 3-3-3- 6 1138 Efficeon 8600 1000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM 1119 Celeron 1700 MHz Asus P4B i845 PC133 SDRAM 3-3-3- 6 1070 AthlonXP 1600+ 1400 MHz Acorp 7KMM1 KM133A Int. PC133 SDRAM 3-3-3- 6 959 Athlon 1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 2-3-3- 7 853 2x PIII 500 MHz Epox KP6-BS i440BX PC100R SDRAM 3-3-3- ? 839 C3 1333 MHz VIA EPIA SP CN400 Int. DDR400 SDRAM 3-3-3- 8 CR2 670 Duron 600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 2-2-2- 5 667 Athlon 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 3-3-3- 6 598 Crusoe 5800 1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 536 2x PII 333 MHz Intel DK440LX i440LX PC66 SDRAM 3-2-2- ? 531 PIII 450 MHz Asus P3C-S i820 PC600 RDRAM - 530 K6-III 400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 2-2-2- 5 357 C3 800 MHz VIA EPIA PLE133 Int. PC133 SDRAM 3-3-3- 6 353 2x PentiumPro 200 MHz Compaq ProLiant 800 i440FX Dual EDO - 327 Celeron 266 MHz Epox P2-100B ApolloPro PC66 SDRAM 3-2-2- 5 297 Celeron 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 3-3-3- 6 270 K6-2 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM 3-3-3- 6 254 K5 PR166 116 MHz Asus P5A ALADDiN5 PC66 SDRAM 2-2-2- 6 173 Pentium 166 MHz Asus TX97-X i430TX PC66 SDRAM 2-2-3- 4 148 MediaGXm 233 MHz ALD NPC6836 Cx5520 PC60 SDRAM 3-3-3- 6 147 2x PentiumMMX 200 MHz Gigabyte GA-586DX i430HX Dual EDO - 142

------[ CPU ZLib ]------8x Xeon E5462 2800 MHz Intel S5400SF i5400 Quad DDR2-640FB 5-5-5- 15 139481 KB/s 4x Core i7 Extreme 965 HT 3333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 9 -9-9-24 CR1 112330 KB/s 8x Opteron 2378 2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 104213 KB/s 8x Xeon L5320 1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 4-4-4- 12 95887 KB/s 8x Opteron HE 2344 1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 88845 KB/s 4x Phenom II X4 Black 940 3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5 -5-5-18 CR2 80081 KB/s 4x Core 2 Extreme QX9650 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066 8- 8-8-20 CR2 77167 KB/s 4x Core 2 Extreme QX6700 2666 MHz Intel D975XBX2 i975X Dual DDR2-667 5- 5-5-15 69756 KB/s 4x Xeon 5140 2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 5-5-5- 15 60995 KB/s 4x Phenom X4 9500 2200 MHz Asus M3A AMD770 Ganged Dual DDR2-800 5-5-5- 18 CR2 58396 KB/s 2x Athlon64 X2 Black 6400+ 3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800 4-4-4-11 CR1 38059 KB/s 2x Core 2 Duo E6700 2666 MHz Abit AB9 P965 Dual DDR2-800 5-5-5- 18 CR2 35355 KB/s 2x Pentium EE 955 HT 3466 MHz Intel D955XBK i955X Dual DDR2-667 4-4-4- 11 29844 KB/s 2x Core 2 Duo P8400 2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 5-5-5- 15 29223 KB/s 2x Xeon HT 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 2.5-3- 3-7 29177 KB/s 2x Xeon 3066 MHz Asus PCH-DL i875P + PAT Dual DDR333 2-2-2- 5 25040 KB/s 2x Core 2 Duo T5600 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 5-5-5- 15 23969 KB/s 2x Athlon64 X2 4000+ 2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 5-5-5- 18 CR2 23852 KB/s 2x Core Duo T2500 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 5-5-5- 15 23789 KB/s P4EE HT 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667 5-5-5- 15 16146 KB/s 2x Opteron 240 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 3-4-4- 8 CR1 15860 KB/s 2x PIII-S 1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 2-3-3- 6 CR2 14669 KB/s P4EE 3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 3-3-3- 8 CR2 14095 KB/s Opteron 248 2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 2-3-3- 6 CR1 12635 KB/s Pentium M 770 2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A A#ABU) i915GM Int. DDR2-533 SDRAM 4-4-4- 12 12056 KB/s Athlon64 3200+ 2000 MHz ASRock 939S56-M SiS756 Dual DDR400 2.5-3- 3-8 CR2 11824 KB/s P4 2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM 2.5-3- 3-8 11343 KB/s Celeron 420 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 5-5-5- 15 10485 KB/s Pentium M 730 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 4-4-4- 12 9871 KB/s P4 2400 MHz Abit SI7 SiSR658 Dual PC1066 RDRAM - 9775 KB/s Celeron D 326 2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 4-4-4- 11 9261 KB/s Atom 230 HT 1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 4-4-4- 12 8404 KB/s Sempron 2600+ 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 2.5-3- 3-8 CR2 8152 KB/s Celeron M 320 1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 2.5-3- 3-7 8110 KB/s Celeron 215 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 5-4-4- 12 7935 KB/s Nano L2200 1600 MHz VIA VB8001 CN896 Int. DDR2-667 SDRAM 5-5-5- 12 CR2 7799 KB/s AthlonXP 1600+ 1400 MHz Acorp 7KMM1 KM133A Int. PC133 SDRAM 3-3-3- 6 7435 KB/s 2x PIII-E 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 3-3-3- 6 7379 KB/s Athlon 1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 2-3-3- 7 7343 KB/s P4 1600 MHz Abit TH7II i850 Dual PC800 RDRAM - 6339 KB/s Efficeon 8600 1000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM 5321 KB/s 2x PIII 500 MHz Epox KP6-BS i440BX PC100R SDRAM 3-3-3- ? 4826 KB/s Celeron 2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 2-2-4- 6 CR1 4407 KB/s C7 1500 MHz VIA EPIA EN CN700 Int. DDR2-533 SDRAM 4-4-4- 12 CR2 4140 KB/s Crusoe 5800 1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 4002 KB/s Duron 1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 2.5-2- 2-6 CR2 3786 KB/s Athlon 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 3-3-3- 6 3586 KB/s Celeron 1700 MHz Asus P4B i845 PC133 SDRAM 3-3-3- 6 3484 KB/s 2x PII 333 MHz Intel DK440LX i440LX PC66 SDRAM 3-2-2- ? 3070 KB/s Duron 600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 2-2-2- 5 2288 KB/s C3 1333 MHz VIA EPIA SP CN400 Int. DDR400 SDRAM 3-3-3- 8 CR2 2280 KB/s PIII 450 MHz Asus P3C-S i820 PC600 RDRAM - 2195 KB/s 2x PentiumPro 200 MHz Compaq ProLiant 800 i440FX Dual EDO - 2102 KB/s K6-III 400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 2-2-2- 5 1986 KB/s C3 800 MHz VIA EPIA PLE133 Int. PC133 SDRAM 3-3-3- 6 1465 KB/s Celeron 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 3-3-3- 6 1299 KB/s 2x PentiumMMX 200 MHz Gigabyte GA-586DX i430HX Dual EDO - 1054 KB/s K6-2 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM 3-3-3- 6 774 KB/s Celeron 266 MHz Epox P2-100B ApolloPro PC66 SDRAM 3-2-2- 5 656 KB/s Pentium 166 MHz Asus TX97-X i430TX PC66 SDRAM 2-2-3- 4 497 KB/s K5 PR166 116 MHz Asus P5A ALADDiN5 PC66 SDRAM 2-2-2- 6 474 KB/s MediaGXm 233 MHz ALD NPC6836 Cx5520 PC60 SDRAM 3-3-3- 6 412 KB/s

------[ CPU AES ]------Nano L2200 1600 MHz VIA VB8001 CN896 Int. DDR2-667 SDRAM 5-5-5- 12 CR2 42295 8x Xeon E5462 2800 MHz Intel S5400SF i5400 Quad DDR2-640FB 5-5-5- 15 41625 8x Opteron 2378 2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 32424 8x Xeon L5320 1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 4-4-4- 12 27698 4x Core i7 Extreme 965 HT 3333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 9 -9-9-24 CR1 26703 8x Opteron HE 2344 1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 22599 4x Core 2 Extreme QX9650 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066 8- 8-8-20 CR2 22435 4x Phenom II X4 Black 940 3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5 -5-5-18 CR2 21658 4x Core 2 Extreme QX6700 2666 MHz Intel D975XBX2 i975X Dual DDR2-667 5- 5-5-15 19896 C7 1500 MHz VIA EPIA EN CN700 Int. DDR2-533 SDRAM 4-4-4- 12 CR2 17358 4x Xeon 5140 2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 5-5-5- 15 17320 4x Phenom X4 9500 2200 MHz Asus M3A AMD770 Ganged Dual DDR2-800 5-5-5- 18 CR2 14802 2x Core 2 Duo E6700 2666 MHz Abit AB9 P965 Dual DDR2-800 5-5-5- 18 CR2 9969 2x Pentium EE 955 HT 3466 MHz Intel D955XBK i955X Dual DDR2-667 4-4-4- 11 8970 2x Xeon HT 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 2.5-3- 3-7 8740 2x Core 2 Duo P8400 2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 5-5-5- 15 8443 2x Athlon64 X2 Black 6400+ 3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800 4-4-4-11 CR1 8339 2x Core Duo T2500 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 5-5-5- 15 7109 2x Core 2 Duo T5600 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 5-5-5- 15 6778 C3 1333 MHz VIA EPIA SP CN400 Int. DDR400 SDRAM 3-3-3- 8 CR2 6771 2x Xeon 3066 MHz Asus PCH-DL i875P + PAT Dual DDR333 2-2-2- 5 6366 2x Athlon64 X2 4000+ 2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 5-5-5- 18 CR2 5444 P4EE HT 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667 5-5-5- 15 4811 2x PIII-S 1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 2-3-3- 6 CR2 3985 2x Opteron 240 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 3-4-4- 8 CR1 3608 P4EE 3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 3-3-3- 8 CR2 3576 Pentium M 770 2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A A#ABU) i915GM Int. DDR2-533 SDRAM 4-4-4- 12 3568 Celeron 420 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 5-5-5- 15 2935 P4 2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM 2.5-3- 3-8 2906 Opteron 248 2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 2-3-3- 6 CR1 2851 Pentium M 730 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 4-4-4- 12 2842 Athlon64 3200+ 2000 MHz ASRock 939S56-M SiS756 Dual DDR400 2.5-3- 3-8 CR2 2603 Celeron 215 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 5-4-4- 12 2378 Celeron M 320 1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 2.5-3- 3-7 2291 P4 2400 MHz Abit SI7 SiSR658 Dual PC1066 RDRAM - 2284 Celeron D 326 2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 4-4-4- 11 2114 2x PIII-E 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 3-3-3- 6 2105 Sempron 2600+ 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 2.5-3- 3-8 CR2 2089 Duron 1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 2.5-2- 2-6 CR2 2031 Celeron 2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 2-2-4- 6 CR1 1920 Atom 230 HT 1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 4-4-4- 12 1845 AthlonXP 1600+ 1400 MHz Acorp 7KMM1 KM133A Int. PC133 SDRAM 3-3-3- 6 1770 Efficeon 8600 1000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM 1762 Celeron 1700 MHz Asus P4B i845 PC133 SDRAM 3-3-3- 6 1579 Athlon 1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 2-3-3- 7 1539 P4 1600 MHz Abit TH7II i850 Dual PC800 RDRAM - 1475 2x PIII 500 MHz Epox KP6-BS i440BX PC100R SDRAM 3-3-3- ? 1466 Crusoe 5800 1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 1177 2x PII 333 MHz Intel DK440LX i440LX PC66 SDRAM 3-2-2- ? 984 Celeron 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 3-3-3- 6 909 Athlon 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 3-3-3- 6 857 Duron 600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 2-2-2- 5 727 PIII 450 MHz Asus P3C-S i820 PC600 RDRAM - 682 2x PentiumPro 200 MHz Compaq ProLiant 800 i440FX Dual EDO - 599 K6-III 400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 2-2-2- 5 447 Celeron 266 MHz Epox P2-100B ApolloPro PC66 SDRAM 3-2-2- 5 401 C3 800 MHz VIA EPIA PLE133 Int. PC133 SDRAM 3-3-3- 6 393 K6-2 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM 3-3-3- 6 348 2x PentiumMMX 200 MHz Gigabyte GA-586DX i430HX Dual EDO - 313 K5 PR166 116 MHz Asus P5A ALADDiN5 PC66 SDRAM 2-2-2- 6 171 MediaGXm 233 MHz ALD NPC6836 Cx5520 PC60 SDRAM 3-3-3- 6 112 Pentium 166 MHz Asus TX97-X i430TX PC66 SDRAM 2-2-3- 4 107

------[ FPU Julia ]------8x Xeon E5462 2800 MHz Intel S5400SF i5400 Quad DDR2-640FB 5-5-5- 15 19454 4x Core i7 Extreme 965 HT 3333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 9 -9-9-24 CR1 14403 8x Xeon L5320 1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 4-4-4- 12 13144 8x Opteron 2378 2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 12276 4x Core 2 Extreme QX9650 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066 8- 8-8-20 CR2 10970 4x Core 2 Extreme QX6700 2666 MHz Intel D975XBX2 i975X Dual DDR2-667 5- 5-5-15 9820 4x Xeon 5140 2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 5-5-5- 15 8584 4x Phenom II X4 Black 940 3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5 -5-5-18 CR2 8046 8x Opteron HE 2344 1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 7904 4x Phenom X4 9500 2200 MHz Asus M3A AMD770 Ganged Dual DDR2-800 5-5-5- 18 CR2 5329 2x Core 2 Duo E6700 2666 MHz Abit AB9 P965 Dual DDR2-800 5-5-5- 18 CR2 5005 2x Core 2 Duo P8400 2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 5-5-5- 15 4188 2x Core 2 Duo T5600 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 5-5-5- 15 3403 2x Pentium EE 955 HT 3466 MHz Intel D955XBK i955X Dual DDR2-667 4-4-4- 11 2709 2x Xeon HT 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 2.5-3- 3-7 2640 2x Athlon64 X2 Black 6400+ 3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800 4-4-4-11 CR1 2586 2x Xeon 3066 MHz Asus PCH-DL i875P + PAT Dual DDR333 2-2-2- 5 2063 2x Athlon64 X2 4000+ 2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 5-5-5- 18 CR2 1776 2x Core Duo T2500 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 5-5-5- 15 1635 P4EE HT 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667 5-5-5- 15 1461 Celeron 420 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 5-5-5- 15 1395 P4EE 3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 3-3-3- 8 CR2 1242 2x Opteron 240 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 3-4-4- 8 CR1 1104 Nano L2200 1600 MHz VIA VB8001 CN896 Int. DDR2-667 SDRAM 5-5-5- 12 CR2 990 P4 2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM 2.5-3- 3-8 922 Opteron 248 2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 2-3-3- 6 CR1 900 Athlon64 3200+ 2000 MHz ASRock 939S56-M SiS756 Dual DDR400 2.5-3- 3-8 CR2 854 Celeron D 326 2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 4-4-4- 11 823 Pentium M 770 2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A A#ABU) i915GM Int. DDR2-533 SDRAM 4-4-4- 12 787 Atom 230 HT 1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 4-4-4- 12 785 P4 2400 MHz Abit SI7 SiSR658 Dual PC1066 RDRAM - 779 Sempron 2600+ 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 2.5-3- 3-8 CR2 683 Celeron 2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 2-2-4- 6 CR1 648 Pentium M 730 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 4-4-4- 12 645 2x PIII-S 1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 2-3-3- 6 CR2 617 Celeron 215 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 5-4-4- 12 538 Duron 1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 2.5-2- 2-6 CR2 534 P4 1600 MHz Abit TH7II i850 Dual PC800 RDRAM - 514 Celeron 1700 MHz Asus P4B i845 PC133 SDRAM 3-3-3- 6 495 Celeron M 320 1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 2.5-3- 3-7 474 AthlonXP 1600+ 1400 MHz Acorp 7KMM1 KM133A Int. PC133 SDRAM 3-3-3- 6 440 Athlon 1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 2-3-3- 7 398 2x PIII-E 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 3-3-3- 6 363 Efficeon 8600 1000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM 309 C7 1500 MHz VIA EPIA EN CN700 Int. DDR2-533 SDRAM 4-4-4- 12 CR2 273 2x PIII 500 MHz Epox KP6-BS i440BX PC100R SDRAM 3-3-3- ? 261 Athlon 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 3-3-3- 6 227 Duron 600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 2-2-2- 5 193 C3 1333 MHz VIA EPIA SP CN400 Int. DDR400 SDRAM 3-3-3- 8 CR2 168 PIII 450 MHz Asus P3C-S i820 PC600 RDRAM - 121 Celeron 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 3-3-3- 6 110 2x PII 333 MHz Intel DK440LX i440LX PC66 SDRAM 3-2-2- ? 100 C3 800 MHz VIA EPIA PLE133 Int. PC133 SDRAM 3-3-3- 6 78 Crusoe 5800 1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 73 K6-III 400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 2-2-2- 5 62 2x PentiumPro 200 MHz Compaq ProLiant 800 i440FX Dual EDO - 56 K6-2 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM 3-3-3- 6 47 2x PentiumMMX 200 MHz Gigabyte GA-586DX i430HX Dual EDO - 39 Celeron 266 MHz Epox P2-100B ApolloPro PC66 SDRAM 3-2-2- 5 39 Pentium 166 MHz Asus TX97-X i430TX PC66 SDRAM 2-2-3- 4 16 K5 PR166 116 MHz Asus P5A ALADDiN5 PC66 SDRAM 2-2-2- 6 11 MediaGXm 233 MHz ALD NPC6836 Cx5520 PC60 SDRAM 3-3-3- 6 6

------[ FPU Mandel ]------8x Xeon E5462 2800 MHz Intel S5400SF i5400 Quad DDR2-640FB 5-5-5- 15 9771 4x Core i7 Extreme 965 HT 3333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 9 -9-9-24 CR1 7825 8x Opteron 2378 2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 7655 8x Xeon L5320 1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 4-4-4- 12 6449 4x Core 2 Extreme QX9650 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066 8- 8-8-20 CR2 5567 8x Opteron HE 2344 1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 5494 4x Phenom II X4 Black 940 3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5 -5-5-18 CR2 5051 4x Core 2 Extreme QX6700 2666 MHz Intel D975XBX2 i975X Dual DDR2-667 5- 5-5-15 4870 4x Xeon 5140 2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 5-5-5- 15 4254 4x Phenom X4 9500 2200 MHz Asus M3A AMD770 Ganged Dual DDR2-800 5-5-5- 18 CR2 3749 2x Core 2 Duo E6700 2666 MHz Abit AB9 P965 Dual DDR2-800 5-5-5- 18 CR2 2492 2x Core 2 Duo P8400 2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 5-5-5- 15 2150 2x Pentium EE 955 HT 3466 MHz Intel D955XBK i955X Dual DDR2-667 4-4-4- 11 1771 2x Xeon HT 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 2.5-3- 3-7 1739 2x Core 2 Duo T5600 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 5-5-5- 15 1698 2x Athlon64 X2 Black 6400+ 3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800 4-4-4-11 CR1 1544 2x Xeon 3066 MHz Asus PCH-DL i875P + PAT Dual DDR333 2-2-2- 5 1489 2x Athlon64 X2 4000+ 2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 5-5-5- 18 CR2 1005 P4EE HT 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667 5-5-5- 15 970 P4EE 3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 3-3-3- 8 CR2 847 2x Core Duo T2500 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 5-5-5- 15 764 Celeron 420 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 5-5-5- 15 745 P4 2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM 2.5-3- 3-8 683 2x Opteron 240 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 3-4-4- 8 CR1 674 Celeron D 326 2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 4-4-4- 11 636 Nano L2200 1600 MHz VIA VB8001 CN896 Int. DDR2-667 SDRAM 5-5-5- 12 CR2 607 P4 2400 MHz Abit SI7 SiSR658 Dual PC1066 RDRAM - 590 Opteron 248 2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 2-3-3- 6 CR1 526 Celeron 2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 2-2-4- 6 CR1 494 Athlon64 3200+ 2000 MHz ASRock 939S56-M SiS756 Dual DDR400 2.5-3- 3-8 CR2 486 Celeron 1700 MHz Asus P4B i845 PC133 SDRAM 3-3-3- 6 412 Sempron 2600+ 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 2.5-3- 3-8 CR2 389 P4 1600 MHz Abit TH7II i850 Dual PC800 RDRAM - 388 Pentium M 770 2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A A#ABU) i915GM Int. DDR2-533 SDRAM 4-4-4- 12 374 2x PIII-S 1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 2-3-3- 6 CR2 340 Pentium M 730 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 4-4-4- 12 300 Celeron 215 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 5-4-4- 12 257 Celeron M 320 1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 2.5-3- 3-7 252 Duron 1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 2.5-2- 2-6 CR2 222 2x PIII-E 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 3-3-3- 6 197 Efficeon 8600 1000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM 194 AthlonXP 1600+ 1400 MHz Acorp 7KMM1 KM133A Int. PC133 SDRAM 3-3-3- 6 192 Athlon 1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 2-3-3- 7 191 C7 1500 MHz VIA EPIA EN CN700 Int. DDR2-533 SDRAM 4-4-4- 12 CR2 145 Atom 230 HT 1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 4-4-4- 12 143 2x PIII 500 MHz Epox KP6-BS i440BX PC100R SDRAM 3-3-3- ? 135 Athlon 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 3-3-3- 6 105 2x PII 333 MHz Intel DK440LX i440LX PC66 SDRAM 3-2-2- ? 91 Celeron 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 3-3-3- 6 87 Duron 600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 2-2-2- 5 85 C3 1333 MHz VIA EPIA SP CN400 Int. DDR400 SDRAM 3-3-3- 8 CR2 80 Crusoe 5800 1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 71 PIII 450 MHz Asus P3C-S i820 PC600 RDRAM - 61 2x PentiumPro 200 MHz Compaq ProLiant 800 i440FX Dual EDO - 53 2x PentiumMMX 200 MHz Gigabyte GA-586DX i430HX Dual EDO - 45 Celeron 266 MHz Epox P2-100B ApolloPro PC66 SDRAM 3-2-2- 5 37 C3 800 MHz VIA EPIA PLE133 Int. PC133 SDRAM 3-3-3- 6 31 K6-III 400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 2-2-2- 5 28 K6-2 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM 3-3-3- 6 23 Pentium 166 MHz Asus TX97-X i430TX PC66 SDRAM 2-2-3- 4 19 K5 PR166 116 MHz Asus P5A ALADDiN5 PC66 SDRAM 2-2-2- 6 9 MediaGXm 233 MHz ALD NPC6836 Cx5520 PC60 SDRAM 3-3-3- 6 6

------[ FPU SinJulia ]------4x Core i7 Extreme 965 HT 3333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 9 -9-9-24 CR1 6254 8x Xeon E5462 2800 MHz Intel S5400SF i5400 Quad DDR2-640FB 5-5-5- 15 5546 8x Opteron 2378 2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 4237 8x Xeon L5320 1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 4-4-4- 12 3484 4x Core 2 Extreme QX9650 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066 8- 8-8-20 CR2 2981 8x Opteron HE 2344 1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 2970 4x Phenom II X4 Black 940 3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5 -5-5-18 CR2 2619 4x Core 2 Extreme QX6700 2666 MHz Intel D975XBX2 i975X Dual DDR2-667 5- 5-5-15 2497 4x Xeon 5140 2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 5-5-5- 15 2178 4x Phenom X4 9500 2200 MHz Asus M3A AMD770 Ganged Dual DDR2-800 5-5-5- 18 CR2 1922 2x Athlon64 X2 Black 6400+ 3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800 4-4-4-11 CR1 1429 2x Pentium EE 955 HT 3466 MHz Intel D955XBK i955X Dual DDR2-667 4-4-4- 11 1289 2x Xeon HT 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 2.5-3- 3-7 1264 2x Core 2 Duo E6700 2666 MHz Abit AB9 P965 Dual DDR2-800 5-5-5- 18 CR2 1248 2x Core 2 Duo P8400 2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 5-5-5- 15 1122 2x Athlon64 X2 4000+ 2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 5-5-5- 18 CR2 934 2x Core Duo T2500 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 5-5-5- 15 911 2x Xeon 3066 MHz Asus PCH-DL i875P + PAT Dual DDR333 2-2-2- 5 867 2x Core 2 Duo T5600 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 5-5-5- 15 848 P4EE HT 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667 5-5-5- 15 693 2x Opteron 240 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 3-4-4- 8 CR1 623 2x PIII-S 1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 2-3-3- 6 CR2 586 Opteron 248 2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 2-3-3- 6 CR1 492 P4EE 3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 3-3-3- 8 CR2 487 Pentium M 770 2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A A#ABU) i915GM Int. DDR2-533 SDRAM 4-4-4- 12 453 Athlon64 3200+ 2000 MHz ASRock 939S56-M SiS756 Dual DDR400 2.5-3- 3-8 CR2 447 P4 2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM 2.5-3- 3-8 394 Celeron 420 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 5-5-5- 15 369 Pentium M 730 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 4-4-4- 12 362 Sempron 2600+ 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 2.5-3- 3-8 CR2 358 Duron 1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 2.5-2- 2-6 CR2 353 P4 2400 MHz Abit SI7 SiSR658 Dual PC1066 RDRAM - 340 2x PIII-E 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 3-3-3- 6 325 AthlonXP 1600+ 1400 MHz Acorp 7KMM1 KM133A Int. PC133 SDRAM 3-3-3- 6 308 Athlon 1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 2-3-3- 7 304 Celeron 215 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 5-4-4- 12 304 Celeron M 320 1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 2.5-3- 3-7 297 Atom 230 HT 1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 4-4-4- 12 285 Celeron 2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 2-2-4- 6 CR1 284 Celeron D 326 2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 4-4-4- 11 270 Celeron 1700 MHz Asus P4B i845 PC133 SDRAM 3-3-3- 6 247 P4 1600 MHz Abit TH7II i850 Dual PC800 RDRAM - 231 2x PIII 500 MHz Epox KP6-BS i440BX PC100R SDRAM 3-3-3- ? 227 Nano L2200 1600 MHz VIA VB8001 CN896 Int. DDR2-667 SDRAM 5-5-5- 12 CR2 185 Athlon 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 3-3-3- 6 163 Celeron 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 3-3-3- 6 155 2x PII 333 MHz Intel DK440LX i440LX PC66 SDRAM 3-2-2- ? 151 Efficeon 8600 1000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM 140 Duron 600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 2-2-2- 5 131 PIII 450 MHz Asus P3C-S i820 PC600 RDRAM - 103 2x PentiumPro 200 MHz Compaq ProLiant 800 i440FX Dual EDO - 91 2x PentiumMMX 200 MHz Gigabyte GA-586DX i430HX Dual EDO - 90 Crusoe 5800 1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 77 K6-III 400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 2-2-2- 5 68 C7 1500 MHz VIA EPIA EN CN700 Int. DDR2-533 SDRAM 4-4-4- 12 CR2 64 Celeron 266 MHz Epox P2-100B ApolloPro PC66 SDRAM 3-2-2- 5 61 K6-2 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM 3-3-3- 6 56 C3 1333 MHz VIA EPIA SP CN400 Int. DDR400 SDRAM 3-3-3- 8 CR2 49 Pentium 166 MHz Asus TX97-X i430TX PC66 SDRAM 2-2-3- 4 37 C3 800 MHz VIA EPIA PLE133 Int. PC133 SDRAM 3-3-3- 6 30 MediaGXm 233 MHz ALD NPC6836 Cx5520 PC60 SDRAM 3-3-3- 6 24 K5 PR166 116 MHz Asus P5A ALADDiN5 PC66 SDRAM 2-2-2- 6 8

------[ Debug - PCI ]------B00 D00 F00: Intel 82915GM Memory Controller Hub [B-1]

Offset 000: 86 80 90 25 06 00 90 20 03 00 00 06 00 00 00 00 Offset 010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 020: 00 00 00 00 00 00 00 00 00 00 00 00 3C 10 C4 30 Offset 030: 00 00 00 00 E0 00 00 00 00 00 00 00 00 00 00 00 Offset 040: 00 90 D9 FE 00 40 D9 FE 00 00 00 E0 00 80 D9 FE Offset 050: 00 00 30 00 19 00 00 B8 00 00 00 00 00 00 00 00 Offset 060: 01 A0 D9 FE 00 00 00 00 00 00 00 00 00 00 00 00 Offset 070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 090: 10 11 11 00 00 11 31 00 00 00 00 00 40 0A B8 00 Offset 0A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0D0: 00 00 00 00 00 00 00 00 00 00 00 00 19 00 00 00 Offset 0E0: 09 00 09 21 02 A2 8B 90 0A 00 00 00 00 00 00 00 Offset 0F0: 00 00 00 00 00 00 00 00 00 00 05 00 10 00 00 00 B00 D02 F00: Intel 82915GM Graphics Controller 0

Offset 000: 86 80 92 25 07 00 90 00 03 00 00 03 00 00 80 00 Offset 010: 00 00 60 D0 01 30 00 00 08 00 00 C0 00 00 68 D0 Offset 020: 00 00 00 00 00 00 00 00 00 00 00 00 3C 10 C4 30 Offset 030: 00 00 00 00 D0 00 00 00 00 00 00 00 10 01 00 00 Offset 040: 00 00 00 00 E0 00 00 00 09 00 09 21 02 A2 8B 90 Offset 050: 0A 00 30 00 19 00 00 B8 00 00 00 00 00 00 80 3F Offset 060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0D0: 01 00 22 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0E0: 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0F0: 11 00 64 34 00 00 00 00 00 00 05 00 00 00 00 00 B00 D02 F01: Intel 82915GM Graphics Controller 1

Offset 000: 86 80 92 27 06 00 90 00 03 00 80 03 00 00 80 00 Offset 010: 00 00 70 D0 00 00 00 00 00 00 00 00 00 00 00 00 Offset 020: 00 00 00 00 00 00 00 00 00 00 00 00 3C 10 C4 30 Offset 030: 00 00 00 00 D0 00 00 00 00 00 00 00 00 00 00 00 Offset 040: 00 00 00 00 E0 00 00 00 09 00 09 21 02 A2 8B 90 Offset 050: 0A 00 30 00 19 00 00 B8 00 00 00 00 00 00 80 3F Offset 060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0D0: 01 00 22 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0E0: 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0F0: 11 00 64 34 00 00 00 00 00 00 05 00 00 00 00 00 B00 D1D F00: Intel 82801FBM ICH6-M - USB Universal Host Controller [B-1]

Offset 000: 86 80 58 26 05 00 80 02 03 00 03 0C 00 00 80 00 Offset 010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 020: 21 30 00 00 00 00 00 00 00 00 00 00 3C 10 C4 30 Offset 030: 00 00 00 00 00 00 00 00 00 00 00 00 13 04 00 00 Offset 040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 060: 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0C0: 00 2F 00 00 00 00 00 00 00 00 01 00 00 00 00 00 Offset 0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0F0: 00 00 00 00 00 00 00 00 80 0F 04 00 00 00 00 00 B00 D1D F07: Intel 82801FBM ICH6-M - Enhanced USB2 Controller [B-1]

Offset 000: 86 80 5C 26 06 00 90 02 03 20 03 0C 00 00 00 00 Offset 010: 00 00 78 D0 00 00 00 00 00 00 00 00 00 00 00 00 Offset 020: 00 00 00 00 00 00 00 00 00 00 00 00 3C 10 C4 30 Offset 030: 00 00 00 00 50 00 00 00 00 00 00 00 13 04 00 00 Offset 040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 050: 01 58 C2 C9 00 80 00 00 0A 00 A0 20 00 00 00 00 Offset 060: 20 20 FF 01 00 00 00 00 01 00 00 00 00 00 00 C0 Offset 070: 00 00 D7 3F 00 00 00 00 00 00 00 00 00 00 00 00 Offset 080: 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 Offset 090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0D0: 00 00 00 00 00 AA FF 00 55 55 FF 00 20 00 00 00 Offset 0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0F0: 00 80 00 09 88 8C 40 00 80 0F 04 00 06 17 00 00 B00 D1E F00: Intel 82801FBM I/O Controller Hub 6 (ICH6-M) [B-1]

Offset 000: 86 80 48 24 07 01 10 00 D3 01 04 06 00 00 81 00 Offset 010: 00 00 00 00 00 00 00 00 00 02 03 20 20 20 80 22 Offset 020: 00 D0 50 D0 F1 FF 01 00 00 00 00 00 00 00 00 00 Offset 030: 00 00 00 00 50 00 00 00 00 00 00 00 00 00 06 00 Offset 040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 050: 0D 00 00 00 3C 10 C4 30 00 00 00 00 00 00 00 00 Offset 060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0F0: 00 00 00 00 00 00 00 00 80 0F 04 00 00 00 00 00 B00 D1E F02: Intel 82801FBM ICH6-M - AC'97 Audio Controller [B-1]

Offset 000: 86 80 6E 26 07 00 90 02 03 00 01 04 00 00 00 00 Offset 010: 01 31 00 00 01 32 00 00 00 10 78 D0 00 20 78 D0 Offset 020: 00 00 00 00 00 00 00 00 00 00 00 00 3C 10 C4 30 Offset 030: 00 00 00 00 50 00 00 00 00 00 00 00 11 02 00 00 Offset 040: 09 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 050: 01 00 C2 C9 00 00 00 00 00 00 00 00 00 00 00 00 Offset 060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0F0: 00 00 00 00 00 00 00 00 80 0F 04 00 00 00 00 00 B00 D1E F03: Intel 82801FBM ICH6-M - AC'97 Modem Controller [B-1]

Offset 000: 86 80 6D 26 00 04 90 02 03 00 03 07 00 00 00 00 Offset 010: 01 34 00 00 01 35 00 00 00 00 00 00 00 00 00 00 Offset 020: 00 00 00 00 00 00 00 00 00 00 00 00 3C 10 C4 30 Offset 030: 00 00 00 00 50 00 00 00 00 00 00 00 11 02 00 00 Offset 040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 050: 01 00 C2 C9 03 80 00 00 00 00 00 00 00 00 00 00 Offset 060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0F0: 00 00 00 00 00 00 00 00 80 0F 04 00 00 00 00 00 B00 D1F F00: Intel 82801FBM ICH6-M - LPC Bridge [B-1]

Offset 000: 86 80 41 26 07 01 00 02 03 00 01 06 00 00 80 00 Offset 010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 020: 00 00 00 00 00 00 00 00 00 00 00 00 3C 10 C4 30 Offset 030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 040: 01 10 00 00 80 00 00 00 01 11 00 00 10 00 00 00 Offset 050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 060: 80 80 80 80 92 00 00 00 80 80 80 80 00 00 00 00 Offset 070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 080: 10 00 07 3D 00 FF 00 00 00 00 00 00 00 00 00 00 Offset 090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0A0: A4 06 00 00 E1 00 00 00 00 1C 00 00 00 03 00 00 Offset 0B0: 00 00 00 00 00 00 00 00 0A 40 4A 96 00 00 00 00 Offset 0C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0D0: 33 22 11 00 67 45 00 00 00 C0 00 00 00 00 00 00 Offset 0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0F0: 01 00 D9 FE 00 00 00 00 80 0F 04 00 00 00 00 00 B00 D1F F01: Intel 82801FBM ICH6-M - ATA-100 IDE Controller [B-1]

Offset 000: 86 80 6F 26 05 00 80 02 03 8A 01 01 00 00 00 00 Offset 010: 01 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 Offset 020: 81 35 00 00 00 00 00 00 00 00 00 00 3C 10 C4 30 Offset 030: 00 00 00 00 00 00 00 00 00 00 00 00 0B 01 00 00 Offset 040: 77 E3 00 00 0B 00 00 00 01 00 01 00 00 00 00 00 Offset 050: 00 00 00 00 11 10 00 00 00 00 00 00 00 00 00 00 Offset 060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0C0: 00 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 Offset 0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0F0: 00 00 00 00 00 00 00 00 80 0F 04 00 00 00 00 00 B00 D1F F03: Intel 82801FBM ICH6-M - SMBus Controller [B-1]

Offset 000: 86 80 6A 26 01 00 80 02 03 00 05 0C 00 00 00 00 Offset 010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 020: 01 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 030: 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 Offset 040: 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0F0: 00 00 00 00 00 00 00 00 80 0F 04 00 00 00 00 00 B02 D04 F00: HP PRO/Wireless 2200BG 3B Network Connection

Offset 000: 86 80 20 42 06 00 90 02 05 00 80 02 10 40 00 00 Offset 010: 00 00 00 D0 00 00 00 00 00 00 00 00 00 00 00 00 Offset 020: 00 00 00 00 00 00 00 00 00 00 00 00 3C 10 F6 12 Offset 030: 00 00 00 00 DC 00 00 00 00 00 00 00 15 01 03 18 Offset 040: 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0D0: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 22 C8 Offset 0E0: 00 20 00 13 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B02 D06 F00: ENE Tech. CB1410 CardBus Controller

Offset 000: 24 15 10 14 07 00 10 02 01 00 07 06 10 40 02 00 Offset 010: 00 10 00 D0 A0 00 00 02 02 03 03 00 00 F0 5F D0 Offset 020: 00 F0 5F D0 00 E0 5F D0 00 E0 5F D0 00 2C 00 00 Offset 030: 00 2C 00 00 FC FF FF FF 00 00 00 00 12 01 C4 06 Offset 040: 3C 10 C4 30 01 00 00 00 00 00 00 00 00 00 00 00 Offset 050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 080: 20 D0 40 20 00 00 00 00 00 00 00 00 32 1B BE 01 Offset 090: 80 02 44 60 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0A0: 01 00 01 FE 00 00 C0 00 00 00 00 00 03 00 00 00 Offset 0B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0C0: 00 10 00 00 80 00 80 00 00 04 08 10 00 00 00 00 Offset 0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B02 D08 F00: Intel PRO/100 VE Network Connection

Offset 000: 86 80 92 10 07 00 90 02 03 00 00 02 10 40 00 00 Offset 010: 00 20 00 D0 01 20 00 00 00 00 00 00 00 00 00 00 Offset 020: 00 00 00 00 00 00 00 00 00 00 00 00 3C 10 C4 30 Offset 030: 00 00 00 00 DC 00 00 00 00 00 00 00 14 01 08 38 Offset 040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0D0: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 22 FE Offset 0E0: 00 41 00 3A 00 00 00 00 00 00 00 00 00 00 00 00 Offset 0F0: 00 00 00 00 00 00 00 00 66 0F 04 00 00 00 00 00 PCI-8086-2590: Intel i910/915/925/E7221 MCHBAR

Offset 100: 10 20 20 20 00 00 00 00 33 00 00 00 03 00 05 00 Offset 110: F8 28 78 B9 22 E9 C2 03 28 02 00 80 0A 01 0A 01 Offset 120: 06 4A 00 40 00 19 0C 80 FC 01 00 0C 00 00 00 00 Offset 130: C4 06 00 00 6D 06 1A 87 01 04 10 00 00 00 00 00 Offset 140: 00 39 2A 48 07 24 10 80 01 01 02 06 03 0C 00 00 Offset 150: 24 87 2D 5A 36 94 63 C1 00 3D 20 80 00 03 00 00 Offset 160: 82 00 00 00 20 00 00 00 15 AA 00 02 54 44 02 E0 Offset 170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset 1A0: 00 00 00 00 00 00 00 00 20 3C 2F 43 4F 4C 32 3E PCI-8086-2590: Intel i910/915/925/E7221 MCHBAR

Offset 200: 00 04 0F 00 00 00 00 00 08 01 02 04 00 00 00 00 Offset 210: 04 08 01 02 C8 E4 42 00 38 08 E8 04 00 00 00 00 PCI-8086-2590: Intel i910/915/925/E7221 MCHBAR

Offset C00: 31 04 01 00 01 01 01 01 00 00 00 00 00 00 00 00 Offset C10: 00 00 00 00 08 00 80 00 00 00 00 00 06 80 00 00 Offset C20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C30: BC 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset C80: 00 00 00 00 00 7C 00 00 B2 02 11 7B 1F 32 00 00 Offset C90: 00 00 00 00 99 00 03 00 00 00 00 00 00 00 00 00 Offset CA0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset CB0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset CC0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Offset CD0: 00 00 00 00 00 26 00 00 B2 02 10 76 26 38 00 00 Offset CE0: 00 00 00 00 99 00 06 00 00 00 00 00 00 00 00 00 Offset CF0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

------[ Debug - Video BIOS ]------C000:0000 U.....000000000000.!.. [email protected] VGA Compatible BIOS. .[.k.y... C000:0040 PCIR...%...... u...... ]...... C000:0080 ...... d...... d...... d.....0d...... C000:00C0 d...... d...... d...... d.....0d...... d.....0d...... d...... d...... d C000:0100 ...... d.....0d...... d...... d.....0$...... $...... d...... C000:0140 `"...... N...... @...... 88...... 1X. (...... V C000:0180 . .1X. .P...... 0X. @...... d..@A.&0..6...... A. 0.`. C000:01C0 ...... $.`A.(00`...... 0*..Q.*@0p...... 4..Q.*@...... =. C000:0200 .Q.0@@...... [email protected]@@...... [email protected]@@...... [email protected]@@.... C000:0240 .....h[..r.

------[ Debug - Unknown ]------Optical DTSOFT Virtual CdRom Device

------The names of actual companies and products mentioned herein may be the trademark s of their respective owners.