--------[ EVEREST Ultimate Edition ]----------------------------------------------------------------------------------Version Benchmark Module Homepage Report Type Computer Generator Operating System te 6.1.

7601 Date Time EVEREST v5.01.1700 2.4.258.0 http://www.lavalys.com/ Report Wizard EMOVHICRN Vic Tiangco Microsoft Windows 7 Ultima 2013-08-19 23:24

--------[ Summary ]---------------------------------------------------------------------------------------------------Computer: Computer Type le) Operating System mate OS Service Pack Internet Explorer DirectX Computer Name User Name Logon Domain Date / Time Service Pack 1 8.0.7601.17514 DirectX 10.1 EMOVHICRN Vic Tiangco emovhicRN 2013-08-19 / 23:24 Microsoft Windows 7 Ulti ACPI x86-based PC (Mobi

Motherboard: CPU Type Mobile Intel Pentium M 7 70, 2133 MHz (16 x 133) Motherboard Name Hewlett-Packard HP 510 N otebook PC (RU964AA#ABU) Motherboard Chipset Mobile Intel Alviso-G i9 15GM System Memory 1015 MB (DDR2-800 DDR2 SDRAM) DIMM1: Nanya M2N1G64TUH8D5F-AC 1 GB DDR2-800 DDR2 SDRAM (5-5-5-18 @ 400 MHz) (4-4-4-12 @ 266 MHz) (3-3-3-9 @ 200 MHz) BIOS Type Compaq (10/31/06) Communication Port Printer Port (LPT1) Display: Video Adapter S,910GML Express Chipset Family (128 MB) Video Adapter S,910GML Express Chipset Family (128 MB) 3D Accelerator Monitor 4" LCD] Monitor 4" LCD] Monitor 4" LCD] Multimedia: Audio Adapter Mobile Intel(R) 915GM/GM Mobile Intel(R) 915GM/GM Intel GMA 900 Chi Mei N154I2-L02 [15. Chi Mei N154I2-L02 [15. Chi Mei N154I2-L02 [15.

Conexant Cx20468 @ Intel

82801FBM ICH6-M - AC'97 Audio Controller [B-1] Storage: IDE Controller Intel(R) 82801FB/FBM Ult ra ATA Storage Controllers - 266F Disk Drive ST950032 5AS USB Device (500 GB, 5400 RPM, SATA-II) Disk Drive WDC WD600UE-22KVT0 ATA D evice (55 GB, IDE) Optical Drive DTSOFT Virtual CdRom Dev ice Optical Drive HL-DT-ST DVDRAM GSA-T10N ATA Device (DVD+R9:4x, DVD-R9:4x, DVD+RW:8x/8x, DVD-RW:8x/6x, DVD-RAM:5x, DVDROM:8x, CD:24x/24x/24x DVD+RW/DVD-RW/DVD-RAM) SMART Hard Disks Status OK Partitions: C: (NTFS) D: (NTFS) G: (NTFS) Total Size Input: Keyboard Keyboard Mouse Mouse Network: Primary IP Address Primary MAC Address Network Adapter ork Connection Network Adapter 00BG Network Connection (192.168.43.3) Modem odem Peripherals: Printer er Printer Printer riter Printer rter USB1 Controller USB Universal Host Controller [B-1] USB2 Controller Enhanced USB2 Controller [B-1] USB Device USB Device USB Device USB Device USB Device Battery Battery Control Method Battery Battery ery Intel 82801FBM ICH6-M Intel 82801FBM ICH6-M Generic USB Hub Generic USB Hub Unknown Device USB Input Device USB Mass Storage Device Microsoft AC Adapter Microsoft ACPI-Compliant Microsoft Composite Batt Universal Document Conve Fax Microsoft XPS Document W 27129 29998 465.8 521.5 MB MB GB GB (9847 MB free) (29758 MB free) (104.2 GB free) (142.9 GB free)

HID Keyboard Device Standard PS/2 Keyboard HID-compliant mouse PS/2 Compatible Mouse 192.168.43.3 00-16-6F-C7-55-78 Intel(R) PRO/100 VE Netw Intel(R) PRO/Wireless 22 Motorola SM56 Data Fax M

Canon MP250 series Print

DMI: DMI BIOS Vendor DMI BIOS Version DMI System Manufacturer DMI System Product 4AA#ABU) DMI System Version DMI System Serial Number DMI System UUID 99-0E0E3529 DMI Motherboard Manufacturer DMI Motherboard Product DMI Motherboard Version DMI Motherboard Serial Number DMI Chassis Manufacturer DMI Chassis Version DMI Chassis Serial Number DMI Chassis Asset Tag DMI Chassis Type

Hewlett-Packard 68DTV Ver. F.05 Hewlett-Packard HP 510 Notebook PC (RU96 F.05 CND7062SWD 5505F427-A3BADB11-599866 Hewlett-Packard 30C4 KBC Version 77.16 Hewlett-Packard CND7062SWD Notebook

--------[ Computer Name ]---------------------------------------------------------------------------------------------Computer Comment Logical NetBIOS Name Logical EMOVHICRN DNS Host Name Logical emovhicRN DNS Domain Name Logical Fully Qualified DNS Name Logical emovhicRN NetBIOS Name Physical EMOVHICRN DNS Host Name Physical emovhicRN DNS Domain Name Physical Fully Qualified DNS Name Physical emovhicRN --------[ DMI ]-------------------------------------------------------------------------------------------------------[ BIOS ] BIOS Properties: Vendor Version Release Date Size Boot Devices CD-ROM, LS-120 Capabilities Selectable Boot, EDD, BBS, Smart Battery Supported Standards Expansion Capabilities [ System ] System Properties: Manufacturer Product 4AA#ABU) Version Hewlett-Packard HP 510 Notebook PC (RU96 F.05 Hewlett-Packard 68DTV Ver. F.05 10/31/2006 576 KB Floppy Disk, Hard Disk, Flash BIOS, Shadow BIOS, DMI, ACPI, PnP PCI, PCMCIA, USB

Serial Number Universal Unique ID 99-0E0E3529 Wake-Up Type [ Motherboard ] Motherboard Properties: Manufacturer Product Version [ Chassis ] Chassis Properties: Manufacturer Serial Number Chassis Type

CND7062SWD 5505F427-A3BADB11-599866 Power Switch

Hewlett-Packard 30C4 KBC Version 77.16

Hewlett-Packard CND7062SWD Notebook

[ Processors / Intel(R) Pentium(R) M processor 2.13GHz ] Processor Properties: Manufacturer Version ocessor 2.13GHz External Clock Maximum Clock Current Clock Type Voltage Status Upgrade Socket Designation [ Caches / Internal L1 Cache ] Cache Properties: Type Status Operational Mode Associativity Maximum Size Installed Size Supported SRAM Type Current SRAM Type Socket Designation [ Caches / Internal L2 Cache ] Cache Properties: Type Status Operational Mode Associativity Maximum Size Installed Size Supported SRAM Type Current SRAM Type Error Correction Socket Designation External Enabled Write-Back 4-way Set-Associative 2048 KB 2048 KB Burst Burst None Internal L2 Cache Internal Enabled Write-Back 4-way Set-Associative 64 KB 64 KB Burst Burst Internal L1 Cache Intel(R) Intel(R) Pentium(R) M pr 133 MHz 2133 MHz 2133 MHz Central Processor 1.1 V Enabled None JP12

[ Memory Devices / DIMM #1 ] Memory Device Properties: Form Factor Type Type Detail Size Speed Total Width Data Width Device Locator Manufacturer Serial Number Part Number [ System Slots / PC CARD-Slot 0 ] System Slot Properties: Slot Designation Type Usage Data Bus Width Length [ On-Board Devices / 8 ] On-Board Device Properties: Description Type Status [ Miscellaneous ] Miscellaneous: OEM String OEM String www.hp.com ABS 70/71 79 7A 7B 7C 8 Video Enabled PC CARD-Slot 0 PC Card (PCMCIA) Empty 32-bit Short SODIMM DDR2 Synchronous 1024 MB 975 MHz 64-bit 64-bit DIMM #1 7F7F7F0B00000000 C4013857 M2N1G64TUH8D5F-AC

--------[ Overclock ]-------------------------------------------------------------------------------------------------CPU Properties: CPU Type 70 CPU Alias CPU Stepping Engineering Sample CPUID CPU Name ocessor 2.13GHz CPUID Revision CPU VID CPU Speed: CPU Clock 133 MHz) CPU Multiplier CPU FSB 3 MHz) Memory Bus Dothan C0 No Intel(R) Pentium(R) M pr 000006D8h 1.3560 V 2128.0 MHz (original: 2 16x 133.0 MHz (original: 13 266.0 MHz Mobile Intel Pentium M 7

DRAM:FSB Ratio CPU Cache: L1 Code Cache L1 Data Cache L2 Cache -Speed) Motherboard Properties: Motherboard ID Motherboard Name otebook PC (RU964AA#ABU) Chipset Properties: Motherboard Chipset 15GM Memory Timings )

8:4 32 KB 32 KB 2 MB (On-Die, ECC, Full

<DMI> Hewlett-Packard HP 510 N

Mobile Intel Alviso-G i9 4-4-4-12 (CL-RCD-RP-RAS

DIMM1: Nanya M2N1G64TUH8D5F-AC 1 GB DDR2-800 DDR2 SDRAM (5-5-5-18 @ 400 MHz) (4-4-4-12 @ 266 MHz) (3-3-3-9 @ 200 MHz) BIOS Properties: System BIOS Date Video BIOS Date DMI BIOS Version Graphics Processor Properties: Video Adapter ontroller 0 GPU Code Name 086 / 2592, Rev 03) 10/31/06 Unknown 68DTV Ver. F.05 Intel 82915GM Graphics C Alviso-GM (Integrated 8

--------[ Power Management ]------------------------------------------------------------------------------------------Power Management Properties: Current Power Source Battery Status Full Battery Lifetime Remaining Battery Lifetime AC Line No Battery Unknown Unknown

--------[ Portable Computer ]-----------------------------------------------------------------------------------------Centrino (Carmel) Platform Compliancy: CPU: Intel Pentium M (Banias/Dothan) um M 770) Chipset: Intel i855GM/PM -G i915GM) WLAN: Intel PRO/Wireless System: Centrino Compliant Centrino (Sonoma) Platform Compliancy: CPU: Intel Pentium M (Dothan) um M 770) Chipset: Intel i915GM/PM o-G i915GM) WLAN: Intel PRO/Wireless Yes (Mobile Intel Penti No (Mobile Intel Alviso Yes No Yes (Mobile Intel Penti Yes (Mobile Intel Alvis Yes

System: Centrino Compliant Centrino (Napa) Platform Compliancy: CPU: Intel Core (Yonah) / Core 2 (Merom) m M 770) Chipset: Intel i945GM/PM -G i915GM) WLAN: Intel PRO/Wireless 3945 System: Centrino Compliant Centrino (Santa Rosa) Platform Compliancy: CPU: Intel Core 2 (Merom/Penryn) m M 770) Chipset: Intel GM965/PM965 -G i915GM) WLAN: Intel Wireless WiFi Link 4965 System: Centrino Compliant Centrino (Montevina) Platform Compliancy: CPU: Intel Core 2 (Penryn) m M 770) Chipset: Intel GM45/GM47/GS45/PM45 -G i915GM) WLAN: Intel WiFi Link 5000 Series System: Centrino Compliant

Yes No (Mobile Intel Pentiu No (Mobile Intel Alviso No No No (Mobile Intel Pentiu No (Mobile Intel Alviso No No No (Mobile Intel Pentiu No (Mobile Intel Alviso No No

--------[ Sensor ]----------------------------------------------------------------------------------------------------Sensor Properties: Sensor Type Temperatures: CPU WDC WD600UE-22KVT0 Seagate ST9500325AS Voltage Values: CPU Core CPU, HDD, ACPI 50 C (122 F) 43 C (109 F) 31 C (88 F) 1.36 V

--------[ CPU ]-------------------------------------------------------------------------------------------------------CPU Properties: CPU Type 70, 2133 MHz (16 x 133) CPU Alias CPU Stepping Instruction Set Original Clock Min / Max CPU Multiplier Engineering Sample L1 Code Cache L1 Data Cache L2 Cache -Speed) CPU Physical Info: Mobile Intel Pentium M 7 Dothan C0 x86, MMX, SSE, SSE2 2133 MHz 6x / 16x No 32 KB 32 KB 2 MB (On-Die, ECC, Full

Package Type n uFCPGA Package Size Transistors Process Technology -K Inter-Layer, High-K Gate, Strained Si Die Size Core Voltage I/O Voltage Typical Power on clock speed) Maximum Power on clock speed) CPU Manufacturer: Company Name Product Information ducts/processor CPU Utilization: CPU #1

479 Ball uFCBGA / 478 Pi 3.5 cm x 3.5 cm 140 million 7M, 90 nm, CMOS, Cu, Low 88 mm2 0.988 - 1.356 V 0.988 - 1.356 V 3.0 - 21.0 W (depending 3.3 - 28.1 W (depending

Intel Corporation http://www.intel.com/pro

33 %

--------[ CPUID ]-----------------------------------------------------------------------------------------------------CPUID Properties: CPUID Manufacturer CPUID CPU Name ocessor 2.13GHz CPUID Revision IA Brand ID Platform ID GA2) Microcode Update Revision HTT / CMP Units Instruction Set: 64-bit x86 Extension (AMD64, Intel64) AMD 3DNow! AMD 3DNow! Professional AMD 3DNowPrefetch AMD Enhanced 3DNow! AMD Extended MMX AMD MisAligned SSE AMD SSE4A AMD SSE5 Cyrix Extended MMX IA-64 IA MMX IA SSE IA SSE 2 IA SSE 3 IA Supplemental SSE 3 IA SSE 4.1 IA SSE 4.2 IA AVX IA FMA IA AES Extensions VIA Alternate Instruction Set GenuineIntel Intel(R) Pentium(R) M pr 000006D8h 16h (Intel Pentium M) 05h / MC 20h (Mobile uP 20 0 / 0 Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Supported Supported Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported

CLFLUSH Instruction CMPXCHG8B Instruction CMPXCHG16B Instruction Conditional Move Instruction LZCNT Instruction MONITOR / MWAIT Instruction MOVBE Instruction PCLMULQDQ Instruction POPCNT Instruction RDTSCP Instruction SYSCALL / SYSRET Instruction SYSENTER / SYSEXIT Instruction VIA FEMMS Instruction Security Features: Advanced Cryptography Engine (ACE) Advanced Cryptography Engine 2 (ACE2) Data Execution Prevention (DEP, NX, EDB) Hardware Random Number Generator (RNG) PadLock Hash Engine (PHE) PadLock Montgomery Multiplier (PMM) Processor Serial Number (PSN) Power Management Features: Automatic Clock Control Digital Thermometer Dynamic FSB Frequency Switching Enhanced Halt State (C1E) Enhanced SpeedStep Technology (EIST, ESS) Frequency ID Control Hardware P-State Control LongRun LongRun Table Interface PowerSaver 1.0 PowerSaver 2.0 PowerSaver 3.0 Processor Duty Cycle Control Software Thermal Control Temperature Sensing Diode Thermal Monitor 1 Thermal Monitor 2 Thermal Monitoring Thermal Trip Voltage ID Control CPUID Features: 1 GB Page Size 36-bit Page Size Extension Address Region Registers (ARR) CPL Qualified Debug Store Debug Trace Store Debugging Extension Direct Cache Access Dynamic Acceleration Technology (IDA) Fast Save & Restore Hyper-Threading Technology (HTT) Invariant Time Stamp Counter L1 Context ID Local APIC On Chip Machine Check Architecture (MCA)

Supported Supported Not Supported Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Supported Not Supported Not Supported Not Supported Supported Not Supported Not Supported Not Supported Not Supported Supported Not Supported Not Supported Not Supported Supported, Enabled Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Supported Not Supported Not Supported Supported Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Supported Supported Not Supported Not Supported Supported Not Supported Not Supported Not Supported Supported Supported

Machine Check Exception (MCE) Memory Configuration Registers (MCR) Memory Type Range Registers (MTRR) Model Specific Registers (MSR) Nested Paging Page Attribute Table (PAT) Page Global Extension Page Size Extension (PSE) Pending Break Event Physical Address Extension (PAE) Safer Mode Extensions (SMX) Secure Virtual Machine Extensions (Pacifica) Self-Snoop Time Stamp Counter (TSC) Turbo Boost Virtual Machine Extensions (Vanderpool) Virtual Mode Extension x2APIC XSAVE / XRSTOR Extended States CPUID Registers (CPU #1): CPUID 00000000 6E-49656E69 CPUID 00000001 80-AFE9FBFF CPUID 00000002 00-2C04307D CPUID 80000000 00-00000000 CPUID 80000001 00-00100000 CPUID 80000002 49-2952286C CPUID 80000003 28-7270204D CPUID 80000004 32-007A4847 CPUID 80000005 00-00000000 CPUID 80000006 40-00000000 CPUID 80000007 00-00000000 CPUID 80000008 00-00000000 MSR Registers: MSR 00000017 tID = 5] MSR 0000001B MSR 0000002A MSR 0000008B MSR 000000CD MSR 000000CE MSR 0000011E MSR 00000198 MSR 00000199 MSR 0000019A MSR 0000019B MSR 0000019C

Supported Not Supported Supported Supported Not Supported Supported Supported Supported Supported Supported Not Supported Not Supported Supported Supported Not Supported Not Supported Supported Not Supported Not Supported 00000002-756E6547-6C6574 000006D8-00000816-000001 02B3B001-000000F0-000000 80000008-00000000-000000 00000000-00000000-000000 20202020-20202020-65746E 6E655020-6D756974-202952 7365636F-20726F73-33312E 00000000-00000000-000000 00000000-00000000-080060 00000000-00000000-000000 00002020-00000000-000000

0014-0000-D024-8829 [Pla 0000-0000-FEC0-1900 0000-0000-4408-0000 0000-0020-0000-0000 0000-0000-0000-0311 2912-1000-0000-0311 0000-0000-0034-272B 0612-1029-0600-1029 0000-0000-0000-1029 0000-0000-0000-0002 0000-0000-0000-0000 0000-0000-0000-0000

MSR 0000019D MSR 000001A0

0000-0000-0001-0612 0000-0000-0011-1488

--------[ Motherboard ]-----------------------------------------------------------------------------------------------Motherboard Properties: Motherboard ID Motherboard Name otebook PC (RU964AA#ABU) Front Side Bus Properties: Bus Type Bus Width Real Clock Effective Clock Bandwidth Memory Bus Properties: Bus Type Bus Width DRAM:FSB Ratio Real Clock Effective Clock Bandwidth Chipset Bus Properties: Bus Type face --------[ Memory ]----------------------------------------------------------------------------------------------------Physical Memory: Total Used Free Utilization Swap Space: Total Used Free Utilization Virtual Memory: Total Used Free Utilization Paging File: Paging File Initial / Maximum Size Current Size Current / Peak Usage Utilization 1015 MB 754 MB 261 MB 74 % 4015 MB 1050 MB 2964 MB 26 % 5030 MB 1805 MB 3225 MB 36 % C:\pagefile.sys 3000 MB / 3000 MB 3000 MB 272 MB / 352 MB 9 % <DMI> Hewlett-Packard HP 510 N

Intel AGTL+ 64-bit 133 MHz (QDR) 533 MHz 4266 MB/s DDR2 SDRAM 64-bit 8:4 267 MHz (DDR) 533 MHz 4266 MB/s Intel Direct Media Inter

Physical Address Extension (PAE): Supported by Operating System Supported by CPU Active

Yes Yes Yes

--------[ SPD ]-------------------------------------------------------------------------------------------------------[ DIMM1: Nanya M2N1G64TUH8D5F-AC ] Memory Module Properties: Module Name Serial Number Manufacture Date Module Size Module Type Memory Type Memory Speed Module Width Module Voltage Error Detection Method Refresh Rate efresh Memory Timings: @ 400 MHz ) / 23-51-4-6-3-3 (RC-RFC-RRD-WR-WTR-RTP) @ 266 MHz ) / 16-34-3-4-2-2 (RC-RFC-RRD-WR-WTR-RTP) @ 200 MHz / 12-26-2-3-2-2 (RC-RFC-RRD-WR-WTR-RTP) Memory Module Features: Analysis Probe FET Switch External Weak Driver Memory Module Manufacturer: Company Name Product Information ex.aspx Nanya M2N1G64TUH8D5F-AC C4013857h (1463288260) Week 18 / 2009 1 GB (2 ranks, 8 banks) SO-DIMM DDR2 SDRAM DDR2-800 (400 MHz) 64 bit SSTL 1.8 None Reduced (7.8 us), Self-R

5-5-5-18 (CL-RCD-RP-RAS 4-4-4-12 (CL-RCD-RP-RAS 3-3-3-9 (CL-RCD-RP-RAS)

Not Present Disabled Supported Nanya Technology Corp. http://www.nanya.com/ind

--------[ Chipset ]---------------------------------------------------------------------------------------------------[ North Bridge: Mobile Intel Alviso-G i915GM ] North Bridge Properties: North Bridge 15GM Intel Platform Supported FSB Speeds Supported Memory Types SDRAM, DDR2-533 SDRAM Maximum Memory Amount Revision / Stepping Package Type Package Size Sonoma FSB400, FSB533 DDR-333 SDRAM, DDR2-400 2 GB 03 / B1 1257 Pin FC-BGA 3.75 cm x 4.00 cm Mobile Intel Alviso-G i9

Core Voltage In-Order Queue Depth Memory Controller: Type Active Mode Memory Timings: CAS Latency (CL) RAS To CAS Delay (tRCD) RAS Precharge (tRP) RAS Active Time (tRAS) Refresh Period (tREF) Error Correction: ECC ChipKill ECC RAID ECC Scrubbing Memory Slots: DRAM Slot #1 AM) Integrated Graphics Graphics Graphics Graphics Controller: Controller Type Controller Status Frame Buffer Size

1.5 V 12 Dual Channel (128-bit) Single Channel (64-bit) 4T 4T 4T 12T 7.8 us Not Not Not Not Supported Supported Supported Supported

1 GB (DDR2-800 DDR2 SDR

Intel GMA 900 Enabled 8 MB Intel Corporation http://www.intel.com/pro http://support.intel.com http://www.esupport.com/ http://driveragent.com?r

Chipset Manufacturer: Company Name Product Information ducts/chipsets Driver Download /support/chipsets BIOS Upgrades biosagent/index.cfm?refererid=40 Driver Update ef=59 [ South Bridge: Intel 82801FBM ICH6-M ] South Bridge Properties: South Bridge Intel Platform Revision / Stepping Package Type Package Size Core Voltage AC'97 Audio Controller: Audio Controller Type Codec Name Codec ID S/PDIF Output MC'97 Modem Controller: Modem Controller Type Codec Name Codec ID

Intel 82801FBM ICH6-M Sonoma D3 / B1 609 Pin mBGA 3.1 cm x 3.1 cm 1.5 V Intel ICH6 Conexant Cx20468 43585430h Supported Intel ICH6 Unknown FFFFFFFFh

Chipset Manufacturer: Company Name Product Information ducts/chipsets Driver Download /support/chipsets BIOS Upgrades biosagent/index.cfm?refererid=40 Driver Update ef=59

Intel Corporation http://www.intel.com/pro http://support.intel.com http://www.esupport.com/ http://driveragent.com?r

--------[ BIOS ]------------------------------------------------------------------------------------------------------BIOS Properties: BIOS Type BIOS Version Compaq BIOS Ownership Tag Compaq BIOS UUID System BIOS Date Video BIOS Date BIOS Manufacturer: Company Name Product Information BIOS Upgrades biosagent/index.cfm?refererid=40 Compaq 68DTV Ver. F.05 Unknown Unknown 10/31/06 Unknown Hewlett-Packard Company http://www.compaq.com http://www.esupport.com/

--------[ ACPI ]------------------------------------------------------------------------------------------------------[ APIC: Multiple APIC Description Table ] ACPI Table Properties: ACPI Signature Table Description n Table Memory Address Table Length OEM ID OEM Table ID OEM Revision Creator ID Creator Revision Local APIC Address [ DSDT: Differentiated System Description Table ] ACPI Table Properties: ACPI Signature Table Description scription Table Memory Address Table Length OEM ID OEM Table ID OEM Revision DSDT Differentiated System De 3F7EFD50h 26952 bytes HP DAU00 00010000h APIC Multiple APIC Descriptio 3F7EFCB8h 90 bytes HP 30C4 00000001h HP 00000001h FEC01000h

Creator ID Creator Revision [ FACP: Fixed ACPI Description Table ] ACPI Table Properties: ACPI Signature Table Description able Memory Address Table Length OEM ID OEM Table ID OEM Revision Creator ID Creator Revision SMI Command Port PM Timer [ FACS: Firmware ACPI Control Structure ] ACPI Table Properties: ACPI Signature Table Description ructure Memory Address Table Length

MSFT 0100000Eh

FACP Fixed ACPI Description T 3F7EFC00h 132 bytes HP 30C4 00000002h HP 00000001h 000000B2h 00001008h

FACS Firmware ACPI Control St 3F7FAE80h 64 bytes

[ MCFG: Memory Mapped Configuration Space Base Address Description Table ] ACPI Table Properties: ACPI Signature Table Description ion Space Base Address Description Table Memory Address Table Length OEM ID OEM Table ID OEM Revision Creator ID Creator Revision [ RSD PTR: Root System Description Pointer ] ACPI Table Properties: ACPI Signature Table Description Pointer Memory Address Table Length OEM ID [ RSDT: Root System Description Table ] ACPI Table Properties: ACPI Signature Table Description Table Memory Address Table Length RSDT Root System Description 3F7EFC84h 52 bytes RSD PTR Root System Description 000FE270h 36 bytes HP MCFG Memory Mapped Configurat 3F7EFD14h 60 bytes HP 30C4 00000001h HP 00000001h

OEM ID OEM Table ID OEM Revision Creator ID Creator Revision

HP 30C4 31100620h HP 00000001h

[ SLIC: Software Licensing Description Table (Emulated) ] ACPI Table Properties: ACPI Signature Table Description iption Table Memory Address Table Length OEM ID OEM Table ID Creator ID [ SSDT: Secondary System Description Table ] ACPI Table Properties: ACPI Signature Table Description tion Table Memory Address Table Length OEM ID OEM Table ID OEM Revision Creator ID Creator Revision SSDT Secondary System Descrip 3F7F6698h 881 bytes HP HPQPpc 00001001h MSFT 0100000Eh SLIC Software Licensing Descr Emulated 374 bytes HPQOEM SLIC-WKS HPQ

--------[ Operating System ]------------------------------------------------------------------------------------------Operating System Properties: OS Name mate OS Language OS Kernel Type bit) OS OS OS OS Version Service Pack Installation Date Root 6.1.7601 Service Pack 1 8/19/2013 C:\Windows Vic Tiangco 00426-OEM-8992662-00010 MHFPT-8C8M2-V9488-FGM44Not Required EMOVHICRN Vic Tiangco emovhicRN 20363 sec (0 days, 5 hou English (United States) Multiprocessor Free (32Microsoft Windows 7 Ulti

License Information: Registered Owner Registered Organization Product ID Product Key 2C9T3 Product Activation (WPA) Current Session: Computer Name User Name Logon Domain UpTime

rs, 39 min, 23 sec) Components Version: Common Controls Internet Explorer Windows Mail .090713-1255) Windows Media Player m.090713-1255) Windows Messenger MSN Messenger Internet Information Services (IIS) .NET Framework : FX45RTMREL Novell Client DirectX OpenGL .090713-1255) ASPI Operating System Features: Debug Version DBCS Version Domain Controller Security Present Network Present Remote Session Safe Mode Slow Processor Terminal Services 6.16 8.0.7601.17514 6.1.7600.16385 (win7_rtm 12.0.7600.16385 (win7_rt 4.0.30319.17929 built by DirectX 10.1 6.1.7600.16385 (win7_rtm No No No No Yes No No No Yes

--------[ Processes ]-------------------------------------------------------------------------------------------------C:\Program Files\DAEMON Tools Pro\DTShellHlp.exe 32-bit 3148 KB 2720 KB Dwm.exe C:\Windows\system32\Dwm.exe 32-bit 608 KB 940 KB everest.exe C:\Program Files\Lavalys\EVEREST Ultimate Edition\e verest.exe 32-bit 34156 KB 28008 KB Explorer.EXE C:\Windows\Explorer.EXE 32-bit 47988 KB 48680 KB firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe 32-bit 296 MB 308 MB FlashPlayerPlugin_11_8_800_115.exe C:\Windows\system32\Macromed\Flash\Flash PlayerPlugin_11_8_800_115.exe 32-bit 3912 KB 4524 KB FlashPlayerPlugin_11_8_800_115.exe C:\Windows\system32\Macromed\Flash\Flash PlayerPlugin_11_8_800_115.exe 32-bit 12648 KB 14612 KB IDMan.exe C:\Program Files\Internet Download Manager\IDMan.ex e 32-bit 13476 KB 7528 KB IEMonitor.exe C:\Program Files\Internet Download Manager\IEMonito r.exe 32-bit 3328 KB 1152 KB plugin-container.exe C:\Program Files\Mozilla Firefox\plugin-container.e xe 32-bit 3928 KB 12044 KB taskhost.exe C:\Windows\system32\taskhost.exe 32-bit 3644 KB 6832 KB taskhost.exe C:\Windows\system32\taskhost.exe 32-bit 1356 KB 2596 KB vlc.exe C:\Program Files\VideoLAN\VLC\vlc.exe DTShellHlp.exe

32-bit

21744 KB

27228 KB

--------[ System Drivers ]--------------------------------------------------------------------------------------------1394ohci Stopped ACPI ACPI.sys Running AcpiPmi Stopped adp94xx Stopped adpahci Stopped adpu320 Stopped AFD afd.sys Running agp440 Stopped aic78xx Stopped aliide Stopped amdagp Stopped amdide Stopped AmdK8 Stopped AmdPPM Stopped amdsata Stopped amdsbs Stopped amdxata Running AppID Stopped 1394 OHCI Compliant Host Controller 1394ohci.sys 6.1.7601.17514 Kernel Driver Microsoft ACPI Driver 6.1.7601.17514 Kernel Driver Kernel Driver Kernel Driver Kernel Driver Kernel Driver

ACPI Power Meter Driver acpipmi.sys 6.1.7601.17514 adp94xx adp94xx.sys adpahci adpahci.sys adpu320 adpu320.sys 1.6.6.4 1.6.6.1 7.2.0.0

Ancillary Function Driver for Winsock 6.1.7601.17514 Kernel Driver Kernel Driver Kernel Driver Kernel Driver Kernel Driver Kernel Driver Kernel Driver Kernel Driver Kernel Driver Kernel Driver Kernel Driver Kernel Driver

Intel AGP Bus Filter agp440.sys 6.1.7600.16385 aic78xx djsvs.sys aliide aliide.sys 6.0.0.0 1.2.0.0

AMD AGP Bus Filter Driver amdagp.sys 6.1.7600.16385 amdide amdide.sys 6.1.7600.16385

AMD K8 Processor Driver amdk8.sys 6.1.7600.16385 AMD Processor Driver amdppm.sys 6.1.7600.16385 amdsata amdsata.sys amdsbs amdsbs.sys amdxata amdxata.sys 1.1.2.5 3.6.1540.127 1.1.2.5

AppID Driver appid.sys 6.1.7601.17514

arc arc.sys Stopped arcsas Stopped AsyncMac Running atapi Running b06bdrv Stopped b57nd60x Stopped Beep Running blbdrive Running bowser Running BrFiltLo Stopped BrFiltUp Stopped Brserid Stopped BrSerWdm Stopped BrUsbMdm Stopped BrUsbSer Stopped BTHMODEM Stopped CAMCAUD Running CAMCHALA Running cdfs cdfs.sys Running cdrom Running

arc 5.2.0.10384 5.2.0.16119 Kernel Driver Kernel Driver arcsas arcsas.sys

RAS Asynchronous Media Driver asyncmac.sys 6.1.7600.16385 Kernel Driver IDE Channel atapi.sys 6.1.7600.16385 Kernel Driver Kernel Driver

Broadcom NetXtreme II VBD bxvbdx.sys 4.8.2.0

Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0 b57nd60x.sys 10.100.4.0 Kernel Driver Beep Kernel Driver blbdrive blbdrive.sys 6.1.7600.16385 Kernel Driver File System Driver

Browser Support Driver bowser.sys 6.1.7600.16385

Brother USB Mass-Storage Lower Filter Driver BrFiltLo.sys 1.10.0.2 Kernel Driver Brother USB Mass-Storage Upper Filter Driver BrFiltUp.sys 1.4.0.1 Kernel Driver Brother MFC Serial Port Interface Driver (WDM) Brserid.sys 1.0.1.6 Kernel Driver Brother WDM Serial driver BrSerWdm.sys 1.0.0.20 Kernel Driver

Brother MFC USB Fax Only Modem BrUsbMdm.sys 1.0.0.12 Kernel Driver Brother MFC USB Serial WDM Driver BrUsbSer.sys 1.0.1.3 Kernel Driver Bluetooth Serial Communications Driver bthmodem.sys 6.1.7600.16385 Kernel Driver Conexant AMC Audio camc6aud.sys 6.14.10.675 CAMCHALA camc6hal.sys 6.14.10.675 Kernel Driver Kernel Driver File System Driver Kernel Driver

CD/DVD File System Reader 6.1.7600.16385

CD-ROM Driver cdrom.sys 6.1.7601.17514

circlass Stopped CLFS

Consumer IR Devices circlass.sys 6.1.7600.16385 CLFS.sys Common Log (CLFS) 6.1.7600.16385

Kernel Driver Kernel Driver

Running CmBatt Running cmdide Stopped CNG

Microsoft ACPI Control Method Battery Driver CmBatt.sys 6.1.7600.16385 Kernel Driver cmdide cmdide.sys CNG cng.sys 6.1.7600.16385 Kernel Driver Microsoft Composite Battery Driver compbatt.sys 6.1.7600.16385 Kernel Driver 2.0.7.0 Kernel Driver

Running Compbatt

Running CompositeBus Composite Bus Enumerator Driver CompositeBus.sys 6.1.7601.17514 Kernel Driver Running crcdisk Crcdisk Filter Driver crcdisk.sys 6.1.7600.16385 Kernel Driver Stopped CSC Offline Files Driver csc.sys 6.1.7601.17514 Kernel Driver Running DeepFrz DeepFrz Kernel Driver Running DfsC DFS Namespace Client Driver dfsc.sys 6.1.7601.17514 File System Driver Running discache System Attribute Cache discache.sys 6.1.7600.16385 Kernel Driver Running Disk Disk Driver disk.sys 6.1.7600.16385 Kernel Driver Running dmvsc dmvsc dmvsc.sys 6.1.7601.17514 Kernel Driver Stopped drmkaud Microsoft Trusted Audio Drivers drmkaud.sys 6.1.7600.16385 Kernel Driver Stopped dtsoftbus01 DAEMON Tools Virtual Bus Driver dtsoftbus01.sys 5.0.1.282 Kernel Driver Running DXGKrnl LDDM Graphics Subsystem dxgkrnl.sys 6.1.7601.17514 Kernel Driver Stopped E100B Intel(R) PRO Adapter Driver e100b325.sys 8.0.47.0 Kernel Driver Running ebdrv Broadcom NetXtreme II 10 GigE VBD evbdx.sys 4.8.13.0 Kernel Driver Stopped elxstor elxstor elxstor.sys 5.2.10.211 Kernel Driver Stopped

ErrDev

Microsoft Hardware Error Device Driver errdev.sys 6.1.7600.16385 Kernel Driver

Stopped EverestDriver Lavalys EVEREST Kernel Driver kerneld.wnt Kernel Driver Running exfat exFAT File System Driver File System Driver Stopped fastfat FAT12/16/32 File System Driver File System Driver Stopped fdc Floppy Disk Controller Driver fdc.sys 6.1.7600.16385 Kernel Driver Stopped FileInfo File Information FS MiniFilter fileinfo.sys 6.1.7600.16385 File System Driver Running Filetrace Filetrace filetrace.sys 6.1.7600.16385 File System Driver Stopped flpydisk Floppy Disk Driver flpydisk.sys 6.1.7600.16385 Kernel Driver Stopped FltMgr FltMgr fltmgr.sys 6.1.7600.16385 File System Driver Running FsDepends File System Dependency Minifilter FsDepends.sys 6.1.7600.16385 File System Driver Stopped fvevol Bitlocker Drive Encryption Filter Driver fvevol.sys 6.1.7601.17514 Kernel Driver Running gagp30kx Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms gagp30kx.sys 6.1.7600.16385 Kernel Driver Stopped HBtnKey HP Hotkey Device cpqbttn.sys 7.0.3.1 Kernel Driver Running hcw85cir Hauppauge Consumer Infrared Receiver hcw85cir.sys 1.31.27127.0 Kernel Driver Stopped HDAudBus Microsoft UAA Bus Driver for High Definition Audio HDAudBus.sys 6.1.7601.17514 Kernel Driver Stopped HidBatt HID UPS Battery Driver HidBatt.sys 6.1.7600.16385 Kernel Driver Stopped HidBth Microsoft Bluetooth HID Miniport hidbth.sys 6.1.7600.16385 Kernel Driver Stopped HidIr Microsoft Infrared HID Driver hidir.sys 6.1.7600.16385 Kernel Driver Stopped HidUsb Microsoft HID Class Driver hidusb.sys 6.1.7601.17514 Kernel Driver Running HpSAMD HpSAMD HpSAMD.sys 6.12.4.32 Kernel Driver Stopped

HTTP HTTP.sys Running hwpolicy Running i8042prt Running ialm Running iaStorV Stopped IDMWFP Running iirsp Stopped intelide Running intelppm

HTTP 6.1.7601.17514 Kernel Driver Kernel Driver Hardware Policy Driver hwpolicy.sys 6.1.7601.17514

i8042 Keyboard and PS/2 Mouse Port Driver i8042prt.sys 6.1.7600.16385 Kernel Driver ialm igxpmp32.sys iaStorV iaStorV.sys IDMWFP idmwfp.sys iirsp iirsp.sys intelide intelide.sys 6.14.10.4704 8.6.2.1014 6.15.14.37 5.4.22.0 6.1.7600.16385 Kernel Driver Kernel Driver Kernel Driver Kernel Driver Kernel Driver

Kernel Driver Running IpFilterDriver IP Traffic Filter Driver ipfltdrv.sys 6.1.7600.16385 Kernel Driver Stopped IPMIDRV IPMIDRV IPMIDrv.sys 6.1.7601.17514 Kernel Driver Stopped IPNAT IP Network Address Translator ipnat.sys 6.1.7600.16385 Kernel Driver Stopped IRENUM IR Bus Enumerator irenum.sys 6.1.7600.16385 Kernel Driver Stopped isapnp isapnp isapnp.sys 6.1.7600.16385 Kernel Driver Stopped iScsiPrt iScsiPort Driver msiscsi.sys 6.1.7601.17514 Kernel Driver Stopped iusb3hcs Intel(R) USB 3.0 Host Controller Switch Driver iusb3hcs.sys 1.0.7.248 Kernel Driver Running kbdclass Keyboard Class Driver kbdclass.sys 6.1.7600.16385 Kernel Driver Running kbdhid Keyboard HID Driver kbdhid.sys 6.1.7601.17514 Kernel Driver Running KSecDD KSecDD ksecdd.sys 6.1.7601.17514 Kernel Driver Running KSecPkg KSecPkg ksecpkg.sys 6.1.7600.16385 Kernel Driver Running

Intel Processor Driver intelppm.sys 6.1.7600.16385

lltdio Running LSI_FC Stopped LSI_SAS Stopped LSI_SAS2 Stopped LSI_SCSI Stopped luafv Running megasas Stopped MegaSR Stopped Modem Running monitor Running mouclass Running mouhid Running mountmgr Running mpio

Link-Layer Topology Discovery Mapper I/O Driver lltdio.sys 6.1.7600.16385 Kernel Driver LSI_FC lsi_fc.sys LSI_SAS lsi_sas.sys LSI_SAS2 lsi_sas2.sys LSI_SCSI lsi_scsi.sys 1.28.3.52 1.28.3.52 2.0.2.71 1.28.3.67 Kernel Driver Kernel Driver Kernel Driver Kernel Driver File System Driver Kernel Driver Kernel Driver Kernel Driver

UAC File Virtualization luafv.sys 6.1.7600.16385 megasas megasas.sys MegaSR MegaSR.sys Modem modem.sys 4.5.1.32 13.5.409.2009 6.1.7600.16385

Microsoft Monitor Class Function Driver Service monitor.sys 6.1.7600.16385 Kernel Driver Mouse Class Driver mouclass.sys 6.1.7600.16385 Mouse HID Driver mouhid.sys 6.1.7600.16385 Mount Point Manager mountmgr.sys 6.1.7601.17514 mpio mpio.sys 6.1.7601.17514 Kernel Driver Windows Firewall Authorization Driver mpsdrv.sys 6.1.7600.16385 Kernel Driver WebDav Client Redirector Driver mrxdav.sys 6.1.7601.17514 File System Driver SMB MiniRedirector Wrapper and Engine mrxsmb.sys 6.1.7601.17514 File System Driver SMB 1.x MiniRedirector mrxsmb10.sys 6.1.7601.17514 SMB 2.0 MiniRedirector mrxsmb20.sys 6.1.7601.17514 msahci msahci.sys 6.1.7601.17514 File System Driver File System Driver Kernel Driver Kernel Driver Kernel Driver Kernel Driver

Stopped mpsdrv Running MRxDAV Stopped mrxsmb Running mrxsmb10 Running mrxsmb20 Running msahci Stopped

msdsm Stopped Msfs Running mshidkmdf Stopped msisadrv Running MSKSSRV Stopped MSPCLOCK Stopped MSPQM Stopped MsRPC Stopped mssmbios Running MSTEE Stopped MTConfig Stopped Mup

msdsm msdsm.sys Msfs

6.1.7601.17514

Kernel Driver File System Driver

Pass-through HID to KMDF Filter Driver mshidkmdf.sys 6.1.7600.16385 Kernel Driver msisadrv msisadrv.sys 6.1.7600.16385 Kernel Driver

Microsoft Streaming Service Proxy MSKSSRV.sys 6.1.7600.16385 Kernel Driver Microsoft Streaming Clock Proxy MSPCLOCK.sys 6.1.7600.16385 Kernel Driver Microsoft Streaming Quality Manager Proxy MSPQM.sys 6.1.7600.16385 Kernel Driver MsRPC Kernel Driver Microsoft System Management BIOS Driver mssmbios.sys 6.1.7600.16385 Kernel Driver Microsoft Streaming Tee/Sink-to-Sink Converter MSTEE.sys 6.1.7600.16385 Kernel Driver Microsoft Input Configuration Driver MTConfig.sys 6.1.7600.16385 Kernel Driver Mup mup.sys

6.1.7600.16385 File System Driver Running NativeWifiP NativeWiFi Filter nwifi.sys 6.1.7600.16385 Kernel Driver Running NDIS NDIS System Driver ndis.sys 6.1.7601.17514 Kernel Driver Running NdisCap NDIS Capture LightWeight Filter ndiscap.sys 6.1.7600.16385 Kernel Driver Stopped NdisTapi Remote Access NDIS TAPI Driver ndistapi.sys 6.1.7600.16385 Kernel Driver Running Ndisuio NDIS Usermode I/O Protocol ndisuio.sys 6.1.7601.17514 Kernel Driver Running NdisWan Remote Access NDIS WAN Driver ndiswan.sys 6.1.7601.17514 Kernel Driver Running NDProxy NDIS Proxy Kernel Driver Running NetBIOS NetBIOS Interface netbios.sys 6.1.7600.16385 File System Driver Running

NetBT Running nfrd960 Stopped Npfs Running nsiproxy Running Ntfs Running Null Running nv_agp Stopped nvraid Stopped nvstor Stopped ohci1394 Stopped Parport Running partmgr Running Parvdm Running pci

NetBT netbt.sys nfrd960 nfrd960.sys Npfs

6.1.7601.17514 7.10.0.0

Kernel Driver Kernel Driver File System Driver

NSI proxy service driver. nsiproxy.sys 6.1.7600.16385 Ntfs

Kernel Driver File System Driver

Null Kernel Driver NVIDIA nForce AGP Bus Filter nv_agp.sys 6.1.7600.16385 nvraid nvraid.sys nvstor nvstor.sys 10.6.0.18 10.6.0.18 Kernel Driver Kernel Driver Kernel Driver

1394 OHCI Compliant Host Controller (Legacy) ohci1394.sys 6.1.7600.16385 Kernel Driver Parallel port driver parport.sys 6.1.7600.16385 Partition Manager partmgr.sys 6.1.7601.17514 Parvdm parvdm.sys PCI Bus Driver pci.sys 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 Kernel Driver Kernel Driver Kernel Driver pciide pciide.sys pcmcia pcmcia.sys pcw.sys 6.1.7600.16385 Kernel Driver Kernel Driver Kernel Driver

Running pciide Stopped pcmcia Running pcw Running PEAUTH

Performance Counters for Windows Driver 6.1.7600.16385 Kernel Driver Kernel Driver Kernel Driver Kernel Driver

6.1.7600.16385 Running PptpMiniport WAN Miniport (PPTP) raspptp.sys 6.1.7600.16385 Running Processor Processor Driver processr.sys 6.1.7600.16385 Stopped

PEAUTH peauth.sys

Psched Running ql2300 Stopped ql40xx Stopped QWAVEdrv Stopped RasAcd

QoS Packet Scheduler pacer.sys 6.1.7600.16385 ql2300 ql2300.sys ql40xx ql40xx.sys 9.1.8.6 2.1.3.20

Kernel Driver Kernel Driver Kernel Driver Kernel Driver

QWAVE driver qwavedrv.sys 6.1.7600.16385

Remote Access Auto Connection Driver rasacd.sys 6.1.7600.16385 Kernel Driver

Stopped RasAgileVpn WAN Miniport (IKEv2) AgileVpn.sys 6.1.7600.16385 Kernel Driver Running Rasl2tp WAN Miniport (L2TP) rasl2tp.sys 6.1.7600.16385 Kernel Driver Running RasPppoe Remote Access PPPOE Driver raspppoe.sys 6.1.7600.16385 Kernel Driver Running RasSstp WAN Miniport (SSTP) rassstp.sys 6.1.7600.16385 Kernel Driver Running rdbss Redirected Buffering Sub Sysytem rdbss.sys 6.1.7601.17514 File System Driver Running rdpbus Remote Desktop Device Redirector Bus Driver rdpbus.sys 6.1.7600.16385 Kernel Driver Running RDPCDD RDPCDD RDPCDD.sys 6.1.7601.17514 Kernel Driver Running RDPDR Terminal Server Device Redirector Driver rdpdr.sys 6.1.7601.17514 Kernel Driver Stopped RDPENCDD RDP Encoder Mirror Driver rdpencdd.sys 6.1.7600.16385 Kernel Driver Running RDPREFMP Reflector Display Driver used to gain access to graphics da ta rdprefmp.sys 6.1.7600.16385 Kernel Driver Running RdpVideoMiniport Remote Desktop Video Miniport Driver rdpvideominiport.sys 6.1.7601.17514 Kernel Driver Stopped RDPWD RDP Winstation Driver Kernel Driver Stopped rdyboost ReadyBoost rdyboost.sys 6.1.7601.17514 Kernel Driver Running rspndr Link-Layer Topology Discovery Responder rspndr.sys 6.1.7600.16385 Kernel Driver Running s3cap s3cap vms3cap.sys 6.1.7601.17514 Kernel Driver Stopped

sbp2port Stopped scfilter Stopped secdrv Running Serenum Stopped Serial Stopped sermouse Stopped sffdisk Stopped sffp_mmc Stopped sffp_sd Stopped sfloppy Stopped sisagp Stopped SiSRaid2 Stopped SiSRaid4 Stopped Smb

sbp2port sbp2port.sys

6.1.7601.17514

Kernel Driver

Smart card PnP Class Filter Driver scfilter.sys 6.1.7601.17514 Kernel Driver Security Driver Kernel Driver Serenum Filter Driver serenum.sys 6.1.7600.16385 Serial Port Driver serial.sys 6.1.7600.16385 Serial Mouse Driver sermouse.sys 6.1.7600.16385 SFF Storage Class Driver sffdisk.sys 6.1.7600.16385 Kernel Driver Kernel Driver Kernel Driver Kernel Driver

SFF Storage Protocol Driver for MMC sffp_mmc.sys 6.1.7600.16385 Kernel Driver SFF Storage Protocol Driver for SDBus sffp_sd.sys 6.1.7601.17514 Kernel Driver High-Capacity Floppy Disk Drive sfloppy.sys 6.1.7600.16385 Kernel Driver SIS AGP Bus Filter sisagp.sys 6.1.7600.16385 SiSRaid2 SiSRaid2.sys SiSRaid4 sisraid4.sys smb.sys 5.1.1039.2600 5.1.1039.3600 Kernel Driver Kernel Driver Kernel Driver

Message-oriented TCP/IP and TCP/IPv6 Protocol (SMB session) 6.1.7600.16385 Kernel Driver 6.12.25.4 Kernel Driver

Stopped smserial Running spldr Running srv

smserial smserial.sys

Security Processor Loader Driver Kernel Driver srv.sys Server SMB 1.xxx Driver 6.1.7601.17514 Server SMB 2.xxx Driver 6.1.7601.17514 6.1.7601.17514 5.0.1.1 File System Driver File System Driver File System Driver Kernel Driver

Running srv2 srv2.sys Running srvnet Running stexstor Stopped

srvnet srvnet.sys stexstor stexstor.sys

storflt Running storvsc Stopped swenum

Disk Virtual Machine Bus Acceleration Filter Driver vmstorfl.sys 6.1.7601.17514 Kernel Driver storvsc storvsc.sys 6.1.7601.17514 Kernel Driver

Kernel Driver Running Synth3dVsc Synth3dVsc synth3dvsc.sys 6.1.7601.17514 Kernel Driver Stopped Tcpip TCP/IP Protocol Driver tcpip.sys 6.1.7601.17514 Kernel Driver Running TCPIP6 Microsoft IPv6 Protocol Driver tcpip.sys 6.1.7601.17514 Kernel Driver Stopped tcpipreg TCP/IP Registry Compatibility tcpipreg.sys 6.1.7601.17514 Kernel Driver Running TDPIPE TDPIPE tdpipe.sys 6.1.7601.17514 Kernel Driver Stopped TDTCP TDTCP tdtcp.sys 6.1.7601.17514 Kernel Driver Stopped tdx NetIO Legacy TDI Support Driver tdx.sys 6.1.7601.17514 Kernel Driver Running TermDD Terminal Device Driver termdd.sys 6.1.7601.17514 Kernel Driver Running terminpt Microsoft Remote Desktop Input Driver terminpt.sys 6.1.7601.17514 Kernel Driver Stopped tssecsrv Remote Desktop Services Security Filter Driver tssecsrv.sys 6.1.7601.17514 Kernel Driver Stopped TsUsbFlt TsUsbFlt tsusbflt.sys 6.1.7601.17514 Kernel Driver Stopped TsUsbGD Remote Desktop Generic USB Device TsUsbGD.sys 6.1.7601.17514 Kernel Driver Stopped tsusbhub tsusbhub tsusbhub.sys 6.1.7601.17514 Kernel Driver Stopped tunnel Microsoft Tunnel Miniport Adapter Driver tunnel.sys 6.1.7601.17514 Kernel Driver Running uagp35 Microsoft AGPv3.5 Filter uagp35.sys 6.1.7600.16385 Kernel Driver Stopped udfs udfs udfs.sys 6.1.7601.17514 File System Driver Stopped uliagpkx Uli AGP Bus Filter uliagpkx.sys 6.1.7600.16385 Kernel Driver Stopped

Software Bus Driver swenum.sys 6.1.7600.16385

umbus Running UmPass Stopped usbccgp Stopped usbcir Stopped usbehci Running usbhub Running usbohci Stopped usbprint Stopped USBSTOR Running usbuhci Running vdrvroot Running vga Stopped VgaSave

UMBus Enumerator Driver umbus.sys 6.1.7601.17514 Microsoft UMPass Driver umpass.sys 6.1.7600.16385

Kernel Driver Kernel Driver

Microsoft USB Generic Parent Driver usbccgp.sys 6.1.7601.17514 Kernel Driver eHome Infrared Receiver (USBCIR) usbcir.sys 6.1.7600.16385 Kernel Driver Microsoft USB 2.0 Enhanced Host Controller Miniport Driver usbehci.sys 6.1.7601.17514 Kernel Driver Microsoft USB Standard Hub Driver usbhub.sys 6.1.7601.17514 Kernel Driver Microsoft USB Open Host Controller Miniport Driver usbohci.sys 6.1.7600.16385 Kernel Driver Microsoft USB PRINTER Class usbprint.sys 6.1.7600.16385 USB Mass Storage Driver USBSTOR.SYS 6.1.7601.17514 Kernel Driver Kernel Driver

Microsoft USB Universal Host Controller Miniport Driver usbuhci.sys 6.1.7600.16385 Kernel Driver Microsoft Virtual Drive Enumerator Driver vdrvroot.sys 6.1.7600.16385 Kernel Driver vga vgapnp.sys VgaSave vga.sys 6.1.7600.16385 Kernel Driver Kernel Driver 6.1.7601.17514 Kernel Driver Kernel Driver Kernel Driver Kernel Driver Kernel Driver Kernel Driver VGPU rdvgkmd.sys vhdmp vhdmp.sys 6.1.7600.16385 Kernel Driver

Running VGPU Stopped vhdmp Stopped viaagp Stopped ViaC7 Stopped viaide Stopped vmbus Stopped VMBusHID Stopped

VIA AGP Bus Filter viaagp.sys 6.1.7600.16385 VIA C7 Processor Driver viac7.sys 6.1.7600.16385 viaide viaide.sys vmbus vmbus.sys VMBusHID VMBusHID.sys 6.0.6000.170 6.1.7601.17514 6.1.7601.17514

volmgr Running volmgrx Running volsnap Running vsmraid Stopped vwifibus

Volume Manager Driver volmgr.sys 6.1.7601.17514 Dynamic Volume Manager volmgrx.sys 6.1.7600.16385 Storage volumes volsnap.sys 6.1.7601.17514 vsmraid vsmraid.sys 6.0.6000.6210

Kernel Driver Kernel Driver Kernel Driver Kernel Driver

Kernel Driver Stopped w29n51 Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows XP w29n51.sys 9.0.4.39 Kernel Driver Running WacomPen Wacom Serial Pen HID Driver wacompen.sys 6.1.7600.16385 Kernel Driver Stopped WANARP Remote Access IP ARP Driver wanarp.sys 6.1.7601.17514 Kernel Driver Stopped Wanarpv6 Remote Access IPv6 ARP Driver wanarp.sys 6.1.7601.17514 Kernel Driver Running Wd Wd wd.sys 6.1.7600.16385 Kernel Driver Stopped Wdf01000 Kernel Mode Driver Frameworks service Wdf01000.sys 1.9.7600.16385 Kernel Driver Running WfpLwf WFP Lightweight Filter wfplwf.sys 6.1.7600.16385 Kernel Driver Running WIMMount WIMMount wimmount.sys 6.1.7600.16385 File System Driver Stopped WinRing0_1_2_0 WinRing0_1_2_0 WinRing0.sys 1.2.0.5 File System Driver Stopped WmiAcpi Microsoft Windows Management Interface for ACPI wmiacpi.sys 6.1.7600.16385 Kernel Driver Running ws2ifsl Winsock IFS Driver ws2ifsl.sys 6.1.7600.16385 Kernel Driver Stopped WudfPf User Mode Driver Frameworks Platform Driver WudfPf.sys 6.1.7601.17514 Kernel Driver Stopped --------[ Services ]--------------------------------------------------------------------------------------------------AeLookupSvc ess ALG Running Application Experience svchost.exe 6.1.7600.16385 Share Proc localSystem Application Layer Gateway Service

Virtual WiFi Bus Driver vwifibus.sys 6.1.7600.16385

s ess ess ess s ess ess ess ess ess ess ess ess ess X86 s X86 s s ess ess ess

alg.exe 6.1.7600.16385 Own Proces NT AUTHORITY\LocalService Application Identity svchost.exe 6.1.7600.16385 Share Proc Stopped NT Authority\LocalService Appinfo Application Information svchost.exe 6.1.7600.16385 Share Proc Stopped LocalSystem AppMgmt Application Management svchost.exe 6.1.7600.16385 Share Proc Stopped LocalSystem aspnet_state ASP.NET State Service aspnet_state.exe 4.0.30319.17929 Own Proces Stopped NT AUTHORITY\NetworkService AudioEndpointBuilder Windows Audio Endpoint Builder svchost.exe 6.1.7600.16385 Share Proc Running LocalSystem Audiosrv Windows Audio svchost.exe 6.1.7600.16385 Share Proc Running NT AUTHORITY\LocalService AxInstSV ActiveX Installer (AxInstSV) svchost.exe 6.1.7600.16385 Share Proc Stopped LocalSystem BDESVC BitLocker Drive Encryption Service svchost.exe 6.1.7600.16385 Share Proc Stopped localSystem BFE Base Filtering Engine svchost.exe 6.1.7600.16385 Share Proc Running NT AUTHORITY\LocalService BITS Background Intelligent Transfer Service svchost.exe 6.1.7600.16385 Share Proc Running LocalSystem Browser Computer Browser svchost.exe 6.1.7600.16385 Share Proc Stopped LocalSystem bthserv Bluetooth Support Service svchost.exe 6.1.7600.16385 Share Proc Stopped NT AUTHORITY\LocalService CertPropSvc Certificate Propagation svchost.exe 6.1.7600.16385 Share Proc Stopped LocalSystem clr_optimization_v2.0.50727_32 Microsoft .NET Framework NGEN v2.0.50727_ mscorsvw.exe 2.0.50727.4927 Own Proces Stopped LocalSystem clr_optimization_v4.0.30319_32 Microsoft .NET Framework NGEN v4.0.30319_ mscorsvw.exe 4.0.30319.17929 Own Proces Stopped LocalSystem COMSysApp COM+ System Application dllhost.exe 6.1.7600.16385 Own Proces Stopped LocalSystem CryptSvc Cryptographic Services svchost.exe 6.1.7600.16385 Share Proc Running NT Authority\NetworkService CscService Offline Files svchost.exe 6.1.7600.16385 Share Proc Running LocalSystem DcomLaunch DCOM Server Process Launcher svchost.exe 6.1.7600.16385 Share Proc Running LocalSystem defragsvc Disk Defragmenter Stopped AppIDSvc

s DFServ s Dhcp ess ess dot3svc ess DPS ess EapHost ess EFS ess ehRecvr s ehSched s ess ess Fax s fdPHost ess ess ess

Stopped Running Running Dnscache Running Stopped Running Running Stopped Stopped Stopped eventlog Running EventSystem Running Stopped Stopped FDResPub Stopped FontCache

Running FontCache3.0.0.0 e 3.0.0.0 rocess Stopped gpsvc ess hidserv ess hkmsvc ess Stopped HomeGroupListener Stopped Running

svchost.exe 6.1.7600.16385 Own Proces localSystem DFServ DFServ.exe 6.61.20.2822 Own Proces LocalSystem DHCP Client svchost.exe 6.1.7600.16385 Share Proc NT Authority\LocalService DNS Client svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\NetworkService Wired AutoConfig svchost.exe 6.1.7600.16385 Share Proc localSystem Diagnostic Policy Service svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Extensible Authentication Protocol svchost.exe 6.1.7600.16385 Share Proc localSystem Encrypting File System (EFS) lsass.exe 6.1.7600.16385 Share Proc LocalSystem Windows Media Center Receiver Service ehRecvr.exe 6.1.7601.17514 Own Proces NT AUTHORITY\networkService Windows Media Center Scheduler Service ehsched.exe 6.1.7600.16385 Own Proces NT AUTHORITY\networkService Windows Event Log svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService COM+ Event System svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Fax fxssvc.exe 6.1.7601.17514 Own Proces NT AUTHORITY\NetworkService Function Discovery Provider Host svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Function Discovery Resource Publication svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Windows Font Cache Service svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Windows Presentation Foundation Font Cach PresentationFontCache.exe 3.0.6920.4902 Own P NT Authority\LocalService Group Policy Client svchost.exe 6.1.7600.16385 Share Proc LocalSystem Human Interface Device Access svchost.exe 6.1.7600.16385 Share Proc LocalSystem Health Key and Certificate Management svchost.exe 6.1.7600.16385 Share Proc localSystem HomeGroup Listener

ess ess

Stopped HomeGroupProvider Stopped idsvc

ess

Stopped IJPLMSVC Survey Program s Stopped IKEEXT ess ess ess KeyIso ess KtmRm ator ess ess ess lltdsvc ess lmhosts ess Mcx2Svc ess MMCSS ess MpsSvc ess MSDTC cess MSiSCSI ess s ess Stopped msiserver Stopped napagent Stopped Netlogon Stopped Running Running Stopped Running Stopped Stopped LanmanServer Running LanmanWorkstation Running Running Stopped IPBusEnum Stopped iphlpsvc Running

svchost.exe 6.1.7600.16385 Share Proc LocalSystem HomeGroup Provider svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Windows CardSpace infocard.exe 3.0.4506.5420 Share Proc LocalSystem Canon Inkjet Printer/Scanner/Fax Extended IJPLMSVC.EXE 3.0.0.101 Own Proces LocalSystem IKE and AuthIP IPsec Keying Modules svchost.exe 6.1.7600.16385 Share Proc LocalSystem PnP-X IP Bus Enumerator svchost.exe 6.1.7600.16385 Share Proc LocalSystem IP Helper svchost.exe 6.1.7600.16385 Share Proc LocalSystem CNG Key Isolation lsass.exe 6.1.7600.16385 Share Proc LocalSystem KtmRm for Distributed Transaction Coordin svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\NetworkService Server svchost.exe 6.1.7600.16385 Share Proc LocalSystem Workstation svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\NetworkService Link-Layer Topology Discovery Mapper svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService TCP/IP NetBIOS Helper svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Media Center Extender Service svchost.exe 6.1.7600.16385 Share Proc NT Authority\LocalService Multimedia Class Scheduler svchost.exe 6.1.7600.16385 Share Proc LocalSystem Windows Firewall svchost.exe 6.1.7600.16385 Share Proc NT Authority\LocalService Distributed Transaction Coordinator msdtc.exe 2001.12.8530.16385 Own Pro NT AUTHORITY\NetworkService Microsoft iSCSI Initiator Service svchost.exe 6.1.7600.16385 Share Proc LocalSystem Windows Installer msiexec.exe 5.0.7601.17514 Own Proces LocalSystem Network Access Protection Agent svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\NetworkService Netlogon

ess Netman ess ess ess ess ess ess NlaSvc ess nsi ess ose s osppsvc s ess p2psvc ess PcaSvc ess ess pla ess ess ess PNRPsvc ess ess Power

Stopped Running NetMsmqActivator Stopped NetPipeActivator Stopped netprofm Running NetTcpActivator Stopped NetTcpPortSharing Stopped Running Running Stopped Running p2pimsvc Stopped Stopped Running PeerDistSvc Stopped Stopped PlugPlay Running PNRPAutoReg Stopped Stopped PolicyAgent Stopped

lsass.exe 6.1.7600.16385 Share Proc LocalSystem Network Connections svchost.exe 6.1.7600.16385 Share Proc LocalSystem Net.Msmq Listener Adapter SMSvcHost.exe 4.0.30319.17929 Share Proc NT AUTHORITY\NetworkService Net.Pipe Listener Adapter SMSvcHost.exe 4.0.30319.17929 Share Proc NT AUTHORITY\LocalService Network List Service svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Net.Tcp Listener Adapter SMSvcHost.exe 4.0.30319.17929 Share Proc NT AUTHORITY\LocalService Net.Tcp Port Sharing Service SMSvcHost.exe 4.0.30319.17929 Share Proc NT AUTHORITY\LocalService Network Location Awareness svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\NetworkService Network Store Interface Service svchost.exe 6.1.7600.16385 Share Proc NT Authority\LocalService Office Source Engine OSE.EXE 14.0.4730.1010 Own Proces LocalSystem Office Software Protection Platform OSPPSVC.EXE 14.0.370.400 Own Proces NT AUTHORITY\NetworkService Peer Networking Identity Manager svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Peer Networking Grouping svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Program Compatibility Assistant Service svchost.exe 6.1.7600.16385 Share Proc LocalSystem BranchCache svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\NetworkService Performance Logs & Alerts svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Plug and Play svchost.exe 6.1.7600.16385 Share Proc LocalSystem PNRP Machine Name Publication Service svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Peer Name Resolution Protocol svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService IPsec Policy Agent svchost.exe 6.1.7600.16385 Share Proc NT Authority\NetworkService Power

ess ProfSvc ess ess QWAVE ess RasAuto ess RasMan ess ess ess ess s RpcSs ess SamSs ess ess ess ess s SDRSVC s ess SENS ess ess

Running Running ProtectedStorage Stopped Stopped Stopped Stopped RemoteAccess Stopped RemoteRegistry Stopped RpcEptMapper Running RpcLocator Stopped Running Running SCardSvr Stopped Schedule Running SCPolicySvc Stopped ScsiAccess Running Stopped seclogon Stopped Running SensrSvc Stopped SessionEnv

svchost.exe 6.1.7600.16385 Share Proc LocalSystem User Profile Service svchost.exe 6.1.7600.16385 Share Proc LocalSystem Protected Storage lsass.exe 6.1.7600.16385 Share Proc LocalSystem Quality Windows Audio Video Experience svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Remote Access Auto Connection Manager svchost.exe 6.1.7600.16385 Share Proc localSystem Remote Access Connection Manager svchost.exe 6.1.7600.16385 Share Proc localSystem Routing and Remote Access svchost.exe 6.1.7600.16385 Share Proc localSystem Remote Registry svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService RPC Endpoint Mapper svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\NetworkService Remote Procedure Call (RPC) Locator locator.exe 6.1.7600.16385 Own Proces NT AUTHORITY\NetworkService Remote Procedure Call (RPC) svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\NetworkService Security Accounts Manager lsass.exe 6.1.7600.16385 Share Proc LocalSystem Smart Card svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Task Scheduler svchost.exe 6.1.7600.16385 Share Proc LocalSystem Smart Card Removal Policy svchost.exe 6.1.7600.16385 Share Proc LocalSystem ScsiAccess ScsiAccess.exe Own Proces LocalSystem Windows Backup svchost.exe 6.1.7600.16385 Own Proces localSystem Secondary Logon svchost.exe 6.1.7600.16385 Share Proc LocalSystem System Event Notification Service svchost.exe 6.1.7600.16385 Share Proc LocalSystem Adaptive Brightness svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Remote Desktop Configuration

ess ess ess s s

Stopped SharedAccess Stopped ShellHWDetection Running SkypeUpdate Stopped SNMPTRAP Stopped Spooler Running sppsvc Running sppuinotify Stopped SSDPSRV Running SstpSvc Stopped StiSvc Stopped swprv Stopped SysMain Running TabletInputService Stopped TapiSrv Stopped TBS Stopped TeamViewer8 Running TermService Stopped Themes Running THREADORDER Stopped TrkWks

s s ess ess ess s s ess ess ess ess ess ess ess ess

svchost.exe 6.1.7600.16385 Share Proc localSystem Internet Connection Sharing (ICS) svchost.exe 6.1.7600.16385 Share Proc LocalSystem Shell Hardware Detection svchost.exe 6.1.7600.16385 Share Proc LocalSystem Skype Updater Updater.exe 5.10.1.44067 Own Proces LocalSystem SNMP Trap snmptrap.exe 6.1.7600.16385 Own Proces NT AUTHORITY\LocalService Print Spooler spoolsv.exe 6.1.7601.17514 Own Proces LocalSystem Software Protection sppsvc.exe 6.1.7601.17514 Own Proces NT AUTHORITY\NetworkService SPP Notification Service svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService SSDP Discovery svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Secure Socket Tunneling Protocol Service svchost.exe 6.1.7600.16385 Share Proc NT Authority\LocalService Windows Image Acquisition (WIA) svchost.exe 6.1.7600.16385 Own Proces NT Authority\LocalService Microsoft Software Shadow Copy Provider svchost.exe 6.1.7600.16385 Own Proces LocalSystem Superfetch svchost.exe 6.1.7600.16385 Share Proc LocalSystem Tablet PC Input Service svchost.exe 6.1.7600.16385 Share Proc LocalSystem Telephony svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\NetworkService TPM Base Services svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService TeamViewer 8 TeamViewer_Service.exe 8.0.17396.0 Own Proc LocalSystem Remote Desktop Services svchost.exe 6.1.7600.16385 Share Proc NT Authority\NetworkService Themes svchost.exe 6.1.7600.16385 Share Proc LocalSystem Thread Ordering Server svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Distributed Link Tracking Client

ess s s

Running TrustedInstaller Stopped UI0Detect

Stopped UmRdpService irector ess Stopped upnphost ess UxSms ess ess vds s VSS s W32Time ess s ess wcncsvc ess ess ess ess ess Wecsvc ess Stopped wercplsupport el Support ess Stopped WerSvc ess Stopped WinDefend Stopped WcsPlugInService Stopped WdiServiceHost Running WdiSystemHost Stopped WebClient Stopped Running wbengine Stopped WbioSrvc Stopped Stopped Stopped Running VaultSvc Stopped Stopped

svchost.exe 6.1.7600.16385 Share Proc LocalSystem Windows Modules Installer TrustedInstaller.exe 6.1.7601.17514 Own Proces localSystem Interactive Services Detection UI0Detect.exe 6.1.7600.16385 Own Proces LocalSystem Remote Desktop Services UserMode Port Red svchost.exe 6.1.7600.16385 Share Proc localSystem UPnP Device Host svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Desktop Window Manager Session Manager svchost.exe 6.1.7600.16385 Share Proc localSystem Credential Manager lsass.exe 6.1.7600.16385 Share Proc LocalSystem Virtual Disk vds.exe 6.1.7601.17514 Own Proces LocalSystem Volume Shadow Copy vssvc.exe 6.1.7601.17514 Own Proces LocalSystem Windows Time svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Block Level Backup Engine Service wbengine.exe 6.1.7601.17514 Own Proces localSystem Windows Biometric Service svchost.exe 6.1.7600.16385 Share Proc LocalSystem Windows Connect Now - Config Registrar svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Windows Color System svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Diagnostic Service Host svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Diagnostic System Host svchost.exe 6.1.7600.16385 Share Proc LocalSystem WebClient svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Windows Event Collector svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\NetworkService Problem Reports and Solutions Control Pan svchost.exe 6.1.7600.16385 Share Proc localSystem Windows Error Reporting Service svchost.exe 6.1.7600.16385 Share Proc localSystem Windows Defender

ess ess

Running WinHttpAutoProxySvc Stopped Winmgmt Running WinRM Stopped Wlansvc Running wmiApSrv Stopped WMPNetworkSvc Stopped WPCSvc Stopped WPDBusEnum Stopped wscsvc Running WSearch Running wuauserv

ess ess ess s ice s ess ess ess s ess

Running wudfsvc ver Framework ess Stopped WwanSvc ess Stopped

svchost.exe 6.1.7600.16385 Share Proc LocalSystem WinHTTP Web Proxy Auto-Discovery Service svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Windows Management Instrumentation svchost.exe 6.1.7600.16385 Share Proc localSystem Windows Remote Management (WS-Management) svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\NetworkService WLAN AutoConfig svchost.exe 6.1.7600.16385 Share Proc LocalSystem WMI Performance Adapter WmiApSrv.exe 6.1.7600.16385 Own Proces localSystem Windows Media Player Network Sharing Serv wmpnetwk.exe 12.0.7601.17514 Own Proces NT AUTHORITY\NetworkService Parental Controls svchost.exe 6.1.7600.16385 Share Proc NT Authority\LocalService Portable Device Enumerator Service svchost.exe 6.1.7600.16385 Share Proc LocalSystem Security Center svchost.exe 6.1.7600.16385 Share Proc NT AUTHORITY\LocalService Windows Search SearchIndexer.exe 7.0.7600.16385 Own Proces LocalSystem Windows Update svchost.exe 6.1.7600.16385 Share Proc LocalSystem Windows Driver Foundation - User-mode Dri svchost.exe 6.1.7600.16385 Share Proc LocalSystem WWAN AutoConfig svchost.exe 6.1.7600.16385 Share Proc NT Authority\LocalService

--------[ AX Files ]--------------------------------------------------------------------------------------------------bdaplgin.ax 6.1.7600.16385 Control Plug-in for MPEG2 based networks. g711codc.ax 6.1.7601.17514 iac25_32.ax 2.0.5.53 ir41_32.ax 4.51.16.3 ivfsrc.ax 5.10.2.51 Source Filter 5.10 ksproxy.ax 6.1.7601.17514 ovie Proxy kstvtune.ax 6.1.7601.17514 kswdmcap.ax 6.1.7601.17514 apture ksxbar.ax 6.1.7601.17514 r Microsoft BDA Device Intel G711 CODEC Indeo audio software Intel Indeo Video 4.5 Intel Indeo video IVF WDM Streaming ActiveM WDM Streaming TvTuner WDM Streaming Video C WDM Streaming Crossba

mpeg2data.ax 6.6.7601.17514 ion and Table Acquisition Module mpg2splt.ax 6.6.7601.17514 itter. msdvbnp.ax 6.6.7601.17514 vider for MPEG2 based networks. msnp.ax 6.6.7601.17514 vider for MPEG2 based networks. psisrndr.ax 6.6.7601.17514 nformation Filter for MPEG2 based networks. vbicodec.ax 6.6.7601.17514 vbisurf.ax 6.1.7601.17514 Filter vidcap.ax 6.1.7600.16385 ce Server wstpager.ax 6.6.7601.17514 rver

Microsoft MPEG-2 Sect DirectShow MPEG-2 Spl Microsoft Network Pro Microsoft Network Pro Microsoft Transport I Microsoft VBI Codec VBI Surface Allocator Video Capture Interfa Microsoft Teletext Se

--------[ DLL Files ]-------------------------------------------------------------------------------------------------aaclient.dll t accessibilitycpl.dll ol panel acctres.dll count Manager Resources acledit.dll ditor aclui.dll ditor acppage.dll ll Extension Library acproxy.dll actioncenter.dll actioncentercpl.dll Panel actionqueue.dll Generator / Executor activeds.dll actxprxy.dll shaling Library admparse.dll mplate Parser admtmpl.dll tes Extension adprovider.dll adsldp.dll adsldpc.dll LL adsmsext.dll adsnt.dll er DLL adtschema.dll DLL advapi32.dll ase API advpack.dll aecache.dll 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 8.0.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 8.0.7600.16385 6.1.7600.16385 Ease of access contr Microsoft Internet Ac Access Control List E Security Descriptor E Compatibility Tab She Autochk Proxy DLL Action Center Action Center Control Unattend Action Queue ADs Router Layer DLL ActiveX Interface Mar IEAK Global Policy Te Administrative Templa adprovider DLL ADs LDAP Provider DLL ADs LDAP Provider C D ADs LDAP Provider DLL ADs Windows NT Provid Security Audit Schema Advanced Windows 32 B ADVPACK AECache Sysprep Plugi 6.1.7601.17514 Anywhere access clien

n aeevts.dll 6.1.7600.16385 Application Experienc e Event Resources aeinv.dll 6.1.7601.17514 Application Experienc e Program Inventory Component aelupsvc.dll 6.1.7600.16385 Application Experienc e Service aepdu.dll 6.1.7601.17514 Program Compatibility Data Updater aepic.dll 6.1.7600.16385 Application Experienc e Program Cache alttab.dll 6.1.7600.16385 Windows Shell Alt Tab amstream.dll 6.6.7601.17514 DirectShow Runtime. amxread.dll 6.1.7600.16385 API Tracing Manifest Read Library apds.dll 6.1.7600.16385 Microsoft Help Data Se rvices Module apilogen.dll 6.1.7600.16385 API Tracing Log Engin e api-ms-win-core-console-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-datetime-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-debug-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DL L api-ms-win-core-delayload-l1-1-0.dll 6.1.7600.16385 ApiSet Stu b DLL api-ms-win-core-errorhandling-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-fibers-l1-1-0.dll 6.1.7600.16385 ApiSet Stub D LL api-ms-win-core-file-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-handle-l1-1-0.dll 6.1.7600.16385 ApiSet Stub D LL api-ms-win-core-heap-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-interlocked-l1-1-0.dll 6.1.7600.16385 ApiSet S tub DLL api-ms-win-core-io-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-libraryloader-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-localization-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-localregistry-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-memory-l1-1-0.dll 6.1.7600.16385 ApiSet Stub D LL api-ms-win-core-misc-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-namedpipe-l1-1-0.dll 6.1.7600.16385 ApiSet Stu b DLL api-ms-win-core-processenvironment-l1-1-0.dll 6.1.7600.16385 A piSet Stub DLL api-ms-win-core-processthreads-l1-1-0.dll 6.1.7600.16385 ApiSe t Stub DLL api-ms-win-core-profile-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-rtlsupport-l1-1-0.dll 6.1.7600.16385 ApiSet St ub DLL api-ms-win-core-string-l1-1-0.dll 6.1.7600.16385 ApiSet Stub D LL api-ms-win-core-synch-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DL

L api-ms-win-core-sysinfo-l1-1-0.dll 6.1.7600.16385 DLL api-ms-win-core-threadpool-l1-1-0.dll 6.1.7600.16385 ApiSet St ub DLL api-ms-win-core-util-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-core-xstate-l1-1-0.dll 6.1.7600.16385 ApiSet Stub D LL api-ms-win-security-base-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-security-lsalookup-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-security-sddl-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-service-core-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-service-management-l1-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-service-management-l2-1-0.dll 6.1.7600.16385 ApiSet Stub DLL api-ms-win-service-winsvc-l1-1-0.dll 6.1.7600.16385 ApiSet Stu b DLL apircl.dll 6.1.7600.16385 Microsoft InfoTech IR Local DLL apisetschema.dll 6.1.7600.16385 ApiSet Schema DLL apphelp.dll 6.1.7601.17514 Application Compatibi lity Client Library apphlpdm.dll 6.1.7600.16385 Application Compatibi lity Help Module appidapi.dll 6.1.7600.16385 Application Identity APIs Dll appidpolicyengineapi.dll 6.1.7600.16385 AppId Policy Engine A PI Module appidsvc.dll 6.1.7600.16385 Application Identity Service appinfo.dll 6.1.7601.17514 Application Informati on Service appmgmts.dll 6.1.7600.16385 Software installation Service appmgr.dll 6.1.7601.17514 Software Installation Snapin Extenstion apss.dll 6.1.7600.16385 Microsoft InfoTech Sto rage System Library asferror.dll 12.0.7600.16385 ASF Error Definitions aspnet_counters.dll 4.0.30319.17929 Microsoft ASP.NET Per formance Counter Shim DLL asycfilt.dll 6.1.7601.17514 atl.dll 3.5.2284.0 ATL Module for Window s XP (Unicode) atmfd.dll 5.1.2.230 Windows NT OpenType/T ype 1 Font Driver atmlib.dll 5.1.2.230 Windows NT OpenType/T ype 1 API Library. audiodev.dll 6.1.7601.17514 Portable Media Device s Shell Extension audioeng.dll 6.1.7600.16385 Audio Engine audiokse.dll 6.1.7600.16385 Audio Ks Endpoint audioses.dll 6.1.7601.17514 Audio Session audiosrv.dll 6.1.7601.17514 Windows Audio Service auditcse.dll 6.1.7600.16385 Windows Audit Setting ApiSet Stub

s CSE auditnativesnapin.dll 6.1.7600.16385 licy Editor Extension auditpolicygpinterop.dll 6.1.7600.16385 e auditpolmsg.dll 6.1.7600.16385 In Messages authfwcfg.dll 6.1.7600.16385 Advanced Security Configuration Helper authfwgp.dll 6.1.7600.16385 Advanced Security Group Policy Editor Extension authfwsnapin.dll 6.1.7601.17514 wall.SnapIn authfwwizfwk.dll 6.1.7600.16385 authui.dll 6.1.7601.17514 n UI authz.dll 6.1.7600.16385 rk autoplay.dll 6.1.7601.17514 l auxiliarydisplayapi.dll 6.1.7600.16385 eShow API auxiliarydisplayclassinstaller.dll 6.1.7600.16385 ler for Microsoft Windows SideShow-compatible devices auxiliarydisplaycpl.dll 6.1.7601.17514 eShow Control Panel auxiliarydisplaydriverlib.dll 6.1.7600.16385 SideShow class extension component auxiliarydisplayservices.dll 6.1.7601.17514 SideShow services avicap.dll 1.15.0.1 avicap32.dll 6.1.7600.16385 ass avifil32.dll 6.1.7601.17514 pport library avifile.dll 4.90.0.3000 pport library avrt.dll 6.1.7600.16385 untime axinstsv.dll 6.1.7601.17514 vice azroles.dll 6.1.7601.17514 azroleui.dll 6.1.7601.17514 azsqlext.dll 6.1.7601.17514 ded Stored Procedures Dll basecsp.dll 6.1.7601.17514 Card Crypto Provider basesrv.dll 6.1.7601.17514 erver DLL batmeter.dll 6.1.7601.17514 DLL batt.dll 6.1.7600.16385 er bcdprov.dll 6.1.7600.16385 ta WMI Provider bcdsrv.dll 6.1.7601.17514 ta COM Server bcrypt.dll 6.1.7600.16385 Primitives Library bcryptprimitives.dll 6.1.7600.16385

Audit Policy Group Po Audit Policy GP Modul Audit Policy MMC Snap Windows Firewall with Windows Firewall with Microsoft.WindowsFire Wizard Framework Windows Authenticatio Authorization Framewo AutoPlay Control Pane Microsoft Windows Sid Class instal Microsoft Windows Sid Microsoft Windows Microsoft Windows AVI Capture DLL AVI Capture window cl Microsoft AVI File su Microsoft AVI File su Multimedia Realtime R ActiveX Installer Ser azroles Module Authorization Manager AzMan Sql Audit Exten Microsoft Base Smart Windows NT BASE API S Battery Meter Helper Battery Class Install Boot Configuration Da Boot Configuration Da Windows Cryptographic Windows Cryptographic

Primitives Library bdehdcfglib.dll 6.1.7600.16385 ve Preparation Tool bderepair.dll 6.1.7600.16385 ption: Drive Repair Tool bdesvc.dll 6.1.7600.16385 bdeui.dll 6.1.7600.16385 ve Encryption User Interface bfe.dll 6.1.7601.17514 bidispl.dll 6.1.7600.16385 biocpl.dll 6.1.7601.17514 nel biocredprov.dll 6.1.7600.16385 vider bitsigd.dll 7.5.7600.16385 t Transfer Service IGD Support bitsperf.dll 7.5.7601.17514 s bitsprx2.dll 7.5.7600.16385 t Transfer Service Proxy bitsprx3.dll 7.5.7600.16385 t Transfer Service 2.0 Proxy bitsprx4.dll 7.5.7600.16385 t Transfer Service 2.5 Proxy bitsprx5.dll 7.5.7600.16385 t Transfer Service 3.0 Proxy bitsprx6.dll 7.5.7600.16385 t Transfer Service 4.0 Proxy blackbox.dll 11.0.7601.17514 blb_ps.dll 6.1.7600.16385 Backup proxy/stub blbevents.dll 6.1.7601.17514 blbres.dll 6.1.7600.16385 Backup Engine Service Resources bootres.dll 6.1.7601.17514 bootstr.dll 6.1.7600.16385 Library bootvid.dll 6.1.7600.16385 brcoinst.dll 1.0.0.20 n CoInstaller brdgcfg.dll 6.1.7600.16385 ect bridgeres.dll 6.1.7600.16385 browcli.dll 6.1.7601.17514 t DLL browser.dll 6.1.7601.17514 ice DLL browseui.dll 6.1.7601.17514 ary bthci.dll 6.1.7600.16385 ller bthmtpcontexthandler.dll 6.1.7600.16385 Menu Handler bthpanapi.dll 6.1.7600.16385 bthpancontexthandler.dll 1.0.0.1 r bthserv.dll 6.1.7600.16385 vice btpanui.dll 6.1.7600.16385 terface

Windows BitLocker Dri BitLocker Drive Encry BDE Service Windows BitLocker Dri Base Filtering Engine Bidispl DLL Biometrics Control Pa WinBio Credential Pro Background Intelligen Perfmon Counter Acces Background Intelligen Background Intelligen Background Intelligen Background Intelligen Background Intelligen BlackBox DLL Microsoft Block Level Blb Publisher Microsoft Block Level Boot Resource Library Boot String Resource VGA Boot Driver Brother Multi Functio NWLink IPX Notify Obj Bridge Resources Browser Service Clien Computer Browser Serv Shell Browser UI Libr Bluetooth Class Insta Bluetooth MTP Context bthpanapi Bthpan Context Handle Bluetooth Support Ser Bluetooth PAN User In

bwcontexthandler.dll 1.0.0.1 bwunpairelevated.dll 6.1.7600.16385 y Dll c_g18030.dll 6.1.7600.16385 Conversion DLL c_is2022.dll 6.1.7600.16385 anslation DLL c_iscii.dll 6.1.7601.17514 lation DLL cabinet.dll 6.1.7601.17514 API cabview.dll 6.1.7601.17514 hell Extension capiprovider.dll 6.1.7600.16385 capisp.dll 6.1.7600.16385 or CAPI cardgames.dll 1.0.0.1 catsrv.dll 2001.12.8530.16385 talog Server catsrvps.dll 2001.12.8530.16385 talog Server Proxy/Stub catsrvut.dll 2001.12.8530.16385 talog Server Utilities cca.dll 6.6.7601.17514 . cdd.dll 6.1.7601.17514 ver cdosys.dll 6.6.7601.17514 dows Library certcli.dll 6.1.7601.17514 tory Certificate Services Client certcredprovider.dll 6.1.7600.16385 der certenc.dll 6.1.7600.16385 ificate Services Encoding certenroll.dll 6.1.7601.17514 tory Certificate Services Enrollment Client certenrollui.dll 6.1.7600.16385 llment UI certmgr.dll 6.1.7601.17514 certpoleng.dll 6.1.7601.17514 gine certprop.dll 6.1.7601.17514 ertificate Propagation Service cewmdm.dll 12.0.7600.16385 ce Provider cfgbkend.dll 6.1.7600.16385 Interface cfgmgr32.dll 6.1.7601.17514 DLL chkwudrv.dll 6.1.7600.16385 for Drivers chsbrkr.dll 6.1.7600.16385 rd Breaker chtbrkr.dll 6.1.7600.16385 ord Breaker chxreadingstringime.dll 6.1.7600.16385 ci.dll 6.1.7601.17514 cic.dll 6.1.7600.16385 r Taskpad

ContextH Application BWUnpairElevated Prox GB18030 DBCS-Unicode ISO-2022 Code Page Tr ISCII Code Page Trans Microsoft Cabinet File Cabinet File Viewer S capiprovider DLL Sysprep cleanup dll f CardGames Resources COM+ Configuration Ca COM+ Configuration Ca COM+ Configuration Ca CCA DirectShow Filter Canonical Display Dri Microsoft CDO for Win Microsoft Active Direc Cert Credential Provi Active Directory Cert Microsoft Active Direc X509 Certificate Enro Certificates snap-in Certificate Policy En Microsoft Smartcard C Windows CE WMDM Servi Configuration Backend Configuration Manager Search Windows Update Simplified Chinese Wo Chinese Traditional W CHxReadingStringIME Code Integrity Module CIC - MMC controls fo

circoinst.dll 6.1.7600.16385 r coinstaller for eHome clb.dll 6.1.7600.16385 clbcatq.dll 2001.12.8530.16385 talog clfsw32.dll 6.1.7600.16385 g Win32 DLL cliconfg.dll 6.1.7600.16385 ion Utility DLL clusapi.dll 6.1.7601.17514 cmcfg32.dll 7.2.7600.16385 Manager Configuration Dll cmdial32.dll 7.2.7600.16385 Manager cmicryptinstall.dll 6.1.7600.16385 graphic elements of CMI objects cmifw.dll 6.1.7600.16385 configuration plug-in cmipnpinstall.dll 6.1.7600.16385 for CMI cmlua.dll 7.2.7600.16385 min API Helper cmnclim.dll 6.1.7600.16385 cmpbk32.dll 7.2.7600.16385 Manager Phonebook cmstplua.dll 7.2.7600.16385 min API Helper for Setup cmutil.dll 7.2.7600.16385 Manager Utility Lib cngaudit.dll 6.1.7600.16385 Next Generation audit library cngprovider.dll 6.1.7600.16385 cnmiu9w.dll 1.6.0.110 ller cnmlm9w.dll 0.3.0.1 cnvfat.dll 6.1.7600.16385 rsion Utility DLL cofiredm.dll 6.1.7600.16385 ry Diagnostic Module colbact.dll 2001.12.8530.16385 colorcnv.dll 6.1.7600.16385 onversion colorui.dll 6.1.7600.16385 ol Panel comcat.dll 6.1.7600.16385 ategory Manager Library comctl32.dll 5.82.7601.17514 ols Library comdlg32.dll 6.1.7601.17514 commdlg.dll 3.10.0.103 ies compobj.dll 2.10.35.35 erability Library compstui.dll 6.1.7600.16385 User Interface DLL comrepl.dll 2001.12.8530.16385 comres.dll 2001.12.8530.16385 comsnap.dll 2001.12.8530.16385 pin comsvcs.dll 2001.12.8530.16385

USB Consumer IR Drive Column List Box COM+ Configuration Ca Common Log Marshallin SQL Client Configurat Cluster API Library Microsoft Connection Microsoft Connection Installers for crypto Windows Firewall rule PNP plugin installer Connection Manager Ad Common Client Library Microsoft Connection Connection Manager Ad Microsoft Connection Windows Cryptographic cngprovider DLL Canon IJ Driver Insta IJ Language Monitor FAT File System Conve Corrupted File Recove COM+ Windows Media Color C Microsoft Color Contr Microsoft Component C User Experience Contr Common Dialogs DLL Common Dialogs librar OLE 2.1 16/32 Interop Common Property Sheet COM+ COM+ Resources COM+ Explorer MMC Sna COM+ Services

comuid.dll connect.dll console.dll Applet corpol.dll Execution Engine correngine.dll cpfilters.dll Decrypter Tagger Filters. credssp.dll Security Package credui.dll er Interface crppresentation.dll ctor : Presentation crtdll.dll ibrary crypt32.dll cryptbase.dll I DLL cryptdlg.dll ificate Dialogs cryptdll.dll cryptext.dll ns cryptnet.dll d API cryptsp.dll Provider API cryptsvc.dll s cryptui.dll ovider cryptxml.dll cscapi.dll PI cscdll.dll ry Shim cscmig.dll es Migration Plugin cscobj.dll ed by clients of CSC API cscsvc.dll cscui.dll I csrsrv.dll Process ctl3d32.dll rols ctl3dv2.dll OW) Controls d2d1.dll d3d10.dll d3d10_1.dll d3d10_1core.dll d3d10core.dll d3d10level9.dll 3D9 Translation Runtime d3d10warp.dll r

2001.12.8530.16385 6.1.7600.16385 6.1.7600.16385 8.0.7600.16385 6.1.7600.16385 6.6.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 4.0.1183.1 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 2.31.0.0 2.99.0.0 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514

COM+ Explorer UI Get Connected Wizards Control Panel Console Microsoft COM Runtime Correlation Engine PTFilter & Encypter/ Credential Delegation Credential Manager Us Conference Room Proje Microsoft C Runtime L Crypto API32 Base cryptographic AP Microsoft Common Cert Cryptography Manager Crypto Shell Extensio Crypto Network Relate Cryptographic Service Cryptographic Service Microsoft Trust UI Pr XML DigSig API Offline Files Win32 A Offline Files Tempora Microsoft Offline Fil In-proc COM object us CSC Service DLL Client Side Caching U Client Server Runtime Ctl3D 3D Windows Cont Ctl3D 3D Windows NT(W Microsoft D2D Library Direct3D 10 Runtime Direct3D 10.1 Runtime Direct3D 10.1 Runtime Direct3D 10 Runtime Direct3D 10 to Direct Direct3D 10 Rasterize

d3d11.dll d3d8.dll d3d8thk.dll Thunk Layer d3d9.dll d3dcompiler_33.dll d3dcompiler_34.dll d3dcompiler_35.dll d3dcompiler_36.dll d3dcompiler_37.dll d3dcompiler_38.dll d3dcompiler_39.dll d3dcompiler_40.dll r d3dcompiler_41.dll r d3dcompiler_42.dll r d3dcompiler_43.dll r d3dcsx_42.dll ons d3dcsx_43.dll ons d3dim.dll d3dim700.dll d3dramp.dll d3dx10.dll d3dx10_33.dll d3dx10_34.dll d3dx10_35.dll d3dx10_36.dll d3dx10_37.dll d3dx10_38.dll d3dx10_39.dll d3dx10_40.dll ons d3dx10_41.dll ons d3dx10_42.dll ons d3dx10_43.dll ons d3dx11_42.dll ons d3dx11_43.dll ons d3dx9_24.dll Windows d3dx9_25.dll Windows d3dx9_26.dll Windows d3dx9_27.dll Windows d3dx9_28.dll Windows d3dx9_29.dll Windows d3dx9_30.dll

6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 9.18.904.15 9.19.949.46 9.19.949.1104 9.19.949.2111 9.22.949.2248 9.23.949.2378 9.24.949.2307 9.24.950.2656 9.26.952.2844 9.27.952.3022 9.29.952.3111 9.27.952.3022 9.29.952.3111 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 9.16.843.0 9.18.904.21 9.19.949.46 9.19.949.1104 9.19.949.2009 9.19.949.2187 9.23.949.2378 9.24.949.2307 9.24.950.2656 9.26.952.2844 9.27.952.3001 9.29.952.3111 9.27.952.3022 9.29.952.3111 9.5.132.0 9.6.168.0 9.7.239.0 9.8.299.0 9.10.455.0 9.11.519.0 9.12.589.0

Direct3D 11 Runtime Microsoft Direct3D Microsoft Direct3D OS Direct3D 9 Runtime Microsoft Direct3D Microsoft Direct3D Microsoft Direct3D Microsoft Direct3D Microsoft Direct3D Microsoft Direct3D Microsoft Direct3D Direct3D HLSL Compile Direct3D HLSL Compile Direct3D HLSL Compile Direct3D HLSL Compile Direct3D 10.1 Extensi Direct3D 10.1 Extensi Microsoft Direct3D Microsoft Direct3D Microsoft Direct3D Microsoft Direct3D Microsoft Direct3D Microsoft Direct3D Microsoft Direct3D Microsoft Direct3D Microsoft Direct3D Microsoft Direct3D Microsoft Direct3D Direct3D 10.1 Extensi Direct3D 10.1 Extensi Direct3D 10.1 Extensi Direct3D 10.1 Extensi Direct3D 10.1 Extensi Direct3D 10.1 Extensi Microsoft DirectX for Microsoft DirectX for Microsoft DirectX for Microsoft DirectX for Microsoft DirectX for Microsoft DirectX for Microsoft DirectX for

Windows d3dx9_31.dll Windows d3dx9_32.dll Windows d3dx9_33.dll Windows d3dx9_34.dll Windows d3dx9_35.dll Windows d3dx9_36.dll Windows d3dx9_37.dll Windows d3dx9_38.dll Windows d3dx9_39.dll Windows d3dx9_40.dll d3dx9_41.dll d3dx9_42.dll d3dx9_43.dll d3dxof.dll dataclen.dll r Windows davclnt.dll davhlpr.dll dbgeng.dll gger Engine dbghelp.dll dbnetlib.dll DLL for SQL Clients dbnmpntw.dll or SQL Clients dciman32.dll ddaclsys.dll seting Data Drive ACL ddeml.dll y ddoiproxy.dll ddores.dll mation and resources ddraw.dll ddrawex.dll defaultlocationcpl.dll rol Panel defragproxy.dll enter Proxy Library defragsvc.dll menter deployjava1.dll binary deskadp.dll ter properties deskmon.dll tor properties deskperf.dll ormance properties devenum.dll

9.15.779.0 9.16.843.0 9.18.904.15 9.19.949.46 9.19.949.1104 9.19.949.2111 9.22.949.2248 9.23.949.2378 9.24.949.2307 9.24.950.2656 9.26.952.2844 9.27.952.3001 9.29.952.3111 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 3.50.0.103 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 10.25.2.17 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.6.7600.16385

Microsoft DirectX for Microsoft DirectX for Microsoft DirectX for Microsoft DirectX for Microsoft DirectX for Microsoft DirectX for Microsoft DirectX for Microsoft DirectX for Microsoft DirectX for Direct3D 9 Extensions Direct3D 9 Extensions Direct3D 9 Extensions Direct3D 9 Extensions DirectX Files DLL Disk Space Cleaner fo Web DAV Client DLL DAV Helper DLL Windows Symbolic Debu Windows Image Helper Winsock Oriented Net Named Pipes Net DLL f DCI Manager SysPrep module for Re DDE Management librar DDOI Interface Proxy Device Category infor Microsoft DirectDraw Direct Draw Ex Default Location Cont Microsoft Disk Defragm Microsoft\Disk Defrag Java(TM) Platform SE Advanced display adap Advanced display moni Advanced display perf Device enumeration.

devicecenter.dll 6.1.7601.17514 devicedisplaystatusmanager.dll 6.1.7600.16385 tatus Manager devicemetadataparsers.dll 6.1.7600.16385 a parsers devicepairing.dll 6.1.7600.16385 Device Pairing devicepairingfolder.dll 6.1.7601.17514 devicepairinghandler.dll 6.1.7600.16385 r Dll devicepairingproxy.dll 6.1.7600.16385 Dll deviceuxres.dll 6.1.7600.16385 xperience Resource File devmgr.dll 6.1.7600.16385 apin devobj.dll 6.1.7600.16385 t DLL devrtl.dll 6.1.7600.16385 Time Library dfdts.dll 6.1.7600.16385 Diagnostic Module dfscli.dll 6.1.7600.16385 d File System Client DLL dfshim.dll 4.0.40305.0 Deployment Support Library dfsshlex.dll 6.1.7600.16385 em shell extension dhcpcmonitor.dll 6.1.7600.16385 ll dhcpcore.dll 6.1.7601.17514 dhcpcore6.dll 6.1.7600.16385 dhcpcsvc.dll 6.1.7600.16385 dhcpcsvc6.dll 6.1.7600.16385 dhcpqec.dll 6.1.7600.16385 forcement Client dhcpsapi.dll 6.1.7600.16385 DLL diagcpl.dll 6.1.7601.17514 ol Panel diagperf.dll 6.1.7601.17514 Diagnostics difx32.dll 2.1.0.0 orks for API library module difxapi.dll 2.1.0.0 orks for API library module dimsjob.dll 6.1.7600.16385 dimsroam.dll 6.1.7600.16385 ider DLL dinput.dll 6.1.7600.16385 dinput8.dll 6.1.7600.16385 directdb.dll 6.1.7600.16385 base API diskcopy.dll 6.1.7600.16385 dispci.dll 6.1.7600.16385 ss Installer dispex.dll 5.8.7600.16385 display.dll 6.1.7601.17514 dmband.dll 6.1.7600.16385 Band

Device Center Device Display S Common Device Metadat Shell extensions for Device Pairing Folder Device Pairing Handle Device Pairing Proxy Windows Device User E Device Manager MMC Sn Device Information Se Device Management Run Windows Disk Failure Windows NT Distribute ClickOnce Application Distributed File Syst DHCP Client Monitor D DHCP Client Service DHCPv6 Client DHCP Client Service DHCPv6 Client Microsoft DHCP NAP En DHCP Server API Stub Troubleshooting Contr Microsoft Performance Driver Install Framew Driver Install Framew DIMS Job DLL Key Roaming DIMS Prov Microsoft DirectInput Microsoft DirectInput Microsoft Direct Data Windows DiskCopy Microsoft Display Cla Microsoft DispEx Display Control Panel Microsoft DirectMusic

dmcompos.dll 6.1.7600.16385 Composer dmdlgs.dll 6.1.7600.16385 in Dialogs dmdskmgr.dll 6.1.7600.16385 in Support Library dmdskres.dll 6.1.7600.16385 in Resources dmdskres2.dll 6.1.7600.16385 in Resources dmime.dll 6.1.7600.16385 Interactive Engine dmintf.dll 6.1.7600.16385 Interface Stub dmloader.dll 6.1.7600.16385 Loader dmocx.dll 6.1.7600.16385 dmrc.dll 6.1.7600.16385 dmscript.dll 6.1.7600.16385 Scripting dmstyle.dll 6.1.7600.16385 Style Engline dmsynth.dll 6.1.7600.16385 Software Synthesizer dmusic.dll 6.1.7600.16385 Core Services dmutil.dll 6.1.7600.16385 Utility Library dmvdsitf.dll 6.1.7600.16385 in Support Library dmvscres.dll 6.1.7601.17514 ic Memory Resource DLL dnsapi.dll 6.1.7601.17514 dnscmmc.dll 6.1.7601.17514 n DLL dnsext.dll 6.1.7600.16385 dnshc.dll 6.1.7600.16385 dnsrslvr.dll 6.1.7601.17514 Service docprop.dll 6.1.7600.16385 Page documentperformanceevents.dll 6.1.7600.16385 nting Performance Events dot3api.dll 6.1.7601.17514 on API dot3cfg.dll 6.1.7601.17514 dot3dlg.dll 6.1.7600.16385 dot3gpclnt.dll 6.1.7600.16385 ient dot3gpui.dll 6.1.7600.16385 Management Snap-in dot3hc.dll 6.1.7600.16385 dot3msm.dll 6.1.7601.17514 Module dot3svc.dll 6.1.7601.17514 ice dot3ui.dll 6.1.7601.17514 dpapiprovider.dll 6.1.7600.16385 dplayx.dll 6.1.7600.16385 dpmodemx.dll 6.1.7600.16385

Microsoft DirectMusic Disk Management SnapDisk Management SnapDisk Management SnapDisk Management SnapMicrosoft DirectMusic Disk Management DCOM Microsoft DirectMusic TreeView OCX Windows MRC Microsoft DirectMusic Microsoft DirectMusic Microsoft DirectMusic Microsoft DirectMusic Logical Disk Manager Disk Management SnapVirtual Machine Dynam DNS Client API DLL DNS Client MMC Snap-i DNS extension DLL DNS Helper Class DNS Caching Resolver OLE DocFile Property Documents and Pri 802.3 Autoconfigurati 802.3 Netsh Helper 802.3 UI Helper 802.3 Group Policy Cl 802.3 Network Policy Dot3 Helper Class 802.3 Media Specific Wired AutoConfig Serv 802.3 Advanced UI dpapiprovider DLL Microsoft DirectPlay Modem and Serial Conn

ection For DirectPlay dpnaddr.dll 6.1.7601.17514 Address dpnathlp.dll 6.1.7600.16385 NAT Helper UPnP dpnet.dll 6.1.7600.16385 dpnhpast.dll 6.1.7600.16385 NAT Helper PAST dpnhupnp.dll 6.1.7600.16385 NAT Helper UPNP dpnlobby.dll 6.1.7600.16385 Lobby dps.dll 6.1.7601.17514 Service dpwsockx.dll 6.1.7600.16385 PX Connection For DirectPlay dpx.dll 6.1.7601.17514 ckage Expander drmmgrtn.dll 11.0.7601.17514 drmv2clt.dll 11.0.7600.16385 drprov.dll 6.1.7600.16385 top Session Host Server Network Provider drt.dll 6.1.7600.16385 able drtprov.dll 6.1.7600.16385 able Providers drttransport.dll 6.1.7600.16385 able Transport Provider drvstore.dll 6.1.7601.17514 ds16gt.dll 3.510.3711.0 Setup Generic Thunk ds32gt.dll 6.1.7600.16385 eric Thunk dsauth.dll 6.1.7601.17514 Services dsdmo.dll 6.1.7600.16385 dshowrdpfilter.dll 1.0.0.0 redirector) dskquota.dll 6.1.7600.16385 ota Support DLL dskquoui.dll 6.1.7601.17514 ota UI DLL dsound.dll 6.1.7600.16385 dsprop.dll 6.1.7600.16385 ory Property Pages dsquery.dll 6.1.7600.16385 d dsrole.dll 6.1.7600.16385 dssec.dll 6.1.7600.16385 urity UI dssenh.dll 6.1.7600.16385 S and Diffie-Hellman Cryptographic Provider dsuiext.dll 6.1.7601.17514 mon UI dswave.dll 6.1.7600.16385 Wave dtsh.dll 6.1.7600.16385 Status API dui70.dll 6.1.7600.16385 ne

Microsoft DirectPlay8 Microsoft DirectPlay Microsoft DirectPlay Microsoft DirectPlay Microsoft DirectPlay Microsoft DirectPlay8 WDI Diagnostic Policy Internet TCP/IP and I Microsoft(R) Delta Pa DRM Migration DLL DRMv2 Client DLL Microsoft Remote Desk Distributed Routing T Distributed Routing T Distributed Routing T Driver Store API Microsoft ODBC Driver ODBC Driver Setup Gen DS Authorization for DirectSound Effects RDP Renderer Filter ( Windows Shell Disk Qu Windows Shell Disk Qu DirectSound Windows Active Direct Directory Service Fin DS Role Client DLL Directory Service Sec Microsoft Enhanced DS Directory Service Com Microsoft DirectMusic Detection and Sharing Windows DirectUI Engi

duser.dll gine

6.1.7600.16385

Windows DirectUser En Microsoft Desktop Win Microsoft DWM Core Li Microsoft Desktop Win Microsoft DirectX Typ Microsoft DirectX Dia DirectX Graphics Infr Microsoft Windows Med Device Stage Shell Ex Device Experience Pla Microsoft Ringtone Ed Microsoft Windows DXP DirectX Media -- Imag DirectX Media -- Dire DirectX Video Acceler Microsoft ThirdPartyE Eap Peer Config EAP Generic UI Microsoft EAPHost Pee Microsoft EAPHost Pee Microsoft EAP NAP Enf Microsoft EAPHost ser File Encryption Utili EFS Core Library LSA extension for EFS EFS Service EFS Utility Library Windows Enhanced Stor Windows Enhanced Stor Windows Enhanced Stor Event Viewer Snapin Els Core Platform DLL ELS Language Detectio ELS Transliteration S

dwmapi.dll 6.1.7600.16385 dow Manager API dwmcore.dll 6.1.7601.17514 brary dwmredir.dll 6.1.7601.17514 dow Manager Redirection Component dwrite.dll 6.1.7601.17514 ography Services dxdiagn.dll 6.1.7601.17514 gnostic Tool dxgi.dll 6.1.7601.17514 astructure dxmasf.dll 12.0.7601.17514 ia Component Removal File. dxp.dll 6.1.7601.17514 tension dxpps.dll 6.1.7600.16385 tform Proxy\Stub DLL dxptaskringtone.dll 6.1.7601.17514 itor dxptasksync.dll 6.1.7601.17514 Sync. dxtmsft.dll 8.0.7600.16385 e DirectX Transforms dxtrans.dll 8.0.7600.16385 ctX Transform Core dxva2.dll 6.1.7600.16385 ation 2.0 DLL eapp3hst.dll 6.1.7601.17514 apDispatcher eappcfg.dll 6.1.7600.16385 eappgnui.dll 6.1.7601.17514 eapphost.dll 6.1.7601.17514 r service eappprxy.dll 6.1.7600.16385 r Client DLL eapqec.dll 6.1.7600.16385 orcement Client eapsvc.dll 6.1.7600.16385 vice efsadu.dll 6.1.7600.16385 ty efscore.dll 6.1.7601.17514 efslsaext.dll 6.1.7600.16385 efssvc.dll 6.1.7600.16385 efsutil.dll 6.1.7600.16385 ehstorapi.dll 6.1.7601.17514 age API ehstorpwdmgr.dll 6.1.7600.16385 age Password Manager ehstorshell.dll 6.1.7600.16385 age Shell Extension DLL els.dll 6.1.7600.16385 elscore.dll 6.1.7600.16385 elslad.dll 6.1.7600.16385 n elstrans.dll 6.1.7601.17514 ervice

encapi.dll 6.1.7600.16385 Encoder API encdec.dll 6.6.7601.17514 XDSCodec & Encypter/ Decrypter Tagger Filters. encdump.dll 5.0.1.1 Media Foundation Cras h Dump Encryption DLL energy.dll 6.1.7600.16385 Power Efficiency Diag nostics eqossnap.dll 6.1.7600.16385 EQoS Snapin extension es.dll 2001.12.8530.16385 COM+ esent.dll 6.1.7601.17514 Extensible Storage En gine for Microsoft(R) Windows(R) esentprf.dll 6.1.7600.16385 Extensible Storage En gine Performance Monitoring Library for Microsoft(R) Windows(R) eventcls.dll 6.1.7600.16385 Microsoft Volume Shado w Copy Service event class evr.dll 6.1.7601.17514 Enhanced Video Render er DLL explorerframe.dll 6.1.7601.17514 ExplorerFrame expsrv.dll 6.0.72.9589 Visual Basic for Appl ications Runtime - Expression Service f3ahvoas.dll 6.1.7600.16385 JP Japanese Keyboard Layout for Fujitsu FMV oyayubi-shift keyboard faultrep.dll 6.1.7601.17514 Windows User Mode Cra sh Reporting DLL fdbth.dll 6.1.7600.16385 Function Discovery Bl uetooth Provider Dll fdbthproxy.dll 6.1.7600.16385 Bluetooth Provider Pr oxy Dll fde.dll 6.1.7601.17514 Folder Redirection Sn apin Extension fdeploy.dll 6.1.7601.17514 Folder Redirection Gr oup Policy Extension fdphost.dll 6.1.7600.16385 Function Discovery Pr ovider host service fdpnp.dll 6.1.7600.16385 Pnp Provider Dll fdprint.dll 6.1.7600.16385 Function Discovery Pr int Provider Dll fdproxy.dll 6.1.7600.16385 Function Discovery Pr oxy Dll fdrespub.dll 6.1.7600.16385 Function Discovery Re source Publication Service fdssdp.dll 6.1.7600.16385 Function Discovery SS DP Provider Dll fdwcn.dll 6.1.7600.16385 Windows Connect Now Config Function Discovery Provider DLL fdwnet.dll 6.1.7600.16385 Function Discovery WN et Provider Dll fdwsd.dll 6.1.7600.16385 Function Discovery WS Discovery Provider Dll feclient.dll 6.1.7600.16385 Windows NT File Encry ption Client Interfaces ff_vfw.dll filemgmt.dll 6.1.7600.16385 Services and Shared F olders findnetprinters.dll 6.1.7600.16385 Find Network Printers COM Component firewallapi.dll 6.1.7600.16385 Windows Firewall API firewallcontrolpanel.dll 6.1.7601.17514 Windows Firewall Cont rol Panel fltlib.dll 6.1.7600.16385 Filter Library

fm20.dll 14.0.4730.1010 fm20enu.dll 14.0.4730.1010 ational DLL fmifs.dll 6.1.7600.16385 fms.dll 1.1.6000.16384 ces fntcache.dll 6.1.7601.17514 rvice fontext.dll 6.1.7601.17514 fontsub.dll 6.1.7601.17514 fphc.dll 6.1.7601.17514 lper Class framebuf.dll 6.1.7600.16385 river framedyn.dll 6.1.7601.17514 ework framedynos.dll 6.1.7601.17514 ework fthsvc.dll 6.1.7600.16385 lt Tolerant Heap Diagnostic Module fundisc.dll 6.1.7600.16385 l fveapi.dll 6.1.7601.17514 ve Encryption API fveapibase.dll 6.1.7600.16385 ve Encryption Base API fvecerts.dll 6.1.7600.16385 s Library fvecpl.dll 6.1.7601.17514 ption control panel fverecover.dll 6.1.7600.16385 ve Encryption User Interface fveui.dll 6.1.7600.16385 ption UI fvewiz.dll 6.1.7600.16385 ption Wizard fwcfg.dll 6.1.7600.16385 iguration Helper fwpuclnt.dll 6.1.7601.17514 PI fwremotesvr.dll 6.1.7600.16385 te APIs Server fxsapi.dll 6.1.7600.16385 pport DLL fxscom.dll 6.1.7600.16385 COM Client Interface fxscomex.dll 6.1.7600.16385 Extended COM Client Interface fxscompose.dll 6.1.7600.16385 fxscomposeres.dll 6.1.7600.16385 fxsevent.dll 6.1.7600.16385 og Support DLL fxsext32.dll 6.1.7600.16385 ge Command Extension fxsmon.dll 6.1.7601.17514 Monitor fxsresm.dll 6.1.7600.16385 ce DLL fxsroute.dll 6.1.7600.16385 g DLL

Microsoft Forms DLL Microsoft Forms Intern FM IFS Utility DLL Font Management Servi Windows Font Cache Se Windows Font Folder Font Subsetting DLL Filtering Platform He Framebuffer Display D WMI SDK Provider Fram WMI SDK Provider Fram Microsoft Windows Fau Function Discovery Dl Windows BitLocker Dri Windows BitLocker Dri BitLocker Certificate BitLocker Drive Encry Windows BitLocker Dri BitLocker Drive Encry BitLocker Drive Encry Windows Firewall Conf FWP/IPsec User-Mode A Windows Firewall Remo Microsoft Fax API Su Microsoft Fax Server Microsoft Fax Server Compose Form Fax Compose Microsoft Fax EventL Microsoft Fax Exchan Microsoft Fax Print Microsoft Fax Resour Microsoft Fax Routin

fxsst.dll 6.1.7600.16385 fxst30.dll 6.1.7600.16385 otocol Service Provider fxstiff.dll 6.1.7601.17514 ibrary fxsutility.dll 6.1.7600.16385 fxsxp32.dll 6.1.7600.16385 ort Provider gacinstall.dll 6.1.7600.16385 d other managed code gameux.dll 6.1.7601.17514 gameuxlegacygdfs.dll 1.0.0.1 LL gcdef.dll 6.1.7600.16385 ult Sheets gdi32.dll 6.1.7601.17514 getuname.dll 6.1.7600.16385 UCE glmf32.dll 6.1.7600.16385 glu32.dll 6.1.7600.16385 y DLL gpapi.dll 6.1.7600.16385 PI gpedit.dll 6.1.7600.16385 gpprefcl.dll 6.1.7601.17514 ce Client gpprnext.dll 6.1.7600.16385 Extension gpscript.dll 6.1.7600.16385 tension gpsvc.dll 6.1.7601.17514 gptext.dll 6.1.7600.16385 groupinghc.dll 6.1.7600.16385 hal.dll 6.1.7601.17514 Layer DLL halacpi.dll 6.1.7601.17514 Layer DLL halmacpi.dll 6.1.7601.17514 Layer DLL hbaapi.dll 6.1.7601.17514 e dll for HBA_API_Rev_2-18_2002MAR1.doc hccutils.dll 3.0.0.4704 hcproviders.dll 6.1.7600.16385 rs helppaneproxy.dll 6.1.7600.16385 hgcpl.dll 6.1.7601.17514 el hgprint.dll 6.1.7601.17514 pport hhsetup.dll 6.1.7600.16385 hid.dll 6.1.7600.16385 hidserv.dll 6.1.7600.16385 hlink.dll 6.1.7600.16385 component hnetcfg.dll 6.1.7600.16385 guration Manager hnetmon.dll 6.1.7600.16385 or DLL hotplug.dll 6.1.7600.16385 e applet

Fax Service Microsoft Fax T30 Pr Microsoft Fax TIFF l Fax Utility DLL Microsoft Fax Transp Installers for CLR an Games Explorer Legacy GDF resource D Game Controllers Defa GDI Client DLL Unicode name Dll for OpenGL Metafiling DLL OpenGL Utility Librar Group Policy Client A GPEdit Group Policy Preferen Group Policy Printer Script Client Side Ex Group Policy Client GPTExt Grouping Helper Class Hardware Abstraction Hardware Abstraction Hardware Abstraction HBA API data interfac hccutils Module Action Center Provide Microsoft Help Proxy HomeGroup Control Pan HomeGroup Printing Su Microsoft HTML Help Hid User Library HID Service Microsoft Office 2000 Home Networking Confi Home Networking Monit Safely Remove Hardwar

hotstartuseragent.dll 6.1.7601.17514 Start User Agent httpapi.dll 6.1.7601.17514 PI htui.dll 6.1.7600.16385 Adjustment Dialogs ias.dll 6.1.7600.16385 iasacct.dll 6.1.7601.17514 er iasads.dll 6.1.7600.16385 Data Store iasdatastore.dll 6.1.7600.16385 iashlpr.dll 6.1.7600.16385 nt iasmigplugin.dll 6.1.7600.16385 iasnap.dll 6.1.7600.16385 iaspolcy.dll 6.1.7600.16385 iasrad.dll 6.1.7601.17514 omponent iasrecst.dll 6.1.7601.17514 ess iassam.dll 6.1.7600.16385 iassdo.dll 6.1.7600.16385 iassvcs.dll 6.1.7600.16385 t icaapi.dll 6.1.7601.17514 DD Device Driver icardie.dll 8.0.7600.16385 Card IE Helper icardres.dll 3.0.4506.4926 iccoinstall.dll 6.1.7601.17514 omponents Coinstaller iccvid.dll 1.10.0.13 icfupgd.dll 6.1.7600.16385 ettings Upgrade icm32.dll 6.1.7600.16385 ement Module (CMM) icmp.dll 6.1.7600.16385 icmui.dll 6.1.7600.16385 ing System User Interface DLL iconcodecservice.dll 6.1.7600.16385 f the icon to a legacy bmp icon icsigd.dll 6.1.7600.16385 ce properties idlisten.dll 6.1.7600.16385 idndl.dll 6.1.7600.16385 idstore.dll 6.1.7600.16385 ieakeng.dll 8.0.7600.16385 inistration Kit Engine Library ieaksie.dll 8.0.7600.16385 p-in Extension to Group Policy ieakui.dll 8.0.7600.16385 UI DLL ieapfltr.dll 8.0.6001.18669 Filter iedkcs32.dll 18.0.7601.17514 ieframe.dll 8.0.7601.17514 iepeers.dll 8.0.7601.17514 r Objects iernonce.dll 8.0.7600.16385

Microsoft Windows Hot HTTP Protocol Stack A Common halftone Color Network Policy Server NPS Accounting Provid NPS Active Directory NPS Datastore server NPS Surrogate Compone NPS NPS NPS NPS Migration DLL NAP Provider Pipeline RADIUS Protocol C

NPS XML Datastore Acc NPS NT SAM Provider NPS SDO Component NPS Services Componen DLL Interface to Term Microsoft Information Windows CardSpace Hyper-V Integration C Cinepak Codec Windows Firewal ICF S Microsoft Color Manag ICMP DLL Microsoft Color Match Converts a PNG part o Internet Gateway Devi Identity Listener Downlevel DLL Identity Store Internet Explorer Adm Internet Explorer Sna Microsoft IEAK Shared Microsoft SmartScreen IEAK branding Internet Browser Internet Explorer Pee Extended RunOnce proc

essing with UI iertutil.dll 8.0.7601.17514 Internet Explorer iesetup.dll 8.0.7600.16385 iesysprep.dll 8.0.7601.17514 ieui.dll 8.0.7600.16385 Engine ifmon.dll 6.1.7600.16385 ifsutil.dll 6.1.7601.17514 ifsutilx.dll 6.1.7600.16385 DLL igddiag.dll 6.1.7600.16385 igfxcoin_v4704.dll igfxdev.dll 3.0.0.4704 igfxdo.dll 3.0.0.4704 igfxexps.dll 3.0.0.4704 igfxpph.dll 3.0.0.4704 igfxres.dll 3.0.0.4704 igfxress.dll 3.0.0.4704 igfxsrvc.dll 3.0.0.4704 igldev32.dll 6.14.10.4704 er for Intel(R) Graphics Accelerator iglicd32.dll 6.14.10.4704 Intel(R) Graphics Accelerator igxpdv32.dll 6.14.10.4704 igxpdx32.dll 6.14.10.4704 for Intel(R) Graphics Technology igxpgd32.dll 6.14.10.4704 ver igxprd32.dll 6.14.10.4704 ation Driver ikeext.dll 6.1.7601.17514 imagehlp.dll 6.1.7601.17514 er imageres.dll 6.1.7600.16385 e imagesp1.dll 6.1.7600.16385 ource imagx7.dll 7.0.74.0 ibrary imagxpr7.dll 7.0.74.0 imagxr7.dll 7.0.495.0 Library imagxra7.dll 7.0.495.0 Library imapi.dll 6.1.7600.16385 imapi2.dll 6.1.7601.17514 2 imapi2fs.dll 6.1.7601.17514 System Imaging API v2 imgutil.dll 8.0.7601.17514 er support DLL imjp10k.dll 10.1.7600.16385 imm32.dll 6.1.7601.17514 M32 API Client DLL inetcomm.dll 6.1.7601.17514 ssaging API Resources inetmib1.dll 6.1.7601.17514 gent inetpp.dll 6.1.7601.17514

Run time utility for IOD Version Map IE Sysprep Provider Internet Explorer UI IF Monitor DLL IFS Utility DLL IFS Utility Extension IGD Helper Class igfxdev Module igfxdo Module igfxext Module igfxpph Module igfxres Module igfxress Module igfxsrvc Module OpenGL(R) Device Driv OpenGL(R) Driver for Component GHAL Driver DirectDraw(R) Driver Intel Graphics 2D Dri Intel Graphics 2D Rot IKE extension Windows NT Image Help Windows Image Resourc Windows SP1 Image Res ImagX7 Dynamic Link L ImagXpr7 Module ImagXR7 Dynamic Link ImagXRA7 Dynamic Link Image Mastering API Image Mastering API v Image Mastering File IE plugin image decod Microsoft IME Multi-User Windows IM Microsoft Internet Me Microsoft MIB-II suba Internet Print Provid

er DLL inetppui.dll 6.1.7600.16385 DLL inetres.dll 6.1.7600.16385 ssaging API Resources infocardapi.dll 3.0.4506.4926 inked.dll 6.1.7600.16385 nkEdit Control input.dll 6.1.7601.17514 inseng.dll 8.0.7601.17514 iologmsg.dll 6.1.7600.16385 ipbusenum.dll 6.1.7600.16385 or DLL ipbusenumproxy.dll 6.1.7600.16385 sence Proxy Dll iphlpapi.dll 6.1.7601.17514 iphlpsvc.dll 6.1.7601.17514 Pv6 connectivity over an IPv4 network. ipnathlp.dll 6.1.7600.16385 Components iprop.dll 6.1.7600.16385 mentation iprtprio.dll 6.1.7600.16385 riority DLL iprtrmgr.dll 6.1.7601.17514 ipsecsnp.dll 6.1.7600.16385 nagement Snap-in ipsecsvc.dll 6.1.7601.17514 ver DLL ipsmsnap.dll 6.1.7601.17514 nap-in ir32_32.dll 3.24.15.3 R3.2 32-bit Driver ir41_qc.dll 4.30.62.2 ractive Quick Compressor ir41_qcx.dll 4.30.62.2 ractive Quick Compressor ir50_32.dll 5.2562.15.55 ir50_qc.dll 5.0.63.48 Quick Compressor ir50_qcx.dll 5.0.63.48 Quick Compressor irclass.dll 6.1.7600.16385 aller irmon.dll 6.1.7600.16385 iscsicpl.dll 5.2.3790.1830 ol Panel Applet iscsidsc.dll 6.1.7600.16385 iscsied.dll 6.1.7600.16385 iscsiexe.dll 6.1.7600.16385 ce iscsilog.dll 6.1.7600.16385 iscsium.dll 6.1.7601.17514 iscsiwmi.dll 6.1.7600.16385 I Provider itircl.dll 6.1.7601.17514 Local DLL itss.dll 6.1.7600.16385 rage System Library itvdata.dll 6.6.7601.17514

Internet Print Client Microsoft Internet Me Microsoft InfoCards Microsoft Tablet PC I InputSetting DLL Install engine IO Logging DLL PnP-X IP Bus Enumerat Associated Device Pre IP Helper API Service that offers I Microsoft NAT Helper OLE PropertySet Imple IP Routing Protocol P IP Router Manager IP Security Policy Ma Windows IPsec SPD Ser IP Security Monitor S Intel Indeo(R) Video Intel Indeo Video Inte Intel Indeo Video Inte Intel Indeo video 5.10 Intel Indeo video 5.10 Intel Indeo video 5.10 Infrared Class Coinst Infrared Monitor iSCSI Initiator Contr iSCSI Discovery api iSCSI Extension DLL iSCSI Discovery servi iSCSI Event Log DLL iSCSI Discovery api MS iSCSI Initiator WM Microsoft InfoTech IR Microsoft InfoTech Sto iTV Data Filters.

iyuv_32.dll YUV Codec jnwmon.dll Monitor DLL jscript.dll jsproxy.dll nfiguration kbd101.dll Layout for 101 kbd101a.dll ayout for 101 (Type A) kbd101b.dll ayout for 101(Type B) kbd101c.dll ayout for 101(Type C) kbd103.dll ayout for 103 kbd106.dll Layout for 106 kbd106n.dll Layout for 106 kbda1.dll yboard Layout kbda2.dll out kbda3.dll board Layout kbdal.dll ut kbdarme.dll oard Layout kbdarmw.dll oard Layout kbdax2.dll Layout for AX2 kbdaze.dll eyboard Layout kbdazel.dll Layout kbdbash.dll ut kbdbe.dll ut kbdbene.dll d Layout kbdbgph.dll yboard Layout kbdbgph1.dll raditional) Keyboard Layout kbdbhc.dll yboard Layout kbdblr.dll ayout kbdbr.dll yout kbdbu.dll ) Keyboard Layout kbdbulg.dll yout kbdca.dll

6.1.7601.17514 0.3.7600.16385 5.8.7601.17514 8.0.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385

Intel Indeo(R) Video Windows Journal Port Microsoft JScript JScript Proxy Auto-Co JP Japanese Keyboard KO Hangeul Keyboard L KO Hangeul Keyboard L KO Hangeul Keyboard L KO Hangeul Keyboard L JP Japanese Keyboard JP Japanese Keyboard Arabic_English_101 Ke Arabic_2 Keyboard Lay Arabic_French_102 Key Albania Keyboard Layo Eastern Armenian Keyb Western Armenian Keyb JP Japanese Keyboard Azerbaijan_Cyrillic K Azeri-Latin Keyboard Bashkir Keyboard Layo Belgian Keyboard Layo Belgian Dutch Keyboar Bulgarian Phonetic Ke Bulgarian (Phonetic T Bosnian (Cyrillic) Ke Belarusian Keyboard L Brazilian Keyboard La Bulgarian (Typewriter Bulgarian Keyboard La Canadian Multilingual

Keyboard Layout kbdcan.dll Standard Keyboard Layout kbdcr.dll yboard Layout kbdcz.dll kbdcz1.dll yout kbdcz2.dll yboard Layout kbdda.dll t kbddiv1.dll ard Layout kbddiv2.dll board Layout kbddv.dll board Layout kbdes.dll oard Layout kbdest.dll ut kbdfa.dll ut kbdfc.dll ard Layout kbdfi.dll ut kbdfi1.dll Sami Keyboard Layout kbdfo.dll kbdfr.dll t kbdgae.dll t kbdgeo.dll out kbdgeoer.dll Keyboard Layout kbdgeoqw.dll board Layout kbdgkl.dll Layout kbdgr.dll t kbdgr1.dll ayout kbdgrlnd.dll Layout kbdhau.dll kbdhe.dll kbdhe220.dll d Layout kbdhe319.dll d Layout kbdheb.dll t kbdhela2.dll eyboard Layout kbdhela3.dll

6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385

Canadian Multilingual Croatian/Slovenian Ke Czech Keyboard Layout Czech_101 Keyboard La Czech_Programmer's Ke Danish Keyboard Layou Divehi Phonetic Keybo Divehi Typewriter Key Dvorak US English Key Spanish Alernate Keyb Estonia Keyboard Layo Persian Keyboard Layo Canadian French Keybo Finnish Keyboard Layo Finnish-Swedish with Froese Keyboard Layout French Keyboard Layou Gaelic Keyboard Layou Georgian Keyboard Lay Georgian (Ergonomic) Georgian (QWERTY) Key Greek_Latin Keyboard German Keyboard Layou German_IBM Keyboard L Greenlandic Keyboard Hausa Keyboard Layout Greek Keyboard Layout Greek IBM 220 Keyboar Greek IBM 319 Keyboar KBDHEB Keyboard Layou Greek IBM 220 Latin K Greek IBM 319 Latin K

eyboard Layout kbdhept.dll ard Layout kbdhu.dll yout kbdhu1.dll board Layout kbdibm02.dll Layout for IBM 5576-002/003 kbdibo.dll kbdic.dll yout kbdinasa.dll eyboard Layout kbdinbe1.dll egacy) Keyboard Layout kbdinbe2.dll yboard Layout kbdinben.dll ut kbdindev.dll ayout kbdinguj.dll out kbdinhin.dll kbdinkan.dll ut kbdinmal.dll yout Keyboard Layout kbdinmar.dll ut kbdinori.dll kbdinpun.dll oard Layout kbdintam.dll kbdintel.dll t kbdinuk2.dll eyboard Layout kbdir.dll kbdit.dll ut kbdit142.dll Layout kbdiulat.dll ard Layout kbdjpn.dll Layout Stub driver kbdkaz.dll rd Layout kbdkhmr.dll yboard Layout kbdkor.dll ayout Stub driver kbdkyr.dll t kbdla.dll h Keyboard Layout kbdlao.dll Layout

6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385

Greek_Polytonic Keybo Hungarian Keyboard La Hungarian 101-key Key JP Japanese Keyboard Igbo Keyboard Layout Icelandic Keyboard La Assamese (Inscript) K Bengali - Inscript (L Bengali (Inscript) Ke Bengali Keyboard Layo Devanagari Keyboard L Gujarati Keyboard Lay Hindi Keyboard Layout Kannada Keyboard Layo Malayalam Keyboard La Marathi Keyboard Layo Oriya Keyboard Layout Punjabi/Gurmukhi Keyb Tamil Keyboard Layout Telugu Keyboard Layou Inuktitut Naqittaut K Irish Keyboard Layout Italian Keyboard Layo Italian 142 Keyboard Inuktitut Latin Keybo JP Japanese Keyboard Kazak_Cyrillic Keyboa Cambodian Standard Ke KO Hangeul Keyboard L Kyrgyz Keyboard Layou Latin-American Spanis Lao Standard Keyboard

kbdlk41a.dll 6.1.7601.17514 Layout kbdlt.dll 6.1.7600.16385 yout kbdlt1.dll 6.1.7601.17514 ayout kbdlt2.dll 6.1.7600.16385 eyboard Layout kbdlv.dll 6.1.7600.16385 t kbdlv1.dll 6.1.7600.16385 d Layout kbdmac.dll 6.1.7600.16385 yboard Layout kbdmacst.dll 6.1.7600.16385 Standard Keyboard Layout kbdmaori.dll 6.1.7601.17514 kbdmlt47.dll 6.1.7600.16385 rd Layout kbdmlt48.dll 6.1.7600.16385 rd Layout kbdmon.dll 6.1.7601.17514 yout kbdmonmo.dll 6.1.7600.16385 Script) Keyboard Layout kbdne.dll 6.1.7600.16385 kbdnec.dll 6.1.7600.16385 Layout for (NEC PC-9800) kbdnec95.dll 6.1.7600.16385 Layout for (NEC PC-9800 Windows 95) kbdnecat.dll 6.1.7600.16385 Layout for (NEC PC-9800 on PC98-NX) kbdnecnt.dll 6.1.7600.16385 00 Keyboard Layout kbdnepr.dll 6.1.7601.17514 t kbdno.dll 6.1.7600.16385 yout kbdno1.dll 6.1.7600.16385 eyboard Layout kbdnso.dll 6.1.7600.16385 oard Layout kbdpash.dll 6.1.7600.16385 Keyboard Layout kbdpl.dll 6.1.7600.16385 t kbdpl1.dll 6.1.7600.16385 eyboard Layout kbdpo.dll 6.1.7601.17514 ayout kbdro.dll 6.1.7600.16385 board Layout kbdropr.dll 6.1.7600.16385 ) Keyboard Layout kbdrost.dll 6.1.7600.16385 eyboard Layout kbdru.dll 6.1.7600.16385 ut kbdru1.dll 6.1.7600.16385 yboard Layout

DEC LK411-AJ Keyboard Lithuania Keyboard La Lithuanian Keyboard L Lithuanian Standard K Latvia Keyboard Layou Latvia-QWERTY Keyboar Macedonian (FYROM) Ke Macedonian (FYROM) Maori Keyboard Layout Maltese 47-key Keyboa Maltese 48-key Keyboa Mongolian Keyboard La Mongolian (Mongolian Dutch Keyboard Layout JP Japanese Keyboard JP Japanese Keyboard JP Japanese Keyboard JP Japanese NEC PC-98 Nepali Keyboard Layou Norwegian Keyboard La Norwegian with Sami K Sesotho sa Leboa Keyb Pashto (Afghanistan) Polish Keyboard Layou Polish Programmer's K Portuguese Keyboard L Romanian (Legacy) Key Romanian (Programmers Romanian (Standard) K Russian Keyboard Layo Russia(Typewriter) Ke

kbdsf.dll Layout kbdsg.dll Layout kbdsl.dll t kbdsl1.dll rd Layout kbdsmsfi.dll -Sweden Keyboard Layout kbdsmsno.dll Keyboard Layout kbdsn1.dll ut kbdsorex.dll oard Layout kbdsors1.dll oard Layout kbdsorst.dll acy) Keyboard Layout kbdsp.dll ut kbdsw.dll ut kbdsw09.dll ard Layout kbdsyr1.dll ard Layout kbdsyr2.dll oard Layout kbdtajik.dll kbdtat.dll rd Layout kbdth0.dll d Layout kbdth1.dll ard Layout kbdth2.dll iftLock) Keyboard Layout kbdth3.dll ShiftLock) Keyboard Layout kbdtiprc.dll d Layout kbdtuf.dll yout kbdtuq.dll yout kbdturme.dll ut kbdughr.dll ard Layout kbdughr1.dll t kbduk.dll rd Layout kbdukx.dll ed Keyboard Layout kbdur.dll yout kbdur1.dll

6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385

Swiss French Keyboard Swiss German Keyboard Slovak Keyboard Layou Slovak(QWERTY) Keyboa Sami Extended Finland Sami Extended Norway Sinhala Keyboard Layo Sorbian Extended Keyb Sorbian Standard Keyb Sorbian Standard (Leg Spanish Keyboard Layo Swedish Keyboard Layo Sinhala - Wij 9 Keybo Syriac Standard Keybo Syriac Phoenetic Keyb Tajik Keyboard Layout Tatar_Cyrillic Keyboa Thai Kedmanee Keyboar Thai Pattachote Keybo Thai Kedmanee (non-Sh Thai Pattachote (nonTibetan (PRC) Keyboar Turkish F Keyboard La Turkish Q Keyboard La Turkmen Keyboard Layo Uyghur (Legacy) Keybo Uyghur Keyboard Layou United Kingdom Keyboa United Kingdom Extend Ukrainian Keyboard La Ukrainian (Enhanced)

Keyboard Layout kbdurdu.dll 6.1.7600.16385 kbdus.dll 6.1.7601.17514 d Layout kbdusa.dll 6.1.7600.16385 eyboard Layout kbdusl.dll 6.1.7600.16385 nglish Keyboard Layout kbdusr.dll 6.1.7600.16385 English Keyboard Layout kbdusx.dll 6.1.7600.16385 oard Layout kbduzb.dll 6.1.7600.16385 rd Layout kbdvntc.dll 6.1.7600.16385 ayout kbdwol.dll 6.1.7600.16385 kbdyak.dll 6.1.7600.16385 rd Layout kbdyba.dll 6.1.7600.16385 t kbdycc.dll 6.1.7600.16385 yboard Layout kbdycl.dll 6.1.7600.16385 ard Layout kd1394.dll 6.1.7600.16385 kdcom.dll 6.1.7600.16385 r kdusb.dll 6.1.7600.16385 er kerberos.dll 6.1.7601.17514 kage kernel32.dll 6.1.7601.17514 lient DLL kernelbase.dll 6.1.7601.17514 lient DLL kernelceip.dll 6.1.7600.16385 keyiso.dll 6.1.7600.16385 vice keymgr.dll 6.1.7600.16385 Passwords kmsvc.dll 6.1.7601.17514 e korwbrkr.dll 6.1.7600.16385 ksuser.dll 6.1.7600.16385 ktmw32.dll 6.1.7600.16385 ent DLL l2gpstore.dll 6.1.7600.16385 l2nacp.dll 6.1.7600.16385 al Provider l2sechc.dll 6.1.7600.16385 nostics Helper Classes langcleanupsysprepaction.dll 6.1.7600.16385 ysprep action laprxy.dll 12.0.7600.16385 t Proxy licmgr10.dll 8.0.7601.17514 ger DLL linkinfo.dll 6.1.7600.16385 ng

Urdu Keyboard Layout United States Keyboar US IBM Arabic 238_L K Dvorak Left-Hand US E Dvorak Right-Hand US US Multinational Keyb Uzbek_Cyrillic Keyboa Vietnamese Keyboard L Wolof Keyboard Layout Yakut - Russia Keyboa Yoruba Keyboard Layou Serbian (Cyrillic) Ke Serbian (Latin) Keybo 1394 Kernel Debugger Serial Kernel Debugge USB 2.0 Kernel Debugg Kerberos Security Pac Windows NT BASE API C Windows NT BASE API C Kernel Ceip Task CNG Key Isolation Ser Stored User Names and Key Management Servic korwbrkr User CSA Library Windows KTM Win32 Cli Policy Storage dll Windows Onex Credenti Layer 2 Security Diag Language cleanup S Windows Media Logagen Microsoft License Mana Windows Volume Tracki

listsvc.dll 6.1.7601.17514 lltdapi.dll 6.1.7600.16385 apper API lltdres.dll 6.1.7600.16385 iscovery Resources lltdsvc.dll 6.1.7600.16385 apper Service lmhsvc.dll 6.1.7600.16385 rt Services DLL loadperf.dll 6.1.7600.16385 ance Counters localsec.dll 6.1.7601.17514 s MMC Snapin localspl.dll 6.1.7601.17514 localui.dll 6.1.7600.16385 locationapi.dll 6.1.7600.16385 ation API loghours.dll 6.1.7600.16385 logoncli.dll 6.1.7601.17514 lpk.dll 6.1.7600.16385 lpksetupproxyserv.dll 6.1.7600.16385 lpksetup.exe lsasrv.dll 6.1.7601.17514 lscshostpolicy.dll 6.1.7601.17514 top Virtual Graphics Session Licensing Host Policy lsmproxy.dll 6.1.7601.17514 Dll luainstall.dll 6.1.7601.17514 lz32.dll 6.1.7600.16385 I DLL lzexpand.dll 3.10.0.103 n library magnification.dll 6.1.7600.16385 on API mapi32.dll 1.0.2536.0 Windows NT mapistub.dll 1.0.2536.0 Windows NT mcewmdrmndbootstrap.dll 1.3.2302.0 MDRM-ND Receiver Bridge Bootstrap DLL mciavi32.dll 6.1.7601.17514 driver mcicda.dll 6.1.7600.16385 o devices mciqtz32.dll 6.6.7601.17514 mciseq.dll 6.1.7600.16385 equencer mciwave.dll 6.1.7600.16385 rm audio mcmde.dll 12.0.7601.17514 mcsrchph.dll 1.0.0.1 Search Protocol Handler mctres.dll 6.1.7600.16385 mcupdate_authenticamd.dll 6.1.7600.16385 Library mcupdate_genuineintel.dll 6.1.7601.17514 e Library mcx2svc.dll 6.1.7601.17514 Service mcxdriv.dll 6.1.7600.16385

Windows HomeGroup Link-Layer Topology M Link-Layer Topology D Link-Layer Topology M TCPIP NetBios Transpo Load & Unload Perform Local Users and Group Local Spooler DLL Local Monitor UI DLL Microsoft Windows Loc Schedule Dialog Net Logon Client DLL Language Pack COM proxy server for LSA Server DLL Microsoft Remote Desk LSM interfaces proxy Lua manifest install LZ Expand/Compress AP Windows file expansio Microsoft Magnificati Extended MAPI 1.0 for Extended MAPI 1.0 for Windows Media Center W Video For Windows MCI MCI driver for cdaudi DirectShow MCI Driver MCI driver for MIDI s MCI driver for wavefo MCMDE DLL Windows Media Center MCT resource DLL AMD Microcode Update Intel Microcode Updat Media Center Extender Media Center Extender

Resources mdminst.dll mediametadatahandler.dll r memdiag.dll ment

6.1.7600.16385 6.1.7601.17514 6.1.7600.16385

Modem Class Installer Media Metadata Handle Memory Tester Enhance

mf.dll 12.0.7601.17514 Media Foundation DLL mf3216.dll 6.1.7600.16385 32-bit to 16-bit Meta file Conversion DLL mfaacenc.dll 6.1.7600.16385 Media Foundation AAC Encoder mfc40.dll 4.1.0.6151 MFCDLL Shared Library - Retail Version mfc40u.dll 4.1.0.6151 MFCDLL Shared Library - Retail Version mfc42.dll 6.6.8063.0 MFCDLL Shared Library - Retail Version mfc42u.dll 6.6.8063.0 MFCDLL Shared Library - Retail Version mfcsubs.dll 2001.12.8530.16385 COM+ mfds.dll 12.0.7601.17514 Media Foundation Dire ct Show wrapper DLL mfdvdec.dll 6.1.7600.16385 Media Foundation DV D ecoder mferror.dll 12.0.7600.16385 Media Foundation Erro r DLL mfh264enc.dll 6.1.7600.16385 Media Foundation H264 Encoder mfmjpegdec.dll 6.1.7600.16385 Media Foundation MJPE G Decoder mfplat.dll 12.0.7600.16385 Media Foundation Plat form DLL mfplay.dll 12.0.7601.17514 Media Foundation Play back API DLL mfps.dll 12.0.7600.16385 Media Foundation Prox y DLL mfreadwrite.dll 12.0.7601.17514 Media Foundation Read Write DLL mfvdsp.dll 6.1.7600.16385 Windows Media Foundat ion Video DSP Components mfwmaaec.dll 6.1.7600.16385 Windows Media Audio A EC for Media Foundation mgmtapi.dll 6.1.7600.16385 Microsoft SNMP Manage r API (uses WinSNMP) microsoft-windows-hal-events.dll 6.1.7600.16385 Microsoft-Wind ows-HAL-Events Resources microsoft-windows-kernel-power-events.dll 6.1.7600.16385 Micro soft-Windows-Kernel-Power-Events Resources microsoft-windows-kernel-processor-power-events.dll 6.1.7600.16385 Microsoft-Windows-Kernel-Processor-Power-Events Resources midimap.dll 6.1.7600.16385 Microsoft MIDI Mapper migisol.dll 6.1.7601.17514 Migration System Isol ation Layer miguiresource.dll 6.1.7600.16385 MIG wini32 resources mimefilt.dll 2008.0.7601.17514 MIME Filter mlang.dll 6.1.7600.16385 Multi Language Suppor t DLL mmcbase.dll 6.1.7600.16385 MMC Base DLL mmci.dll 6.1.7600.16385 Media class installer mmcico.dll 6.1.7600.16385 Media class co-instal

ler mmcndmgr.dll mmcshext.dll LL mmcss.dll duler Service mmdevapi.dll mmres.dll es mmsystem.dll media modemui.dll ies montr_ci.dll ss Installer moricons.dll Resources Library mp3dmod.dll DMO mp43decd.dll Video Decoder mp4sdecd.dll S Video Decoder mpg4decd.dll Video Decoder mpr.dll ter DLL mprapi.dll Administration DLL mprddm.dll upervisor mprdim.dll ager mprmsg.dll Service Messages DLL mpssvc.dll Service msaatext.dll text support msac3enc.dll r msacm.dll ession Manager msacm32.dll ilter msadce.dll msadcer.dll Resources msadcf.dll Data Factory msadcfr.dll Data Factory Resources msadco.dll Data Control msadcor.dll Data Control Resources msadcs.dll ISAPI Library msadds.dll vider 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 3.10.0.103 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 2.0.10413.0 6.1.7601.17514 3.50.0.9 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 Multimedia Class Sche MMDevice API General Audio Resourc System APIs for Multi Windows Modem Propert Microsoft Monitor Cla Windows NT Setup Icon Microsoft MP3 Decoder Windows Media MPEG-4 Windows Media MPEG-4 Windows Media MPEG-4 Multiple Provider Rou Windows NT MP Router Demand Dial Manager S Dynamic Interface Man Multi-Protocol Router Microsoft Protection Active Accessibility Microsoft AC-3 Encode Microsoft Audio Compr Microsoft ACM Audio F OLE DB Cursor Engine OLE DB Cursor Engine Remote Data Services Remote Data Services Remote Data Services Remote Data Services Remote Data Services OLE DB Data Shape Pro 6.1.7601.17514 6.1.7600.16385 MMC Node Manager DLL MMC Shell Extension D

msaddsr.dll ovider Resources msader15.dll Resources msado15.dll msadomd.dll (Multi-Dimensional) msador15.dll a Objects Recordset msadox.dll Extensions msadrh15.dll Rowset Helper msafd.dll kets 2.0 Service Provider msasn1.dll msaudite.dll DLL mscandui.dll mscat32.dll msclmd.dll driver mscms.dll ing System DLL mscoree.dll e Execution Engine mscorier.dll e IE resources mscories.dll URITY REGISTRATION mscpx32r.dll ator Resources mscpxl32.dll ator msctf.dll msctfmonitor.dll msctfp.dll msctfui.dll msdadc.dll n Stub msdadiag.dll msdaenum.dll r Stub msdaer.dll on Stub msdaora.dll racle msdaorar.dll racle Resources msdaosp.dll r msdaprsr.dll rvices Resources msdaprst.dll rvices msdaps.dll ies/Stubs msdarem.dll r msdaremr.dll

6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 4.0.40305.0 2.0.50727.5420 2.0.50727.5420 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385

OLE DB Data Shape Pr ActiveX Data Objects ActiveX Data Objects ActiveX Data Objects Microsoft ActiveX Dat ActiveX Data Objects ActiveX Data Objects Microsoft Windows Soc ASN.1 Runtime APIs Security Audit Events MSCANDUI Server DLL MSCAT32 Forwarder DLL Microsoft Class MiniMicrosoft Color Match Microsoft .NET Runtim Microsoft .NET Runtim Microsoft .NET IE SEC ODBC Code Page Transl ODBC Code Page Transl MSCTF Server DLL MsCtfMonitor DLL MSCTFP Server DLL MSCTFUI Server DLL OLE DB Data Conversio Built-In Diagnostics OLE DB Root Enumerato OLE DB Error Collecti OLE DB Provider for O OLE DB Provider for O OLE DB Simple Provide OLE DB Persistence Se OLE DB Persistence Se OLE DB Interface Prox OLE DB Remote Provide OLE DB Remote Provide

r Resources msdart.dll 6.1.7600.16385 OLE DB Runtime Routin es msdasc.dll 6.1.7600.16385 OLE DB Service Compon ents Stub msdasql.dll 6.1.7601.17514 OLE DB Provider for O DBC Drivers msdasqlr.dll 6.1.7600.16385 OLE DB Provider for O DBC Drivers Resources msdatl3.dll 6.1.7600.16385 OLE DB Implementation Support Routines msdatt.dll 6.1.7600.16385 OLE DB Temporary Tabl e Services msdaurl.dll 6.1.7600.16385 OLE DB RootBinder Stu b msdelta.dll 6.1.7600.16385 Microsoft Patch Engin e msdfmap.dll 6.1.7601.17514 Data Factory Handler msdmeng.dll 8.0.2039.0 Microsoft Data Mining Engine msdmine.dll 8.0.2039.0 Microsoft OLE DB Prov ider for Data Mining Services msdmo.dll 6.6.7601.17514 DMO Runtime msdri.dll 6.1.7601.17514 Microsoft Digital Rec eiver Interface Class Driver msdrm.dll 6.1.7601.17514 Windows Rights Manage ment client msdtckrm.dll 2001.12.8530.16385 Microsoft Distributed Transaction Coordinator OLE Transactions KTM Resource Manager DLL msdtclog.dll 2001.12.8530.16385 Microsoft Distributed Transaction Coordinator Log Manager DLL msdtcprx.dll 2001.12.8530.16385 Microsoft Distributed Transaction Coordinator OLE Transactions Interface Proxy DLL msdtctm.dll 2001.12.8531.17514 Microsoft Distributed Transaction Coordinator Transaction Manager DLL msdtcuiu.dll 2001.12.8530.16385 Microsoft Distributed Transaction Coordinator Administrative DLL msdtcvsp1res.dll 2001.12.8530.16385 Microsoft Distributed Transaction Coordinator Resources for Vista SP1 msexch40.dll 4.0.9756.0 Microsoft Jet Exchang e Isam msexcl40.dll 4.0.9756.0 Microsoft Jet Excel I sam msfeeds.dll 8.0.7601.17514 Microsoft Feeds Manag er msfeedsbs.dll 8.0.7601.17514 Microsoft Feeds Backg round Sync msftedit.dll 5.41.21.2510 Rich Text Edit Contro l, v4.1 mshtml.dll 8.0.7601.17514 Microsoft (R) HTML Vi ewer mshtmled.dll 8.0.7601.17514 Microsoft HTML Editing Component mshtmler.dll 8.0.7600.16385 Microsoft HTML Editing Component's Resource DLL msi.dll 5.0.7601.17514 Windows Installer msicofire.dll 6.1.7600.16385 Corrupted MSI File Re covery Diagnostic Module msidcrl30.dll 6.1.7600.16385 IDCRL Dynamic Link Li brary

msident.dll 6.1.7600.16385 nager msidle.dll 6.1.7600.16385 msidntld.dll 6.1.7600.16385 nager msieftp.dll 6.1.7601.17514 plorer FTP Folder Shell Extension msihnd.dll 5.0.7601.17514 msiltcfg.dll 5.0.7600.16385 figuration API Stub msimg32.dll 6.1.7600.16385 msimsg.dll 5.0.7600.16385 rnational Messages msimtf.dll 6.1.7600.16385 msisip.dll 5.0.7600.16385 vider msjet40.dll 4.0.9756.0 Library msjetoledb40.dll 4.0.9756.0 msjint40.dll 4.0.9756.0 e Engine International DLL msjro.dll 6.1.7601.17514 bjects msjter40.dll 4.0.9756.0 e Engine Error DLL msjtes40.dll 4.0.9756.0 ion Service msls31.dll 3.10.349.0 es library file msltus40.dll 4.0.9756.0 -2-3 Isam msmdcb80.dll 8.0.2039.0 l msmdgd80.dll 8.0.2039.0 Analysis Services driver msmdun80.dll 2000.80.2039.0 for SQL Enterprise Components msmmsp.dll 6.1.7600.16385 sprep Utility Library msmpeg2adec.dll 6.1.7140.0 io Decoder msmpeg2enc.dll 6.1.7601.17514 der msmpeg2vdec.dll 6.1.7140.0 eo Decoder msnetobj.dll 11.0.7601.17514 bject msobjs.dll 6.1.7600.16385 ames msoeacct.dll 6.1.7600.16385 count Manager msoert2.dll 6.1.7600.16385 l RT Lib msolap80.dll 8.0.2216.0 ider for Analysis Services 8.0 msolui80.dll 8.0.0.2039 ider for Analysis Services connection dialog 8.0 msorc32r.dll 6.1.7600.16385 e Resources msorcl32.dll 6.1.7601.17514

Microsoft Identity Ma User Idle Monitor Microsoft Identity Ma Microsoft Internet Ex Windows installer Windows Installer Con GDIEXT Client DLL Windows Installer Inte Active IMM Server DLL MSI Signature SIP Pro Microsoft Jet Engine Microsoft Jet Databas Jet and Replication O Microsoft Jet Databas Microsoft Jet Express Microsoft Line Servic Microsoft Jet Lotus 1 PivotTable Service dl Microsoft SQL Server String Function .DLL Mount Point Manger Sy Microsoft DTV-DVD Aud Microsoft MPEG-2 Enco Microsoft DTV-DVD Vid DRM ActiveX Network O System object audit n Microsoft Internet Ac Microsoft Windows Mai Microsoft OLE DB Prov Microsoft OLE DB prov ODBC Driver for Oracl ODBC Driver for Oracl

e mspatcha.dll 6.1.7600.16385 Application API mspbda.dll 6.1.7601.17514 roadcast Digital Architecture Class Driver mspbdacoinst.dll 6.1.7600.16385 roadcast Digital Architecture Class Driver CoInstaller mspbde40.dll 4.0.9756.0 Isam msports.dll 6.1.7600.16385 msprivs.dll 6.1.7600.16385 ranslations msrahc.dll 6.1.7600.16385 gnostics Provider msrating.dll 8.0.7601.17514 Local User Management DLL msrd2x40.dll 4.0.9756.0 M msrd3x40.dll 4.0.9756.0 M msrdc.dll 6.1.7600.16385 ompression COM server msrdpwebaccess.dll 6.1.7600.16385 top Services Web Access Control msrepl40.dll 4.0.9756.0 Library msrle32.dll 6.1.7601.17514 sor msscntrs.dll 7.0.7600.16385 msscp.dll 11.0.7601.17514 Content Provider mssha.dll 6.1.7600.16385 th Agent msshavmsg.dll 6.1.7600.16385 th Agent Validator Message msshooks.dll 7.0.7600.16385 mssign32.dll 6.1.7600.16385 ng APIs mssip32.dll 6.1.7600.16385 mssitlb.dll 7.0.7600.16385 mssph.dll 7.0.7600.16385 ocol Handler mssphtb.dll 7.0.7601.17514 ector mssprxy.dll 7.0.7600.16385 y mssrch.dll 7.0.7601.17514 mssvp.dll 7.0.7601.17514 rm msswch.dll 6.1.7600.16385 mstask.dll 6.1.7601.17514 ace DLL mstext40.dll 4.0.9756.0 am mstime.dll 8.0.7601.17514 nteractive Multimedia Extensions to HTML mstscax.dll 6.1.7601.17514 es ActiveX Client msutb.dll 6.1.7601.17514 msv1_0.dll 6.1.7601.17514 Microsoft File Patch Microsoft Protected B Microsoft Protected B Microsoft Jet Paradox Ports Class Installer Microsoft Privilege T Remote Assistance Dia Internet Ratings and Microsoft (R) Red ISA Microsoft (R) Red ISA Remote Differential C Microsoft Remote Desk Microsoft Replication Microsoft RLE Compres msscntrs.dll Windows Media Secure Windows Security Heal Windows Security Heal MSSHooks.dll Microsoft Trust Signi MSSIP32 Forwarder DLL mssitlb Microsoft Search Prot Outlook MSSearch Conn Microsoft Search Prox mssrch.dll MSSearch Vista Platfo msswch Task Scheduler interf Microsoft Jet Text Is Microsoft (R) Timed I Remote Desktop Servic MSUTB Server DLL Microsoft Authenticat

ion Package v1.0 msvbvm60.dll 6.0.98.15 Machine msvcirt.dll 7.0.7600.16385 DLL msvcp110_clr0400.dll 11.0.50709.17929 brary msvcp60.dll 7.0.7600.16385 e Library DLL msvcr100_clr0400.dll 11.0.50709.17929 rk msvcr110_clr0400.dll 11.0.50709.17929 brary msvcrt.dll 7.0.7600.16385 msvcrt20.dll 2.12.0.0 brary msvcrt40.dll 6.1.7600.16385 rded to msvcrt.dll) msvfw32.dll 6.1.7601.17514 indows DLL msvidc32.dll 6.1.7601.17514 pressor msvidctl.dll 6.5.7601.17514 treaming video msvideo.dll 1.15.0.1 indows DLL mswdat10.dll 4.0.9756.0 bles mswmdm.dll 12.0.7600.16385 Manager Core mswsock.dll 6.1.7601.17514 kets 2.0 Service Provider mswstr10.dll 4.0.9756.0 brary msxactps.dll 6.1.7600.16385 oxies/Stubs msxbde40.dll 4.0.9756.0 sam msxml3.dll 8.110.7601.17514 msxml3r.dll 8.110.7600.16385 msxml6.dll 6.30.7601.17514 msxml6r.dll 6.30.7600.16385 msyuv.dll 6.1.7601.17514 Decompressor mtxclu.dll 2001.12.8531.17514 Transaction Coordinator Failover Clustering Support DLL mtxdm.dll 2001.12.8530.16385 mtxex.dll 2001.12.8530.16385 mtxlegih.dll 2001.12.8530.16385 mtxoci.dll 2001.12.8530.16385 Transaction Coordinator Database Support DLL for Oracle muifontsetup.dll 6.1.7601.17514 registry settings muilanguagecleanup.dll 6.1.7600.16385 uage pack cleanup mycomput.dll 6.1.7600.16385 mydocs.dll 6.1.7601.17514 I napcrypt.dll 6.1.7601.17514 helper

Visual Basic Virtual Windows NT IOStreams Microsoft C Runtime Li Windows NT C++ Runtim Microsoft .NET Framewo Microsoft C Runtime Li Windows NT CRT DLL Microsoft C Runtime Li VC 4.x CRT DLL (Forwa Microsoft Video for W Microsoft Video 1 Com ActiveX control for s Microsoft Video for W Microsoft Jet Sort Ta Windows Media Device Microsoft Windows Soc Microsoft Jet Sort Li OLE DB Transaction Pr Microsoft Jet xBASE I MSXML 3.0 SP11 XML Resources MSXML 6.0 SP3 XML Resources Microsoft UYVY Video Microsoft Distributed COM+ COM+ COM+ Microsoft Distributed MUI Callback for font MUI Callback for Lang Computer Management My Documents Folder U NAP Cryptographic API

napdsnap.dll 6.1.7601.17514 naphlpr.dll 6.1.7601.17514 helper napinsp.dll 6.1.7600.16385 ovider napipsec.dll 6.1.7600.16385 Client napmontr.dll 6.1.7600.16385 nativehooks.dll 6.1.7600.16385 tive hook handler naturallanguage6.dll 6.1.7601.17514 lopment Platform 6 ncdprop.dll 6.1.7600.16385 ce properties nci.dll 6.1.7601.17514 ncobjapi.dll 6.1.7600.16385 ting System ncrypt.dll 6.1.7600.16385 library ncryptui.dll 6.1.7601.17514 key protection UI library ncsi.dll 6.1.7601.17514 Status Indicator nddeapi.dll 6.1.7600.16385 agement APIs ndfapi.dll 6.1.7600.16385 amework Client API ndfetw.dll 6.1.7600.16385 gine Event Interface ndfhcdiscovery.dll 6.1.7600.16385 amework HC Discovery API ndiscapcfg.dll 6.1.7600.16385 ndishc.dll 6.1.7600.16385 ndproxystub.dll 6.1.7600.16385 gine Proxy/Stub negoexts.dll 6.1.7600.16385 Package netapi.dll 3.11.0.300 amic Link Library for Microsoft Windows netapi32.dll 6.1.7601.17514 netbios.dll 6.1.7600.16385 rary netcenter.dll 6.1.7601.17514 l panel netcfgx.dll 6.1.7601.17514 Objects netcorehc.dll 6.1.7600.16385 ostics Helper Classes netdiagfx.dll 6.1.7601.17514 amework netevent.dll 6.1.7600.16385 netfxperf.dll 4.0.40305.0 e Counter Shim neth.dll 6.1.7600.16385 netid.dll 6.1.7601.17514 Applet; Network ID Page netiohlp.dll 6.1.7601.17514 netjoin.dll 6.1.7601.17514 netlogon.dll 6.1.7601.17514 L

NAP GPEdit Extension NAP client config API E-mail Naming Shim Pr NAP IPSec Enforcement NAP Netsh Helper Microsoft Narrator Na Natural Language Deve Advanced network devi CoInstaller: NET Microsoft Windows Opera Windows cryptographic Windows cryptographic Network Connectivity Network DDE Share Man Network Diagnostic Fr Network Diagnostic En Network Diagnostic Fr NdisCap Notify Object NDIS Helper Classes Network Diagnostic En NegoExtender Security Microsoft Network Dyn Net Win32 API DLL NetBIOS Interface Lib Network Center contro Network Configuration Networking Core Diagn Network Diagnostic Fr Net Event Handler Extensible Performanc Net Help Messages DLL System Control Panel Netio Helper DLL Domain Join DLL Net Logon Services DL

netman.dll 6.1.7600.16385 anager netmsg.dll 6.1.7600.16385 netplwiz.dll 6.1.7601.17514 twork Places Wizard netprof.dll 6.1.7600.16385 ement UI netprofm.dll 6.1.7600.16385 netprojw.dll 6.1.7600.16385 Projector netshell.dll 6.1.7601.17514 hell nettrace.dll 6.1.7600.16385 netutils.dll 6.1.7601.17514 DLL netw2c32.dll 9.0.4.95 32 bit DLL netw2r32.dll 9.0.4.95 32 bit DLL networkexplorer.dll 6.1.7601.17514 networkitemfactory.dll 6.1.7600.16385 networkmap.dll 6.1.7601.17514 newdev.dll 6.0.5054.0 ibrary nlaapi.dll 6.1.7601.17514 eness 2 nlahc.dll 6.1.7600.16385 nlasvc.dll 6.1.7601.17514 eness 2 nlhtml.dll 2008.0.7600.16385 nlmgp.dll 6.1.7600.16385 Snapin nlmsprep.dll 6.1.7600.16385 Sysprep Module nlsbres.dll 6.1.7601.17514 nlsdata0000.dll 6.1.7600.16385 ural Language Server Data and Code nlsdata0001.dll 6.1.7600.16385 ural Language Server Data and Code nlsdata0002.dll 6.1.7600.16385 ural Language Server Data and Code nlsdata0003.dll 6.1.7600.16385 ural Language Server Data and Code nlsdata0007.dll 6.1.7600.16385 ral Language Server Data and Code nlsdata0009.dll 6.1.7600.16385 ural Language Server Data and Code nlsdata000a.dll 6.1.7600.16385 ural Language Server Data and Code nlsdata000c.dll 6.1.7600.16385 ral Language Server Data and Code nlsdata000d.dll 6.1.7600.16385 ural Language Server Data and Code nlsdata000f.dll 6.1.7600.16385 ural Language Server Data and Code nlsdata0010.dll 6.1.7600.16385 ural Language Server Data and Code nlsdata0011.dll 6.1.7600.16385 tural Language Server Data and Code nlsdata0013.dll 6.1.7600.16385

Network Connections M Net Messages DLL Map Network Drives/Ne Network Profile Manag Network List Manager Connect to a Network Network Connections S Network Trace Helper Net Win32 API Helpers Coinstaller and NCPA Coinstaller and NCPA Network Explorer NetworkItem Factory Network Map Add Hardware Device L Network Location Awar NLA Helper Classes Network Location Awar HTML filter Network List Manager Network List Manager NLSBuild resource DLL Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft German Natu Microsoft English Nat Microsoft Spanish Nat Microsoft French Natu Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Japanese Na Microsoft Neutral Nat

ural Language Server Data nlsdata0018.dll ural Language Server Data nlsdata0019.dll ural Language Server Data nlsdata001a.dll ural Language Server Data nlsdata001b.dll ural Language Server Data nlsdata001d.dll ural Language Server Data nlsdata0020.dll ural Language Server Data nlsdata0021.dll ural Language Server Data nlsdata0022.dll ural Language Server Data nlsdata0024.dll ural Language Server Data nlsdata0026.dll ural Language Server Data nlsdata0027.dll ural Language Server Data nlsdata002a.dll ural Language Server Data nlsdata0039.dll ural Language Server Data nlsdata003e.dll ural Language Server Data nlsdata0045.dll ural Language Server Data nlsdata0046.dll ural Language Server Data nlsdata0047.dll ural Language Server Data nlsdata0049.dll ural Language Server Data nlsdata004a.dll ural Language Server Data nlsdata004b.dll ural Language Server Data nlsdata004c.dll ural Language Server Data nlsdata004e.dll ural Language Server Data nlsdata0414.dll ural Language Server Data nlsdata0416.dll ural Language Server Data nlsdata0816.dll ural Language Server Data nlsdata081a.dll ural Language Server Data nlsdata0c1a.dll ural Language Server Data nlsdl.dll nlslexicons0001.dll ural Language Server Data nlslexicons0002.dll ural Language Server Data

and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 and Code 6.1.7600.16385 6.1.7600.16385 and Code 6.1.7600.16385 and Code

Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Nls Downlevel DLL Microsoft Neutral Nat Microsoft Neutral Nat

nlslexicons0003.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons0007.dll 6.1.7600.16385 ral Language Server Data and Code nlslexicons0009.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons000a.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons000c.dll 6.1.7600.16385 ral Language Server Data and Code nlslexicons000d.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons000f.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons0010.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons0011.dll 6.1.7600.16385 tural Language Server Data and Code nlslexicons0013.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons0018.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons0019.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons001a.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons001b.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons001d.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons0020.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons0021.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons0022.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons0024.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons0026.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons0027.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons002a.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons0039.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons003e.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons0045.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons0046.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons0047.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons0049.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons004a.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons004b.dll 6.1.7600.16385 ural Language Server Data and Code

Microsoft Neutral Nat Microsoft German Natu Microsoft English Nat Microsoft Spanish Nat Microsoft French Natu Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Japanese Na Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat

nlslexicons004c.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons004e.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons0414.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons0416.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons0816.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons081a.dll 6.1.7600.16385 ural Language Server Data and Code nlslexicons0c1a.dll 6.1.7600.16385 ural Language Server Data and Code nlsmodels0011.dll 6.1.7600.16385 tural Language Server Data and Code normaliz.dll 6.1.7600.16385 DLL npdeployjava1.dll 10.25.2.17 -in Library for Java(TM) Deploy npmproxy.dll 6.1.7600.16385 Proxy nrpsrv.dll 6.1.7601.17514 (NRP) RPC interface nshhttp.dll 6.1.7600.16385 nshipsec.dll 6.1.7601.17514 helper DLL nshwfp.dll 6.1.7601.17514 tform Netsh Helper nsi.dll 6.1.7600.16385 ce DLL nsisvc.dll 6.1.7600.16385 ce RPC server ntdll.dll 6.1.7601.17514 ntdsapi.dll 6.1.7600.16385 in Services API ntlanman.dll 6.1.7601.17514 ntlanui2.dll 6.1.7600.16385 UI ntmarta.dll 6.1.7600.16385 ider ntprint.dll 6.1.7601.17514 ntshrui.dll 6.1.7601.17514 sharing ntvdmd.dll 6.1.7600.16385 objsel.dll 6.1.7600.16385 occache.dll 8.0.7601.17514 ocsetapi.dll 6.1.7601.17514 onent Setup API odbc16gt.dll 3.510.3711.0 Generic Thunk odbc32.dll 6.1.7601.17514 odbc32gt.dll 6.1.7600.16385 hunk odbcbcp.dll 6.1.7600.16385 odbcconf.dll 6.1.7601.17514 tion Program odbccp32.dll 6.1.7601.17514 odbccr32.dll 6.1.7600.16385 odbccu32.dll 6.1.7600.16385

Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Neutral Nat Microsoft Japanese Na Unicode Normalization NPRuntime Script Plug Network List Manager Name Resolution Proxy HTTP netsh DLL Net Shell IP Security Windows Filtering Pla NSI User-mode interfa Network Store Interfa NT Layer DLL Active Directory Doma Microsoft Lan Manager Network object shell Windows NT MARTA prov Spooler Setup DLL Shell extensions for NTVDMD.DLL Object Picker Dialog Object Control Viewer Windows Optional Comp Microsoft ODBC Driver ODBC Driver Manager ODBC Driver Generic T BCP for ODBC ODBC Driver Configura ODBC Installer ODBC Cursor Library ODBC Cursor Library

odbcint.dll odbcji32.dll p Driver Pack 3.5 odbcjt32.dll p Driver Pack 3.5 odbctrac.dll race oddbse32.dll DBase odexl32.dll Excel odfox32.dll FoxPro odpdx32.dll Paradox odtext32.dll text files oemdspif.dll offfilt.dll ogldrv.dll ole2.dll erability Library ole2disp.dll erability Library ole2nls.dll erability Library ole32.dll dows oleacc.dll Core Component oleacchooks.dll Event Hooks Library oleaccrc.dll Resource DLL oleaut32.dll olecli.dll bedding Client Library olecli32.dll bedding Client Library oledb32.dll oledb32r.dll Resources oledlg.dll pport oleprn.dll olepro32.dll oleres.dll olesvr.dll bedding Server Library olesvr32.dll bedding Server Library olethk32.dll dows onex.dll t library onexui.dll t UI library onlineidcpl.dll nel oobefldr.dll

6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 3.0.0.4704 2008.0.7600.16385 6.1.7600.16385 2.10.35.35 2.10.3050.1 2.10.3050.1 6.1.7601.17514 7.0.0.0 7.0.0.0 7.0.0.0 6.1.7601.17514 1.32.0.0 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 1.11.0.0 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514

ODBC Resources Microsoft ODBC Deskto Microsoft ODBC Deskto ODBC Driver Manager T ODBC (3.0) driver for ODBC (3.0) driver for ODBC (3.0) driver for ODBC (3.0) driver for ODBC (3.0) driver for Oemdspif Module OFFICE Filter MSOGL OLE 2.1 16/32 Interop OLE 2.1 16/32 Interop OLE 2.1 16/32 Interop Microsoft OLE for Win Active Accessibility Active Accessibility Active Accessibility Object Linking and Em Object Linking and Em OLE DB Core Services OLE DB Core Services OLE User Interface Su Oleprn DLL Ole resource dll Object Linking and Em Object Linking and Em Microsoft OLE for Win IEEE 802.1X supplican IEEE 802.1X supplican Online IDs Control Pa Getting Started

opcservices.dll 6.1.7601.17514 ces Library opengl32.dll 6.1.7600.16385 osbaseln.dll 6.1.7600.16385 osuninst.dll 6.1.7600.16385 p2p.dll 6.1.7600.16385 p2pcollab.dll 6.1.7600.16385 ation p2pgraph.dll 6.1.7600.16385 p2pnetsh.dll 6.1.7600.16385 lper p2psvc.dll 6.1.7600.16385 packager.dll 6.1.7600.16385 panmap.dll 6.1.7600.16385 r pautoenr.dll 6.1.7600.16385 pcadm.dll 6.1.7600.16385 Assistant Diagnostic Module pcaevts.dll 6.1.7600.16385 Assistant Event Resources pcasvc.dll 6.1.7600.16385 Assistant Service pcaui.dll 6.1.7600.16385 Assistant User Interface Module pcwum.dll 6.1.7600.16385 for Windows Native DLL pcwutl.dll 6.1.7600.16385 Troubleshooter Helper pdh.dll 6.1.7601.17514 ata Helper DLL pdhui.dll 6.1.7601.17514 peerdist.dll 6.1.7600.16385 brary peerdisthttptrans.dll 6.1.7600.16385 port peerdistsh.dll 6.1.7600.16385 Helper peerdistsvc.dll 6.1.7600.16385 peerdistwsddiscoprov.dll 6.1.7600.16385 very Provider perfcentercpl.dll 6.1.7601.17514 perfctrs.dll 6.1.7600.16385 perfdisk.dll 6.1.7600.16385 nce Objects DLL perfnet.dll 6.1.7600.16385 ce Performance Objects DLL perfos.dll 6.1.7600.16385 mance Objects DLL perfproc.dll 6.1.7600.16385 s Performance Objects DLL perftrack.dll 6.1.7600.16385 PerfTrack perfts.dll 6.1.7601.17514 p Services Performance Objects photometadatahandler.dll 6.1.7600.16385 r photowiz.dll 6.1.7601.17514 pid.dll 6.1.7600.16385 pidgenx.dll 6.1.7600.16385 pifmgr.dll 6.1.7601.17514

Native Code OPC Servi OpenGL Client DLL Service Reporting API Uninstall Interface Peer-to-Peer Grouping Peer-to-Peer Collabor Peer-to-Peer Graphing Peer-to-Peer NetSh He Peer-to-Peer Services Object Packager2 PANOSE(tm) Font Mappe Auto Enrollment DLL Program Compatibility Program Compatibility Program Compatibility Program Compatibility Performance Counters Program Compatibility Windows Performance D PDH UI BranchCache Client Li BranchCache HTTP Tans BranchCache Netshell BranchCache Service BranchCache WSD Disco Performance Center Performance Counters Windows Disk Performa Windows Network Servi Windows System Perfor Windows System Proces Microsoft Performance Windows Remote Deskto Photo Metadata Handle Photo Printing Wizard Microsoft PID Pid Generation Windows NT PIF Manage

r Icon Resources Library pku2u.dll 6.1.7600.16385 Pku2u Security Packag e pla.dll 6.1.7601.17514 Performance Logs & Al erts playsndsrv.dll 6.1.7600.16385 PlaySound Service pmcsnap.dll 6.1.7600.16385 pmcsnap dll pmspl.dll 2.10.0.1 Microsoft LAN Manager 2.1 Network Dynamic Link Library for Microsoft Windows pngfilt.dll 8.0.7600.16385 IE PNG plugin image d ecoder pnidui.dll 6.1.7601.17514 Network System Icon pnpsetup.dll 6.1.7600.16385 Pnp installer for CMI pnpts.dll 6.1.7600.16385 PlugPlay Troubleshoot er pnpui.dll 5.2.3668.0 Plug and Play User In terface DLL pnpxassoc.dll 6.1.7600.16385 PNPX Association Dll pnpxassocprx.dll 6.1.7600.16385 PNPX Association Dll pnrpauto.dll 6.1.7600.16385 PNRP Auto Service Dll pnrphc.dll 6.1.7600.16385 PNRP Helper Class pnrpnsp.dll 6.1.7600.16385 PNRP Name Space Provi der pnrpsvc.dll 6.1.7600.16385 PNRP Service Dll polstore.dll 6.1.7600.16385 Policy Storage dll portabledeviceapi.dll 6.1.7601.17514 Windows Portable Devi ce API Components portabledeviceclassextension.dll 6.1.7600.16385 Windows Portab le Device Class Extension Component portabledeviceconnectapi.dll 6.1.7600.16385 Portable Device Co nnection API Components portabledevicestatus.dll 6.1.7601.17514 Microsoft Windows Por table Device Status Provider portabledevicesyncprovider.dll 6.1.7601.17514 Microsoft Window s Portable Device Provider. portabledevicetypes.dll 6.1.7600.16385 Windows Portable Devi ce (Parameter) Types Component portabledevicewiacompat.dll 6.1.7600.16385 PortableDevice WIA Compatibility Driver portabledevicewmdrm.dll 6.1.7600.16385 Windows Portable Devi ce WMDRM Component pots.dll 6.1.7600.16385 Power Troubleshooter powercpl.dll 6.1.7601.17514 Power Options Control Panel powrprof.dll 6.1.7600.16385 Power Profile Helper DLL ppcsnap.dll 6.1.7600.16385 ppcsnap DLL presentationcffrasterizernative_v0300.dll 3.0.6920.4902 WinFX OpenType/CFF Rasterizer presentationhostproxy.dll 4.0.40305.0 Windows Presentation Foundation Host Proxy presentationnative_v0300.dll 3.0.6920.4902 PresentationNative _v0300.dll prflbmsg.dll 6.1.7600.16385 Perflib Event Message s printfilterpipelineprxy.dll 6.1.7600.16385 Print Filter Pipeli ne Proxy printisolationproxy.dll 6.1.7601.17514 Print Sandbox COM Pro xy Stub printui.dll 6.1.7601.17514 Printer Settings User

Interface prncache.dll prnfldr.dll prnntfy.dll prntvpt.dll Module procinst.dll ller profapi.dll I profprov.dll ider profsvc.dll propsys.dll stem provsvc.dll provthrd.dll Log Library psapi.dll psbase.dll ault provider pshed.dll dware Error Driver psisdecd.dll er for MPEG2 based networks. pstorec.dll interfaces pstorsvc.dll ver puiapi.dll puiobj.dll pwrshplugin.dll qagent.dll y qagentrt.dll ice Run-Time qasf.dll t qcap.dll qcliprov.dll Provider qdv.dll qdvd.dll ck Runtime. qedit.dll qedwipes.dll PTE Wipes qmgr.dll t Transfer Service qmgrprxy.dll t Transfer Service Proxy qshvhost.dll qsvrmgmt.dll agement quartz.dll query.dll DLL qutil.dll qwave.dll racengn.dll

6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 7.0.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.6.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 12.0.7601.17514 6.6.7601.17514 6.1.7601.17514 6.6.7601.17514 6.6.7601.17514 6.6.7601.17514 6.6.7600.16385 7.5.7601.17514 7.5.7600.16385 6.1.7601.17514 6.1.7601.17514 6.6.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514

Print UI Cache prnfldr dll prnntfy DLL Print Ticket Services Processor Class Insta User Profile Basic AP User Profile WMI Prov ProfSvc Microsoft Property Sy Windows HomeGroup WMI Provider Thread & Process Status Helper Protected Storage def Platform Specific Har Microsoft SI/PSI pars Protected Storage COM Protected storage ser puiapi DLL PrintUI Objects DLL pwrshplugin.dll Quarantine Agent Prox Quarantine Agent Serv DirectShow ASF Suppor DirectShow Runtime. Quarantine Client WMI DirectShow Runtime. DirectShow DVD PlayBa DirectShow Editing. DirectShow Editing SM Background Intelligen Background Intelligen Quarantine SHV Host Quarantine Server Man DirectShow Runtime. Content Index Utility Quarantine Utilities Windows NT Reliability analysis

metrics calculation engine racpldlg.dll 6.1.7600.16385 Remote Assistance Con tact List radardt.dll 6.1.7600.16385 Microsoft Windows Res ource Exhaustion Detector radarrs.dll 6.1.7600.16385 Microsoft Windows Res ource Exhaustion Resolver rasadhlp.dll 6.1.7600.16385 Remote Access AutoDia l Helper rasapi32.dll 6.1.7600.16385 Remote Access API rasauto.dll 6.1.7600.16385 Remote Access AutoDia l Manager rascfg.dll 6.1.7600.16385 RAS Configuration Obj ects raschap.dll 6.1.7601.17514 Remote Access PPP CHA P rasctrs.dll 6.1.7600.16385 Windows NT Remote Acc ess Perfmon Counter dll rasdiag.dll 6.1.7600.16385 RAS Diagnostics Helpe r Classes rasdlg.dll 6.1.7600.16385 Remote Access Common Dialog API rasgcw.dll 6.1.7600.16385 RAS Wizard Pages rasman.dll 6.1.7600.16385 Remote Access Connect ion Manager rasmans.dll 6.1.7601.17514 Remote Access Connect ion Manager rasmbmgr.dll 6.1.7600.16385 Provides support for the switching of mobility enabled VPN connections if their underlying interface goes down. rasmm.dll 6.1.7600.16385 RAS Media Manager rasmontr.dll 6.1.7600.16385 RAS Monitor DLL rasmxs.dll 6.1.7600.16385 Remote Access Device DLL for modems, PADs and switches rasplap.dll 6.1.7600.16385 RAS PLAP Credential P rovider rasppp.dll 6.1.7601.17514 Remote Access PPP rasser.dll 6.1.7600.16385 Remote Access Media D LL for COM ports rastapi.dll 6.1.7601.17514 Remote Access TAPI Co mpliance Layer rastls.dll 6.1.7601.17514 Remote Access PPP EAP -TLS rdpcfgex.dll 6.1.7601.17514 Remote Desktop Sessio n Host Server Connection Configuration Extension for the RDP protocol rdpcore.dll 6.1.7601.17514 RDP Core DLL rdpcorekmts.dll 6.1.7601.17514 TS (KM) RDPCore DLL rdpcorets.dll 6.1.7601.17514 TS RDPCore DLL rdpd3d.dll 6.1.7601.17514 RDP Direct3D Remoting DLL rdpdd.dll 6.1.7601.17514 RDP Display Driver rdpencdd.dll 6.1.7601.17514 RDP Encoder Mirror Dr iver rdpencom.dll 6.1.7601.17514 RDPSRAPI COM Objects rdpendp.dll 6.1.7601.17514 RDP Audio Endpoint rdprefdd.dll 6.1.7601.17514 Microsoft RDP Reflect or Display Driver rdprefdrvapi.dll 6.1.7601.17514 Reflector Driver API rdpudd.dll 6.1.7601.17514 UMRDP Display Driver rdpwsx.dll 6.1.7601.17514 RDP Extension DLL

reagent.dll 6.1.7601.17514 overy Agent DLL recovery.dll 6.1.7601.17514 l regapi.dll 6.1.7601.17514 n APIs regctrl.dll 6.1.7600.16385 regidle.dll 6.1.7600.16385 regsvc.dll 6.1.7600.16385 ce remotepg.dll 6.1.7601.17514 xtension resampledmo.dll 6.1.7600.16385 er resutils.dll 6.1.7601.17514 ource Utility DLL rgb9rast.dll 6.1.7600.16385 ting System riched20.dll 5.31.23.1230 l, v3.1 riched32.dll 6.1.7601.17514 dit 1.0 rnr20.dll 6.1.7600.16385 pace DLL rpcdiag.dll 6.1.7600.16385 rpcepmap.dll 6.1.7600.16385 rpchttp.dll 6.1.7601.17514 rpcndfp.dll 1.0.0.1 rpcns4.dll 6.1.7600.16385 Name Service Client rpcnsh.dll 6.1.7600.16385 rpcrt4.dll 6.1.7601.17514 Runtime rpcrtremote.dll 6.1.7601.17514 rpcss.dll 6.1.7601.17514 ces rsaenh.dll 6.1.7600.16385 yptographic Provider rshx32.dll 6.1.7600.16385 ion rstrtmgr.dll 6.1.7600.16385 rtffilt.dll 2008.0.7600.16385 rtm.dll 6.1.7600.16385 rtutils.dll 6.1.7601.17514 samcli.dll 6.1.7601.17514 ager Client DLL samlib.dll 6.1.7600.16385 sampleres.dll 6.1.7600.16385 samsrv.dll 6.1.7601.17514 sas.dll 6.1.7600.16385 Library sbe.dll 6.6.7601.17514 fer Filter. sbeio.dll 12.0.7600.16385 sberes.dll 6.6.7600.16385 fer Filter Resouces. scansetting.dll 6.1.7601.17514 ScanSettings Profile and Scanning implementation scarddlg.dll 6.1.7600.16385 Common Dialog

Microsoft Windows Rec Recovery Control Pane Registry Configuratio RegCtrl RegIdle Backup Task Remote Registry Servi Remote Sessions CPL E Windows Media Resampl Microsoft Cluster Res Microsoft Windows Opera Rich Text Edit Contro Wrapper Dll for Riche Windows Socket2 NameS RPC Diagnostics RPC Endpoint Mapper RPC HTTP DLL RPC NDF Helper Class Remote Procedure Call RPC Netshell Helper Remote Procedure Call Remote RPC Extension Distributed COM Servi Microsoft Enhanced Cr Security Shell Extens Restart Manager RTF Filter Routing Table Manager Routing Utilities Security Accounts Man SAM Library DLL Microsoft Samples SAM Server DLL WinLogon Software SAS DirectShow Stream Buf Stream Buffer IO DLL DirectShow Stream Buf Microsoft Windows(TM) SCardDlg - Smart Card

scardsvr.dll 6.1.7600.16385 anagement Server scavengeui.dll 6.1.7601.17514 sccls.dll 6.1.7600.16385 or Smart Cards scecli.dll 6.1.7601.17514 iguration Editor Client Engine scesrv.dll 6.1.7601.17514 iguration Editor Engine scext.dll 6.1.7600.16385 er Extension DLL for non-minwin schannel.dll 6.1.7601.17514 ovider schedcli.dll 6.1.7601.17514 ent DLL schedsvc.dll 6.1.7601.17514 e scksp.dll 6.1.7600.16385 Key Storage Provider scripto.dll 6.6.7600.16385 scrobj.dll 5.8.7600.16385 ent Runtime scrptadm.dll 6.1.7601.17514 scrrun.dll 5.8.7600.16385 ime sdautoplay.dll 6.1.7600.16385 up AutoPlay Integration Library sdcpl.dll 6.1.7601.17514 store Control Panel sdengin2.dll 6.1.7601.17514 up Engine sdhcinst.dll 6.1.7600.16385 ontroller Class Installer sdiageng.dll 6.1.7600.16385 Execution Engine sdiagprv.dll 6.1.7600.16385 nostic Provider API sdiagschd.dll 6.1.7600.16385 Scheduled Task sdohlp.dll 6.1.7600.16385 ent sdrsvc.dll 6.1.7601.17514 up Service sdshext.dll 6.1.7600.16385 up Shell Extension searchfolder.dll 6.1.7601.17514 sechost.dll 6.1.7600.16385 Lookup APIs seclogon.dll 6.1.7600.16385 ce DLL secproc.dll 6.1.7601.17514 ment Desktop Security Processor secproc_isv.dll 6.1.7601.17514 ment Desktop Security Processor secproc_ssp.dll 6.1.7601.17514 ment Services Server Security Processor secproc_ssp_isv.dll 6.1.7601.17514 ment Services Server Security Processor (Pre-production) secur32.dll 6.1.7601.17514 ider Interface

Smart Card Resource M Service Pack Cleanup Class-Installer DLL f Windows Security Conf Windows Security Conf Service Control Manag TLS / SSL Security Pr Scheduler Service Cli Task Scheduler Servic Microsoft Smart Card Microsoft ScriptO Windows Script Compon Script Adm Extension Microsoft Script Runt Microsoft Windows Back Windows Backup And Re Microsoft Windows Back Secure Digital Host C Scripted Diagnostics Windows Scripted Diag Scripted Diagnostics NPS SDO Helper Compon Microsoft Windows Back Microsoft Windows Back SearchFolder Host for SCM/SDDL/LSA Secondary Logon Servi Windows Rights Manage Windows Rights Manage Windows Rights Manage Windows Rights Manage Security Support Prov

security.dll ider Interface sendmail.dll sens.dll tion Service (SENS) sensapi.dll DLL sensorsapi.dll sensorsclassextension.dll xtension component sensorscpl.dll er Sensors sensrsvc.dll ient light service serialui.dll Pages serwvdrv.dll driver sessenv.dll uration service setbcdlocale.dll setupapi.dll setupcln.dll setupetw.dll rces sfc.dll on sfc_os.dll on shacct.dll s sharemediacpl.dll anel shdocvw.dll Control Library shell.dll shell32.dll Dll shellstyle.dll esource Dll shfolder.dll shgina.dll gon shimeng.dll shimgvw.dll shlwapi.dll ility Library shpafact.dll Elevation Factory Dll shsetup.dll shsvcs.dll s Dll shunimpl.dll e APIs shwebsvc.dll vices signdrv.dll ed Drivers sisbkup.dll Backup Support Functions

6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 3.10.0.103 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514

Security Support Prov Send Mail System Event Notifica SENS Connectivity API Sensor API Sensor Driver Class E Open Location and Oth Microsoft Windows amb Serial Port Property Unimodem Serial Wave Remote Desktop Config MUI Callback for Bcd Windows Setup API Setup Files Cleanup Setup ETW Event Resou Windows File Protecti Windows File Protecti Shell Accounts Classe Share Media Control P Shell Doc Object and Windows Shell library Windows Shell Common Windows Shell Style R Shell Folder Service Windows Shell User Lo Shim Engine DLL Photo Gallery Viewer Shell Light-weight Ut Windows Shell LUA/PA Shell setup helper Windows Shell Service Windows Shell Obsolet Windows Shell Web Ser WMI provider for Sign Single-Instance Store

slc.dll 6.1.7600.16385 ient Dll slcext.dll 6.1.7600.16385 ient Extension Dll slwga.dll 6.1.7601.17514 A API sm56co85.dll 6.12.25.4 er smartcardcredentialprovider.dll 6.1.7601.17514 rd Credential Provider smbhelperclass.dll 1.0.0.1 lper Class for Network Diagnostic Framework smiengine.dll 6.1.7601.17514 e sndvolsso.dll 6.1.7601.17514 snmpapi.dll 6.1.7600.16385 sntsearch.dll 6.1.7600.16385 LL softkbd.dll 6.1.7600.16385 and Tip softpub.dll 6.1.7600.16385 sortserver2003compat.dll 6.1.7600.16385 003 sortwindows6compat.dll 6.1.7600.16385 6.0 spbcd.dll 6.1.7601.17514 spcmsg.dll 6.1.7600.16385 sperror.dll 6.1.7600.16385 spfileq.dll 6.1.7600.16385 spinf.dll 6.1.7600.16385 spnet.dll 6.1.7600.16385 spoolss.dll 6.1.7600.16385 spopk.dll 6.1.7601.17514 spp.dll 6.1.7601.17514 ed Protection Point Library sppc.dll 6.1.7601.17514 ient Dll sppcc.dll 6.1.7600.16385 mmerce Client sppcext.dll 6.1.7600.16385 latform Client Extension Dll sppcomapi.dll 6.1.7601.17514 brary sppcommdlg.dll 6.1.7600.16385 API sppinst.dll 6.1.7601.17514 g-in DLL sppnp.dll 6.1.7601.17514 sppobjs.dll 6.1.7601.17514 latform Plugins sppuinotify.dll 6.1.7601.17514 ice sppwinob.dll 6.1.7601.17514 latform Windows Plugin sppwmi.dll 6.1.7600.16385 latform WMI provider spwinsat.dll 6.1.7600.16385 spwizeng.dll 6.1.7601.17514 k spwizimg.dll 6.1.7600.16385

Software Licensing Cl Software Licensing Cl Software Licensing WG SM56 Modem co-install Windows Smartca SMB (File Sharing) He WMI Configuration Cor SCA Volume SNMP Utility Library Sticky Notes Search D Soft Keyboard Server Softpub Forwarder DLL Sort Version Server 2 Sort Version Windows BCD Sysprep Plugin SP Installer Msg Dll SP Error Windows SPFILEQ Windows SPINF Net Sysprep Plugin Spooler SubSystem DLL OPK Sysprep Plugin Microsoft Windows Shar Software Licensing Cl Software Licensing Co Software Protection P Software Licensing Li Software Licensing UI SPP CMI Installer Plu PnP module of SysPrep Software Protection P SPP Notification Serv Software Protection P Software Protection P WinSAT Sysprep Plugin Setup Wizard Framewor Setup Wizard Framewor

k Resources spwizres.dll 6.1.7601.17514 Setup Wizard Framewor k Resources spwizui.dll 6.1.7601.17514 SPC Wizard UI spwmp.dll 6.1.7601.17514 Windows Media Player System Preparation DLL sqlceoledb30.dll 3.0.7600.0 Microsoft SQL Mobile sqlceqp30.dll 3.0.7600.0 Microsoft SQL Mobile sqlcese30.dll 3.0.7601.0 Microsoft SQL Mobile sqloledb.dll 6.1.7601.17514 OLE DB Provider for S QL Server sqlsrv32.dll 6.1.7601.17514 SQL Server ODBC Drive r sqlunirl.dll 2000.80.728.0 String Function .DLL for SQL Enterprise Components sqlwid.dll 1999.10.20.0 Unicode Function .DLL for SQL Enterprise Components sqlwoa.dll 1999.10.20.0 Unicode/ANSI Function .DLL for SQL Enterprise Components sqlxmlx.dll 6.1.7600.16385 XML extensions for SQ L Server sqmapi.dll 6.1.7601.17514 SQM Client srchadmin.dll 7.0.7601.17514 Indexing Options srclient.dll 6.1.7600.16385 Microsoft Windows Syst em Restore Client Library srcore.dll 6.1.7601.17514 Microsoft Windows Syst em Restore Core Library srhelper.dll 6.1.7600.16385 Microsoft Windows driv er and windows update enumeration library srpuxnativesnapin.dll 6.1.7600.16385 Application Control P olicies Group Policy Editor Extension srrstr.dll 6.1.7601.17514 Microsoft Windows Syst em Protection Configuration Library srvcli.dll 6.1.7601.17514 Server Service Client DLL srvsvc.dll 6.1.7601.17514 Server Service DLL srwmi.dll 6.1.7600.16385 Microsoft Windows Syst em Restore WMI Provider sscore.dll 6.1.7601.17514 Server Service Core D LL ssdpapi.dll 6.1.7600.16385 SSDP Client API DLL ssdpsrv.dll 6.1.7600.16385 SSDP Service DLL sspicli.dll 6.1.7601.17514 Security Support Prov ider Interface sspisrv.dll 6.1.7601.17514 LSA SSPI RPC interfac e DLL ssshim.dll 6.1.7600.16385 Windows Componentizat ion Platform Servicing API sstpsvc.dll 6.1.7600.16385 Provides the facility of using Secure Socket Tunneling Protocol (SSTP) to connect to remote computers (using VPN). stclient.dll 2001.12.8530.16385 COM+ Configuration Ca talog Client sti.dll 6.1.7600.16385 Still Image Devices c lient DLL sti_ci.dll 6.1.7600.16385 Still Image Class Ins taller stobject.dll 6.1.7601.17514 Systray shell service object storage.dll 2.10.35.35 OLE 2.1 16/32 Interop

erability Library storagecontexthandler.dll 6.1.7600.16385 Context Menu Handler storprop.dll 6.1.7600.16385 orage Devices streamci.dll 6.1.7600.16385 s Installer structuredquery.dll 7.0.7601.17514 sud.dll 6.1.7601.17514 swprv.dll 6.1.7600.16385 w Copy Service software provider sxproxy.dll 6.1.7600.16385 em Protection Proxy Library sxs.dll 6.1.7601.17514 sxshared.dll 6.1.7600.16385 hared Library sxssrv.dll 6.1.7600.16385 L sxsstore.dll 6.1.7600.16385 synccenter.dll 6.1.7601.17514 synceng.dll 6.1.7600.16385 ine synchostps.dll 6.1.7600.16385 st syncinfrastructure.dll 6.1.7600.16385 c Infrastructure. syncinfrastructureps.dll 6.1.7600.16385 c infrastructure proxy stub. syncreg.dll 2007.94.7600.16385 tion Framework Registration syncui.dll 6.1.7601.17514 sysclass.dll 6.1.7601.17514 r Library sysmain.dll 6.1.7601.17514 st sysntfy.dll 6.1.7600.16385 Dynamic Link Library sysprepmce.dll 6.1.7600.16385 SysPrep DLL syssetup.dll 6.1.7601.17514 up systemcpl.dll 6.1.7601.17514 t2embed.dll 6.1.7601.17514 t Embedding tabbtn.dll 6.1.7600.16385 uttons Component tabbtnex.dll 6.1.7600.16385 xtended Buttons Component tabsvc.dll 6.1.7601.17514 nput Service tapi.dll 3.10.0.103 Telephony Server16 tapi3.dll 6.1.7600.16385 tapi32.dll 6.1.7600.16385 Telephony API Client DLL tapilua.dll 6.1.7600.16385 Phone And Modem Lua Elevation Dll tapimigplugin.dll 6.1.7600.16385 TAPI Migration Plugin Dll tapiperf.dll 6.1.7600.16385

Device Center Storage Property Pages for St Streaming Device Clas Structured Query SUD Control Panel Microsoft Volume Shado Microsoft Windows Syst Fusion 2.5 Microsoft Windows SX S Windows SxS Server DL Sxs Store DLL Microsoft Sync Center Windows Briefcase Eng Proxystub for sync ho Microsoft Windows Syn Microsoft Windows syn Microsoft Synchroniza Windows Briefcase System Class Installe Superfetch Service Ho Windows Notifications Windows Media Center Windows NT System Set My System CPL Microsoft T2Embed Fon Microsoft Tablet PC B Microsoft Tablet PC E Microsoft Tablet PC I Microsoft Windows(TM) Microsoft TAPI3 Microsoft Windows(TM) Microsoft Windows(TM) Microsoft Windows(TM) Microsoft Windows(TM)

Telephony Performance Monitor tapisrv.dll 6.1.7601.17514 Telephony Server tapisysprep.dll 6.1.7600.16385 Telephony Sysprep Work tapiui.dll 6.1.7600.16385 Telephony API UI DLL taskbarcpl.dll 6.1.7601.17514 taskcomp.dll 6.1.7601.17514 rd Compatibility Plug-in taskschd.dll 6.1.7601.17514 I taskschdps.dll 6.1.7600.16385 aces Proxy tbs.dll 6.1.7600.16385 tbssvc.dll 6.1.7600.16385 tcpipcfg.dll 6.1.7601.17514 Objects tcpmib.dll 6.1.7600.16385 Monitor Helper DLL tcpmon.dll 6.1.7600.16385 Monitor DLL tcpmonui.dll 6.1.7600.16385 Monitor UI DLL tdh.dll 6.1.7600.16385 brary termmgr.dll 6.1.7601.17514 nal Manager termsrv.dll 6.1.7601.17514 n Host Server Remote Connections Manager thawbrkr.dll 6.1.7600.16385 themecpl.dll 6.1.7601.17514 themeservice.dll 6.1.7600.16385 ervice Dll themeui.dll 6.1.7601.17514 thumbcache.dll 6.1.7601.17514 ache timedatemuicallback.dll 6.1.7600.16385 Language Change plugin tlscsp.dll 6.1.7601.17514 op Services Cryptographic Utility toolhelp.dll 3.10.0.103 lper library tpmcompc.dll 6.1.7600.16385 og tquery.dll 7.0.7601.17514 traffic.dll 6.1.7600.16385 trol 1.0 DLL trapi.dll 6.1.7601.17514 xt Renderer trkwks.dll 6.1.7600.16385 king Client tsbyuv.dll 6.1.7601.17514 tscfgwmi.dll 6.1.7601.17514 n Host Server Configuration WMI provider tschannel.dll 6.1.7600.16385 tsddd.dll 6.1.7600.16385 river tserrredir.dll 6.1.7600.16385 es Logon Error Redirector

Microsoft Windows(TM) Microsoft Windows(TM) Microsoft Windows(TM) Taskbar Control Panel Task Scheduler Backwa Task Scheduler COM AP Task Scheduler Interf TBS TBS Service Network Configuration Standard TCP/IP Port Standard TCP/IP Port Standard TCP/IP Port Event Trace Helper Li Microsoft TAPI3 Termi Remote Desktop Sessio Thai Word Breaker Personalization CPL Windows Shell Theme S Windows Theme API Microsoft Thumbnail C Time Date Control UI Microsoft Remote Deskt Windows Debug/Tool he Computer Chooser Dial tquery.dll Microsoft Traffic Con Microsoft Narrator Te Distributed Link Trac Toshiba Video Codec Remote Desktop Sessio Task Scheduler Proxy Framebuffer Display D Remote Desktop Servic

tsgqec.dll 6.1.7601.17514 RD Gateway QEC tsmf.dll 6.1.7601.17514 RDP MF Plugin tspkg.dll 6.1.7601.17514 Web Service Security Package tspnprdrcoinstaller.dll 6.1.7600.16385 Remote Desktop PnP Re directed Device Co-Installer tspubwmi.dll 6.1.7601.17514 Remote Desktop Progra ms WMI provider tssrvlic.dll 6.1.7601.17514 RD Server Licensing P olicy Module tsusbgdcoinstaller.dll 6.1.7601.17514 Remote Desktop Generi c USB Driver Coinstaller tsusbredirectiongrouppolicyextension.dll 6.1.7601.17514 Remote Desktop USB Redirection GP Extension tsworkspace.dll 6.1.7601.17514 RemoteApp and Desktop Connection Component tvratings.dll 6.6.7600.16385 Module for managing T V ratings twext.dll 6.1.7601.17514 Previous Versions pro perty page twnlib4.dll 4.0.19.0 TwnLib4 txflog.dll 2001.12.8530.16385 COM+ txfw32.dll 6.1.7600.16385 TxF Win32 DLL typelib.dll 2.10.3029.1 OLE 2.1 16/32 Interop erability Library tzres.dll 6.1.7601.17514 Time Zones resource D LL ubpm.dll 6.1.7600.16385 Unified Background Pr ocess Manager DLL uci32108.dll 2.0.0.8 Conexant Unified x86 Device CoInstaller ucmhc.dll 6.1.7600.16385 UCM Helper Class udcpm.dll 0.3.5.3 Universal Document Co nverter Port Monitor udhisapi.dll 6.1.7600.16385 UPnP Device Host ISAP I Extension udwm.dll 6.1.7600.16385 Microsoft Desktop Win dow Manager uexfat.dll 6.1.7600.16385 eXfat Utility DLL ufat.dll 6.1.7600.16385 FAT Utility DLL uianimation.dll 6.1.7600.16385 Windows Animation Man ager uiautomationcore.dll 7.0.0.0 Microsoft UI Automati on Core uicom.dll 6.1.7600.16385 Add/Remove Modems uihub.dll 6.1.7600.16385 Microsoft Tablet PC F licks and Pen Feedback Component uiribbon.dll 6.1.7601.17514 Windows Ribbon Framew ork uiribbonres.dll 6.1.7601.17514 Windows Ribbon Framew ork Resources ulib.dll 6.1.7600.16385 File Utilities Suppor t DLL umb.dll 6.1.7601.17514 User Mode Bus Driver Interface Dll umdmxfrm.dll 6.1.7600.16385 Unimodem Tranform Mod ule umpnpmgr.dll 6.1.7601.17514 User-mode Plug-and-Pl ay Service umpo.dll 6.1.7601.17514 User-mode Power Servi

ce umrdp.dll 6.1.7601.17514 Remote Desktop Servic es Device Redirector Service unattend.dll 6.1.7601.17514 Unattend Library unimdmat.dll 6.1.7601.17514 Unimodem Service Prov ider AT Mini Driver uniplat.dll 6.1.7600.16385 Unimodem AT Mini Driv er Platform Driver for Windows NT untfs.dll 6.1.7601.17514 NTFS Utility DLL upnp.dll 6.1.7601.17514 UPnP Control Point AP I upnphost.dll 6.1.7600.16385 UPnP Device Host ureg.dll 6.1.7600.16385 Registry Utility DLL url.dll 8.0.7600.16385 Internet Shortcut She ll Extension DLL urlmon.dll 8.0.7601.17514 OLE32 Extensions for Win32 usbceip.dll 6.1.7600.16385 USBCEIP Task usbmon.dll 6.1.7600.16385 Standard Dynamic Prin ting Port Monitor DLL usbperf.dll 6.1.7600.16385 USB Performance Objec ts DLL usbui.dll 6.1.7600.16385 USB UI Dll user32.dll 6.1.7601.17514 Multi-User Windows US ER API Client DLL useraccountcontrolsettings.dll 6.1.7601.17514 UserAccountContr olSettings usercpl.dll 6.1.7601.17514 User control panel userenv.dll 6.1.7601.17514 Userenv usp10.dll 1.626.7601.17514 Uniscribe Unicode scr ipt processor utildll.dll 6.1.7601.17514 WinStation utility su pport DLL uudf.dll 6.1.7600.16385 UDF Utility DLL uxinit.dll 6.1.7600.16385 Windows User Experien ce Session Initialization Dll uxlib.dll 6.1.7601.17514 Setup Wizard Framewor k uxlibres.dll 6.1.7600.16385 UXLib Resources uxsms.dll 6.1.7600.16385 Microsoft User Experi ence Session Management Service uxtheme.dll 6.1.7600.16385 Microsoft UxTheme Lib rary van.dll 6.1.7601.17514 View Available Networ ks vault.dll 6.1.7601.17514 Windows vault Control Panel vaultcli.dll 6.1.7600.16385 Credential Vault Clie nt Library vaultcredprovider.dll 6.1.7600.16385 Vault Credential Prov ider vaultsvc.dll 6.1.7601.17514 Credential Manager Se rvice vbajet32.dll 6.0.1.9431 Visual Basic for Appl ications Development Environment - Expression Service Loader vbscript.dll 5.8.7601.17514 Microsoft VBScript vdmdbg.dll 6.1.7600.16385 VDMDBG.DLL vdmredir.dll 6.1.7600.16385 Virtual Dos Machine N etwork Interface Library vds_ps.dll 6.1.7600.16385 Microsoft Virtual Disk

Service proxy/stub vdsbas.dll 6.1.7601.17514 Basic Provider vdsdyn.dll 6.1.7600.16385 ovider, Version 2.1.0.1 vdsutil.dll 6.1.7601.17514 Utility Library vdsvd.dll 6.1.7600.16385 ider, Version 1.0 ver.dll 3.10.0.103 File Installation Libraries verifier.dll 6.1.7600.16385 verifier provider dll version.dll 6.1.7600.16385 File Installation Libraries vfpodbc.dll 1.0.2.0 vfwwdm32.dll 6.1.7601.17514 Video Capture Devices vga.dll 6.1.7600.16385 Driver vga256.dll 6.1.7600.16385 splay Driver vga64k.dll 6.1.7600.16385 A Display Driver vidreszr.dll 6.1.7600.16385 virtdisk.dll 6.1.7600.16385 vmbuscoinstaller.dll 6.1.7601.17514 ller vmbuspipe.dll 6.1.7601.17514 DLL vmbusres.dll 6.1.7601.17514 esource DLL vmdcoinstall.dll 6.1.7601.17514 omponents Coinstaller vmicres.dll 6.1.7601.17514 ration Component Service Resource DLL vmictimeprovider.dll 6.1.7601.17514 ration Component Time Sync Provider Library vmstorfltres.dll 6.1.7601.17514 ge Filter Resource DLL vpnike.dll 6.1.7601.17514 e - Test dll vpnikeapi.dll 6.1.7601.17514 vss_ps.dll 6.1.7600.16385 w Copy Service proxy/stub vssapi.dll 6.1.7601.17514 w Copy Requestor/Writer Services API DLL vsstrace.dll 6.1.7600.16385 w Copy Service Tracing Library w32time.dll 6.1.7600.16385 w32topl.dll 6.1.7600.16385 aintenance Tool wab32.dll 6.1.7600.16385 s DLL wab32res.dll 6.1.7600.16385 s DLL wabsyncprovider.dll 6.1.7600.16385 tacts Sync Provider wavdest.dll 6.1.7601.17514 r

Virtual Disk Service VDS Dynamic Volume Pr Virtual Disk Service VDS Virtual Disk Prov Version Checking and Standard application Version Checking and vfpodbc VfW MM Driver for WDM VGA 16 Colour Display 256 Color VGA\SVGA Di 32K/64K color VGA\SVG Windows Media Resizer Virtual Disk API DLL Hyper-V VMBUS Coinsta VmBus User Mode Pipe Virtual Machine Bus R Hyper-V Integration C Virtual Machine Integ Virtual Machine Integ Virtual Machine Stora VPNIKE Protocol Engin VPN IKE API's Microsoft Volume Shado Microsoft Volume Shado Microsoft Volume Shado Windows Time Service Windows NT Topology M Microsoft (R) Contact Microsoft (R) Contact Microsoft Windows Con Windows Sound Recorde

wavemsp.dll wbemcomn.dll wbiosrvc.dll vice wcnapi.dll API Helper DLL wcncsvc.dll Config Registrar Service wcneapauthproxy.dll WCN EAP Authenticator Proxy wcneappeerproxy.dll WCN EAP PEER Proxy wcnnetsh.dll wcnwiz.dll izards wcspluginservice.dll wdc.dll wdfcoinstaller01009.dll wdi.dll frastructure wdiasqmmodule.dll in wdigest.dll ss wdscore.dll webcheck.dll webclnt.dll webio.dll s API webservices.dll Runtime wecapi.dll guration API wecsvc.dll ce wer.dll ng DLL werconcpl.dll wercplsupport.dll olutions werdiagcontroller.dll ller wersvc.dll ng Service werui.dll ng UI DLL wevtapi.dll and Configuration API wevtfwd.dll orwarding Plug-in wevtsvc.dll wfapigp.dll Helper dll wfhc.dll per Class wfsr.dll Resources whealogr.dll whhelper.dll for winHttp

6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 1.9.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514 8.0.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385

Microsoft Wave MSP WMI Windows Biometric Ser Windows Connect Now Windows Connect Now Windows Connect Now Windows Connect Now WCN Netsh Helper DLL Windows Connect Now W WcsPlugInService DLL Performance Monitor WDF Coinstaller Windows Diagnostic In Adaptive SQM WDI Plug Microsoft Digest Acce Panther Engine Module Web Site Monitor Web DAV Service DLL Web Transfer Protocol Windows Web Services Event Collector Confi Event Collector Servi Windows Error Reporti PRS CPL Problem Reports and S WER Diagnostic Contro Windows Error Reporti Windows Error Reporti Eventing Consumption WS-Management Event F Event Logging Service Windows Firewall GPO Windows Firewall Hel Windows Fax and Scan WHEA Troubleshooter Net shell helper DLL

wiaaut.dll wiadefui.dll I wiadss.dll ty layer wiarpc.dll tion RPC client DLL wiascanprofiles.dll nProfiles wiaservc.dll ervice wiashext.dll Folder UI wiatrace.dll wiavideo.dll wifeman.dll e core component wimgapi.dll ry win32spl.dll Print Provider win87em.dll winbio.dll ient API winbrand.dll urces wincredprovider.dll windowsaccessbridge.dll r Windows windowscodecs.dll ecs Library windowscodecsext.dll ecs Extended Library winethc.dll winfax.dll pport DLL winhttp.dll wininet.dll or Win32 winipsec.dll ent DLL winmm.dll winnls.dll core component winnsi.dll tion RPC interface winrnr.dll winrscmd.dll winrsmgr.dll winrssrv.dll winsatapi.dll ment Tool API winscard.dll API winshfhc.dll winsock.dll DLL winsockhc.dll ostic Helper Class winsrpc.dll

6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 3.10.0.103 6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 2.0.7.0 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 8.0.7601.17514 6.1.7600.16385 6.1.7601.17514 3.10.0.103 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 3.10.0.103 6.1.7600.16385 6.1.7600.16385

WIA Automation Layer WIA Scanner Default U WIA TWAIN compatibili Windows Image Acquisi Microsoft Windows Sca Still Image Devices S Imaging Devices Shell WIA Tracing WIA Video Windows WIFE interfac Windows Imaging Libra Client Side Rendering Windows Biometrics Cl Windows Branding Reso wincredprovider DLL Java Access Bridge fo Microsoft Windows Cod Microsoft Windows Cod WinInet Helper Class Microsoft Fax API Su Windows HTTP Services Internet Extensions f Windows IPsec SPD Cli MCI API DLL Windows IME interface Network Store Informa LDAP RnR Provider DLL remtsvc WSMan Shell API winrssrv Windows System Assess Microsoft Smart Card File Risk Estimation Windows Socket 16-Bit Winsock Network Diagn WINS RPC LIBRARY

winsrv.dll 6.1.7601.17514 rver DLL winsta.dll 6.1.7601.17514 winsync.dll 2007.94.7600.16385 work winsyncmetastore.dll 2007.94.7600.16385 on Metadata Store winsyncproviders.dll 2007.94.7600.16385 on Provider Framework wintrust.dll 6.1.7601.17514 ication APIs winusb.dll 6.1.7600.16385 er Library wkscli.dll 6.1.7601.17514 lient DLL wksprtps.dll 6.1.7600.16385 yStub DLL wkssvc.dll 6.1.7601.17514 LL wlanapi.dll 6.1.7600.16385 ig Client Side API DLL wlancfg.dll 6.1.7600.16385 wlanconn.dll 6.1.7600.16385 s wlandlg.dll 6.1.7600.16385 izards wlangpui.dll 6.1.7601.17514 cy Management Snap-in wlanhc.dll 6.1.7600.16385 lasses wlanhlp.dll 6.1.7600.16385 802.11 Client Side Helper API wlaninst.dll 6.1.7600.16385 ass Co-Installer for Wireless LAN wlanmm.dll 6.1.7600.16385 Managers wlanmsm.dll 6.1.7601.17514 802.11 MSM DLL wlanpref.dll 6.1.7601.17514 tworks wlansec.dll 6.1.7600.16385 802.11 MSM Security Module DLL wlansvc.dll 6.1.7600.16385 ig Service DLL wlanui.dll 6.1.7601.17514 wlanutil.dll 6.1.7600.16385 802.11 Utility DLL wldap32.dll 6.1.7601.17514 wlgpclnt.dll 6.1.7600.16385 lient wls0wndh.dll 6.1.7600.16385 w Hook DLL wmadmod.dll 6.1.7601.17514 ecoder wmadmoe.dll 6.1.7600.16385 0 Encoder/Transcoder wmasf.dll 12.0.7600.16385 wmcodecdspps.dll 6.1.7600.16385 P Proxy Stub Dll wmdmlog.dll 12.0.7600.16385

Multi-User Windows Se Winstation Library Synchronization Frame Windows Synchronizati Windows Synchronizati Microsoft Trust Verif Windows USB Driver Us Workstation Service C WorkspaceRuntime Prox Workstation Service D Windows WLAN AutoConf Wlan Netsh Helper DLL Dot11 Connection Flow Wireless Lan Dialog W Wireless Network Poli Wireless LAN Helper C Windows Wireless LAN Windows NET Device Cl Dot11 Media and AdHoc Windows Wireless LAN Wireless Preferred Ne Windows Wireless LAN Windows WLAN AutoConf Wireless Profile UI Windows Wireless LAN Win32 LDAP API DLL 802.11 Group Policy C Session0 Viewer Windo Windows Media Audio D Windows Media Audio 1 Windows Media ASF DLL Windows Media CodecDS Windows Media Device

Manager Logger wmdmps.dll Manager Proxy Stub wmdrmdev.dll Network Devices Registration wmdrmnet.dll Network Devices DLL wmdrmsdk.dll DLL wmerror.dll efinitions (English) wmi.dll nality wmicmiplugin.dll wmidx.dll DLL wmiprop.dll Property Page CoInstaller wmnetmgr.dll Plugin Manager DLL wmp.dll wmpcm.dll Compositing Mixer wmpdui.dll UI Engine wmpdxm.dll Extension wmpeffects.dll Effects wmpencen.dll Encoding Module wmphoto.dll odec wmploc.dll Resources wmpmde.dll wmpps.dll Proxy Stub Dll wmpshell.dll Launcher wmpsrcwp.dll wmsgapi.dll wmspdmod.dll oice Decoder wmspdmoe.dll oice Encoder wmvcore.dll k/Authoring DLL wmvdecod.dll ecoder wmvdspa.dll SP Components - Advanced wmvencod.dll Encoder wmvsdecd.dll Decoder wmvsencd.dll Encoder wmvxencd.dll ncoder

12.0.7600.16385 12.0.7601.17514 DLL 12.0.7601.17514 11.0.7601.17514 12.0.7600.16385 6.1.7600.16385 6.1.7601.17514 12.0.7600.16385 6.1.7600.16385 12.0.7601.17514 12.0.7601.17514 12.0.7600.16385 12.0.7600.16385 12.0.7601.17514 12.0.7601.17514 12.0.7601.17514 6.1.7601.17514 12.0.7601.17514 12.0.7601.17514 12.0.7601.17514 12.0.7601.17514 12.0.7601.17514 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 12.0.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385

Windows Media Device Windows Media DRM for Windows Media DRM for Windows Media DRM SDK Windows Media Error D WMI DC and DP functio WMI CMI Plugin Windows Media Indexer WDM Provider Dynamic Windows Media Network Windows Media Player Windows Media Player Windows Media Player Windows Media Player Windows Media Player Windows Media Player Windows Media Photo C Windows Media Player WMPMDE DLL Windows Media Player Windows Media Player WMPSrcWp Module WinLogon IPC Client Windows Media Audio V Windows Media Audio V Windows Media Playbac Windows Media Video D Windows Media Video D Windows Media Video 9 Windows Media Screen Windows Media Screen Windows Media Video E

wow32.dll 6.1.7600.16385 Library wpc.dll 1.0.0.1 wpcao.dll 6.1.7600.16385 rride wpccpl.dll 6.1.7601.17514 trol Panel wpcmig.dll 1.0.0.1 rols Migration wpcsvc.dll 1.0.0.1 wpcumi.dll 1.0.0.1 rols Notifications wpd_ci.dll 6.1.7601.17514 staller for Windows Portable Devices wpdbusenum.dll 6.1.7601.17514 rator wpdshext.dll 6.1.7601.17514 l Extension wpdshserviceobj.dll 6.1.7601.17514 ce Shell Service Object wpdsp.dll 6.1.7601.17514 for Windows Portable Devices wpdwcn.dll 6.1.7601.17514 ce WCN Wizard ws2_32.dll 6.1.7601.17514 -Bit DLL ws2help.dll 6.1.7600.16385 lper for Windows NT wscapi.dll 6.1.7601.17514 er API wscinterop.dll 6.1.7600.16385 WSC Interop wscisvif.dll 6.1.7600.16385 er ISV API wscmisetup.dll 6.1.7600.16385 k Transport and Name Space Providers wscproxystub.dll 6.1.7600.16385 er ISV Proxy Stub wscsvc.dll 6.1.7600.16385 er Service wsdapi.dll 6.1.7601.17514 ces API DLL wsdchngr.dll 6.1.7601.17514 nt wsdmon.dll 6.1.7600.16385 tor wsdprintproxy.dll 6.1.7600.16385 inter Proxy Dll wsdscanproxy.dll 6.1.7600.16385 D Scanner Proxy Dll wsecedit.dll 6.1.7600.16385 n UI Module wsepno.dll 7.0.7600.16385 support for Windows Search Service wshbth.dll 6.1.7601.17514 r DLL wshcon.dll 5.8.7600.16385 ipt Controller wshelper.dll 6.1.7600.16385 per DLL for winsock

32-bit WOW Subsystem WPC Settings Library WPC Administrator Ove Parental Controls Con Windows Parental Cont WPC Filtering Service Windows Parental Cont Driver Setup Class In Portable Device Enume Portable Devices Shel Windows Portable Devi WMDM Service Provider Windows Portable Devi Windows Socket 2.0 32 Windows Socket 2.0 He Windows Security Cent Windows Health Center Windows Security Cent Installers for Winsoc Windows Security Cent Windows Security Cent Web Services for Devi WSD Challenge Compone WSD Printer Port Moni Function Discovery Pr Function Discovery WS Security Configuratio Profile notification Windows Sockets Helpe Microsoft Windows Scr Winsock Net shell hel

wshext.dll 5.8.7600.16385 sion for Windows Script Host wship6.dll 6.1.7600.16385 TL/IPv6) wshirda.dll 6.1.7601.17514 r DLL wshnetbs.dll 6.1.7600.16385 ts Helper DLL wshqos.dll 6.1.7600.16385 LL wshrm.dll 6.1.7600.16385 r DLL for PGM wshtcpip.dll 6.1.7600.16385 TL/IPv4) wsmanmigrationplugin.dll 6.1.7600.16385 n wsmauto.dll 6.1.7600.16385 wsmplpxy.dll 6.1.7600.16385 wsmres.dll 6.1.7600.16385 wsmsvc.dll 6.1.7601.17514 wsmwmipl.dll 6.1.7600.16385 wsnmp32.dll 6.1.7601.17514 0 Manager API wsock32.dll 6.1.7600.16385 DLL wtsapi32.dll 6.1.7601.17514 p Session Host Server SDK APIs wuapi.dll 7.5.7601.17514 API wuaueng.dll 7.5.7601.17514 wucltux.dll 7.5.7601.17514 User Experience wudfcoinstaller.dll 6.1.7601.17514 tion - User-mode Platform Device Co-Installer wudfplatform.dll 6.1.7601.17514 tion - User-mode Platform Library wudfsvc.dll 6.1.7601.17514 tion - User-mode Driver Framework Service wudfx.dll 6.1.7601.17514 brary wudriver.dll 7.5.7601.17514 er Stub wups.dll 7.5.7601.17514 proxy stub wups2.dll 7.5.7601.17514 proxy stub 2 wuwebv.dll 7.5.7601.17514 Web Control wvc.dll 6.1.7601.17514 ents wwanadvui.dll 8.1.2.0 on Flows wwanapi.dll 6.1.7600.16385 wwancfg.dll 6.1.7600.16385 wwanconn.dll 8.1.7601.17514 on Flows wwanhc.dll 8.1.2.0 lass wwaninst.dll 8.1.2.0 ass Co-Installer for Wireless WAN

Microsoft Shell Exten Winsock2 Helper DLL ( Windows Sockets Helpe Netbios Windows Socke QoS Winsock2 Helper D Windows Sockets Helpe Winsock2 Helper DLL ( WinRM Migration Plugi WSMAN Automation wsmplpxy WSMan Resource DLL WSMan Service WSMAN WMI Provider Microsoft WinSNMP v2. Windows Socket 32-Bit Windows Remote Deskto Windows Update Client Windows Update Agent Windows Update Client Windows Driver Founda Windows Driver Founda Windows Driver Founda WDF:UMDF Framework Li Windows Update WUDriv Windows Update client Windows Update client Windows Update Vista Windows Visual Compon Wireless WAN Connecti Mbnapi MBN Netsh Helper DLL Wireless WAN Connecti Wireless WAN Helper C Windows NET Device Cl

wwanmm.dll wwanpref.dll Settings Editor wwanprotdim.dll Module wwansvc.dll ice wwapi.dll wzcdlg.dll Flash Config Enrollee x3daudio1_0.dll x3daudio1_1.dll x3daudio1_2.dll x3daudio1_3.dll x3daudio1_4.dll x3daudio1_5.dll x3daudio1_6.dll x3daudio1_7.dll xactengine2_0.dll xactengine2_1.dll xactengine2_10.dll xactengine2_2.dll xactengine2_3.dll xactengine2_4.dll xactengine2_5.dll xactengine2_6.dll xactengine2_7.dll xactengine2_8.dll xactengine2_9.dll xactengine3_0.dll xactengine3_1.dll xactengine3_2.dll xactengine3_3.dll xactengine3_4.dll xactengine3_5.dll xactengine3_6.dll xactengine3_7.dll xapofx1_0.dll xapofx1_1.dll xapofx1_2.dll xapofx1_3.dll xapofx1_4.dll xapofx1_5.dll xaudio2_0.dll I xaudio2_1.dll I xaudio2_2.dll I xaudio2_3.dll I xaudio2_4.dll I xaudio2_5.dll I xaudio2_6.dll I xaudio2_7.dll I xinput1_1.dll

8.1.2.0 8.1.2.0 8.1.7601.17514 8.1.2.0 8.1.2.0 6.1.7600.16385 9.11.519.0 9.15.779.0 9.21.1148.0 9.22.1284.0 9.23.1350.0 9.25.1476.0 9.26.1590.0 9.28.1886.0 9.11.519.0 9.12.589.0 9.21.1148.0 9.13.644.0 9.14.701.0 9.15.779.0 9.16.857.0 9.17.892.0 9.18.944.0 9.19.1007.0 9.20.1057.0 9.22.1284.0 9.23.1350.0 9.24.1400.0 9.25.1476.0 9.26.1590.0 9.27.1734.0 9.28.1886.0 9.29.1962.0 9.23.1350.0 9.24.1400.0 9.25.1476.0 9.26.1590.0 9.28.1886.0 9.29.1962.0 9.22.1284.0 9.23.1350.0 9.24.1400.0 9.25.1476.0 9.26.1590.0 9.27.1734.0 9.28.1886.0 9.29.1962.0 9.12.589.0

WWan Media Manager Wireless WAN Profile WWAN Device Interface WWAN Auto Config Serv WWAN API Windows Connect Now X3DAudio X3DAudio X3DAudio X3DAudio X3DAudio X3DAudio 3D Audio Library 3D Audio Library XACT Engine API XACT Engine API XACT Engine API XACT Engine API XACT Engine API XACT Engine API XACT Engine API XACT Engine API XACT Engine API XACT Engine API XACT Engine API XACT Engine API XACT Engine API XACT Engine API XACT Engine API XACT Engine API XACT Engine API XACT Engine API XACT Engine API XAPOFX XAPOFX XAPOFX Audio Effect Library Audio Effect Library Audio Effect Library XAudio2 Game Audio AP XAudio2 Game Audio AP XAudio2 Game Audio AP XAudio2 Game Audio AP XAudio2 Game Audio AP XAudio2 Game Audio AP XAudio2 Game Audio AP XAudio2 Game Audio AP Microsoft Common Cont

roller API xinput1_2.dll 9.14.701.0 roller API xinput1_3.dll 9.18.944.0 roller API xinput9_1_0.dll 6.1.7600.16385 xmlfilter.dll 2008.0.7600.16385 xmllite.dll 1.3.1000.0 rary xmlprovi.dll 6.1.7600.16385 Service Client API xmlrw.dll 2.0.3609.0 brary xmlrwbin.dll 2.0.3609.0 brary xolehlp.dll 2001.12.8530.16385 Transaction Coordinator Helper APIs DLL xpsfilt.dll 6.1.7600.16385 on Document IFilter xpsgdiconverter.dll 6.1.7601.17514 xpsprint.dll 6.1.7601.17514 xpsrasterservice.dll 6.1.7601.17514 vice Component xpsservices.dll 6.1.7601.17514 emory creation and deserialization xpsshhdr.dll 6.1.7600.16385 l Extension Handler xpssvcs.dll 6.1.7600.16385 ces Library xwizards.dll 6.1.7600.16385 nager Module xwreg.dll 6.1.7600.16385 istration Manager Module xwtpdui.dll 6.1.7600.16385 e Plugin for DUI xwtpw32.dll 6.1.7600.16385 e Plugin for Win32 zgmprxy.dll 6.1.7600.16385 the Internet Games zipfldr.dll 6.1.7601.17514 olders

Microsoft Common Cont Microsoft Common Cont XNA Common Controller XML Filter Microsoft XmlLite Lib Network Provisioning Microsoft XML Slim Li Microsoft XML Slim Li Microsoft Distributed XML Paper Specificati XPS to GDI Converter XPS Printing DLL XPS Rasterization Ser Xps Object Model in m Package Document Shel Native Code Xps Servi Extensible Wizards Ma Extensible Wizard Reg Extensible Wizard Typ Extensible Wizard Typ Internal file used by Compressed (zipped) F

--------[ UpTime ]----------------------------------------------------------------------------------------------------Current Session: Last Shutdown Time Last Boot Time Current Time UpTime rs, 40 min, 47 sec) UpTime Statistics: First Boot Time First Shutdown Time Total UpTime rs, 12 min, 25 sec) Total DownTime s, 11 min, 25 sec) 8/19/2013 8/19/2013 8/19/2013 20447 sec 4:58:04 PM 5:45:53 PM 11:26:09 PM (0 days, 5 hou

8/19/2013 2:04:24 PM 8/19/2013 2:03:31 PM 29545 sec (0 days, 8 hou 4285 sec (0 days, 1 hour

Longest UpTime rs, 40 min, 47 sec) Longest DownTime s, 47 min, 49 sec) Total Reboots System Availability Bluescreen Statistics: Total Bluescreens Information: Information based on System Event Log entries

20447 sec (0 days, 5 hou 2869 sec (0 days, 0 hour 11 87.33% 0 The above statistics are

--------[ Share ]-----------------------------------------------------------------------------------------------------ADMIN$ C:\Windows C$ C:\ D$ D:\ G$ G:\ IPC$ IPC Remote IPC Folder Default share Folder Default share Folder Default share Folder Remote Admin

--------[ Account Security ]------------------------------------------------------------------------------------------Account Security Properties: Computer Role Domain Name Primary Domain Controller Forced Logoff Time Min / Max Password Age Minimum Password Length Password History Length Lockout Threshold Lockout Duration Lockout Observation Window Primary emovhicRN Not Specified Disabled 0 / 42 days 0 chars Disabled Disabled 30 min 30 min

--------[ Logon ]-----------------------------------------------------------------------------------------------------Vic Tiangco hicRN EMOVHICRN emov

--------[ Users ]-----------------------------------------------------------------------------------------------------[ Administrator ] User Properties: User Name Administrator

Full Name Comment inistering the computer/domain Member Of Groups Logon Count Disk Quota User Features: Logon Script Executed Account Disabled Locked Out User Home Folder Required Password Required Read-Only Password Password Never Expires [ Guest ] User Properties: User Name Full Name Comment st access to the computer/domain Member Of Groups Logon Count Disk Quota User Features: Logon Script Executed Account Disabled Locked Out User Home Folder Required Password Required Read-Only Password Password Never Expires [ Vic Tiangco ] User Properties: User Name Full Name Member Of Groups Logon Count Disk Quota User Features: Logon Script Executed Account Disabled Locked Out User Home Folder Required Password Required Read-Only Password Password Never Expires

Administrator Built-in account for adm Administrators 6 Yes Yes No No Yes No Yes

Guest Guest Built-in account for gue Guests 0 Yes Yes No No No Yes Yes

Vic Tiangco Vic Tiangco Administrators 14 Yes No No No No No Yes

--------[ Local Groups ]----------------------------------------------------------------------------------------------[ Administrators ]

Local Group Properties: Comment lete and unrestricted access to the computer/domain Group Members: Administrator Vic Tiangco [ Backup Operators ]

Administrators have comp

Local Group Properties: Comment Backup Operators can ove rride security restrictions for the sole purpose of backing up or restoring file s [ Cryptographic Operators ] Local Group Properties: Comment o perform cryptographic operations. [ Distributed COM Users ] Local Group Properties: Comment Members are allowed to l aunch, activate and use Distributed COM objects on this machine. [ Event Log Readers ] Local Group Properties: Comment n read event logs from local machine [ Guests ] Local Group Properties: Comment Guests have the same acc ess as members of the Users group by default, except for the Guest account which is further restricted Group Members: Guest [ IIS_IUSRS ] Local Group Properties: Comment nternet Information Services. Group Members: IUSR [ Network Configuration Operators ] Local Group Properties: Comment Members in this group ca n have some administrative privileges to manage configuration of networking feat ures [ Performance Log Users ] Built-in group used by I Members of this group ca Members are authorized t

Local Group Properties: Comment Members of this group ma y schedule logging of performance counters, enable trace providers, and collect event traces both locally and via remote access to this computer [ Performance Monitor Users ] Local Group Properties: Comment Members of this group ca n access performance counter data locally and remotely [ Power Users ] Local Group Properties: Comment Power Users are included for backwards compatibility and possess limited administrative powers [ Remote Desktop Users ] Local Group Properties: Comment e granted the right to logon remotely [ Replicator ] Local Group Properties: Comment n in a domain [ Users ] Local Group Properties: Comment Users are prevented from making accidental or intentional system-wide changes and can run most applicati ons Group Members: Authenticated Users INTERACTIVE --------[ Global Groups ]---------------------------------------------------------------------------------------------[ None ] Global Group Properties: Comment Group Members: Administrator Guest Vic Tiangco --------[ Windows Video ]---------------------------------------------------------------------------------------------[ Mobile Intel(R) 915GM/GMS,910GML Express Chipset Family ] Ordinary users Supports file replicatio Members in this group ar

Video Adapter Properties: Device Description S,910GML Express Chipset Family Adapter String L Express Chipset BIOS String Chip Type L Express Chipset DAC Type Memory Size Installed Drivers: igxprd32 Video Adapter Manufacturer: Company Name Product Information ducts/chipsets Driver Download /support/graphics Driver Update ef=59

Mobile Intel(R) 915GM/GM Intel(R) 915GM/GMS,910GM Intel Video BIOS Intel(R) 915GM/GMS,910GM Internal 128 MB 6.14.10.4704 Intel Corporation http://www.intel.com/pro http://support.intel.com http://driveragent.com?r

[ Mobile Intel(R) 915GM/GMS,910GML Express Chipset Family ] Video Adapter Properties: Device Description S,910GML Express Chipset Family Adapter String L Express Chipset BIOS String Chip Type L Express Chipset DAC Type Memory Size Installed Drivers: igxprd32 Video Adapter Manufacturer: Company Name Product Information ducts/chipsets Driver Download /support/graphics Driver Update ef=59 Mobile Intel(R) 915GM/GM Intel(R) 915GM/GMS,910GM Intel Video BIOS Intel(R) 915GM/GMS,910GM Internal 128 MB 6.14.10.4704 Intel Corporation http://www.intel.com/pro http://support.intel.com http://driveragent.com?r

--------[ PCI / AGP Video ]-------------------------------------------------------------------------------------------Intel GMA 900 Video Adapter Intel GMA 900 3D Accelerator --------[ GPU ]-----------------------------------------------------------------

---------------------------------------[ Integrated: Intel 82915GM Graphics Controller 0 ] Graphics Processor Properties: Video Adapter ontroller 0 GPU Code Name PCI Device Rev 03) Bus Type RAMDAC Clock Pixel Pipelines TMU Per Pipeline Vertex Shaders Pixel Shaders DirectX Hardware Support Graphics Processor Manufacturer: Company Name Product Information ducts/chipsets Driver Download /support/graphics Driver Update ef=59 Intel 82915GM Graphics C Alviso-GM 8086-2592 / 103C-30C4 ( Integrated 400 MHz 4 1 1 (v2.0) 4 (v2.0) DirectX v9.0 Intel Corporation http://www.intel.com/pro http://support.intel.com http://driveragent.com?r

--------[ Monitor ]---------------------------------------------------------------------------------------------------[ Chi Mei N154I2-L02 ] Monitor Properties: Monitor Name Monitor ID Manufacturer Monitor Type Manufacture Date Serial Number Max. Visible Display Size Picture Aspect Ratio Maximum Resolution Gamma DPMS Mode Support [ Chi Mei N154I2-L02 ] Monitor Properties: Monitor Name Monitor ID Manufacturer Monitor Type Manufacture Date Serial Number Max. Visible Display Size Picture Aspect Ratio Maximum Resolution Gamma DPMS Mode Support Chi Mei N154I2-L02 CMO1526 N154I2-L02 15.4" LCD (WXGA) Week 9 / 2006 None 33 cm x 21 cm (15.4") 16:10 1280 x 800 2.20 None Chi Mei N154I2-L02 CMO1526 N154I2-L02 15.4" LCD (WXGA) Week 9 / 2006 None 33 cm x 21 cm (15.4") 16:10 1280 x 800 2.20 None

[ Chi Mei N154I2-L02 ] Monitor Properties: Monitor Name Monitor ID Manufacturer Monitor Type Manufacture Date Serial Number Max. Visible Display Size Picture Aspect Ratio Maximum Resolution Gamma DPMS Mode Support Chi Mei N154I2-L02 CMO1526 N154I2-L02 15.4" LCD (WXGA) Week 9 / 2006 None 33 cm x 21 cm (15.4") 16:10 1280 x 800 2.20 None

--------[ Desktop ]---------------------------------------------------------------------------------------------------Desktop Properties: Device Technology Raster Display Resolution 1280 x 800 Color Depth 32-bit Color Planes 1 Font Resolution 96 dpi Pixel Width / Height 36 / 36 Pixel Diagonal 51 Vertical Refresh Rate 60 Hz Desktop Wallpaper C:\Users\Vic Tiangco\App Data\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg Desktop Effects: Combo-Box Animation Drop Shadow Effect Flat Menu Effect Font Smoothing ClearType Full Window Dragging Gradient Window Title Bars Hide Menu Access Keys Hot Tracking Effect Icon Title Wrapping List-Box Smooth Scrolling Menu Animation Menu Fade Effect Minimize/Restore Animation Mouse Cursor Shadow Selection Fade Effect ShowSounds Accessibility Feature ToolTip Animation ToolTip Fade Effect Windows Aero Windows Plus! Extension Disabled Disabled Disabled Disabled Disabled Disabled Enabled Enabled Enabled Enabled Disabled Disabled Enabled Disabled Disabled Disabled Disabled Disabled Enabled Disabled Disabled

--------[ Multi-Monitor ]---------------------------------------------------------------------------------------------\\.\DISPLAY1 Yes (0,0) (1280,800)

--------[ Video Modes ]-----------------------------------------------------------------------------------------------320 x 200 320 x 200 320 x 200 320 x 240 320 x 240 320 x 240 400 x 300 400 x 300 400 x 300 512 x 384 512 x 384 512 x 384 640 x 400 640 x 400 640 x 400 640 x 480 640 x 480 640 x 480 640 x 480 800 x 600 800 x 600 800 x 600 1024 x 768 1024 x 768 1024 x 768 1280 x 600 1280 x 600 1280 x 600 1280 x 720 1280 x 720 1280 x 720 1280 x 768 1280 x 768 1280 x 768 1280 x 800 1280 x 800 1280 x 800 8-bit 16-bit 32-bit 8-bit 16-bit 32-bit 8-bit 16-bit 32-bit 8-bit 16-bit 32-bit 8-bit 16-bit 32-bit 4-bit 8-bit 16-bit 32-bit 8-bit 16-bit 32-bit 8-bit 16-bit 32-bit 8-bit 16-bit 32-bit 8-bit 16-bit 32-bit 8-bit 16-bit 32-bit 8-bit 16-bit 32-bit 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz Default 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz 60 Hz

--------[ OpenGL ]----------------------------------------------------------------------------------------------------OpenGL Properties: Vendor Renderer Version OpenGL DLL 090713-1255) Sub-Pixel Precision Max Viewport Size Max Clipping Planes Max Display-List Nesting Level Max Evaluator Order Max Light Sources Max Pixel Map Table Size Microsoft Corporation GDI Generic 1.1.0 6.1.7600.16385(win7_rtm. 3-bit 16384 x 16384 6 64 30 8 65536

OpenGL Compliancy: OpenGL 1.1 OpenGL 1.2 OpenGL 1.3 OpenGL 1.4 OpenGL 1.5 OpenGL 2.0 OpenGL 2.1 OpenGL 3.0 OpenGL 3.1 Max Stack Depth: Attribute Stack Client Attribute Stack Modelview Matrix Stack Name Stack Projection Matrix Stack Texture Matrix Stack OpenGL Extensions: GL_3DFX_multisample GL_3DFX_tbuffer GL_3DFX_texture_compression_FXT1 GL_3DL_direct_texture_access2 GL_3Dlabs_multisample_transparency_id GL_3Dlabs_multisample_transparency_range GL_AMD_performance_monitor GL_AMD_texture_texture4 GL_AMDX_vertex_shader_tessellator GL_APPLE_aux_depth_stencil GL_APPLE_client_storage GL_APPLE_element_array GL_APPLE_fence GL_APPLE_float_pixels GL_APPLE_flush_buffer_range GL_APPLE_flush_render GL_APPLE_packed_pixel GL_APPLE_packed_pixels GL_APPLE_pixel_buffer GL_APPLE_specular_vector GL_APPLE_texture_range GL_APPLE_transform_hint GL_APPLE_vertex_array_object GL_APPLE_vertex_array_range GL_APPLE_vertex_program_evaluators GL_APPLE_ycbcr_422 GL_ARB_color_buffer_float GL_ARB_compatibility GL_ARB_copy_buffer GL_ARB_depth_buffer_float GL_ARB_depth_texture GL_ARB_draw_buffers GL_ARB_draw_instanced GL_ARB_fragment_program GL_ARB_fragment_program_shadow GL_ARB_fragment_shader GL_ARB_framebuffer_object GL_ARB_framebuffer_sRGB GL_ARB_geometry_shader4

Yes No No No No No No No No 16 16 32 128 10 10 Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not

(100%) (12%) (0%) (0%) (0%) (0%) (0%) (0%) (0%)

Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported

GL_ARB_half_float_pixel GL_ARB_half_float_vertex GL_ARB_imaging GL_ARB_instanced_arrays GL_ARB_map_buffer_range GL_ARB_matrix_palette GL_ARB_multisample GL_ARB_multitexture GL_ARB_occlusion_query GL_ARB_pixel_buffer_object GL_ARB_point_parameters GL_ARB_point_sprite GL_ARB_shader_objects GL_ARB_shader_texture_lod GL_ARB_shading_language_100 GL_ARB_shadow GL_ARB_shadow_ambient GL_ARB_texture_border_clamp GL_ARB_texture_buffer_object GL_ARB_texture_compression GL_ARB_texture_compression_rgtc GL_ARB_texture_cube_map GL_ARB_texture_env_add GL_ARB_texture_env_combine GL_ARB_texture_env_crossbar GL_ARB_texture_env_dot3 GL_ARB_texture_float GL_ARB_texture_mirrored_repeat GL_ARB_texture_non_power_of_two GL_ARB_texture_rectangle GL_ARB_texture_rg GL_ARB_transpose_matrix GL_ARB_uniform_buffer_object GL_ARB_vertex_array_object GL_ARB_vertex_blend GL_ARB_vertex_buffer_object GL_ARB_vertex_program GL_ARB_vertex_shader GL_ARB_window_pos GL_ATI_array_rev_comps_in_4_bytes GL_ATI_blend_equation_separate GL_ATI_blend_weighted_minmax GL_ATI_draw_buffers GL_ATI_element_array GL_ATI_envmap_bumpmap GL_ATI_fragment_shader GL_ATI_lock_texture GL_ATI_map_object_buffer GL_ATI_meminfo GL_ATI_pixel_format_float GL_ATI_pn_triangles GL_ATI_point_cull_mode GL_ATI_separate_stencil GL_ATI_shader_texture_lod GL_ATI_text_fragment_shader GL_ATI_texture_compression_3dc GL_ATI_texture_env_combine3 GL_ATI_texture_float GL_ATI_texture_mirror_once GL_ATI_vertex_array_object

Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not

Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported

GL_ATI_vertex_attrib_array_object GL_ATI_vertex_blend GL_ATI_vertex_shader GL_ATI_vertex_streams GL_ATIX_pn_triangles GL_ATIX_texture_env_combine3 GL_ATIX_texture_env_route GL_ATIX_vertex_shader_output_point_size GL_Autodesk_facet_normal GL_Autodesk_valid_back_buffer_hint GL_DIMD_YUV GL_EXT_422_pixels GL_EXT_abgr GL_EXT_bgra GL_EXT_bindable_uniform GL_EXT_blend_color GL_EXT_blend_equation_separate GL_EXT_blend_func_separate GL_EXT_blend_logic_op GL_EXT_blend_minmax GL_EXT_blend_subtract GL_EXT_Cg_shader GL_EXT_clip_volume_hint GL_EXT_cmyka GL_EXT_color_matrix GL_EXT_color_subtable GL_EXT_color_table GL_EXT_compiled_vertex_array GL_EXT_convolution GL_EXT_convolution_border_modes GL_EXT_coordinate_frame GL_EXT_copy_buffer GL_EXT_copy_texture GL_EXT_cull_vertex GL_EXT_depth_bounds_test GL_EXT_depth_buffer_float GL_EXT_direct_state_access GL_EXT_draw_buffers2 GL_EXT_draw_instanced GL_EXT_draw_range_elements GL_EXT_fog_coord GL_EXT_fog_function GL_EXT_fog_offset GL_EXT_fragment_lighting GL_EXT_framebuffer_blit GL_EXT_framebuffer_multisample GL_EXT_framebuffer_object GL_EXT_framebuffer_sRGB GL_EXT_generate_mipmap GL_EXT_geometry_shader4 GL_EXT_gpu_program_parameters GL_EXT_gpu_shader4 GL_EXT_histogram GL_EXT_index_array_formats GL_EXT_index_func GL_EXT_index_material GL_EXT_index_texture GL_EXT_interlace GL_EXT_light_texture GL_EXT_misc_attribute

Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported

GL_EXT_multi_draw_arrays GL_EXT_multisample GL_EXT_packed_depth_stencil GL_EXT_packed_float GL_EXT_packed_pixels GL_EXT_packed_pixels_12 GL_EXT_paletted_texture GL_EXT_pixel_buffer_object GL_EXT_pixel_format GL_EXT_pixel_texture GL_EXT_pixel_transform GL_EXT_pixel_transform_color_table GL_EXT_point_parameters GL_EXT_polygon_offset GL_EXT_rescale_normal GL_EXT_scene_marker GL_EXT_secondary_color GL_EXT_separate_specular_color GL_EXT_shadow_funcs GL_EXT_shared_texture_palette GL_EXT_stencil_clear_tag GL_EXT_stencil_two_side GL_EXT_stencil_wrap GL_EXT_subtexture GL_EXT_swap_control GL_EXT_texgen_reflection GL_EXT_texture GL_EXT_texture_array GL_EXT_texture_border_clamp GL_EXT_texture_buffer_object GL_EXT_texture_color_table GL_EXT_texture_compression_dxt1 GL_EXT_texture_compression_latc GL_EXT_texture_compression_rgtc GL_EXT_texture_compression_s3tc GL_EXT_texture_cube_map GL_EXT_texture_edge_clamp GL_EXT_texture_env GL_EXT_texture_env_add GL_EXT_texture_env_combine GL_EXT_texture_env_dot3 GL_EXT_texture_filter_anisotropic GL_EXT_texture_integer GL_EXT_texture_lod GL_EXT_texture_lod_bias GL_EXT_texture_mirror_clamp GL_EXT_texture_object GL_EXT_texture_perturb_normal GL_EXT_texture_rectangle GL_EXT_texture_shared_exponent GL_EXT_texture_sRGB GL_EXT_texture_swizzle GL_EXT_texture3D GL_EXT_texture4D GL_EXT_timer_query GL_EXT_transform_feedback GL_EXT_vertex_array GL_EXT_vertex_array_bgra GL_EXT_vertex_shader GL_EXT_vertex_weighting

Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported

GL_EXTX_framebuffer_mixed_formats GL_EXTX_packed_depth_stencil GL_FGL_lock_texture GL_GL2_geometry_shader GL_GREMEDY_frame_terminator GL_GREMEDY_string_marker GL_HP_convolution_border_modes GL_HP_image_transform GL_HP_occlusion_test GL_HP_texture_lighting GL_I3D_argb GL_I3D_color_clamp GL_I3D_interlace_read GL_IBM_clip_check GL_IBM_cull_vertex GL_IBM_load_named_matrix GL_IBM_multi_draw_arrays GL_IBM_multimode_draw_arrays GL_IBM_occlusion_cull GL_IBM_pixel_filter_hint GL_IBM_rasterpos_clip GL_IBM_rescale_normal GL_IBM_static_data GL_IBM_texture_clamp_nodraw GL_IBM_texture_mirrored_repeat GL_IBM_vertex_array_lists GL_IBM_YCbCr GL_INGR_blend_func_separate GL_INGR_color_clamp GL_INGR_interlace_read GL_INGR_multiple_palette GL_INTEL_parallel_arrays GL_INTEL_texture_scissor GL_KTX_buffer_region GL_MESA_pack_invert GL_MESA_resize_buffers GL_MESA_window_pos GL_MESA_ycbcr_texture GL_MESAX_texture_stack GL_MTX_fragment_shader GL_MTX_precision_dpi GL_NV_blend_square GL_NV_centroid_sample GL_NV_conditional_render GL_NV_copy_depth_to_color GL_NV_depth_buffer_float GL_NV_depth_clamp GL_NV_depth_range_unclamped GL_NV_evaluators GL_NV_explicit_multisample GL_NV_fence GL_NV_float_buffer GL_NV_fog_distance GL_NV_fragment_program GL_NV_fragment_program_option GL_NV_fragment_program2 GL_NV_fragment_program4 GL_NV_framebuffer_multisample_coverage GL_NV_framebuffer_multisample_ex GL_NV_geometry_program4

Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not

Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported

GL_NV_geometry_shader4 GL_NV_gpu_program4 GL_NV_half_float GL_NV_light_max_exponent GL_NV_multisample_coverage GL_NV_multisample_filter_hint GL_NV_occlusion_query GL_NV_packed_depth_stencil GL_NV_parameter_buffer_object GL_NV_pixel_buffer_object GL_NV_pixel_data_range GL_NV_point_sprite GL_NV_present_video GL_NV_primitive_restart GL_NV_register_combiners GL_NV_register_combiners2 GL_NV_texgen_emboss GL_NV_texgen_reflection GL_NV_texture_compression_latc GL_NV_texture_compression_vtc GL_NV_texture_env_combine4 GL_NV_texture_expand_normal GL_NV_texture_rectangle GL_NV_texture_shader GL_NV_texture_shader2 GL_NV_texture_shader3 GL_NV_timer_query GL_NV_transform_feedback GL_NV_transform_feedback2 GL_NV_vertex_array_range GL_NV_vertex_array_range2 GL_NV_vertex_program GL_NV_vertex_program1_1 GL_NV_vertex_program2 GL_NV_vertex_program2_option GL_NV_vertex_program3 GL_NV_vertex_program4 GL_NVX_conditional_render GL_NVX_flush_hold GL_NVX_ycrcb GL_OES_byte_coordinates GL_OES_compressed_paletted_texture GL_OES_fixed_point GL_OES_query_matrix GL_OES_read_format GL_OES_single_precision GL_OML_interlace GL_OML_resample GL_OML_subsample GL_PGI_misc_hints GL_PGI_vertex_hints GL_REND_screen_coordinates GL_S3_performance_analyzer GL_S3_s3tc GL_SGI_color_matrix GL_SGI_color_table GL_SGI_compiled_vertex_array GL_SGI_cull_vertex GL_SGI_index_array_formats GL_SGI_index_func

Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not

Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported

GL_SGI_index_material GL_SGI_index_texture GL_SGI_make_current_read GL_SGI_texture_add_env GL_SGI_texture_color_table GL_SGI_texture_edge_clamp GL_SGI_texture_lod GL_SGIS_color_range GL_SGIS_detail_texture GL_SGIS_fog_function GL_SGIS_generate_mipmap GL_SGIS_multisample GL_SGIS_multitexture GL_SGIS_pixel_texture GL_SGIS_point_line_texgen GL_SGIS_sharpen_texture GL_SGIS_texture_border_clamp GL_SGIS_texture_color_mask GL_SGIS_texture_edge_clamp GL_SGIS_texture_filter4 GL_SGIS_texture_lod GL_SGIS_texture_select GL_SGIS_texture4D GL_SGIX_async GL_SGIX_async_histogram GL_SGIX_async_pixel GL_SGIX_blend_alpha_minmax GL_SGIX_clipmap GL_SGIX_convolution_accuracy GL_SGIX_depth_pass_instrument GL_SGIX_depth_texture GL_SGIX_flush_raster GL_SGIX_fog_offset GL_SGIX_framezoom GL_SGIX_instruments GL_SGIX_interlace GL_SGIX_ir_instrument1 GL_SGIX_list_priority GL_SGIX_pbuffer GL_SGIX_pixel_texture GL_SGIX_pixel_texture_bits GL_SGIX_reference_plane GL_SGIX_resample GL_SGIX_shadow GL_SGIX_shadow_ambient GL_SGIX_sprite GL_SGIX_subsample GL_SGIX_tag_sample_buffer GL_SGIX_texture_add_env GL_SGIX_texture_coordinate_clamp GL_SGIX_texture_lod_bias GL_SGIX_texture_multi_buffer GL_SGIX_texture_range GL_SGIX_texture_scale_bias GL_SGIX_vertex_preclip GL_SGIX_vertex_preclip_hint GL_SGIX_ycrcb GL_SGIX_ycrcb_subsample GL_SUN_convolution_border_modes GL_SUN_global_alpha

Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not

Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported

GL_SUN_mesh_array GL_SUN_multi_draw_arrays GL_SUN_slice_accum GL_SUN_triangle_list GL_SUN_vertex GL_SUNX_constant_data GL_WGL_ARB_extensions_string GL_WGL_EXT_extensions_string GL_WGL_EXT_swap_control GL_WIN_phong_shading GL_WIN_specular_fog GL_WIN_swap_hint GLU_EXT_nurbs_tessellator GLU_EXT_object_space_tess GLU_SGI_filter4_parameters GLX_ARB_create_context GLX_ARB_fbconfig_float GLX_ARB_framebuffer_sRGB GLX_ARB_get_proc_address GLX_ARB_multisample GLX_EXT_fbconfig_packed_float GLX_EXT_framebuffer_sRGB GLX_EXT_import_context GLX_EXT_scene_marker GLX_EXT_texture_from_pixmap GLX_EXT_visual_info GLX_EXT_visual_rating GLX_MESA_agp_offset GLX_MESA_copy_sub_buffer GLX_MESA_pixmap_colormap GLX_MESA_release_buffers GLX_MESA_set_3dfx_mode GLX_NV_present_video GLX_NV_swap_group GLX_NV_video_output GLX_OML_swap_method GLX_OML_sync_control GLX_SGI_cushion GLX_SGI_make_current_read GLX_SGI_swap_control GLX_SGI_video_sync GLX_SGIS_blended_overlay GLX_SGIS_color_range GLX_SGIS_multisample GLX_SGIX_dm_buffer GLX_SGIX_fbconfig GLX_SGIX_hyperpipe GLX_SGIX_pbuffer GLX_SGIX_swap_barrier GLX_SGIX_swap_group GLX_SGIX_video_resize GLX_SGIX_video_source GLX_SGIX_visual_select_group GLX_SUN_get_transparent_index GLX_SUN_video_resize WGL_3DFX_gamma_control WGL_3DFX_multisample WGL_3DL_stereo_control WGL_ARB_buffer_region WGL_ARB_create_context

Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported

WGL_ARB_extensions_string WGL_ARB_framebuffer_sRGB WGL_ARB_make_current_read WGL_ARB_multisample WGL_ARB_pbuffer WGL_ARB_pixel_format WGL_ARB_pixel_format_float WGL_ARB_render_texture WGL_ATI_pbuffer_memory_hint WGL_ATI_pixel_format_float WGL_ATI_render_texture_rectangle WGL_EXT_buffer_region WGL_EXT_depth_float WGL_EXT_display_color_table WGL_EXT_extensions_string WGL_EXT_framebuffer_sRGB WGL_EXT_framebuffer_sRGBWGL_ARB_create_context WGL_EXT_gamma_control WGL_EXT_make_current_read WGL_EXT_multisample WGL_EXT_pbuffer WGL_EXT_pixel_format WGL_EXT_pixel_format_packed_float WGL_EXT_render_texture WGL_EXT_swap_control WGL_EXT_swap_interval WGL_I3D_digital_video_control WGL_I3D_gamma WGL_I3D_genlock WGL_I3D_image_buffer WGL_I3D_swap_frame_lock WGL_I3D_swap_frame_usage WGL_MTX_video_preview WGL_NV_float_buffer WGL_NV_gpu_affinity WGL_NV_multisample_coverage WGL_NV_present_video WGL_NV_render_depth_texture WGL_NV_render_texture_rectangle WGL_NV_swap_group WGL_NV_video_output WGL_OML_sync_control Supported Compressed Texture Formats: RGB DXT1 RGBA DXT1 RGBA DXT3 RGBA DXT5 RGB FXT1 RGBA FXT1 3Dc

Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not Not

Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported

--------[ Fonts ]-----------------------------------------------------------------------------------------------------@Batang 16 x 32 @Batang European 16 x 32 40 % Roman 40 % Regular Central Roman Regular Baltic

@Batang c @Batang 16 x 32 @Batang 16 x 32 @Batang 16 x 32 @Batang 16 x 32 @BatangChe 16 x 32 @BatangChe European @BatangChe c @BatangChe 16 x 32 @BatangChe 16 x 32 @BatangChe 16 x 32 @BatangChe 16 x 32 @DFKai-SB _BIG5 @DFKai-SB @Dotum 16 x 32 @Dotum European @Dotum c @Dotum 16 x 32 @Dotum 16 x 32 @Dotum 16 x 32 @Dotum 16 x 32 @DotumChe 16 x 32 @DotumChe European @DotumChe c @DotumChe 16 x 32 @DotumChe 16 x 32 @DotumChe 16 x 32 @DotumChe 16 x 32 @FangSong _GB2312 @FangSong 16 x 32 16 x 32 40 % 40 % 40 % 40 % 40 % 16 x 32 16 x 32 40 % 40 % 40 % 40 % 40 % 40 % 16 x 32 16 x 32 40 % 40 % 16 x 32 16 x 32 40 % 40 % 40 % 40 % 40 % 16 x 32 16 x 32 40 % 40 % 40 % 40 % 40 % 40 % 16 x 32 40 %

Roman Roman Roman Roman Roman Modern Modern Modern 40 % Modern Modern Modern Modern Script Script 40 % Swiss Swiss Swiss 40 % Swiss Swiss Swiss Swiss Modern Modern Modern 40 % Modern Modern Modern Modern Modern Modern 40 %

Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Cyrilli Greek Hangul Turkish Western Baltic Central Cyrilli Greek Hangul Turkish Western CHINESE Western Baltic Central Cyrilli Greek Hangul Turkish Western Baltic Central Cyrilli Greek Hangul Turkish Western CHINESE Western

@Gulim 16 x 32 @Gulim European @Gulim c @Gulim 16 x 32 @Gulim 16 x 32 @Gulim 16 x 32 @Gulim 16 x 32 @GulimChe 16 x 32 @GulimChe European @GulimChe c @GulimChe 16 x 32 @GulimChe 16 x 32 @GulimChe 16 x 32 @GulimChe 16 x 32 @Gungsuh 16 x 32 @Gungsuh European @Gungsuh c @Gungsuh 16 x 32 @Gungsuh 16 x 32 @Gungsuh 16 x 32 @Gungsuh 16 x 32 @GungsuhChe 16 x 32 @GungsuhChe European 16 @GungsuhChe c 16 @GungsuhChe 16 @GungsuhChe 16 @GungsuhChe 16 @GungsuhChe 16 @Hand Of Sean 20 @Hand Of Sean European 20 x 32 x 32 x 32 x 32 x 32 x 32 x 57 x 57 40 % 40 % 40 % 40 % 40 % 40 % 16 x 32 16 x 32 40 % 40 % 40 % 40 % 40 % 40 % 16 x 32 16 x 32 40 % 40 % 40 % 40 % 40 % 40 % 16 x 32 16 x 32 40 % 40 %

Swiss Swiss Swiss 40 % Swiss Swiss Swiss Swiss Modern Modern Modern 40 % Modern Modern Modern Modern Roman Roman Roman 40 % Roman Roman Roman Roman Modern Modern Modern 40 % Modern 40 % Modern 40 % Modern 40 % Modern 40 % Special 40 % Special 40 %

Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Baltic Central Cyrilli Greek Hangul Turkish Western Baltic Central Cyrilli Greek Hangul Turkish Western Baltic Central Cyrilli Greek Hangul Turkish Western Baltic Central Cyrilli Greek Hangul Turkish Western Baltic Central

@Hand Of Sean _GB2312 20 x 57 @Hand Of Sean c 20 x 57 @Hand Of Sean 20 x 57 @Hand Of Sean 20 x 57 @Hand Of Sean e 20 x 57 @Hand Of Sean 20 x 57 @Hand Of Sean ese 20 x 57 @Hand Of Sean 20 x 57 @KaiTi _GB2312 16 x 32 @KaiTi 16 x 32 @Malgun Gothic 15 x 43 @Malgun Gothic 15 x 43 @Meiryo UI 17 x 41 @Meiryo UI European 17 x 41 @Meiryo UI c 17 x 41 @Meiryo UI 17 x 41 @Meiryo UI e 17 x 41 @Meiryo UI 17 x 41 @Meiryo UI 17 x 41 @Meiryo 31 x 48 @Meiryo European 31 x 48 @Meiryo c 31 x 48 @Meiryo 31 x 48 @Meiryo e 31 x 48 @Meiryo 31 x 48 @Meiryo 31 x 48 @Microsoft JhengHei _BIG5 15 x 43 @Microsoft JhengHei 15 x 43 @Microsoft JhengHei 15 x 43 @Microsoft YaHei European 15 x 42

Special 40 % Special 40 % Special 40 % Special 40 % Special 40 % Special 40 % Special 40 % Special 40 % Modern 40 % Modern 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 %

Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

CHINESE Cyrilli Greek Hangul Japanes Turkish Vietnam Western CHINESE Western Hangul Western Baltic Central Cyrilli Greek Japanes Turkish Western Baltic Central Cyrilli Greek Japanes Turkish Western CHINESE Greek Western Central

@Microsoft YaHei _GB2312 15 x 42 @Microsoft YaHei c 15 x 42 @Microsoft YaHei 15 x 42 @Microsoft YaHei 15 x 42 @Microsoft YaHei 15 x 42 @MingLiU _BIG5 16 x 32 @MingLiU 16 x 32 @MingLiU_HKSCS _BIG5 16 x 32 @MingLiU_HKSCS 16 x 32 @MingLiU_HKSCS-ExtB _BIG5 16 x 32 @MingLiU_HKSCS-ExtB 16 x 32 @MingLiU-ExtB _BIG5 16 x 32 @MingLiU-ExtB 16 x 32 @MS Gothic 16 x 32 @MS Gothic European 16 x 32 @MS Gothic c 16 x 32 @MS Gothic 16 x 32 @MS Gothic e 16 x 32 @MS Gothic 16 x 32 @MS Gothic 16 x 32 @MS Mincho 16 x 32 @MS Mincho European 16 x 32 @MS Mincho c 16 x 32 @MS Mincho 16 x 32 @MS Mincho e 16 x 32 @MS Mincho 16 x 32 @MS Mincho 16 x 32 @MS PGothic 13 x 32 @MS PGothic European 13 x 32 @MS PGothic c 13 x 32

Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Modern 40 % Modern 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Modern 40 % Modern 40 % Modern 40 % Modern 40 % Modern 40 % Modern 40 % Modern 40 % Modern 40 % Modern 40 % Modern 40 % Modern 40 % Modern 40 % Modern 40 % Modern 40 % Swiss 40 % Swiss 40 % Swiss 40 %

Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

CHINESE Cyrilli Greek Turkish Western CHINESE Western CHINESE Western CHINESE Western CHINESE Western Baltic Central Cyrilli Greek Japanes Turkish Western Baltic Central Cyrilli Greek Japanes Turkish Western Baltic Central Cyrilli

@MS PGothic 13 x 32 @MS PGothic e @MS PGothic 13 x 32 @MS PGothic 13 x 32 @MS PMincho 13 x 32 @MS PMincho European 13 @MS PMincho c 13 @MS PMincho 13 @MS PMincho e 13 @MS PMincho 13 @MS PMincho 13 @MS UI Gothic 13 @MS UI Gothic European 13 @MS UI Gothic c 13 @MS UI Gothic 13 @MS UI Gothic e 13 @MS UI Gothic 13 @MS UI Gothic 13 @NSimSun _GB2312 16 @NSimSun 16 @PMingLiU _BIG5 16 @PMingLiU 16 @PMingLiU-ExtB _BIG5 16 @PMingLiU-ExtB 16 @SimHei _GB2312 16 @SimHei 16 @SimSun _GB2312 16 @SimSun 16 @SimSun-ExtB _GB2312 16 @SimSun-ExtB 16 x 32 x 32 x 32 x 32 x 32 x 32 x 32 x 32 x 32 x 32 x 32 x 32 x 32 x 32 x 32 x 32 x 32 x 32 x 32 x 32 x 32 x 32 x 32 x 32 x 32 40 % 40 % 40 % 40 % 13 x 32 40 % 40 %

Swiss Swiss Swiss Swiss Roman Roman Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Modern 40 % Modern 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Modern 40 % Modern 40 % Special 40 % Special 40 % Modern 40 % Modern 40 %

Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Greek Japanes Turkish Western Baltic Central Cyrilli Greek Japanes Turkish Western Baltic Central Cyrilli Greek Japanes Turkish Western CHINESE Western CHINESE Western CHINESE Western CHINESE Western CHINESE Western CHINESE Western

Aharoni 15 x 32 Andalus 15 x 49 Andalus 15 x 49 Angsana New 8 x 43 Angsana New 8 x 43 AngsanaUPC 8 x 43 AngsanaUPC 8 x 43 Aparajita 16 x 38 Arabic Typesetting 9 x 36 Arabic Typesetting 9 x 36 Arabic Typesetting European 9 x 36 Arabic Typesetting 9 x 36 Arabic Typesetting 9 x 36 Arial Black 18 x 45 Arial Black European 18 x 45 Arial Black c 18 x 45 Arial Black 18 x 45 Arial Black 18 x 45 Arial Black 18 x 45 Arial Narrow 12 x 36 Arial Narrow European 12 x 36 Arial Narrow c 12 x 36 Arial Narrow 12 x 36 Arial Narrow 12 x 36 Arial Narrow 12 x 36 Arial 14 x 36 Arial 14 x 36 Arial European 14 x 36 Arial c 14 x 36 Arial 14 x 36 40 % 40 % 40 % 40 % 40 % 40 % 40 % 40 % 70 %

Special Roman Roman Roman Roman Roman Roman Swiss Script Script 40 % Script 40 % Script 40 % Script 40 % Swiss 90 % Swiss 90 % Swiss 90 % Swiss 90 % Swiss 90 % Swiss 90 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 %

Bold Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Hebrew Arabic Western Thai Western Thai Western Western Arabic Baltic Central Turkish Western Baltic Central Cyrilli Greek Turkish Western Baltic Central Cyrilli Greek Turkish Western Arabic Baltic Central Cyrilli Greek

Arial 14 x 36 Arial 14 x 36 Arial ese Arial 14 x 36 Batang 16 x 32 Batang European Batang c Batang 16 x 32 Batang 16 x 32 Batang 16 x 32 Batang 16 x 32 BatangChe 16 x 32 BatangChe European BatangChe c BatangChe 16 x 32 BatangChe 16 x 32 BatangChe 16 x 32 BatangChe 16 x 32 Book Antiqua 14 x 40 Book Antiqua European 14 x Book Antiqua c 14 x Book Antiqua 14 x Book Antiqua 14 x Book Antiqua 14 x Bookman Old Style 16 x Bookman Old Style European 16 x Bookman Old Style c 16 x Bookman Old Style 16 x Bookman Old Style 16 x Bookman Old Style 16 x 40 40 40 40 40 36 36 36 36 36 36 40 % 40 % 40 % 40 % 40 % 40 % 16 x 32 16 x 32 40 % 40 % 40 % 40 % 40 % 40 % 16 x 32 16 x 32 40 % 40 % 40 % 14 x 36 40 % 40 % 40 %

Swiss Swiss Swiss Swiss Roman Roman Roman 40 % Roman Roman Roman Roman Modern Modern Modern 40 % Modern Modern Modern Modern Roman Roman Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 30 % Roman 30 % Roman 30 % Roman 30 % Roman 30 % Roman 30 %

Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Hebrew Turkish Vietnam Western Baltic Central Cyrilli Greek Hangul Turkish Western Baltic Central Cyrilli Greek Hangul Turkish Western Baltic Central Cyrilli Greek Turkish Western Baltic Central Cyrilli Greek Turkish Western

Bookshelf Symbol 7 21 x 32 Browallia New 9 x 40 Browallia New 9 x 40 BrowalliaUPC 9 x 40 BrowalliaUPC 9 x 40 Calibri 17 x 39 Calibri European 17 x 39 Calibri c 17 x 39 Calibri 17 x 39 Calibri 17 x 39 Calibri ese 17 x 39 Calibri 17 x 39 Cambria Math 20 x 179 Cambria Math European 20 x 179 Cambria Math c 20 x 179 Cambria Math 20 x 179 Cambria Math 20 x 179 Cambria Math ese 20 x 179 Cambria Math 20 x 179 Cambria 20 x 38 Cambria European 20 x 38 Cambria c 20 x 38 Cambria 20 x 38 Cambria 20 x 38 Cambria ese 20 x 38 Cambria 20 x 38 Candara 17 x 39 Candara European 17 x 39 Candara c 17 x 39 Candara 17 x 39

Special 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 %

Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Symbol Thai Western Thai Western Baltic Central Cyrilli Greek Turkish Vietnam Western Baltic Central Cyrilli Greek Turkish Vietnam Western Baltic Central Cyrilli Greek Turkish Vietnam Western Baltic Central Cyrilli Greek

Candara 17 x 39 Candara ese Candara 17 x 39 Century 15 x 38 Century European Century c Century 15 x 38 Century 15 x 38 Century 15 x 38 Cocaine Sans 9 x 36 Cocaine Sans European 9 Cocaine Sans c 9 Cocaine Sans 9 Cocaine Sans 9 Cocaine Sans ese 9 Cocaine Sans 9 Comic Sans MS 15 Comic Sans MS European 15 Comic Sans MS c 15 Comic Sans MS 15 Comic Sans MS 15 Comic Sans MS 15 Consolas 18 Consolas European 18 Consolas c 18 Consolas 18 Consolas 18 Consolas ese 18 Consolas 18 Constantia 17 x 36 x 36 x 36 x 36 x 36 x 36 x 45 x 45 x 45 x 45 x 45 x 45 x 37 x 37 x 37 x 37 x 37 x 37 x 37 x 39 40 % 40 % 40 % 40 % 40 % 15 x 38 15 x 38 40 % 40 % 40 % 17 x 39 40 % 40 %

Swiss Swiss Swiss Roman Roman Roman 40 % Roman Roman Roman Special Special Special 40 % Special 40 % Special 40 % Special 40 % Special 40 % Script 40 % Script 40 % Script 40 % Script 40 % Script 40 % Script 40 % Modern 40 % Modern 40 % Modern 40 % Modern 40 % Modern 40 % Modern 40 % Modern 40 % Roman 40 %

Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Turkish Vietnam Western Baltic Central Cyrilli Greek Turkish Western Baltic Central Cyrilli Greek Turkish Vietnam Western Baltic Central Cyrilli Greek Turkish Western Baltic Central Cyrilli Greek Turkish Vietnam Western Baltic

Constantia European Constantia c Constantia Constantia

Roman 17 x 39 17 x 39 17 x 39 17 x 39 40 % Roman 40 % Roman 40 % Roman 40 % Roman 17 x 39 40 % Roman 17 x 39 40 % Swiss 17 x 39 40 % Swiss 17 x 39 17 x 39 40 % Swiss 40 % Swiss 17 x 39 40 % Swiss 17 x 39 40 % Swiss 17 x 39 40 % Swiss 17 x 39 40 % Swiss 9 x 44 40 % Swiss 9 x 44 40 % Swiss 9 x 44 40 % Swiss 9 x 44 40 % Modern 19 x 36 40 % Modern 19 x 36 40 % Modern x 36 x 36 x 36 x 36 x 36 x 36 x 36 x 13 x 43 x 31 x 32 40 % Modern 40 % Modern 40 % Modern 40 % Modern 40 % Modern 40 % Modern 40 % Modern 40 % Special 40 % Swiss 40 % Script 40 %

Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Central Cyrilli Greek Turkish Vietnam Western Baltic Central Cyrilli Greek Turkish Vietnam Western Thai Western Thai Western Arabic Baltic Central Cyrilli Greek Hebrew Turkish Vietnam Western Western

Constantia ese Constantia Corbel Corbel European Corbel c Corbel Corbel Corbel ese Corbel Cordia New Cordia New CordiaUPC CordiaUPC Courier New Courier New Courier New European 19 Courier New c 19 Courier New 19 Courier New 19 Courier New 19 Courier New ese 19 Courier New 19 Courier 8 DaunPenh 12 David 13 DFKai-SB _BIG5 16

Regular Regular Regular

Western Hebrew CHINESE

DFKai-SB 16 x 32 DilleniaUPC 9 x 42 DilleniaUPC 9 x 42 DokChampa 19 x 62 DokChampa 19 x 62 Dotum 16 x 32 Dotum European Dotum c Dotum 16 x 32 Dotum 16 x 32 Dotum 16 x 32 Dotum 16 x 32 DotumChe 16 x 32 DotumChe European DotumChe c DotumChe 16 x 32 DotumChe 16 x 32 DotumChe 16 x 32 DotumChe 16 x 32 Ebrima 19 x 43 Ebrima European Ebrima Ebrima 19 x 43 Egregio Script_demo 21 x 49 Egregio Script_demo ese 21 x 49 Egregio Script_demo 21 x 49 Estrangelo Edessa 16 x 36 EucrosiaUPC 9 x 39 EucrosiaUPC 9 x 39 Euphemia 22 x 42 40 % 40 % 19 x 43 19 x 43 40 % 40 % 40 % 40 % 40 % 40 % 16 x 32 16 x 32 40 % 40 % 40 % 40 % 40 % 40 % 16 x 32 16 x 32 40 % 40 % 40 % 40 % 40 % 40 % 40 %

Script Roman Roman Swiss Swiss Swiss Swiss Swiss 40 % Swiss Swiss Swiss Swiss Modern Modern Modern 40 % Modern Modern Modern Modern Special Special Special 40 % Special Special Special 40 % Special 40 % Script 40 % Roman 40 % Roman 40 % Swiss 40 %

Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Western Thai Western Thai Western Baltic Central Cyrilli Greek Hangul Turkish Western Baltic Central Cyrilli Greek Hangul Turkish Western Baltic Central Turkish Western Turkish Vietnam Western Western Thai Western Western

FangSong _GB2312 FangSong Fixedsys

Modern 16 x 32 16 x 32 40 % Modern 40 % Modern x 15 Medium x 36 Medium x 36 Medium x 36 Medium x 36 Medium x 36 Medium x 36 x 30 x 38 x 38 x 59 x 59 x 59 x 59 x 59 x 59 x 36 x 36 x 36 x 36 x 36 x 36 x 56 x 36 x 36 x 36 x 36 x 36 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % 40 %

Regular Regular

CHINESE Western Western

8 Franklin Gothic 14 Franklin Gothic European 14 Franklin Gothic c 14 Franklin Gothic 14 Franklin Gothic 14 Franklin Gothic 14 FrankRuehl 13 FreesiaUPC 9 FreesiaUPC 9 Gabriola 16 Gabriola European 16 Gabriola c 16 Gabriola 16 Gabriola 16 Gabriola 16 Garamond 12 Garamond European 12 Garamond c 12 Garamond 12 Garamond 12 Garamond 12 Gautami 18 Georgia 14 Georgia European 14 Georgia c 14 Georgia 14 Georgia 14

Regular Regular Regular Regular Regular Regular Regular Regular Regular

Baltic Central Cyrilli Greek Turkish Western Hebrew Thai Western Baltic Central Cyrilli Greek Turkish Western Baltic Central Cyrilli Greek Turkish Western Western Baltic Central Cyrilli Greek Turkish

Decorative Regular Decorative Regular 40 % Decorative Regular 40 % Decorative Regular 40 % Decorative Regular 40 % Decorative Regular 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Swiss 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Georgia 14 x 36 Gisha 16 x 38 Gisha 16 x 38 Gulim 16 x 32 Gulim European Gulim c Gulim 16 x 32 Gulim 16 x 32 Gulim 16 x 32 Gulim 16 x 32 GulimChe 16 x 32 GulimChe European GulimChe c GulimChe 16 x 32 GulimChe 16 x 32 GulimChe 16 x 32 GulimChe 16 x 32 Gungsuh 16 x 32 Gungsuh European Gungsuh c Gungsuh 16 x 32 Gungsuh 16 x 32 Gungsuh 16 x 32 Gungsuh 16 x 32 GungsuhChe 16 x 32 GungsuhChe European GungsuhChe c GungsuhChe 16 x 32 GungsuhChe 16 x 32 GungsuhChe 16 x 32 40 % 40 % 40 % 16 x 32 16 x 32 40 % 40 % 40 % 40 % 40 % 40 % 16 x 32 16 x 32 40 % 40 % 40 % 40 % 40 % 40 % 16 x 32 16 x 32 40 % 40 % 40 % 40 % 40 % 40 % 16 x 32 16 x 32 40 % 40 % 40 % 40 % 40 %

Roman Swiss Swiss Swiss Swiss Swiss 40 % Swiss Swiss Swiss Swiss Modern Modern Modern 40 % Modern Modern Modern Modern Roman Roman Roman 40 % Roman Roman Roman Roman Modern Modern Modern 40 % Modern Modern Modern

Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Western Hebrew Western Baltic Central Cyrilli Greek Hangul Turkish Western Baltic Central Cyrilli Greek Hangul Turkish Western Baltic Central Cyrilli Greek Hangul Turkish Western Baltic Central Cyrilli Greek Hangul Turkish

GungsuhChe 16 x 32 Hand Of Sean 20 x 57 Hand Of European Hand Of _GB2312 Hand Of c Hand Of Sean 20 x 57 Sean 20 x 57 Sean 20 x 57 Sean 20 x 57 Hand Of Sean 20 x 57 Hand Of Sean e Hand Of Sean 20 x 57 Hand Of Sean ese Hand Of Sean 20 x 57 Impact 13 x 39 Impact European Impact c Impact 13 x 39 Impact 13 x 39 Impact 13 x 39 IrisUPC 9 x 40 IrisUPC 9 x 40 Iskoola Pota 22 x 36 JasmineUPC 9 x 34 JasmineUPC Jellyka Jellyka European Jellyka c Jellyka Jellyka Jellyka ese Jellyka KaiTi _GB2312 9 x 34 40 % Estrya's Handwriting 4 x 24 40 % Estrya's Handwriting 4 x 24 40 % Estrya's Handwriting 4 x 24 40 % Estrya's Handwriting 4 x 24 40 % Estrya's Handwriting 4 x 24 40 % Estrya's Handwriting 4 x 24 40 % Estrya's Handwriting 4 x 24 40 % 16 x 32 40 % 40 % 40 % 40 % 40 % 40 % 40 % 40 % 13 x 39 13 x 39 40 % 40 % 40 % 20 x 57 40 % 40 % 20 x 57 40 % 40 % 40 % 40 % 40 % 40 % 40 % 40 %

Modern Special Special Special Special Special Special Special Special Special Special Swiss Swiss Swiss 40 % Swiss Swiss Swiss Swiss Swiss Swiss Roman Roman Special Special Special Special Special Special Special Modern

Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Western Baltic Central CHINESE Cyrilli Greek Hangul Japanes Turkish Vietnam Western Baltic Central Cyrilli Greek Turkish Western Thai Western Western Thai Western Baltic Central Cyrilli Greek Turkish Vietnam Western CHINESE

KaiTi 16 x 32 Kalinga 19 x 48 Kartika 27 x 46 Khmer UI 21 x 36 KodchiangUPC 9 x 31 KodchiangUPC 9 x 31 Kokila 13 x 37 Lao UI 18 x 43 Latha 23 x 44 Leelawadee 17 x 38 Leelawadee 17 x 38 Levenim MT 16 x 42 LeviBrush 15 x 43 LilyUPC 9 x 30 LilyUPC 9 x 30 Lobster 1.4 Lucida European Lucida c Lucida Lucida Lucida Lucida Lucida European Lucida c Lucida Lucida Lucida Lucida Malgun Malgun 17 x 40 Console 19 x 32 Console 19 x 32 Console 19 x 32 Console 19 x 32 Console 19 x 32 Sans Unicode 16 x 49 Sans Unicode 16 x 49 Sans Unicode 16 x 49 Sans Unicode 16 x 49 Sans Unicode 16 x 49 Sans Unicode 16 x 49 Sans Unicode 16 x 49 Gothic 15 x 43 Gothic 15 x 43 40 % 40 % 40 % 40 % 40 % 40 % 40 % 40 % 40 % 40 % 40 % 40 % 40 % 40 % 40 % 40 % 40 %

Modern Swiss Roman Swiss Roman Roman Swiss Swiss Swiss Swiss Swiss Special Special Swiss Swiss Modern Modern Modern 40 % Modern 40 % Modern 40 % Modern 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 %

Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Western Western Western Western Thai Western Western Western Western Thai Western Hebrew Western Thai Western Western Central Cyrilli Greek Turkish Western Baltic Central Cyrilli Greek Hebrew Turkish Western Hangul Western

Mangal 19 x 54 Marlett 31 x 32 Meiryo UI 17 x 41 Meiryo UI European Meiryo UI c Meiryo UI 17 x 41 Meiryo UI e Meiryo UI 17 x 41 Meiryo UI 17 x 41 Meiryo 31 x 48 Meiryo European Meiryo c Meiryo 31 x 48 Meiryo e Meiryo 31 x 48 Meiryo Microsoft Microsoft _BIG5 Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft Microsoft European Microsoft c Microsoft Microsoft Microsoft Microsoft 31 x 48 Himalaya 13 x 32 JhengHei 15 x 43 JhengHei 15 x 43 JhengHei 15 x 43 New Tai Lue 19 x 42 PhagsPa 24 x 41 Sans Serif 14 x 36 Sans Serif 14 x 36 Sans Serif 14 x 36 Sans Serif 14 x 36 Sans Serif 14 x 36 Sans Serif 14 x 36 Sans Serif 14 x 36 Sans Serif 14 x 36 40 % 40 % 40 % 31 x 48 40 % 40 % 31 x 48 31 x 48 40 % 40 % 40 % 40 % 17 x 41 40 % 40 % 17 x 41 17 x 41 40 % 40 % 50 % 40 %

Roman Special Swiss Swiss Swiss 40 % Swiss Swiss Swiss Swiss Swiss Swiss Swiss 40 % Swiss Swiss Swiss Swiss Special Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 %

Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Western Symbol Baltic Central Cyrilli Greek Japanes Turkish Western Baltic Central Cyrilli Greek Japanes Turkish Western Western CHINESE Greek Western Western Western Arabic Baltic Central Cyrilli Greek Hebrew Thai Turkish

Microsoft Sans Serif 14 x 36 Microsoft Sans Serif 14 x 36 Microsoft Tai Le 19 x 41 Microsoft Uighur 13 x 32 Microsoft Uighur 13 x 32 Microsoft YaHei European 15 x 42 Microsoft YaHei _GB2312 15 x 42 Microsoft YaHei c 15 x 42 Microsoft YaHei 15 x 42 Microsoft YaHei 15 x 42 Microsoft YaHei 15 x 42 Microsoft Yi Baiti 21 x 32 MingLiU _BIG5 16 x 32 MingLiU 16 x 32 MingLiU_HKSCS _BIG5 16 x 32 MingLiU_HKSCS 16 x 32 MingLiU_HKSCS-ExtB _BIG5 16 x 32 MingLiU_HKSCS-ExtB 16 x 32 MingLiU-ExtB _BIG5 16 x 32 MingLiU-ExtB 16 x 32 Miriam Fixed 19 x 32 Miriam 13 x 32 Modern 19 x 37 Mongolian Baiti 14 x 34 Monotype Corsiva 11 x 35 Monotype Corsiva European 11 x 35 Monotype Corsiva c 11 x 35 Monotype Corsiva 11 x 35 Monotype Corsiva 11 x 35 Monotype Corsiva 11 x 35 ese

Swiss 40 % Swiss 40 % Swiss 40 % Special 40 % Special 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Script 40 % Modern 40 % Modern 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Modern 40 % Swiss 40 % Modern 40 % Script 40 % Script 40 % Script 40 % Script 40 % Script 40 % Script 40 % Script 40 %

Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Vietnam Western Western Arabic Western Central CHINESE Cyrilli Greek Turkish Western Western CHINESE Western CHINESE Western CHINESE Western CHINESE Western Hebrew Hebrew OEM/DOS

Regular Regular Regular Regular Regular Regular Regular

Western Baltic Central Cyrilli Greek Turkish Western

MoolBoran 13 x 43 MS Gothic 16 x 32 MS Gothic European MS Gothic c MS Gothic 16 x 32 MS Gothic e MS Gothic 16 x 32 MS Gothic 16 x 32 MS Mincho 16 x 32 MS Mincho European MS Mincho c MS Mincho 16 x 32 MS Mincho e MS Mincho 16 x 32 MS Mincho 16 x 32 MS PGothic 13 x 32 MS PGothic European MS PGothic c MS PGothic 13 x 32 MS PGothic e MS PGothic 13 x 32 MS PGothic 13 x 32 MS PMincho 13 x 32 MS PMincho European MS PMincho c MS PMincho 13 x 32 MS PMincho e MS PMincho 13 x 32 MS PMincho 13 x 32 40 % MS Reference Sans Serif 16 x 39 40 % 40 % 13 x 32 40 % 40 % 13 x 32 13 x 32 40 % 40 % 40 % 40 % 13 x 32 40 % 40 % 13 x 32 13 x 32 40 % 40 % 40 % 40 % 16 x 32 40 % 40 % 16 x 32 16 x 32 40 % 40 % 40 % 40 % 16 x 32 40 % 40 % 16 x 32 16 x 32 40 % 40 % 40 %

Swiss Modern Modern Modern 40 % Modern Modern Modern Modern Modern Modern Modern 40 % Modern Modern Modern Modern Swiss Swiss Swiss 40 % Swiss Swiss Swiss Swiss Roman Roman Roman 40 % Roman Roman Roman Roman Swiss

Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Western Baltic Central Cyrilli Greek Japanes Turkish Western Baltic Central Cyrilli Greek Japanes Turkish Western Baltic Central Cyrilli Greek Japanes Turkish Western Baltic Central Cyrilli Greek Japanes Turkish Western Baltic

MS Reference Sans Serif European 16 x 39 40 MS Reference Sans Serif c 16 x 39 40 MS Reference Sans Serif 16 x 39 40 MS Reference Sans Serif 16 x 39 40 MS Reference Sans Serif ese 16 x 39 40 MS Reference Sans Serif 16 x 39 40 MS Reference Specialty 23 x 39 40 MS Sans Serif 5 x 13 40 MS Serif 5 x 13 40 MS UI Gothic 13 x 32 40 MS UI Gothic European 13 x 32 40 MS UI Gothic c 13 x 32 40 MS UI Gothic 13 x 32 40 MS UI Gothic e 13 x 32 40 MS UI Gothic 13 x 32 40 MS UI Gothic 13 x 32 40 MV Boli 18 x 52 40 my dream 11 x 34 50 Narkisim 12 x 32 40 NSimSun _GB2312 16 x 32 40 NSimSun 16 x 32 40 Nyala 18 x 33 40 Nyala European 18 x 33 40 Nyala 18 x 33 40 Nyala 18 x 33 40 Palatino Linotype 14 x 43 40 Palatino Linotype European 14 x 43 40 Palatino Linotype c 14 x 43 40 Palatino Linotype 14 x 43 40 Palatino Linotype 14 x 43 40

Swiss % Swiss % Swiss % Swiss % Swiss % Swiss % Special % Swiss % Roman % Swiss % Swiss % Swiss % Swiss % Swiss % Swiss % Swiss % Special % Special % Swiss % Modern % Modern % Special % Special % Special % Special % Roman % Roman % Roman % Roman % Roman %

Regular Regular Regular Regular Regular Regular Regular

Central Cyrilli Greek Turkish Vietnam Western Symbol Western Western

Regular Regular Regular Regular Regular Regular Regular Regular Medium Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Baltic Central Cyrilli Greek Japanes Turkish Western Western Western Hebrew CHINESE Western Baltic Central Turkish Western Baltic Central Cyrilli Greek Turkish

Palatino Linotype 14 x 43 40 % Palatino Linotype 14 x 43 40 % Plantagenet Cherokee 14 x 41 40 % PMingLiU _BIG5 16 x 32 40 % PMingLiU 16 x 32 40 % PMingLiU-ExtB _BIG5 16 x 32 40 % PMingLiU-ExtB 16 x 32 40 % Raavi 13 x 53 40 % Remachine Script Personal Use 15 x 34 40 % Remachine Script Personal Use European 15 x 34 40 % Remachine Script Personal Use 15 x 34 40 % Remachine Script Personal Use ese 15 x 34 40 % Remachine Script Personal Use 15 x 34 40 % Rod 19 x 31 40 % Roman 22 x 37 40 % Sakkal Majalla 16 x 45 40 % Sakkal Majalla 16 x 45 40 % Sakkal Majalla European 16 x 45 40 % Sakkal Majalla 16 x 45 40 % Sakkal Majalla 16 x 45 40 % Script 16 x 36 40 % Scriptina - Alternates 277 x 85 40 % Scriptina 13 x 93 40 % Segoe Print 21 x 56 40 % Segoe Print European 21 x 56 40 % Segoe Print c 21 x 56 40 % Segoe Print 21 x 56 40 % Segoe Print 21 x 56 40 % Segoe Print 21 x 56 40 % Segoe Script 22 x 51 40 % ese

Roman Roman Roman Roman Roman Roman Roman Swiss Special Special Special Special Special Modern Roman Special Special Special Special Special Script Special Special Special Special Special Special Special Special Swiss

Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Vietnam Western Western CHINESE Western CHINESE Western Western Baltic Central Turkish Vietnam Western Hebrew OEM/DOS

Regular Regular Regular Regular Regular

Arabic Baltic Central Turkish Western OEM/DOS

Regular Regular Regular Regular Regular Regular Regular Regular Regular

Western Western Baltic Central Cyrilli Greek Turkish Western Baltic

Segoe Script European 22 x Segoe Script c 22 x Segoe Script 22 x Segoe Script 22 x Segoe Script 22 x Segoe UI Light 17 x Segoe UI Light European 17 x Segoe UI Light c 17 x Segoe UI Light 17 x Segoe UI Light 17 x Segoe UI Light ese 17 x Segoe UI Light 17 x Segoe UI Semibold 18 x Segoe UI Semibold European 18 x Segoe UI Semibold c 18 x Segoe UI Semibold 18 x Segoe UI Semibold 18 x Segoe UI Semibold ese 18 x Segoe UI Semibold 18 x Segoe UI Symbol 23 x Segoe UI 17 x Segoe UI 17 x Segoe UI European 17 x Segoe UI c 17 x Segoe UI 17 x Segoe UI 17 x Segoe UI ese 17 x Segoe UI 17 x Shonar Bangla 16 x Shruti 14 x

Swiss 51 51 51 51 51 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 41 54 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 30 % Swiss 30 % Swiss 30 % Swiss 30 % Swiss 30 % Swiss 30 % Swiss 30 % Swiss 60 % Swiss 60 % Swiss 60 % Swiss 60 % Swiss 60 % Swiss 60 % Swiss 60 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 %

Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Central Cyrilli Greek Turkish Western Baltic Central Cyrilli Greek Turkish Vietnam Western Baltic Central Cyrilli Greek Turkish Vietnam Western Western Arabic Baltic Central Cyrilli Greek Turkish Vietnam Western Western Western

SimHei _GB2312 SimHei Simplified Simplified Simplified Simplified SimSun _GB2312 SimSun

Modern 16 x 32 16 x Arabic 19 x Arabic 19 x Arabic 13 x Arabic 13 x 40 % Modern 32 40 % Fixed 35 40 % Fixed 35 40 % 53 53 40 % Roman 40 % Special 16 x 32 16 x 32 40 % Special 40 % Modern 40 % Modern 40 % Swiss 40 % Use Only 40 % Use Only 40 % Use Only 40 % Use Only 40 % Use Only 40 % 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Swiss 70 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Special Special Special Special Special Roman Modern Modern Roman

Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

CHINESE Western Arabic Western Arabic Western CHINESE Western CHINESE Western Western

SimSun-ExtB _GB2312 16 x 32 SimSun-ExtB 16 x 32 Small Fonts 1 x 3 Southern Aire Personal 14 x 33 Southern Aire Personal European 14 x 33 Southern Aire Personal 14 x 33 Southern Aire Personal ese 14 x 33 Southern Aire Personal 14 x 33 Sylfaen 13 x 42 Sylfaen European 13 x 42 Sylfaen c 13 x 42 Sylfaen 13 x 42 Sylfaen 13 x 42 Sylfaen 13 x 42 Symbol 19 x 39 System 7 x 16 Tahoma 14 x 39 Tahoma 14 x 39 Tahoma European 14 x 39 Tahoma c 14 x 39 Tahoma 14 x 39 Tahoma 14 x 39

Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Baltic Central Turkish Vietnam Western Baltic Central Cyrilli Greek Turkish Western Symbol Western

Regular Regular Regular Regular Regular Regular

Arabic Baltic Central Cyrilli Greek Hebrew

Tahoma 14 x 39 Tahoma 14 x 39 Tahoma ese Tahoma 14 x 39 TeamViewer8 23 x 32 Terminal 8 x 12 Times New Roman 13 x 35 Times New Roman 13 x 35 Times New Roman European 13 x 35 Times New Roman c 13 x 35 Times New Roman 13 x 35 Times New Roman 13 x 35 Times New Roman 13 x 35 Times New Roman ese 13 x 35 Times New Roman 13 x 35 Traditional Arabic 15 x 48 Traditional Arabic 15 x 48 Trebuchet MS 15 x 37 Trebuchet MS European 15 x 37 Trebuchet MS c 15 x 37 Trebuchet MS 15 x 37 Trebuchet MS 15 x 37 Trebuchet MS 15 x 37 Tunga 18 x 53 Utsaah 13 x 36 Vani 23 x 54 Verdana 16 x 39 Verdana European 16 x 39 Verdana c 16 x 39 Verdana 16 x 39 40 % 40 % 50 % 40 % 14 x 39 40 % 40 % 40 %

Swiss Swiss Swiss Swiss

Regular Regular Regular Regular

Thai Turkish Vietnam Western Other OEM/DOS

Decorative Medium Modern Roman Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Roman 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Swiss 40 % Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular Regular

Arabic Baltic Central Cyrilli Greek Hebrew Turkish Vietnam Western Arabic Western Baltic Central Cyrilli Greek Turkish Western Western Western Western Baltic Central Cyrilli Greek

Verdana 16 x 39 Verdana ese Verdana 16 x 39 Vijaya 19 x 32 Vrinda 20 x 44 Waltograph UI 20 x 35 Waltograph 14 x 44 Webdings 31 x 32 Wingdings 2 27 x 34 Wingdings 3 25 x 36 Wingdings 28 x 36 40 % 40 % 40 % 40 % 50 % 70 % 40 % 40 % 40 % 16 x 39 40 % 40 %

Swiss Swiss Swiss Swiss Swiss Script Script Roman Roman Roman Special

Regular Regular Regular Regular Regular Bold Regular Regular Regular Regular Regular

Turkish Vietnam Western Western Western Western Western Symbol Symbol Symbol Symbol

--------[ Windows Audio ]---------------------------------------------------------------------------------------------midi-out.0 mixer.0 mixer.1 wave-in.0 wave-out.0 0001 0001 0001 0001 0001 001B 0068 0068 0065 0064 Microsoft GS Wavetable Synth Speakers (Conexant AC-Link Audi Microphone (Conexant AC-Link Au Microphone (Conexant AC-Link Au Speakers (Conexant AC-Link Audi

--------[ PCI / PnP Audio ]-------------------------------------------------------------------------------------------Conexant Cx20468 @ Intel 82801FBM ICH6-M - AC'97 Audio Controller [B-1] PCI --------[ Audio Codecs ]----------------------------------------------------------------------------------------------[ Fraunhofer IIS MPEG Layer-3 Codec (decode only) ] ACM Driver Properties: Driver Description r-3 Codec (decode only) Copyright Notice nhofer Institut Integrierte Schaltungen IIS Driver Features Driver Version [ Microsoft ADPCM CODEC ] ACM Driver Properties: Driver Description Copyright Notice Microsoft Corporation Microsoft ADPCM CODEC Copyright (C) 1992-1996 Fraunhofer IIS MPEG Laye Copyright 1996-1999 Frau decoder only version 1.09

Driver Features ses Microsoft ADPCM audio data. Driver Version [ Microsoft CCITT G.711 A-Law and u-Law CODEC ] ACM Driver Properties: Driver Description Law and u-Law CODEC Copyright Notice Microsoft Corporation Driver Features ses CCITT G.711 A-Law and u-Law audio data. Driver Version [ Microsoft GSM 6.10 Audio CODEC ]

Compresses and decompres 4.00

Microsoft CCITT G.711 ACopyright (c) 1993-1996 Compresses and decompres 4.00

ACM Driver Properties: Driver Description Microsoft GSM 6.10 Audio CODEC Copyright Notice Copyright (C) 1993-1996 Microsoft Corporation Driver Features Compresses and decompres ses audio data conforming to the ETSI-GSM (European Telecommunications Standards Institute-Groupe Special Mobile) recommendation 6.10. Driver Version 4.00 [ Microsoft IMA ADPCM CODEC ] ACM Driver Properties: Driver Description C Copyright Notice Microsoft Corporation Driver Features ses IMA ADPCM audio data. Driver Version [ Microsoft PCM Converter ] ACM Driver Properties: Driver Description Copyright Notice Microsoft Corporation Driver Features its per sample of PCM audio data. Driver Version Microsoft PCM Converter Copyright (C) 1992-1996 Converts frequency and b 5.00 Copyright (C) 1992-1996 Compresses and decompres 4.00 Microsoft IMA ADPCM CODE

--------[ Video Codecs ]----------------------------------------------------------------------------------------------ff_vfw.dll encoder iccvid.dll iyuv_32.dll o(R) Video YUV Codec msrle32.dll RLE Compressor msvidc32.dll ffdshow video 1.10.0.11 Cinepak Codec 6.1.7600.16385 (win7_rtm.090713-1255) Intel Inde 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft 6.1.7600.16385 (win7_rtm.090713-1255) Microsoft

Video 1 Compressor msyuv.dll ft UYVY Video Decompressor tsbyuv.dll Video Codec

6.1.7601.17514 (win7sp1_rtm.101119-1850) Microso 6.1.7601.17514 (win7sp1_rtm.101119-1850) Toshiba

--------[ MCI ]-------------------------------------------------------------------------------------------------------[ AVIVideo ] MCI Device Properties: Device Name Description iver Type Driver Status MCI Device Features: Compound Device File Based Device Can Eject Can Play Can Play In Reverse Can Record Can Save Data Can Freeze Data Can Lock Data Can Stretch Frame Can Stretch Input Can Test Audio Capable Video Capable Still Image Capable [ CDAudio ] MCI Device Properties: Device Name Description evices Type Driver Status MCI Device Features: Compound Device File Based Device Can Eject Can Play Can Record Can Save Data Audio Capable Video Capable [ MPEGVideo ] CDAudio CD Audio MCI driver for cdaudio d CD Audio Device mcicda.dll Enabled No No Yes Yes No No Yes No Digital Video Device mciavi32.dll Enabled Yes Yes No Yes Yes No No No No Yes No Yes Yes Yes No AVIVideo Video for Windows Video For Windows MCI dr

MCI Device Properties: Device Name Description Type Driver Status MCI Device Features: Compound Device File Based Device Can Eject Can Play Can Play In Reverse Can Record Can Save Data Can Freeze Data Can Lock Data Can Stretch Frame Can Stretch Input Can Test Audio Capable Video Capable Still Image Capable [ Sequencer ] MCI Device Properties: Device Name Description encer Type Driver Status MCI Device Features: Compound Device File Based Device Can Eject Can Play Can Record Can Save Data Audio Capable Video Capable [ WaveAudio ] MCI Device Properties: Device Name Description audio Type Driver Status MCI Device Features: Compound Device

MPEGVideo DirectShow DirectShow MCI Driver Digital Video Device mciqtz32.dll Enabled Yes Yes No Yes No No No No No Yes No Yes Yes Yes No

Sequencer MIDI Sequencer MCI driver for MIDI sequ Sequencer Device mciseq.dll Enabled Yes Yes No Yes No No Yes No

WaveAudio Sound MCI driver for waveform Waveform Audio Device mciwave.dll Enabled Yes

File Based Device Can Eject Can Play Can Record Can Save Data Audio Capable Video Capable

Yes No Yes Yes Yes Yes No

--------[ Windows Storage ]-------------------------------------------------------------------------------------------[ ST950032 5AS USB Device ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Disk Device Physical Info: Manufacturer Hard Disk Name Form Factor Formatted Capacity Disks Recording Surfaces Physical Dimensions Max. Weight Average Rotational Latency Rotational Speed Max. Internal Data Rate Interface Buffer-to-Host Data Rate Buffer Size Device Manufacturer: Company Name Product Information roducts [ WDC WD600UE-22KVT0 ATA Device ] Device Properties: Driver Description evice Driver Date Driver Version Driver Provider INF File Device Manufacturer: Company Name ion Product Information l.com/en/products [ DTSOFT Virtual CdRom Device ] http://www.westerndigita WDC WD600UE-22KVT0 ATA D 6/21/2006 6.1.7600.16385 Microsoft disk.inf Western Digital Corporat ST950032 5AS USB Device 6/21/2006 6.1.7600.16385 Microsoft disk.inf Seagate Momentus 5400.6 500325 2.5" 500 GB 2 4 100.5 x 69.85 x 9.5 mm 98.8 g 5.6 ms 5400 RPM 1175 Mbit/s SATA-II 300 MB/s 8 MB Seagate Technology LLC http://www.seagate.com/p

Device Properties: Driver Description ice Driver Date Driver Version Driver Provider INF File [ HL-DT-ST DVDRAM GSA-T10N ATA Device ] Device Properties: Driver Description ATA Device Driver Date Driver Version Driver Provider INF File Optical Drive Properties: Manufacturer Device Type Interface Writing Speeds: DVD+R9 Dual Layer DVD+R DVD+RW DVD-R9 Dual Layer DVD-R DVD-RW DVD-RAM CD-R CD-RW Reading Speeds: DVD-ROM CD-ROM

DTSOFT Virtual CdRom Dev 6/21/2006 6.1.7601.17514 Microsoft cdrom.inf

HL-DT-ST DVDRAM GSA-T10N 6/21/2006 6.1.7601.17514 Microsoft cdrom.inf Hitachi-LG DVD+RW/DVD-RW/DVD-RAM ATAPI 4x 8x 8x 4x 8x 6x 5x 24x 24x 8x 24x

Device Manufacturer: Company Name LG Electronics Product Information http://www.lge.com/produ cts/category/list/computer%20products_optical%20storage.jhtml Firmware Download http://www.lge.com/suppo rt/main.jhtml [ ATA Channel 0 ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Device Resources: IRQ Port Port ATA Channel 0 6/21/2006 6.1.7601.17514 Microsoft mshdc.inf 14 01F0-01F7 03F6-03F6

[ Intel(R) 82801FB/FBM Ultra ATA Storage Controllers - 266F ]

Device Properties: Driver Description ra ATA Storage Controllers - 266F Driver Date Driver Version Driver Provider INF File Device Resources: Port

Intel(R) 82801FB/FBM Ult 2/25/2013 9.1.9.1003 Intel oem4.inf 3580-358F

--------[ Logical Drives ]--------------------------------------------------------------------------------------------C: 27129 MB 17287 MB D: (Courseware 2013) 29998 MB 240 MB E: F: G: (Seagate Vic) 76936 MB 370226 MB 106710 MB 9842 MB 29758 MB Local Disk 36 % 5887-1E46 Local Disk 99 % 9C3D-4D24 Optical Drive Optical Drive Local Disk 22 % B236-75FE NTFS 4 NTFS NTFS

--------[ Physical Drives ]-------------------------------------------------------------------------------------------[ Drive #1 - WDC WD600UE-22KVT0 (55 GB) ] #1 (Active) 1 MB 100 #2 101 MB 27130 #3 27231 MB 29999 NTFS MB NTFS MB NTFS MB

C: D: (Courseware 2013)

[ Drive #2 - ST9500325AS (465 GB) ] #1 1 MB NTFS 476937 MB G: (Seagate Vic)

--------[ Optical Drives ]--------------------------------------------------------------------------------------------[ E:\ HL-DT-ST DVDRAM GSA-T10N ATA Device ] Optical Drive Properties: Device Description ATA Device Serial Number Firmware Revision Firmware Date Buffer Size Manufacturer Device Type HL-DT-ST DVDRAM GSA-T10N KY971AL0833 PC05 7/20/2006 2 MB Hitachi-LG DVD+RW/DVD-RW/DVD-RAM

Interface Region Code Remaining User Changes Remaining Vendor Changes Writing Speeds: DVD+R9 Dual Layer DVD+R DVD+RW DVD-R9 Dual Layer DVD-R DVD-RW DVD-RAM CD-R CD-RW Reading Speeds: DVD-ROM CD-ROM Supported Disk Types: BD-ROM BD-R BD-RE HD DVD-ROM HD DVD-R HD DVD-RW DVD-ROM DVD+R9 Dual Layer DVD+R DVD+RW DVD-R9 Dual Layer DVD-R DVD-RW DVD-RAM CD-ROM CD-R CD-RW Optical Drive Features: Buffer Underrun Protection C2 Error Pointers CD+G CD-Text Hybrid Disc JustLink LabelFlash Layer-Jump Recording LightScribe Mount Rainier SMART CSS CPRM AACS VCPS BD CPS Device Manufacturer: Company Name Product Information

ATAPI 3 3 4 4x 8x 8x 4x 8x 6x 5x 24x 24x 8x 24x Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Read Read + Write Read + Write Read + Write Read + Write Read + Write Read + Write Read + Write Read Read + Write Read + Write Supported Supported Not Supported Supported Not Supported Not Supported Not Supported Supported Not Supported Not Supported Supported Supported Supported Not Supported Not Supported Not Supported LG Electronics http://www.lge.com/produ

cts/category/list/computer%20products_optical%20storage.jhtml Firmware Download http://www.lge.com/suppo rt/main.jhtml [ F:\ DTSOFT Virtual CdRom Device ] Optical Drive Properties: Device Description ice Firmware Revision Buffer Size Region Code Remaining User Changes Remaining Vendor Changes Supported Disk Types: BD-ROM BD-R BD-RE HD DVD-ROM HD DVD-R HD DVD-RW DVD-ROM DVD+R9 Dual Layer DVD+R DVD+RW DVD-R9 Dual Layer DVD-R DVD-RW DVD-RAM CD-ROM CD-R CD-RW Optical Drive Features: Buffer Underrun Protection C2 Error Pointers CD+G CD-Text Hybrid Disc JustLink LabelFlash Layer-Jump Recording LightScribe Mount Rainier SMART CSS CPRM AACS VCPS BD CPS 1.05 128 KB 1 4 4 Read Read Read Not Supported Not Supported Not Supported Read Read Read Read Read Read Read Not Supported Read Read Read Not Supported Supported Supported Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported DTSOFT Virtual CdRom Dev

--------[ ATA ]-------------------------------------------------------------------------------------------------------[ WDC WD600UE-22KVT0 (WD-WXCX06132557) ] ATA Device Properties: Model ID WDC WD600UE-22KVT0

Serial Number Revision World Wide Name Device Type Parameters ds, 63 sectors per track, 512 bytes per sector LBA Sectors Buffer Multiple Sectors ECC Bytes Max. PIO Transfer Mode Max. UDMA Transfer Mode Active UDMA Transfer Mode Unformatted Capacity ATA Device Features: 48-bit LBA Advanced Power Management Automatic Acoustic Management Device Configuration Overlay DMA Setup Auto-Activate General Purpose Logging Host Protected Area In-Order Data Delivery Native Command Queuing Phy Event Counters Power Management Power-Up In Standby Read Look-Ahead Release Interrupt Security Mode SMART SMART Error Logging SMART Self-Test Software Settings Preservation Streaming Tagged Command Queuing Write Cache ATA Device Manufacturer: Company Name ion Product Information l.com/en/products [ ST9500325AS (6VETQDD0) ] ATA Device Properties: Model ID Serial Number Revision World Wide Name Device Type Parameters ds, 63 sectors per track, 512 bytes per sector LBA Sectors Buffer Multiple Sectors ECC Bytes Unformatted Capacity

WD-WXCX06132557 01.03K01 5-0014EE-2001A7DEA ATA-100 116280 cylinders, 16 hea 117210240 2 MB 16 56 PIO 4 UDMA 5 (ATA-100) UDMA 5 (ATA-100) 57232 MB Supported Supported, Enabled Supported, Disabled Supported Not Supported Not Supported Supported, Enabled Not Supported Not Supported Not Supported Supported, Enabled Not Supported Supported, Enabled Not Supported Supported, Disabled Supported, Enabled Supported Supported Not Supported Not Supported Not Supported Supported, Enabled Western Digital Corporat http://www.westerndigita

ST9500325AS 6VETQDD0 0003SDM1 5-000C50-0375E0093 SATA-II @ Oxford 969021 cylinders, 16 hea 976773168 8 MB 16 4 476940 MB

ATA Device Features: 48-bit LBA Advanced Power Management Automatic Acoustic Management Device Configuration Overlay DMA Setup Auto-Activate General Purpose Logging Host Protected Area In-Order Data Delivery Native Command Queuing Phy Event Counters Power Management Power-Up In Standby Read Look-Ahead Release Interrupt Security Mode SMART SMART Error Logging SMART Self-Test Software Settings Preservation Streaming Tagged Command Queuing Write Cache ATA Device Physical Info: Manufacturer Hard Disk Name Form Factor Formatted Capacity Disks Recording Surfaces Physical Dimensions Max. Weight Average Rotational Latency Rotational Speed Max. Internal Data Rate Interface Buffer-to-Host Data Rate Buffer Size ATA Device Manufacturer: Company Name Product Information roducts

Supported Supported, Enabled Not Supported Supported Not Supported Supported Supported, Enabled Not Supported Supported Supported Supported, Enabled Not Supported Supported, Enabled Not Supported Supported, Disabled Supported, Enabled Supported Supported Supported, Enabled Not Supported Not Supported Supported, Enabled Seagate Momentus 5400.6 500325 2.5" 500 GB 2 4 100.5 x 69.85 x 9.5 mm 98.8 g 5.6 ms 5400 RPM 1175 Mbit/s SATA-II 300 MB/s 8 MB Seagate Technology LLC http://www.seagate.com/p

--------[ SMART ]-----------------------------------------------------------------------------------------------------[ WDC WD600UE-22KVT0 (WD-WXCX06132557) ] 01 Raw Read Error Rate e is normal 03 Spinup Time e is normal 04 Start/Stop Count ys passes 05 Reallocated Sector Count e is normal 51 21 0 200 200 159 156 86 86 16 OK: Valu 1008 OK: Valu 14277 OK: Alwa 402 OK: Valu

140 149 149

07 Seek Error Rate e is normal 09 Power-On Time Count ys passes 0A Spinup Retry Count e is normal 0B Calibration Retry Count e is normal 0C Power Cycle Count ys passes C0 Power-Off Retract Count ys passes C1 Load/Unload Cycle Count ys passes C2 Temperature ys passes C4 Reallocation Event Count ys passes C5 Current Pending Sector Count ys passes C6 Offline Uncorrectable Sector Count ys passes C7 Ultra ATA CRC Error Rate ys passes C8 Write Error Rate e is normal [ ST9500325AS (6VETQDD0) ] 01 Raw Read Error Rate e is normal 03 Spinup Time ys passes 04 Start/Stop Count e is normal 05 Reallocated Sector Count e is normal 07 Seek Error Rate e is normal 09 Power-On Time Count ys passes 0A Spinup Retry Count e is normal 0C Power Cycle Count e is normal B8 <vendor-specific> e is normal BB <vendor-specific> ys passes BC <vendor-specific> ys passes BD <vendor-specific> ys passes BE Airflow Temperature e is normal BF Mechanical Shock ys passes C0 Power-Off Retract Count ys passes C1 Load/Unload Cycle Count

51 0 51 51 0 0 0 0 0 0 0 0 51

200 200 68 68

0 OK: Valu 24051 OK: Alwa 0 OK: Valu 0 OK: Valu 9603 OK: Alwa 9443 OK: Alwa 419847 OK: Alwa 44 OK: Alwa 140 OK: Alwa 0 OK: Alwa 0 OK: Alwa 309 OK: Alwa 0 OK: Valu

100 100 100 100 91 91

188 188 61 99 60 61 88 60

200 200 200 200 200 200 200 200

6 0 20 36 30 0 97 20 99 0 0 0 45 0 0 0

116 99 99 98 98 98

111262278 OK: Valu 0 OK: Alwa 2657 OK: Valu 0 OK: Valu 182943644 OK: Valu 9802 OK: Alwa 0 OK: Valu 2539 OK: Valu 0 OK: Valu 0 OK: Alwa 393297 OK: Alwa 0 OK: Alwa 538837024 OK: Valu 2029 OK: Alwa 326 OK: Alwa 107854 OK: Alwa

100 100 82 89 60 89

100 100 98 98

100 100 100 100 100 93 100 100 68 99 50 99

100 100 47 47

ys passes C2 Temperature ys passes C3 Hardware ECC Recovered ys passes C5 Current Pending Sector Count ys passes C6 Offline Uncorrectable Sector Count ys passes C7 Ultra ATA CRC Error Rate ys passes FE <vendor-specific> ys passes

0 0 0 0 0 0

32 55

50 49

32 OK: Alwa 111262278 OK: Alwa 0 OK: Alwa 0 OK: Alwa 2 OK: Alwa 0 OK: Alwa

100 100 100 100 200 200 100 100

--------[ Windows Network ]-------------------------------------------------------------------------------------------[ Intel(R) PRO/100 VE Network Connection ] Network Adapter Properties: Network Adapter ork Connection Interface Type Hardware Address Connection Name Connection Speed MTU Bytes Received Bytes Sent Network Adapter Manufacturer: Company Name Product Information ign/network/products/ethernet/linecard_ec.htm Driver Download /support/network Driver Update ef=59 [ Intel(R) PRO/Wireless 2200BG Network Connection ] Network Adapter Properties: Network Adapter 00BG Network Connection Interface Type Hardware Address Connection Name ion Connection Speed MTU DHCP Lease Obtained DHCP Lease Expires WLAN Signal Strength Bytes Received Bytes Sent Network Adapter Addresses: IP / Subnet Mask 55.0 Intel(R) PRO/Wireless 22 802.11 Wireless Ethernet 00-16-6F-C7-55-78 Wireless Network Connect 54 Mbps 1500 bytes 8/19/2013 11:01:18 PM 8/20/2013 12:01:18 AM -33 dBm (Excellent) 405831060 (387.0 MB) 28880728 (27.5 MB) 192.168.43.3 / 255.255.2 Intel(R) PRO/100 VE Netw Ethernet 00-16-D4-BC-CE-11 Local Area Connection 10 Mbps 1500 bytes 0 0 Intel Corporation http://www.intel.com/des http://support.intel.com http://driveragent.com?r

Gateway DHCP DNS Network Adapter Manufacturer: Company Name Product Information ign/network/products/ethernet/linecard_ec.htm Driver Download /support/network Driver Update ef=59

192.168.43.1 192.168.43.1 192.168.43.1 Intel Corporation http://www.intel.com/des http://support.intel.com http://driveragent.com?r

--------[ PCI / PnP Network ]-----------------------------------------------------------------------------------------HP PRO/Wireless 2200BG 3B Network Connection PCI Intel PRO/100 VE Network Connection PCI --------[ IAM ]-------------------------------------------------------------------------------------------------------[ Microsoft Communities ] Account Properties: Account Name Account ID F9-9F79-A250A6BE7FE4}.oeaccount Account Type Connection Name t) NNTP Server Account Features: NNTP Prompt For Password NNTP Secure Authentication NNTP Secure Connection NNTP Use Group Descriptions NNTP Post Using Plain Text Format NNTP Post Using HTML Format [ Active Directory ] Account Properties: Account Name Account ID 2C-AD70-CF109B7FC846}.oeaccount Account Type Connection Name t) LDAP Server LDAP User Name LDAP Search Base LDAP Search Timeout Account Features: Active Directory account{4D537664-B4C3-49 LDAP Not Specified (IE Defaul NULL:3268 NULL NULL 1 min Microsoft Communities account{9E2C0896-48A6-45 News (Default) Not Specified (IE Defaul msnews.microsoft.com No No No No No No

LDAP LDAP LDAP LDAP

Authentication Required Secure Authentication Secure Connection Simple Search Filter

Yes Yes No No

[ VeriSign Internet Directory Service ] Account Properties: Account Name ory Service Account ID 51-A79C-99EF967221E1}.oeaccount Account Type Connection Name t) LDAP Server LDAP URL LDAP Search Base LDAP Search Timeout Account Features: LDAP Authentication Required LDAP Secure Authentication LDAP Secure Connection LDAP Simple Search Filter VeriSign Internet Direct account{CB9EC4F5-E86A-41 LDAP Not Specified (IE Defaul directory.verisign.com http://www.verisign.com NULL 1 min No No No Yes

--------[ Internet ]--------------------------------------------------------------------------------------------------Internet Settings: Start Page fwlink/?LinkId=69157 Search Page fwlink/?LinkId=54896 Download Folder Current Proxy: Proxy Status LAN Proxy: Proxy Status http://go.microsoft.com/ http://go.microsoft.com/

Disabled Disabled

--------[ Routes ]----------------------------------------------------------------------------------------------------Active 0.0.0.0 0.0.0.0 192.168.43.1 8.43.3 (Intel(R) PRO/Wireless 2200BG Network Connection) Active 127.0.0.0 255.0.0.0 127.0.0.1 0.1 (Software Loopback Interface 1) Active 127.0.0.1 255.255.255.255 127.0.0.1 0.1 (Software Loopback Interface 1) Active 127.255.255.255 255.255.255.255 127.0.0.1 0.1 (Software Loopback Interface 1) Active 192.168.43.0 255.255.255.0 192.168.43.3 8.43.3 (Intel(R) PRO/Wireless 2200BG Network Connection) Active 192.168.43.3 255.255.255.255 192.168.43.3 8.43.3 (Intel(R) PRO/Wireless 2200BG Network Connection) Active 192.168.43.255 255.255.255.255 192.168.43.3 25 192.16

306 127.0. 306 127.0. 306 127.0. 281 192.16 281 192.16 281 192.16

8.43.3 (Intel(R) PRO/Wireless 2200BG Network Connection) Active 224.0.0.0 240.0.0.0 127.0.0.1 0.1 (Software Loopback Interface 1) Active 224.0.0.0 240.0.0.0 192.168.43.3 8.43.3 (Intel(R) PRO/Wireless 2200BG Network Connection) Active 255.255.255.255 255.255.255.255 127.0.0.1 0.1 (Software Loopback Interface 1) Active 255.255.255.255 255.255.255.255 192.168.43.3 8.43.3 (Intel(R) PRO/Wireless 2200BG Network Connection)

306 127.0. 281 192.16 306 127.0. 281 192.16

--------[ Browser History ]-------------------------------------------------------------------------------------------2013-08-19 16:52:44 DLLFixer.exe/426 2013-08-19 16:52:44 DLLFixer.exe/445 2013-08-19 16:52:45 DLLFixer.exe/424 2013-08-19 16:52:46 DLLFixer.exe/420 2013-08-19 16:52:46 DLLFixer.exe/421 2013-08-19 16:52:46 DLLFixer.exe/427 2013-08-19 16:52:46 DLLFixer.exe/428 Vic Tiangco@res://C:\Program Files\Dll-Files.com Fixer\ Vic Tiangco@res://C:\Program Files\Dll-Files.com Fixer\ Vic Tiangco@res://C:\Program Files\Dll-Files.com Fixer\ Vic Tiangco@res://C:\Program Files\Dll-Files.com Fixer\ Vic Tiangco@res://C:\Program Files\Dll-Files.com Fixer\ Vic Tiangco@res://C:\Program Files\Dll-Files.com Fixer\ Vic Tiangco@res://C:\Program Files\Dll-Files.com Fixer\

--------[ DirectX Files ]---------------------------------------------------------------------------------------------amstream.dll glish bdaplgin.ax glish d3d8.dll glish d3d8thk.dll glish d3d9.dll glish d3dim.dll glish d3dim700.dll glish d3dramp.dll glish d3dxof.dll glish ddraw.dll glish ddrawex.dll glish devenum.dll glish dinput.dll glish dinput8.dll 6.06.7601.17514 70656 11/21/2010 5:29:07 AM 6.01.7600.16385 74240 7/14/2009 9:14:10 AM 6.01.7600.16385 1036800 7/14/2009 9:15:08 AM 6.01.7600.16385 11264 7/14/2009 9:15:08 AM 6.01.7601.17514 1828352 11/21/2010 5:29:19 AM 6.01.7600.16385 386048 7/14/2009 9:15:08 AM 6.01.7600.16385 817664 7/14/2009 9:15:08 AM 6.01.7600.16385 593920 7/14/2009 9:15:08 AM 6.01.7600.16385 53760 7/14/2009 9:15:08 AM 6.01.7600.16385 531968 7/14/2009 9:15:10 AM 6.01.7600.16385 30208 7/14/2009 9:15:10 AM 6.06.7600.16385 66560 7/14/2009 9:15:10 AM 6.01.7600.16385 136704 7/14/2009 9:15:11 AM 6.01.7600.16385 Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En

glish dmband.dll glish dmcompos.dll glish dmime.dll glish dmloader.dll glish dmscript.dll glish dmstyle.dll glish dmsynth.dll glish dmusic.dll glish dplaysvr.exe glish dplayx.dll glish dpmodemx.dll glish dpnaddr.dll glish dpnet.dll glish dpnhpast.dll glish dpnhupnp.dll glish dpnlobby.dll glish dpnsvr.exe glish dpwsockx.dll glish dsdmo.dll glish dsound.dll glish dswave.dll glish dxapi.sys glish dxdiagn.dll glish dxmasf.dll glish encapi.dll glish gcdef.dll glish iac25_32.ax glish ir41_32.ax glish ir41_qc.dll glish ir41_qcx.dll

145408 7/14/2009 9:15:11 AM 6.01.7600.16385 30720 7/14/2009 9:15:12 AM 6.01.7600.16385 63488 7/14/2009 9:15:12 AM 6.01.7600.16385 179712 7/14/2009 9:15:12 AM 6.01.7600.16385 38400 7/14/2009 9:15:12 AM 6.01.7600.16385 86016 7/14/2009 9:15:12 AM 6.01.7600.16385 105984 7/14/2009 9:15:12 AM 6.01.7600.16385 105472 7/14/2009 9:15:12 AM 6.01.7600.16385 101376 7/14/2009 9:15:12 AM 6.01.7600.16385 29184 7/14/2009 9:14:18 AM 6.01.7600.16385 213504 7/14/2009 9:15:12 AM 6.01.7600.16385 23040 7/14/2009 9:15:12 AM 6.01.7601.17514 2560 11/21/2010 5:29:06 AM 6.01.7600.16385 376832 7/14/2009 9:15:12 AM 6.01.7600.16385 7168 7/14/2009 9:15:12 AM 6.01.7600.16385 7168 7/14/2009 9:15:12 AM 6.01.7600.16385 2560 7/14/2009 9:04:52 AM 6.01.7600.16385 33280 7/14/2009 9:14:18 AM 6.01.7600.16385 44032 7/14/2009 9:15:12 AM 6.01.7600.16385 173568 7/14/2009 9:15:13 AM 6.01.7600.16385 453632 7/14/2009 9:15:13 AM 6.01.7600.16385 20992 7/14/2009 9:15:13 AM 6.01.7600.16385 13312 7/14/2009 7:25:26 AM 6.01.7601.17514 210432 11/21/2010 5:29:19 AM 12.00.7601.17514 4096 11/21/2010 5:29:41 AM 6.01.7600.16385 20992 7/14/2009 9:15:14 AM 6.01.7600.16385 120832 7/14/2009 9:15:22 AM 2.00.0005.0053 197632 7/14/2009 9:14:10 AM 4.51.0016.0003 839680 7/14/2009 9:14:10 AM 4.30.0062.0002 120320 7/14/2009 9:15:34 AM 4.30.0062.0002

Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En

glish 120320 7/14/2009 9:15:34 AM ir50_32.dll 5.2562.0015.0055 glish 746496 7/14/2009 9:15:34 AM ir50_qc.dll 5.00.0063.0048 glish 200192 7/14/2009 9:15:34 AM ir50_qcx.dll 5.00.0063.0048 glish 200192 7/14/2009 9:15:34 AM ivfsrc.ax 5.10.0002.0051 glish 146944 7/14/2009 9:14:10 AM joy.cpl 6.01.7600.16385 glish 138240 7/14/2009 9:14:09 AM ks.sys 6.01.7601.17514 glish 190976 11/21/2010 5:29:21 AM ksproxy.ax 6.01.7601.17514 glish 193536 11/21/2010 5:29:24 AM kstvtune.ax 6.01.7601.17514 glish 84480 11/21/2010 5:29:38 AM ksuser.dll 6.01.7600.16385 glish 4608 7/14/2009 9:15:35 AM kswdmcap.ax 6.01.7601.17514 glish 107008 11/21/2010 5:29:13 AM ksxbar.ax 6.01.7601.17514 glish 48640 11/21/2010 5:29:38 AM mciqtz32.dll 6.06.7601.17514 glish 36352 11/21/2010 5:29:07 AM mfc40.dll 4.01.0000.6151 glish 954752 11/21/2010 5:29:07 AM mfc42.dll 6.06.8063.0000 glish 1136640 7/14/2009 9:15:39 AM Microsoft.DirectX.AudioVideoPlayback.dll 5.04.0000.2904 glish 53248 8/19/2013 2:34:46 PM Microsoft.DirectX.Diagnostics.dll 5.04.0000.2904 glish 12800 8/19/2013 2:34:46 PM Microsoft.DirectX.Direct3D.dll 9.05.0132.0000 glish 473600 8/19/2013 2:34:46 PM Microsoft.DirectX.Direct3DX.dll 5.04.0000.3900 glish 2676224 8/19/2013 2:34:44 PM Microsoft.DirectX.Direct3DX.dll 9.04.0091.0000 glish 2846720 8/19/2013 2:34:45 PM Microsoft.DirectX.Direct3DX.dll 9.05.0132.0000 glish 563712 8/19/2013 2:34:45 PM Microsoft.DirectX.Direct3DX.dll 9.06.0168.0000 glish 567296 8/19/2013 2:34:45 PM Microsoft.DirectX.Direct3DX.dll 9.07.0239.0000 glish 576000 8/19/2013 2:34:45 PM Microsoft.DirectX.Direct3DX.dll 9.08.0299.0000 glish 577024 8/19/2013 2:34:46 PM Microsoft.DirectX.Direct3DX.dll 9.09.0376.0000 glish 577536 8/19/2013 2:34:46 PM Microsoft.DirectX.Direct3DX.dll 9.10.0455.0000 glish 577536 8/19/2013 2:34:46 PM Microsoft.DirectX.Direct3DX.dll 9.11.0519.0000 glish 578560 8/19/2013 2:34:46 PM Microsoft.DirectX.Direct3DX.dll 9.12.0589.0000 glish 578560 8/19/2013 2:34:46 PM Microsoft.DirectX.DirectDraw.dll 5.04.0000.2904 glish 145920 8/19/2013 2:34:46 PM Microsoft.DirectX.DirectInput.dll 5.04.0000.2904 glish 159232 8/19/2013 2:34:46 PM Microsoft.DirectX.DirectPlay.dll 5.04.0000.2904

Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Beta Retail Beta Retail En En

Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En

glish 364544 8/19/2013 2:34:46 PM Microsoft.DirectX.DirectSound.dll 5.04.0000.2904 glish 178176 8/19/2013 2:34:46 PM Microsoft.DirectX.dll 5.04.0000.2904 glish 223232 8/19/2013 2:34:46 PM mpeg2data.ax 6.06.7601.17514 glish 72704 11/21/2010 5:29:38 AM mpg2splt.ax 6.06.7601.17514 glish 199680 11/21/2010 5:29:38 AM msdmo.dll 6.06.7601.17514 glish 30720 11/21/2010 5:29:08 AM msdvbnp.ax 6.06.7601.17514 glish 59904 11/21/2010 5:29:38 AM mskssrv.sys 6.01.7600.16385 glish 8320 7/14/2009 7:45:08 AM mspclock.sys 6.01.7600.16385 glish 5888 7/14/2009 7:45:08 AM mspqm.sys 6.01.7600.16385 glish 5504 7/14/2009 7:45:07 AM mstee.sys 6.01.7600.16385 glish 6144 7/14/2009 7:45:08 AM msvidctl.dll 6.05.7601.17514 glish 2291712 11/21/2010 5:29:38 AM msyuv.dll 6.01.7601.17514 glish 22528 11/21/2010 5:29:04 AM pid.dll 6.01.7600.16385 glish 36352 7/14/2009 9:16:12 AM psisdecd.dll 6.06.7600.16385 glish 465408 7/14/2009 9:16:12 AM psisrndr.ax 6.06.7601.17514 glish 75776 11/21/2010 5:29:38 AM qasf.dll 12.00.7601.17514 glish 206848 11/21/2010 5:29:08 AM qcap.dll 6.06.7601.17514 glish 190976 11/21/2010 5:29:12 AM qdv.dll 6.06.7601.17514 glish 283136 11/21/2010 5:29:12 AM qdvd.dll 6.06.7601.17514 glish 514560 11/21/2010 5:29:06 AM qedit.dll 6.06.7601.17514 glish 509440 11/21/2010 5:29:40 AM qedwipes.dll 6.06.7600.16385 glish 733184 7/14/2009 9:09:35 AM quartz.dll 6.06.7601.17514 glish 1328128 11/21/2010 5:29:07 AM stream.sys 6.01.7600.16385 glish 53632 7/14/2009 7:50:57 AM swenum.sys 6.01.7600.16385 glish 12240 7/14/2009 9:19:10 AM vbisurf.ax 6.01.7601.17514 glish 33792 11/21/2010 5:29:38 AM vfwwdm32.dll 6.01.7601.17514 glish 56832 11/21/2010 5:29:12 AM wsock32.dll 6.01.7600.16385 glish 15360 7/14/2009 9:16:20 AM

Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En Final Retail En

--------[ DirectX Video ]----------------------------------------------------------------------------------------------

[ Primary Display Driver ] DirectDraw Device Properties: DirectDraw Driver Name DirectDraw Driver Description Hardware Driver 04) Hardware Description S,910GML Express Chipset Family Direct3D Device Properties: Rendering Bit Depths Z-Buffer Bit Depths Min Texture Size Max Texture Size Vertex Shader Version Pixel Shader Version Direct3D Device Features: Additive Texture Blending AGP Texturing Anisotropic Filtering Automatic Mipmap Generation Bilinear Filtering Cubic Environment Mapping Cubic Filtering Decal-Alpha Texture Blending Decal Texture Blending DirectX Texture Compression DirectX Volumetric Texture Compression Dithering Dot3 Texture Blending Dynamic Textures Edge Anti-Aliasing Environmental Bump Mapping Environmental Bump Mapping + Luminance Factor Alpha Blending Geometric Hidden-Surface Removal Guard Band Hardware Scene Rasterization Hardware Transform & Lighting Legacy Depth Bias Mipmap LOD Bias Adjustments Mipmapped Cube Textures Mipmapped Volume Textures Modulate-Alpha Texture Blending Modulate Texture Blending Non-Square Textures N-Patches Perspective Texture Correction Point Sampling Projective Textures Quintic Bezier Curves & B-Splines Range-Based Fog Rectangular & Triangular Patches Rendering In Windowed Mode Scissor Test Slope-Scale Based Depth Bias Specular Flat Shading Specular Gouraud Shading Mobile Intel(R) 915GM/GM display Primary Display Driver igxprd32.dll (6.14.10.47

16, 32 16, 24 1 x 1 2048 x 2048 Not Supported 2.0 Supported Not Supported Supported Not Supported Supported Supported Not Supported Supported Supported Not Supported Not Supported Supported Supported Supported Not Supported Supported Supported Supported Not Supported Supported Not Supported Not Supported Supported Supported Supported Supported Supported Supported Supported Not Supported Supported Supported Not Supported Not Supported Not Supported Not Supported Supported Supported Supported Supported Supported

Specular Phong Shading Spherical Mapping Stencil Buffers Sub-Pixel Accuracy Subtractive Texture Blending Table Fog Texture Alpha Blending Texture Clamping Texture Mirroring Texture Transparency Texture Wrapping Triangle Culling Trilinear Filtering Two-Sided Stencil Test Vertex Alpha Blending Vertex Fog Vertex Tweening Volume Textures W-Based Fog W-Buffering Z-Based Fog Z-Bias Z-Test Supported FourCC Codes: I420 IMC1 IMC2 IMC3 IMC4 IYUV UYVY VYUY YUY2 YV12 YVU9 YVYU Video Adapter Manufacturer: Company Name Product Information ducts/chipsets Driver Download /support/graphics Driver Update ef=59

Not Supported Not Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Not Supported Supported Supported Supported Supported Not Supported Supported Supported Not Supported Supported Supported Not Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Supported Intel Corporation http://www.intel.com/pro http://support.intel.com http://driveragent.com?r

--------[ DirectX Sound ]---------------------------------------------------------------------------------------------[ Primary Sound Driver ] DirectSound Device Properties: Device Description Driver Module Primary Buffers Min / Max Secondary Buffers Sample Rate Primary Buffers Sound Formats reo Primary Sound Driver 1 100 / 200000 Hz 8-bit, 16-bit, Mono, Ste

Secondary Buffers Sound Formats reo Total Total Total Total Total Total / / / / / / Free Free Free Free Free Free Sound Buffers Static Sound Buffers Streaming Sound Buffers 3D Sound Buffers 3D Static Sound Buffers 3D Streaming Sound Buffers

8-bit, 16-bit, Mono, Ste 1 1 1 0 0 0 / / / / / / 0 0 0 0 0 0

DirectSound Device Features: Certified Driver Emulated Device Precise Sample Rate DirectSound3D Creative EAX 1.0 Creative EAX 2.0 Creative EAX 3.0 Creative EAX 4.0 Creative EAX 5.0 I3DL2 Sensaura ZoomFX [ Speakers (Conexant AC-Link Audio) ] DirectSound Device Properties: Device Description nk Audio) Driver Module c9-ead8-41f2-a5d0-6164be9fc07f} Primary Buffers Min / Max Secondary Buffers Sample Rate Primary Buffers Sound Formats reo Secondary Buffers Sound Formats reo Total / Free Sound Buffers Total / Free Static Sound Buffers Total / Free Streaming Sound Buffers Total / Free 3D Sound Buffers Total / Free 3D Static Sound Buffers Total / Free 3D Streaming Sound Buffers DirectSound Device Features: Certified Driver Emulated Device Precise Sample Rate DirectSound3D Creative EAX 1.0 Creative EAX 2.0 Creative EAX 3.0 Creative EAX 4.0 Creative EAX 5.0 I3DL2 Sensaura ZoomFX

No No Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported

Speakers (Conexant AC-Li {0.0.0.00000000}.{ab5363 1 100 / 200000 Hz 8-bit, 16-bit, Mono, Ste 8-bit, 16-bit, Mono, Ste 1 1 1 0 0 0 / / / / / / 0 0 0 0 0 0

No No Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported Not Supported

--------[ DirectX Music ]---------------------------------------------------------------------------------------------[ Microsoft MIDI Mapper [Emulated] ]

DirectMusic Device Properties: Device Description mulated] Synthesizer Type Device Class Device Type MIDI Channels DirectMusic Device Features: Built-In GM Instrument Set Built-In Roland GS Sound Set DirectSound DLS L1 Sample Collections DLS L2 Sample Collections External MIDI Port Fixed DLS Memory Size Port Sharing Chorus Effect Delay Effect Reverb Effect [ Microsoft GS Wavetable Synth [Emulated] ] DirectMusic Device Properties: Device Description ynth [Emulated] Synthesizer Type Device Class Device Type MIDI Channels DirectMusic Device Features: Built-In GM Instrument Set Built-In Roland GS Sound Set DirectSound DLS L1 Sample Collections DLS L2 Sample Collections External MIDI Port Fixed DLS Memory Size Port Sharing Chorus Effect Delay Effect Reverb Effect [ Microsoft Synthesizer ] DirectMusic Device Properties: Device Description Synthesizer Type Device Class Device Type Audio Channels MIDI Channels Voices Available Memory DirectMusic Device Features: Built-In GM Instrument Set Built-In Roland GS Sound Set

Microsoft MIDI Mapper [E Hardware Output Port Windows Multimedia 16 No No Not Supported Not Supported Not Supported No No Supported Not Supported Not Supported Not Supported

Microsoft GS Wavetable S Hardware Output Port Windows Multimedia 16 No No Not Supported Not Supported Not Supported No No Supported Not Supported Not Supported Not Supported

Microsoft Synthesizer Software Output Port User-Mode Synthesizer 2 16000 1000 System Memory No No

DirectSound DLS L1 Sample Collections DLS L2 Sample Collections External MIDI Port Fixed DLS Memory Size Port Sharing Chorus Effect Delay Effect Reverb Effect

Supported Supported Supported No No Not Supported Not Supported Not Supported Supported

--------[ DirectX Input ]---------------------------------------------------------------------------------------------[ Mouse ] DirectInput Device Properties: Device Description Device Type Device Subtype Axes Buttons/Keys DirectInput Device Features: Emulated Device Alias Device Polled Device Polled Data Format Attack Force Feedback Deadband Force Feedback Fade Force Feedback Force Feedback Saturation Force Feedback +/- Force Feedback Coefficients +/- Force Feedback Saturation [ Keyboard ] DirectInput Device Properties: Device Description Device Type Device Subtype Buttons/Keys DirectInput Device Features: Emulated Device Alias Device Polled Device Polled Data Format Attack Force Feedback Deadband Force Feedback Fade Force Feedback Force Feedback Saturation Force Feedback +/- Force Feedback Coefficients +/- Force Feedback Saturation [ HP Hotkey Device ] DirectInput Device Properties: Keyboard Unknown Unknown 128 Yes No No No Not Not Not Not Not Not Not Mouse Unknown Unknown 3 5 Yes No No No Not Not Not Not Not Not Not

Supported Supported Supported Supported Supported Supported Supported

Supported Supported Supported Supported Supported Supported Supported

Device Description Device Type Device Subtype Buttons/Keys DirectInput Device Features: Emulated Device Alias Device Polled Device Polled Data Format Attack Force Feedback Deadband Force Feedback Fade Force Feedback Force Feedback Saturation Force Feedback +/- Force Feedback Coefficients +/- Force Feedback Saturation

HP Hotkey Device Unknown Unknown 12 Yes No No No Not Not Not Not Not Not Not

Supported Supported Supported Supported Supported Supported Supported

--------[ Windows Devices ]-------------------------------------------------------------------------------------------[ Devices ] Batteries: Microsoft AC Adapter Microsoft ACPI-Compliant Control Method Battery Microsoft Composite Battery Computer: ACPI x86-based PC Disk drives: ST950032 5AS USB Device WDC WD600UE-22KVT0 ATA Device 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385

Display adapters: Mobile Intel(R) 915GM/GMS,910GML Express Chipset Family6.14.10.4704 Mobile Intel(R) 915GM/GMS,910GML Express Chipset Family6.14.10.4704 DVD/CD-ROM drives: DTSOFT Virtual CdRom Device HL-DT-ST DVDRAM GSA-T10N ATA Device Human Interface Devices: HID-compliant device HP Hotkey Device USB Input Device 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 7.0.3.1 6.1.7601.17514

IDE ATA/ATAPI controllers: ATA Channel 0 6.1.7601.17514 Intel(R) 82801FB/FBM Ultra ATA Storage Controllers - 266F9.1.9.1003 Keyboards: HID Keyboard Device Standard PS/2 Keyboard Mice and other pointing devices: HID-compliant mouse PS/2 Compatible Mouse 6.1.7601.17514 6.1.7601.17514 6.1.7600.16385 6.1.7600.16385

Modems: Motorola SM56 Data Fax Modem Monitors: Generic PnP Monitor Generic PnP Monitor Generic PnP Monitor Network adapters: Intel(R) PRO/100 VE Network Connection Intel(R) PRO/Wireless 2200BG Network Connection Microsoft ISATAP Adapter #2 Microsoft ISATAP Adapter RAS Async Adapter Teredo Tunneling Pseudo-Interface WAN Miniport (IKEv2) WAN Miniport (IP) WAN Miniport (IPv6) WAN Miniport (L2TP) WAN Miniport (Network Monitor) WAN Miniport (PPPOE) WAN Miniport (PPTP) WAN Miniport (SSTP)

6.12.25.4 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 8.0.47.1 9.0.4.39 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514

Non-Plug and Play Drivers: Ancillary Function Driver for Winsock Beep Bitlocker Drive Encryption Filter Driver CNG Common Log (CLFS) Disk Virtual Machine Bus Acceleration Filter Driver Dynamic Volume Manager Hardware Policy Driver HTTP IDMWFP Kernel Mode Driver Frameworks service KSecDD KSecPkg Link-Layer Topology Discovery Mapper I/O Driver Link-Layer Topology Discovery Responder Mount Point Manager msisadrv NativeWiFi Filter NDIS System Driver NDIS Usermode I/O Protocol NDProxy NETBT NetIO Legacy TDI Support Driver NSI proxy service driver. Null Offline Files Driver Parvdm PEAUTH Performance Counters for Windows Driver QoS Packet Scheduler RDP Encoder Mirror Driver RDPCDD Reflector Display Driver used to gain access to graphics data Remote Access IPv6 ARP Driver

Security Driver Security Processor Loader Driver Storage volumes System Attribute Cache TCP/IP Protocol Driver TCP/IP Registry Compatibility VgaSave WFP Lightweight Filter Windows Firewall Authorization Driver PCMCIA adapters: ENE CB-1410/851 Cardbus Controller Ports (COM & LPT): Printer Port (LPT1) Processors: Intel(R) Pentium(R) M processor 2.13GHz Sound, video and game controllers: Conexant AC-Link Audio Storage volume shadow copies: Generic volume shadow copy Generic volume shadow copy Generic volume shadow copy Storage Volumes: Generic volume Generic volume Generic volume Generic volume 5.1.2600.3001 6.1.7600.16385 6.1.7600.16385 6.14.10.675 6.1.7600.16385 6.1.7600.16385 6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514

System devices: ACPI Fixed Feature Button 6.1.7601.17514 ACPI Lid 6.1.7601.17514 ACPI Sleep Button 6.1.7601.17514 ACPI Thermal Zone 6.1.7601.17514 Composite Bus Enumerator 6.1.7601.17514 DAEMON Tools Virtual Bus 5.0.1.282 Direct memory access controller 6.1.7601.17514 Extended IO Bus 6.1.7601.17514 File as Volume Driver 6.1.7600.16385 Intel(R) 82801 PCI Bridge - 2448 6.1.7601.17514 Intel(R) 82801FBM LPC Interface Controller - 2641 9.1.9.1003 Microsoft ACPI-Compliant Embedded Controller 6.1.7601.17514 Microsoft ACPI-Compliant System 6.1.7601.17514 Microsoft System Management BIOS Driver 6.1.7601.17514 Microsoft Virtual Drive Enumerator Driver 6.1.7601.17514 Microsoft Windows Management Interface for ACPI 6.1.7601.17514 Mobile Intel(R) 915GM/PM/GMS/910GML Express Processor to DRAM Controller 25909.1.9.1003 Motherboard resources 6.1.7601.17514 Motherboard resources 6.1.7601.17514 Motherboard resources 6.1.7601.17514 Numeric data processor 6.1.7601.17514 PCI bus 1.0.7.248 Plug and Play Software Device Enumerator 6.1.7601.17514 Printer Port Logical Interface 6.1.7601.17514 Programmable interrupt controller 6.1.7601.17514

Remote Desktop Device Redirector Bus System board System CMOS/real time clock System speaker System timer Terminal Server Keyboard Driver Terminal Server Mouse Driver UMBus Enumerator UMBus Root Bus Enumerator Volume Manager

6.1.7600.16385 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514 6.1.7601.17514

Universal Serial Bus controllers: Generic USB Hub 6.1.7601.17514 Generic USB Hub 6.1.7601.17514 Intel(R) 82801FB/FBM USB Universal Host Controller - 26589.1.9.1003 Intel(R) 82801FB/FBM USB2 Enhanced Host Controller - 265C9.1.9.1003 Unknown Device 6.1.7601.17514 USB Mass Storage Device 6.1.7601.17514 USB Root Hub 6.1.7601.17514 USB Root Hub 6.1.7601.17514 [ Batteries / Microsoft AC Adapter ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID PnP Device Microsoft AC Adapter 6/21/2006 6.1.7600.16385 Microsoft battery.inf ACPI\ACPI0003 Microsoft AC Adapter

[ Batteries / Microsoft ACPI-Compliant Control Method Battery ] Device Properties: Driver Description Control Method Battery Driver Date Driver Version Driver Provider INF File Hardware ID PnP Device [ Batteries / Microsoft Composite Battery ] Device Properties: Driver Description ery Driver Date Driver Version Driver Provider INF File Hardware ID [ Computer / ACPI x86-based PC ] Device Properties: Driver Description Driver Date ACPI x86-based PC 6/21/2006 6/21/2006 6.1.7600.16385 Microsoft battery.inf COMPOSITE_BATTERY Microsoft Composite Batt Microsoft ACPI-Compliant 6/21/2006 6.1.7600.16385 Microsoft battery.inf ACPI\PNP0C0A Control Method Battery

Driver Version Driver Provider INF File Hardware ID [ Disk drives / ST950032 5AS USB Device ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID ________________ [ Disk drives / WDC WD600UE-22KVT0 ATA Device ] Device Properties: Driver Description evice Driver Date Driver Version Driver Provider INF File Hardware ID T0______________________01.03K01 Location Information 0

6.1.7600.16385 Microsoft hal.inf acpiapic

ST950032 5AS USB Device 6/21/2006 6.1.7600.16385 Microsoft disk.inf USBSTOR\DiskST9500325AS_

WDC WD600UE-22KVT0 ATA D 6/21/2006 6.1.7600.16385 Microsoft disk.inf IDE\DiskWDC_WD600UE-22KV Channel 0, Target 0, Lun

[ Display adapters / Mobile Intel(R) 915GM/GMS,910GML Express Chipset Family ] Device Properties: Driver Description S,910GML Express Chipset Family Driver Date Driver Version Driver Provider INF File Hardware ID BSYS_30C4103C&REV_03 Location Information s,#65536;PCI bus %1, device %2, function %3;(0,2,0) PCI Device ontroller 0 Device Resources: IRQ Memory Memory Memory Memory Port Port Port Mobile Intel(R) 915GM/GM 10/6/2006 6.14.10.4704 Intel Corporation oem11.inf PCI\VEN_8086&DEV_2592&SU @system32\drivers\pci.sy Intel 82915GM Graphics C

16 000A0000-000BFFFF C0000000-CFFFFFFF D0600000-D067FFFF D0680000-D06BFFFF 03B0-03BB 03C0-03DF 3000-3007

[ Display adapters / Mobile Intel(R) 915GM/GMS,910GML Express Chipset Family ] Device Properties: Driver Description Mobile Intel(R) 915GM/GM

S,910GML Express Chipset Family Driver Date Driver Version Driver Provider INF File Hardware ID BSYS_30C4103C&REV_03 Location Information s,#65536;PCI bus %1, device %2, function %3;(0,2,1) PCI Device ontroller 1 Device Resources: Memory [ DVD/CD-ROM drives / DTSOFT Virtual CdRom Device ] Device Properties: Driver Description ice Driver Date Driver Version Driver Provider INF File Hardware ID ev1 Location Information

10/6/2006 6.14.10.4704 Intel Corporation oem11.inf PCI\VEN_8086&DEV_2792&SU @system32\drivers\pci.sy Intel 82915GM Graphics C

D0700000-D077FFFF

DTSOFT Virtual CdRom Dev 6/21/2006 6.1.7601.17514 Microsoft cdrom.inf DTSOFTBUS&Rev1\DTCDROM&R 00

[ DVD/CD-ROM drives / HL-DT-ST DVDRAM GSA-T10N ATA Device ] Device Properties: Driver Description ATA Device Driver Date Driver Version Driver Provider INF File Hardware ID _GSA-T10N________________PC05____ Location Information 0 [ Human Interface Devices / HID-compliant device ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID [ Human Interface Devices / HP Hotkey Device ] Device Properties: Driver Description Driver Date Driver Version Driver Provider ent Company, L.P. HP Hotkey Device 7/26/2011 7.0.3.1 Hewlett-Packard Developm HID-compliant device 6/21/2006 6.1.7601.17514 Microsoft input.inf HID\HPQ0006&Col01 HL-DT-ST DVDRAM GSA-T10N 6/21/2006 6.1.7601.17514 Microsoft cdrom.inf IDE\CdRomHL-DT-ST_DVDRAM Channel 0, Target 1, Lun

INF File Hardware ID PnP Device [ Human Interface Devices / USB Input Device ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID V_0021 Location Information [ IDE ATA/ATAPI controllers / ATA Channel 0 ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID Location Information Device Resources: IRQ Port Port

oem8.inf ACPI\HPQ0006 HP Quick Launch Buttons

USB Input Device 6/21/2006 6.1.7601.17514 Microsoft input.inf USB\VID_1D57&PID_0016&RE Port_#0004.Hub_#0003

ATA Channel 0 6/21/2006 6.1.7601.17514 Microsoft mshdc.inf Intel-266f Channel 0 14 01F0-01F7 03F6-03F6

[ IDE ATA/ATAPI controllers / Intel(R) 82801FB/FBM Ultra ATA Storage Controlle rs - 266F ] Device Properties: Driver Description ra ATA Storage Controllers - 266F Driver Date Driver Version Driver Provider INF File Hardware ID BSYS_30C4103C&REV_03 Location Information s,#65536;PCI bus %1, device %2, function %3;(0,31,1) PCI Device ATA-100 IDE Controller [B-1] Device Resources: Port [ Keyboards / HID Keyboard Device ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File HID Keyboard Device 6/21/2006 6.1.7601.17514 Microsoft keyboard.inf Intel(R) 82801FB/FBM Ult 2/25/2013 9.1.9.1003 Intel oem4.inf PCI\VEN_8086&DEV_266F&SU @system32\drivers\pci.sy Intel 82801FBM ICH6-M -

3580-358F

Hardware ID [ Keyboards / Standard PS/2 Keyboard ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID PnP Device l Keyboard Device Resources: IRQ Port Port

HID\HPQ0006&Col02

Standard PS/2 Keyboard 6/21/2006 6.1.7601.17514 Microsoft keyboard.inf ACPI\PNP0303 101/102-Key or MS Natura

01 0060-0060 0064-0064

[ Mice and other pointing devices / HID-compliant mouse ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID V_0021 HID-compliant mouse 6/21/2006 6.1.7600.16385 Microsoft msmouse.inf HID\VID_1D57&PID_0016&RE

[ Mice and other pointing devices / PS/2 Compatible Mouse ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID PnP Device hPad Device Resources: IRQ [ Modems / Motorola SM56 Data Fax Modem ] Device Properties: Driver Description odem Driver Date Driver Version Driver Provider INF File Hardware ID BSYS_30C4103C&REV_03 Location Information s,#65536;PCI bus %1, device %2, function %3;(0,30,3) PCI Device AC'97 Modem Controller [B-1] 3/12/2009 6.12.25.4 Motorola Inc oem7.inf PCI\VEN_8086&DEV_266D&SU @system32\drivers\pci.sy Intel 82801FBM ICH6-M Motorola SM56 Data Fax M 12 PS/2 Compatible Mouse 6/21/2006 6.1.7600.16385 Microsoft msmouse.inf ACPI\SYN0132 Synaptics PS/2 Port Touc

Device Resources: IRQ Port Port [ Monitors / Generic PnP Monitor ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID Monitor [ Monitors / Generic PnP Monitor ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID Monitor [ Monitors / Generic PnP Monitor ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID Monitor

17 3400-34FF 3500-357F

Generic PnP Monitor 6/21/2006 6.1.7600.16385 Microsoft monitor.inf Monitor\CMO1526 Chi Mei N154I2-L02

Generic PnP Monitor 6/21/2006 6.1.7600.16385 Microsoft monitor.inf Monitor\CMO1526 Chi Mei N154I2-L02

Generic PnP Monitor 6/21/2006 6.1.7600.16385 Microsoft monitor.inf Monitor\CMO1526 Chi Mei N154I2-L02

[ Network adapters / Intel(R) PRO/100 VE Network Connection ] Device Properties: Driver Description ork Connection Driver Date Driver Version Driver Provider INF File Hardware ID BSYS_30C4103C&REV_03 Location Information s,#65536;PCI bus %1, device %2, function %3;(2,8,0) PCI Device Connection Device Resources: IRQ Memory Port Intel(R) PRO/100 VE Netw 11/16/2007 8.0.47.1 Microsoft netefe32.inf PCI\VEN_8086&DEV_1092&SU @system32\drivers\pci.sy Intel PRO/100 VE Network

20 D0002000-D0002FFF 2000-203F

[ Network adapters / Intel(R) PRO/Wireless 2200BG Network Connection ] Device Properties: Driver Description 00BG Network Connection Driver Date Driver Version Driver Provider INF File Hardware ID BSYS_12F6103C&REV_05 Location Information s,#65536;PCI bus %1, device %2, function %3;(2,4,0) PCI Device B Network Connection Device Resources: IRQ Memory [ Network adapters / Microsoft ISATAP Adapter #2 ] Device Properties: Driver Description #2 Driver Date Driver Version Driver Provider INF File Hardware ID [ Network adapters / Microsoft ISATAP Adapter ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID [ Network adapters / RAS Async Adapter ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID 42b-00805fc1270e} RAS Async Adapter 6/21/2006 6.1.7601.17514 Microsoft netrasa.inf SW\{eeab7790-c514-11d1-b Microsoft ISATAP Adapter 6/21/2006 6.1.7600.16385 Microsoft nettun.inf *ISATAP 6/21/2006 6.1.7600.16385 Microsoft nettun.inf *ISATAP Microsoft ISATAP Adapter Intel(R) PRO/Wireless 22 12/19/2007 9.0.4.39 Intel oem9.inf PCI\VEN_8086&DEV_4220&SU @system32\drivers\pci.sy HP PRO/Wireless 2200BG 3

21 D0000000-D0000FFF

[ Network adapters / Teredo Tunneling Pseudo-Interface ] Device Properties: Driver Description Interface Driver Date Driver Version Driver Provider Teredo Tunneling Pseudo6/21/2006 6.1.7600.16385 Microsoft

INF File Hardware ID [ Network adapters / WAN Miniport (IKEv2) ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID [ Network adapters / WAN Miniport (IP) ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID [ Network adapters / WAN Miniport (IPv6) ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID [ Network adapters / WAN Miniport (L2TP) ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID [ Network adapters / WAN Miniport (Network Monitor) ] Device Properties: Driver Description nitor) Driver Date Driver Version Driver Provider INF File Hardware ID [ Network adapters / WAN Miniport (PPPOE) ] Device Properties: Driver Description Driver Date Driver Version

nettun.inf *TEREDO

WAN Miniport (IKEv2) 6/21/2006 6.1.7601.17514 Microsoft netavpna.inf ms_agilevpnminiport

WAN Miniport (IP) 6/21/2006 6.1.7601.17514 Microsoft netrasa.inf ms_ndiswanip

WAN Miniport (IPv6) 6/21/2006 6.1.7601.17514 Microsoft netrasa.inf ms_ndiswanipv6

WAN Miniport (L2TP) 6/21/2006 6.1.7601.17514 Microsoft netrasa.inf ms_l2tpminiport

WAN Miniport (Network Mo 6/21/2006 6.1.7601.17514 Microsoft netrasa.inf ms_ndiswanbh

WAN Miniport (PPPOE) 6/21/2006 6.1.7601.17514

Driver Provider INF File Hardware ID [ Network adapters / WAN Miniport (PPTP) ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID [ Network adapters / WAN Miniport (SSTP) ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID

Microsoft netrasa.inf ms_pppoeminiport

WAN Miniport (PPTP) 6/21/2006 6.1.7601.17514 Microsoft netrasa.inf ms_pptpminiport

WAN Miniport (SSTP) 6/21/2006 6.1.7601.17514 Microsoft netsstpa.inf ms_sstpminiport

[ Non-Plug and Play Drivers / Ancillary Function Driver for Winsock ] Device Properties: Driver Description r for Winsock [ Non-Plug and Play Drivers / Beep ] Device Properties: Driver Description Beep Ancillary Function Drive

[ Non-Plug and Play Drivers / Bitlocker Drive Encryption Filter Driver ] Device Properties: Driver Description on Filter Driver [ Non-Plug and Play Drivers / CNG ] Device Properties: Driver Description [ Non-Plug and Play Drivers / Common Log (CLFS) ] Device Properties: Driver Description Common Log (CLFS) CNG Bitlocker Drive Encrypti

[ Non-Plug and Play Drivers / Disk Virtual Machine Bus Acceleration Filter Dri ver ] Device Properties: Driver Description Acceleration Filter Driver [ Non-Plug and Play Drivers / Dynamic Volume Manager ] Disk Virtual Machine Bus

Device Properties: Driver Description [ Non-Plug and Play Drivers / Hardware Policy Driver ] Device Properties: Driver Description [ Non-Plug and Play Drivers / HTTP ] Device Properties: Driver Description [ Non-Plug and Play Drivers / IDMWFP ] Device Properties: Driver Description

Dynamic Volume Manager

Hardware Policy Driver

HTTP

IDMWFP

[ Non-Plug and Play Drivers / Kernel Mode Driver Frameworks service ] Device Properties: Driver Description works service [ Non-Plug and Play Drivers / KSecDD ] Device Properties: Driver Description [ Non-Plug and Play Drivers / KSecPkg ] Device Properties: Driver Description ] Device Properties: Driver Description overy Mapper I/O Driver Link-Layer Topology Disc KSecPkg KSecDD Kernel Mode Driver Frame

[ Non-Plug and Play Drivers / Link-Layer Topology Discovery Mapper I/O Driver

[ Non-Plug and Play Drivers / Link-Layer Topology Discovery Responder ] Device Properties: Driver Description overy Responder [ Non-Plug and Play Drivers / Mount Point Manager ] Device Properties: Driver Description [ Non-Plug and Play Drivers / msisadrv ] Device Properties: Driver Description [ Non-Plug and Play Drivers / NativeWiFi Filter ] Device Properties: msisadrv Mount Point Manager Link-Layer Topology Disc

Driver Description [ Non-Plug and Play Drivers / NDIS System Driver ] Device Properties: Driver Description

NativeWiFi Filter

NDIS System Driver

[ Non-Plug and Play Drivers / NDIS Usermode I/O Protocol ] Device Properties: Driver Description ol [ Non-Plug and Play Drivers / NDProxy ] Device Properties: Driver Description [ Non-Plug and Play Drivers / NETBT ] Device Properties: Driver Description NETBT NDProxy NDIS Usermode I/O Protoc

[ Non-Plug and Play Drivers / NetIO Legacy TDI Support Driver ] Device Properties: Driver Description Driver NetIO Legacy TDI Support

[ Non-Plug and Play Drivers / NSI proxy service driver. ] Device Properties: Driver Description . [ Non-Plug and Play Drivers / Null ] Device Properties: Driver Description [ Non-Plug and Play Drivers / Offline Files Driver ] Device Properties: Driver Description [ Non-Plug and Play Drivers / Parvdm ] Device Properties: Driver Description [ Non-Plug and Play Drivers / PEAUTH ] Device Properties: Driver Description PEAUTH Parvdm Offline Files Driver Null NSI proxy service driver

[ Non-Plug and Play Drivers / Performance Counters for Windows Driver ] Device Properties: Driver Description Windows Driver Performance Counters for

[ Non-Plug and Play Drivers / QoS Packet Scheduler ] Device Properties: Driver Description QoS Packet Scheduler

[ Non-Plug and Play Drivers / RDP Encoder Mirror Driver ] Device Properties: Driver Description r [ Non-Plug and Play Drivers / RDPCDD ] Device Properties: Driver Description RDPCDD RDP Encoder Mirror Drive

[ Non-Plug and Play Drivers / Reflector Display Driver used to gain access to graphics data ] Device Properties: Driver Description used to gain access to graphics data Reflector Display Driver

[ Non-Plug and Play Drivers / Remote Access IPv6 ARP Driver ] Device Properties: Driver Description river [ Non-Plug and Play Drivers / Security Driver ] Device Properties: Driver Description Security Driver Remote Access IPv6 ARP D

[ Non-Plug and Play Drivers / Security Processor Loader Driver ] Device Properties: Driver Description r Driver [ Non-Plug and Play Drivers / Storage volumes ] Device Properties: Driver Description [ Non-Plug and Play Drivers / System Attribute Cache ] Device Properties: Driver Description [ Non-Plug and Play Drivers / TCP/IP Protocol Driver ] Device Properties: Driver Description TCP/IP Protocol Driver System Attribute Cache Storage volumes Security Processor Loade

[ Non-Plug and Play Drivers / TCP/IP Registry Compatibility ] Device Properties: Driver Description TCP/IP Registry Compatib

ility [ Non-Plug and Play Drivers / VgaSave ] Device Properties: Driver Description [ Non-Plug and Play Drivers / WFP Lightweight Filter ] Device Properties: Driver Description WFP Lightweight Filter VgaSave

[ Non-Plug and Play Drivers / Windows Firewall Authorization Driver ] Device Properties: Driver Description zation Driver Windows Firewall Authori

[ PCMCIA adapters / ENE CB-1410/851 Cardbus Controller ] Device Properties: Driver Description Controller Driver Date Driver Version Driver Provider INF File Hardware ID BSYS_30C4103C&REV_01 Location Information s,#65536;PCI bus %1, device %2, function %3;(2,6,0) PCI Device Controller Device Resources: IRQ Memory Memory Memory Memory Port [ Ports (COM & LPT) / Printer Port (LPT1) ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID PnP Device Device Resources: Port Port Printer Port (LPT1) 6/21/2006 6.1.7600.16385 Microsoft msports.inf ACPI\PNP0400 Parallel Port 0378-037F 0778-077A ENE CB-1410/851 Cardbus 1/31/2007 5.1.2600.3001 ENE TECHNOLOGY INC. oem2.inf PCI\VEN_1524&DEV_1410&SU @system32\drivers\pci.sy ENE Tech. CB1410 CardBus

18 D0001000-D0001FFF D05FE000-D05FEFFF D05FF000-D05FFFFF FFEFF000-FFEFFFFF 2C00-2C03

[ Processors / Intel(R) Pentium(R) M processor 2.13GHz ] Device Properties:

Driver Description ocessor 2.13GHz Driver Date Driver Version Driver Provider INF File Hardware ID Family_6_Model_13

Intel(R) Pentium(R) M pr 6/21/2006 6.1.7600.16385 Microsoft cpu.inf ACPI\GenuineIntel_-_x86_

[ Sound, video and game controllers / Conexant AC-Link Audio ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID BSYS_30C4103C&REV_03 Location Information s,#65536;PCI bus %1, device %2, function %3;(0,30,2) PCI Device AC'97 Audio Controller [B-1] Device Resources: IRQ Memory Memory Port Port Conexant AC-Link Audio 8/22/2006 6.14.10.675 Conexant oem12.inf PCI\VEN_8086&DEV_266E&SU @system32\drivers\pci.sy Intel 82801FBM ICH6-M -

17 D0781000-D07811FF D0782000-D07820FF 3100-31FF 3200-323F

[ Storage volume shadow copies / Generic volume shadow copy ] Device Properties: Driver Description py Driver Date Driver Version Driver Provider INF File Hardware ID 6/21/2006 6.1.7600.16385 Microsoft volsnap.inf STORAGE\VolumeSnapshot Generic volume shadow co

[ Storage volume shadow copies / Generic volume shadow copy ] Device Properties: Driver Description py Driver Date Driver Version Driver Provider INF File Hardware ID 6/21/2006 6.1.7600.16385 Microsoft volsnap.inf STORAGE\VolumeSnapshot Generic volume shadow co

[ Storage volume shadow copies / Generic volume shadow copy ] Device Properties: Driver Description py Driver Date Driver Version 6/21/2006 6.1.7600.16385 Generic volume shadow co

Driver Provider INF File Hardware ID [ Storage Volumes / Generic volume ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID [ Storage Volumes / Generic volume ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID [ Storage Volumes / Generic volume ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID [ Storage Volumes / Generic volume ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID [ System devices / ACPI Fixed Feature Button ] Device Properties: Driver Description n Driver Date Driver Version Driver Provider INF File Hardware ID [ System devices / ACPI Lid ] Device Properties: Driver Description Driver Date

Microsoft volsnap.inf STORAGE\VolumeSnapshot

Generic volume 6/21/2006 6.1.7601.17514 Microsoft volume.inf STORAGE\Volume

Generic volume 6/21/2006 6.1.7601.17514 Microsoft volume.inf STORAGE\Volume

Generic volume 6/21/2006 6.1.7601.17514 Microsoft volume.inf STORAGE\Volume

Generic volume 6/21/2006 6.1.7601.17514 Microsoft volume.inf STORAGE\Volume

ACPI Fixed Feature Butto 6/21/2006 6.1.7601.17514 Microsoft machine.inf ACPI\FixedButton

ACPI Lid 6/21/2006

Driver Version Driver Provider INF File Hardware ID PnP Device [ System devices / ACPI Sleep Button ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID PnP Device [ System devices / ACPI Thermal Zone ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID [ System devices / Composite Bus Enumerator ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID [ System devices / DAEMON Tools Virtual Bus ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID [ System devices / Direct memory access controller ] Device Properties: Driver Description troller Driver Date Driver Version Driver Provider INF File Hardware ID PnP Device Device Resources:

6.1.7601.17514 Microsoft machine.inf ACPI\PNP0C0D Lid

ACPI Sleep Button 6/21/2006 6.1.7601.17514 Microsoft machine.inf ACPI\PNP0C0E Sleep Button

ACPI Thermal Zone 6/21/2006 6.1.7601.17514 Microsoft machine.inf ACPI\ThermalZone

Composite Bus Enumerator 6/21/2006 6.1.7601.17514 Microsoft compositebus.inf ROOT\CompositeBus

DAEMON Tools Virtual Bus 1/13/2012 5.0.1.282 DT Soft Ltd oem15.inf root\DTSoftBus01

Direct memory access con 6/21/2006 6.1.7601.17514 Microsoft machine.inf ACPI\PNP0200 DMA Controller

DMA Port Port Port [ System devices / Extended IO Bus ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID PnP Device [ System devices / File as Volume Driver ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID [ System devices / Intel(R) 82801 PCI Bridge - 2448 ] Device Properties: Driver Description e - 2448 Driver Date Driver Version Driver Provider INF File Hardware ID BSYS_30C4103C&REV_D3 Location Information s,#65536;PCI bus %1, device %2, function %3;(0,30,0) PCI Device oller Hub 6 (ICH6-M) [B-1] Device Resources: Memory Port

04 0000-000F 0080-008F 00C0-00DF

Extended IO Bus 6/21/2006 6.1.7601.17514 Microsoft machine.inf ACPI\PNP0A06 Extended IO Bus

File as Volume Driver 6/21/2006 6.1.7600.16385 Microsoft blbdrive.inf ROOT\BLBDRIVE

Intel(R) 82801 PCI Bridg 6/21/2006 6.1.7601.17514 Microsoft machine.inf PCI\VEN_8086&DEV_2448&SU @system32\drivers\pci.sy Intel 82801FBM I/O Contr

D0000000-D05FFFFF 2000-2FFF

[ System devices / Intel(R) 82801FBM LPC Interface Controller - 2641 ] Device Properties: Driver Description terface Controller - 2641 Driver Date Driver Version Driver Provider INF File Hardware ID BSYS_30C4103C&REV_03 Location Information s,#65536;PCI bus %1, device %2, function %3;(0,31,0) PCI Device Intel(R) 82801FBM LPC In 2/25/2013 9.1.9.1003 Intel oem6.inf PCI\VEN_8086&DEV_2641&SU @system32\drivers\pci.sy Intel 82801FBM ICH6-M -

LPC Bridge [B-1] [ System devices / Microsoft ACPI-Compliant Embedded Controller ] Device Properties: Driver Description Embedded Controller Driver Date Driver Version Driver Provider INF File Hardware ID PnP Device ce Device Resources: Port Port [ System devices / Microsoft ACPI-Compliant System ] Device Properties: Driver Description System Driver Date Driver Version Driver Provider INF File Hardware ID PnP Device Device Resources: IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ Microsoft ACPI-Compliant 6/21/2006 6.1.7601.17514 Microsoft acpi.inf ACPI_HAL\PNP0C08 ACPI Driver/BIOS 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 Microsoft ACPI-Compliant 6/21/2006 6.1.7601.17514 Microsoft machine.inf ACPI\PNP0C09 Embedded Controller Devi

0062-0062 0066-0066

IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ

128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187

IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ IRQ

188 189 190 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

[ System devices / Microsoft System Management BIOS Driver ] Device Properties: Driver Description ent BIOS Driver Driver Date Driver Version Driver Provider INF File Hardware ID Microsoft System Managem 6/21/2006 6.1.7601.17514 Microsoft machine.inf ROOT\mssmbios

[ System devices / Microsoft Virtual Drive Enumerator Driver ] Device Properties: Driver Description Enumerator Driver Driver Date Driver Version Driver Provider INF File Hardware ID Microsoft Virtual Drive 6/21/2006 6.1.7601.17514 Microsoft machine.inf ROOT\vdrvroot

[ System devices / Microsoft Windows Management Interface for ACPI ] Device Properties: Driver Description ment Interface for ACPI Driver Date Driver Version Driver Provider INF File Hardware ID PnP Device e Microsoft Windows Manage 6/21/2006 6.1.7601.17514 Microsoft acpi.inf ACPI\PNP0C14 ACPI Management Interfac

[ System devices / Mobile Intel(R) 915GM/PM/GMS/910GML Express Processor to DR AM Controller - 2590 ]

Device Properties: Driver Description /GMS/910GML Express Processor to DRAM Controller - 2590 Driver Date Driver Version Driver Provider INF File Hardware ID BSYS_30C4103C&REV_03 Location Information s,#65536;PCI bus %1, device %2, function %3;(0,0,0) PCI Device troller Hub [B-1] [ System devices / Motherboard resources ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID PnP Device Device Resources: Memory Memory [ System devices / Motherboard resources ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID PnP Device Device Resources: Memory Memory Memory Memory Port Port Port Port [ System devices / Motherboard resources ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID

Mobile Intel(R) 915GM/PM 2/25/2013 9.1.9.1003 Intel oem5.inf PCI\VEN_8086&DEV_2590&SU @system32\drivers\pci.sy Intel 82915GM Memory Con

Motherboard resources 6/21/2006 6.1.7601.17514 Microsoft machine.inf ACPI\PNP0C02 Motherboard Resources FEC01000-FEC01FFF FEDA0000-FEDBFFFF

Motherboard resources 6/21/2006 6.1.7601.17514 Microsoft machine.inf ACPI\PNP0C02 Motherboard Resources E0000000-EFFFFFFF FEC00000-FEC000FF FED20000-FED8FFFF FED90000-FED9AFFF 04D0-04D1 1000-107F 1100-113F 1200-121F

Motherboard resources 6/21/2006 6.1.7601.17514 Microsoft machine.inf ACPI\PNP0C02

PnP Device Device Resources: Memory Memory Port Port Port Port Port Port Port Port Port Port Port Port [ System devices / Numeric data processor ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID PnP Device Device Resources: IRQ Port [ System devices / PCI bus ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID PnP Device us Device Resources: Memory Memory Memory Memory Port Port

Motherboard Resources FFB00000-FFBFFFFF FFF00000-FFFFFFFF 0010-001F 0024-003F 004E-004F 0050-0053 0063-0063 0065-0065 0067-0067 0074-0077 0090-009F 00A4-00BD 0200-0203 0500-057F

Numeric data processor 6/21/2006 6.1.7601.17514 Microsoft machine.inf ACPI\PNP0C04 Numeric Data Processor 13 00F0-00FF

PCI bus 12/4/2012 1.0.7.248 Intel oem10.inf ACPI\PNP0A08 ACPI Three-wire Device B

000A0000-000BFFFF 000D0000-000DFFFF 3F800000-FEC00FFF FEC02000-FFFFFFFF 0000-0CF7 0D00-FFFF

[ System devices / Plug and Play Software Device Enumerator ] Device Properties: Driver Description evice Enumerator Driver Date Driver Version Plug and Play Software D 6/21/2006 6.1.7601.17514

Driver Provider INF File Hardware ID [ System devices / Printer Port Logical Interface ] Device Properties: Driver Description erface Driver Date Driver Version Driver Provider INF File Hardware ID 958A Location Information [ System devices / Programmable interrupt controller ] Device Properties: Driver Description ontroller Driver Date Driver Version Driver Provider INF File Hardware ID PnP Device ontroller Device Resources: Port Port

Microsoft machine.inf root\swenum

Printer Port Logical Int 6/21/2006 6.1.7601.17514 Microsoft machine.inf LPTENUM\MicrosoftRawPort LPT1

Programmable interrupt c 6/21/2006 6.1.7601.17514 Microsoft machine.inf ACPI\PNP0000 Programmable Interrupt C

0020-0021 00A0-00A1

[ System devices / Remote Desktop Device Redirector Bus ] Device Properties: Driver Description director Bus Driver Date Driver Version Driver Provider INF File Hardware ID [ System devices / System board ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID PnP Device Device Resources: Memory Memory Memory System board 6/21/2006 6.1.7601.17514 Microsoft machine.inf ACPI\PNP0C01 System Board Extension 00000000-0009FFFF 000E0000-000FFFFF 00100000-3F7FFFFF Remote Desktop Device Re 6/21/2006 6.1.7600.16385 Microsoft rdpbus.inf ROOT\RDPBUS

[ System devices / System CMOS/real time clock ] Device Properties: Driver Description ock Driver Date Driver Version Driver Provider INF File Hardware ID PnP Device Device Resources: IRQ Port Port [ System devices / System speaker ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID PnP Device Device Resources: Port [ System devices / System timer ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID PnP Device Device Resources: IRQ Port [ System devices / Terminal Server Keyboard Driver ] Device Properties: Driver Description Driver Driver Date Driver Version Driver Provider INF File Hardware ID [ System devices / Terminal Server Mouse Driver ] Terminal Server Keyboard 6/21/2006 6.1.7601.17514 Microsoft machine.inf ROOT\RDP_KBD System timer 6/21/2006 6.1.7601.17514 Microsoft machine.inf ACPI\PNP0100 System Timer 00 0040-0043 System speaker 6/21/2006 6.1.7601.17514 Microsoft machine.inf ACPI\PNP0800 PC Speaker 0061-0061 6/21/2006 6.1.7601.17514 Microsoft machine.inf ACPI\PNP0B00 Real-Time Clock 08 0070-0071 0072-0073 System CMOS/real time cl

Device Properties: Driver Description iver Driver Date Driver Version Driver Provider INF File Hardware ID [ System devices / UMBus Enumerator ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID [ System devices / UMBus Root Bus Enumerator ] Device Properties: Driver Description r Driver Date Driver Version Driver Provider INF File Hardware ID [ System devices / Volume Manager ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID [ Universal Serial Bus controllers / Generic USB Hub ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID V_0111 Location Information [ Universal Serial Bus controllers / Generic USB Hub ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File

Terminal Server Mouse Dr 6/21/2006 6.1.7601.17514 Microsoft machine.inf ROOT\RDP_MOU

UMBus Enumerator 6/21/2006 6.1.7601.17514 Microsoft umbus.inf UMB\UMBUS

UMBus Root Bus Enumerato 6/21/2006 6.1.7601.17514 Microsoft umbus.inf root\umbus

Volume Manager 6/21/2006 6.1.7601.17514 Microsoft machine.inf ROOT\VOLMGR

Generic USB Hub 6/21/2006 6.1.7601.17514 Microsoft usb.inf USB\VID_1A40&PID_0101&RE Port_#0002.Hub_#0001

Generic USB Hub 6/21/2006 6.1.7601.17514 Microsoft usb.inf

Hardware ID V_0111 Location Information

USB\VID_1A40&PID_0101&RE Port_#0001.Hub_#0003

[ Universal Serial Bus controllers / Intel(R) 82801FB/FBM USB Universal Host C ontroller - 2658 ] Device Properties: Driver Description Universal Host Controller - 2658 Driver Date Driver Version Driver Provider INF File Hardware ID BSYS_30C4103C&REV_03 Location Information s,#65536;PCI bus %1, device %2, function %3;(0,29,0) PCI Device USB Universal Host Controller [B-1] Device Resources: IRQ Port Intel(R) 82801FB/FBM USB 2/25/2013 9.1.9.1003 Intel oem3.inf PCI\VEN_8086&DEV_2658&SU @system32\drivers\pci.sy Intel 82801FBM ICH6-M -

19 3020-303F

[ Universal Serial Bus controllers / Intel(R) 82801FB/FBM USB2 Enhanced Host C ontroller - 265C ] Device Properties: Driver Description 2 Enhanced Host Controller - 265C Driver Date Driver Version Driver Provider INF File Hardware ID BSYS_30C4103C&REV_03 Location Information s,#65536;PCI bus %1, device %2, function %3;(0,29,7) PCI Device Enhanced USB2 Controller [B-1] Device Resources: IRQ Memory [ Universal Serial Bus controllers / Unknown Device ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID Location Information Unknown Device 6/21/2006 6.1.7601.17514 Microsoft usb.inf USB\UNKNOWN Port_#0002.Hub_#0003 Intel(R) 82801FB/FBM USB 2/25/2013 9.1.9.1003 Intel oem3.inf PCI\VEN_8086&DEV_265C&SU @system32\drivers\pci.sy Intel 82801FBM ICH6-M -

19 D0780000-D07803FF

[ Universal Serial Bus controllers / USB Mass Storage Device ] Device Properties:

Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID V_0200 Location Information [ Universal Serial Bus controllers / USB Root Hub ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID 2658&REV0003 [ Universal Serial Bus controllers / USB Root Hub ] Device Properties: Driver Description Driver Date Driver Version Driver Provider INF File Hardware ID ID265C&REV0003

USB Mass Storage Device 6/21/2006 6.1.7601.17514 Microsoft usbstor.inf USB\VID_14CD&PID_6116&RE Port_#0001.Hub_#0002

USB Root Hub 6/21/2006 6.1.7601.17514 Microsoft usbport.inf USB\ROOT_HUB&VID8086&PID

USB Root Hub 6/21/2006 6.1.7601.17514 Microsoft usbport.inf USB\ROOT_HUB20&VID8086&P

--------[ Physical Devices ]------------------------------------------------------------------------------------------PCI Devices: Bus 2, Device 6, Function 0 Controller Bus 2, Device 4, Function 0 B Network Connection Bus 0, Device 30, Function 0 oller Hub 6 (ICH6-M) [B-1] Bus 0, Device 30, Function 2 AC'97 Audio Controller [B-1] Bus 0, Device 30, Function 3 AC'97 Modem Controller [B-1] Bus 0, Device 31, Function 1 ATA-100 IDE Controller [B-1] Bus 0, Device 29, Function 7 Enhanced USB2 Controller [B-1] Bus 0, Device 31, Function 0 LPC Bridge [B-1] Bus 0, Device 31, Function 3 SMBus Controller [B-1] Bus 0, Device 29, Function 0 USB Universal Host Controller [B-1] Bus 0, Device 2, Function 0 ontroller 0 Bus 0, Device 2, Function 1 ontroller 1 ENE Tech. CB1410 CardBus HP PRO/Wireless 2200BG 3 Intel 82801FBM I/O Contr Intel 82801FBM ICH6-M Intel 82801FBM ICH6-M Intel 82801FBM ICH6-M Intel 82801FBM ICH6-M Intel 82801FBM ICH6-M Intel 82801FBM ICH6-M Intel 82801FBM ICH6-M Intel 82915GM Graphics C Intel 82915GM Graphics C

Bus 0, Device 0, Function 0 troller Hub [B-1] Bus 2, Device 8, Function 0 Connection

Intel 82915GM Memory Con Intel PRO/100 VE Network

PnP Devices: PNP0303 101/102-Key or MS Natura l Keyboard PNP0C08 ACPI Driver/BIOS FIXEDBUTTON ACPI Fixed Feature Butto n PNP0C14 ACPI Management Interfac e THERMALZONE ACPI Thermal Zone PNP0A08 ACPI Three-wire Device B us PNP0C0A Control Method Battery PNP0200 DMA Controller PNP0C09 Embedded Controller Devi ce PNP0A06 Extended IO Bus HPQ0006 HP Quick Launch Buttons GENUINEINTEL_-_X86_FAMILY_6_MODEL_13_-_________INTEL(R)_PENTIUM(R)_M_PROCE SSOR_2.13GHZIntel(R) Pentium(R) M processor 2.13GHz PNP0C0D Lid ACPI0003 Microsoft AC Adapter ISATAP Microsoft ISATAP Adapter #2 ISATAP Microsoft ISATAP Adapter PNP0C02 Motherboard Resources PNP0C02 Motherboard Resources PNP0C02 Motherboard Resources PNP0C04 Numeric Data Processor PNP0400 Parallel Port PNP0800 PC Speaker PNP0000 Programmable Interrupt C ontroller PNP0B00 Real-Time Clock PNP0C0E Sleep Button SYN0132 Synaptics PS/2 Port Touc hPad PNP0C01 System Board Extension PNP0100 System Timer TEREDO Teredo Tunneling PseudoInterface LPT PnP Devices: MICROSOFTRAWPORT erface USB Devices: 1A40 0101 1A40 0101 0000 0000 1D57 0016 14CD 6116 Ports: LPT1 Printer Port Logical Int

Generic USB Hub Generic USB Hub Unknown Device USB Input Device USB Mass Storage Device Printer Port (LPT1)

--------[ PCI Devices ]-----------------------------------------------------------------------------------------------[ ENE Tech. CB1410 CardBus Controller ] Device Properties: Device Description Controller Bus Type Bus / Device / Function Device ID Subsystem ID Device Class ) Revision Fast Back-to-Back Transactions Device Features: 66 MHz Operation Bus Mastering [ HP PRO/Wireless 2200BG 3B Network Connection ] Device Properties: Device Description B Network Connection Bus Type Bus / Device / Function Device ID Subsystem ID Device Class ) Revision Fast Back-to-Back Transactions Device Features: 66 MHz Operation Bus Mastering [ Intel 82801FBM I/O Controller Hub 6 (ICH6-M) [B-1] ] Device Properties: Device Description oller Hub 6 (ICH6-M) [B-1] Bus Type Bus / Device / Function Device ID Subsystem ID Device Class Revision Fast Back-to-Back Transactions Device Features: 66 MHz Operation Bus Mastering Intel 82801FBM I/O Contr PCI 0 / 30 / 0 8086-2448 0000-0000 0604 (PCI/PCI Bridge) D3 Not Supported Not Supported Enabled HP PRO/Wireless 2200BG 3 PCI 2 / 4 / 0 8086-4220 103C-12F6 0280 (Network Controller 05 Supported, Disabled Not Supported Enabled 01 Not Supported Not Supported Enabled ENE Tech. CB1410 CardBus PCI 2 / 6 / 0 1524-1410 2C00-0000 0607 (PCI/CardBus Bridge

[ Intel 82801FBM ICH6-M - AC'97 Audio Controller [B-1] ] Device Properties:

Device Description AC'97 Audio Controller [B-1] Bus Type Bus / Device / Function Device ID Subsystem ID Device Class Revision Fast Back-to-Back Transactions Device Features: 66 MHz Operation Bus Mastering

Intel 82801FBM ICH6-M PCI 0 / 30 / 2 8086-266E 103C-30C4 0401 (Audio Device) 03 Supported, Disabled Not Supported Enabled

[ Intel 82801FBM ICH6-M - AC'97 Modem Controller [B-1] ] Device Properties: Device Description AC'97 Modem Controller [B-1] Bus Type Bus / Device / Function Device ID Subsystem ID Device Class Revision Fast Back-to-Back Transactions Device Features: 66 MHz Operation Bus Mastering Intel 82801FBM ICH6-M PCI 0 / 30 / 3 8086-266D 103C-30C4 0703 (Modem) 03 Supported, Disabled Not Supported Disabled

[ Intel 82801FBM ICH6-M - ATA-100 IDE Controller [B-1] ] Device Properties: Device Description ATA-100 IDE Controller [B-1] Bus Type Bus / Device / Function Device ID Subsystem ID Device Class Revision Fast Back-to-Back Transactions Device Features: 66 MHz Operation Bus Mastering Intel 82801FBM ICH6-M PCI 0 / 31 / 1 8086-266F 103C-30C4 0101 (IDE Controller) 03 Supported, Disabled Not Supported Enabled

[ Intel 82801FBM ICH6-M - Enhanced USB2 Controller [B-1] ] Device Properties: Device Description Enhanced USB2 Controller [B-1] Bus Type Bus / Device / Function Device ID Subsystem ID Device Class Revision Fast Back-to-Back Transactions Intel 82801FBM ICH6-M PCI 0 / 29 / 7 8086-265C 103C-30C4 0C03 (USB Controller) 03 Supported, Disabled

Device Features: 66 MHz Operation Bus Mastering [ Intel 82801FBM ICH6-M - LPC Bridge [B-1] ] Device Properties: Device Description LPC Bridge [B-1] Bus Type Bus / Device / Function Device ID Subsystem ID Device Class Revision Fast Back-to-Back Transactions Device Features: 66 MHz Operation Bus Mastering [ Intel 82801FBM ICH6-M - SMBus Controller [B-1] ] Device Properties: Device Description SMBus Controller [B-1] Bus Type Bus / Device / Function Device ID Subsystem ID Device Class Revision Fast Back-to-Back Transactions Device Features: 66 MHz Operation Bus Mastering

Not Supported Enabled

Intel 82801FBM ICH6-M PCI 0 / 31 / 0 8086-2641 103C-30C4 0601 (PCI/ISA Bridge) 03 Not Supported Not Supported Enabled

Intel 82801FBM ICH6-M PCI 0 / 31 / 3 8086-266A 0000-0000 0C05 (SMBus Controller) 03 Supported, Disabled Not Supported Disabled

[ Intel 82801FBM ICH6-M - USB Universal Host Controller [B-1] ] Device Properties: Device Description USB Universal Host Controller [B-1] Bus Type Bus / Device / Function Device ID Subsystem ID Device Class Revision Fast Back-to-Back Transactions Device Features: 66 MHz Operation Bus Mastering [ Intel 82915GM Graphics Controller 0 ] Device Properties: Device Description Intel 82915GM Graphics C Intel 82801FBM ICH6-M PCI 0 / 29 / 0 8086-2658 103C-30C4 0C03 (USB Controller) 03 Supported, Disabled Not Supported Enabled

ontroller 0 Bus Type Bus / Device / Function Device ID Subsystem ID Device Class ller) Revision Fast Back-to-Back Transactions Device Features: 66 MHz Operation Bus Mastering [ Intel 82915GM Graphics Controller 1 ] Device Properties: Device Description ontroller 1 Bus Type Bus / Device / Function Device ID Subsystem ID Device Class ) Revision Fast Back-to-Back Transactions Device Features: 66 MHz Operation Bus Mastering [ Intel 82915GM Memory Controller Hub [B-1] ] Device Properties: Device Description troller Hub [B-1] Bus Type Bus / Device / Function Device ID Subsystem ID Device Class Revision Fast Back-to-Back Transactions Device Features: 66 MHz Operation Bus Mastering [ Intel PRO/100 VE Network Connection ] Device Properties: Device Description Connection Bus Type Bus / Device / Function Device ID Subsystem ID Device Class r)

PCI 0 / 2 / 0 8086-2592 103C-30C4 0300 (VGA Display Contro 03 Supported, Disabled Not Supported Enabled

Intel 82915GM Graphics C PCI 0 / 2 / 1 8086-2792 103C-30C4 0380 (Display Controller 03 Supported, Disabled Not Supported Enabled

Intel 82915GM Memory Con PCI 0 / 0 / 0 8086-2590 103C-30C4 0600 (Host/PCI Bridge) 03 Supported, Disabled Not Supported Enabled

Intel PRO/100 VE Network PCI 2 / 8 / 0 8086-1092 103C-30C4 0200 (Ethernet Controlle

Revision Fast Back-to-Back Transactions Device Features: 66 MHz Operation Bus Mastering

03 Supported, Disabled Not Supported Enabled

--------[ USB Devices ]-----------------------------------------------------------------------------------------------[ USB Mass Storage Device (USB 2.0 SATA BRIDGE) ] Device Properties: Device Description Device ID Device Class Device Protocol Manufacturer Product Serial Number Supported USB Version Current Speed [ Generic USB Hub (USB 2.0 Hub [Safe]) ] Device Properties: Device Description Device ID Device Class Device Protocol Product Supported USB Version Current Speed [ Generic USB Hub ] Device Properties: Device Description Device ID Device Class Device Protocol Supported USB Version Current Speed [ Unknown Device ] Device Properties: Device Description Device ID Device Class Device Protocol Supported USB Version Current Speed [ USB Input Device ] Device Properties: Device Description Device ID USB Input Device 1D57-0016 Unknown Device 0000-0000 00 / 00 00 0.00 Low (USB 1.1) Generic USB Hub 1A40-0101 09 / 00 (Full-Speed Hub) 00 2.00 Full (USB 1.1) Generic USB Hub 1A40-0101 09 / 00 (Full-Speed Hub) 00 USB 2.0 Hub [Safe] 2.00 Full (USB 1.1) USB Mass Storage Device 14CD-6116 08 / 06 (Mass Storage) 50 Super Top USB 2.0 SATA BRIDGE M6116A016V20 2.00 High (USB 2.0)

Device Class Device) Device Protocol Manufacturer Supported USB Version Current Speed

03 / 01 (Human Interface 02 HID Wireless Mouse? 1.10 Full (USB 1.1)

--------[ Device Resources ]------------------------------------------------------------------------------------------DMA roller IRQ IRQ IRQ ck IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ IRQ System 04 00 01 08 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 12 120 Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Direct memory access cont System timer Standard PS/2 Keyboard System CMOS/real time clo Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant PS/2 Compatible Mouse Microsoft ACPI-Compliant

IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System

121 122 123 124 125 126 127 128 129 13 130 131 132 133 134 135 136 137 138 139 14 140 141 142 143 144 145 146 147 148 149

Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive

Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Numeric data processor Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant ATA Channel 0 Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant

IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ ,910GML IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ dem IRQ IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ System IRQ

150 151 152 153 154 155 156 157 158 159 16 Express Chipset Family 160 161 162 163 164 165 166 167 168 169 17 17 170 171 172 173 174 175 176 177

Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Shared Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Shared Shared Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive

Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Mobile Intel(R) 915GM/GMS Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Motorola SM56 Data Fax Mo Conexant AC-Link Audio Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant

System IRQ 178 Exclusive System IRQ 179 Exclusive System IRQ 18 Shared ontroller IRQ 180 Exclusive System IRQ 181 Exclusive System IRQ 182 Exclusive System IRQ 183 Exclusive System IRQ 184 Exclusive System IRQ 185 Exclusive System IRQ 186 Exclusive System IRQ 187 Exclusive System IRQ 188 Exclusive System IRQ 189 Exclusive System IRQ 19 Shared Universal Host Controller - 2658 IRQ 19 Shared Enhanced Host Controller - 265C IRQ 190 Exclusive System IRQ 20 Shared rk Connection IRQ 21 Shared 0BG Network Connection IRQ 81 Exclusive System IRQ 82 Exclusive System IRQ 83 Exclusive System IRQ 84 Exclusive System IRQ 85 Exclusive System IRQ 86 Exclusive System IRQ 87 Exclusive System IRQ 88 Exclusive System IRQ 89 Exclusive System IRQ 90 Exclusive System IRQ 91 Exclusive System IRQ 92 Exclusive

Microsoft ACPI-Compliant Microsoft ACPI-Compliant ENE CB-1410/851 Cardbus C Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Intel(R) 82801FB/FBM USB Intel(R) 82801FB/FBM USB2 Microsoft ACPI-Compliant Intel(R) PRO/100 VE Netwo Intel(R) PRO/Wireless 220 Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant

System IRQ 93 System IRQ 94 System IRQ 95 System IRQ 96 System IRQ 97 System IRQ 98 System IRQ 99 System Memory 00000000-0009FFFF Memory 000A0000-000BFFFF Memory 000A0000-000BFFFF ,910GML Express Chipset Family Memory 000D0000-000DFFFF Memory 000E0000-000FFFFF Memory 00100000-3F7FFFFF Memory 3F800000-FEC00FFF Memory C0000000-CFFFFFFF ,910GML Express Chipset Family Memory D0000000-D0000FFF 0BG Network Connection Memory D0000000-D05FFFFF - 2448 Memory D0001000-D0001FFF ontroller Memory D0002000-D0002FFF rk Connection Memory D05FE000-D05FEFFF ontroller Memory D05FF000-D05FFFFF ontroller Memory D0600000-D067FFFF ,910GML Express Chipset Family Memory D0680000-D06BFFFF ,910GML Express Chipset Family Memory D0700000-D077FFFF ,910GML Express Chipset Family Memory D0780000-D07803FF Enhanced Host Controller - 265C Memory D0781000-D07811FF Memory D0782000-D07820FF Memory E0000000-EFFFFFFF Memory FEC00000-FEC000FF Memory FEC01000-FEC01FFF Memory FEC02000-FFFFFFFF Memory FED20000-FED8FFFF Memory FED90000-FED9AFFF Memory FEDA0000-FEDBFFFF Memory FFB00000-FFBFFFFF Memory FFEFF000-FFEFFFFF ontroller Memory FFF00000-FFFFFFFF Port 0000-000F roller

Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Shared Shared Shared Exclusive Exclusive Shared Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Shared Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive

Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant Microsoft ACPI-Compliant System board PCI bus Mobile Intel(R) 915GM/GMS PCI bus System board System board PCI bus Mobile Intel(R) 915GM/GMS Intel(R) PRO/Wireless 220 Intel(R) 82801 PCI Bridge ENE CB-1410/851 Cardbus C Intel(R) PRO/100 VE Netwo ENE CB-1410/851 Cardbus C ENE CB-1410/851 Cardbus C Mobile Intel(R) 915GM/GMS Mobile Intel(R) 915GM/GMS Mobile Intel(R) 915GM/GMS Intel(R) 82801FB/FBM USB2 Conexant AC-Link Audio Conexant AC-Link Audio Motherboard resources Motherboard resources Motherboard resources PCI bus Motherboard resources Motherboard resources Motherboard resources Motherboard resources ENE CB-1410/851 Cardbus C Motherboard resources Direct memory access cont

Port 0000-0CF7 Port 0010-001F Port 0020-0021 ntroller Port 0024-003F Port 0040-0043 Port 004E-004F Port 0050-0053 Port 0060-0060 Port 0061-0061 Port 0062-0062 Embedded Controller Port 0063-0063 Port 0064-0064 Port 0065-0065 Port 0066-0066 Embedded Controller Port 0067-0067 Port 0070-0071 ck Port 0072-0073 ck Port 0074-0077 Port 0080-008F roller Port 0090-009F Port 00A0-00A1 ntroller Port 00A4-00BD Port 00C0-00DF roller Port 00F0-00FF Port 01F0-01F7 Port 0200-0203 Port 0378-037F Port 03B0-03BB ,910GML Express Chipset Family Port 03C0-03DF ,910GML Express Chipset Family Port 03F6-03F6 Port 04D0-04D1 Port 0500-057F Port 0778-077A Port 0D00-FFFF Port 1000-107F Port 1100-113F Port 1200-121F Port 2000-203F rk Connection Port 2000-2FFF - 2448 Port 2C00-2C03 ontroller Port 3000-3007 ,910GML Express Chipset Family Port 3020-303F Universal Host Controller - 2658 Port 3100-31FF Port 3200-323F Port 3400-34FF

Shared Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Shared Shared Exclusive Exclusive Exclusive Exclusive Shared Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive Exclusive

PCI bus Motherboard resources Programmable interrupt co Motherboard resources System timer Motherboard resources Motherboard resources Standard PS/2 Keyboard System speaker Microsoft ACPI-Compliant Motherboard resources Standard PS/2 Keyboard Motherboard resources Microsoft ACPI-Compliant Motherboard resources System CMOS/real time clo System CMOS/real time clo Motherboard resources Direct memory access cont Motherboard resources Programmable interrupt co Motherboard resources Direct memory access cont Numeric data processor ATA Channel 0 Motherboard resources Printer Port (LPT1) Mobile Intel(R) 915GM/GMS Mobile Intel(R) 915GM/GMS ATA Channel 0 Motherboard resources Motherboard resources Printer Port (LPT1) PCI bus Motherboard resources Motherboard resources Motherboard resources Intel(R) PRO/100 VE Netwo Intel(R) 82801 PCI Bridge ENE CB-1410/851 Cardbus C Mobile Intel(R) 915GM/GMS Intel(R) 82801FB/FBM USB Conexant AC-Link Audio Conexant AC-Link Audio Motorola SM56 Data Fax Mo

dem Port 3500-357F dem Port 3580-358F Exclusive a ATA Storage Controllers - 266F Intel(R) 82801FB/FBM Ultr Exclusive Motorola SM56 Data Fax Mo

--------[ Input ]-----------------------------------------------------------------------------------------------------[ HID Keyboard Device ] Keyboard Properties: Keyboard Name Keyboard Type 2-key) keyboard Keyboard Layout ANSI Code Page tem32\mlang.dll,-4612 OEM Code Page Repeat Delay Repeat Rate [ HID-compliant mouse ] Mouse Properties: Mouse Name Mouse Buttons Mouse Hand Pointer Speed Double-Click Time X/Y Threshold Wheel Scroll Lines Mouse Features: Active Window Tracking ClickLock Hide Pointer While Typing Mouse Wheel Move Pointer To Default Button Pointer Trails Sonar HID-compliant mouse 5 Right 1 500 msec 6 / 10 3 Disabled Disabled Enabled Present Disabled Disabled Disabled HID Keyboard Device IBM enhanced (101- or 10 US 1252 - @%SystemRoot%\sys 437 1 31

--------[ Printers ]--------------------------------------------------------------------------------------------------[ Canon MP250 series Printer (Default) ] Printer Properties: Printer Name er Default Printer Share Point Printer Port Printer Driver er (v12.06) Device Name er Print Processor Yes Not shared COM1: Canon MP250 series Print Canon MP250 series Print Canon MP250 series Print Canon MP250 series Print

Processor Separator Page Availability Priority Print Jobs Queued Status Paper Properties: Paper Size Orientation Print Quality

None Always 1 0 Unknown Letter, 8.5 x 11 in Portrait Medium Color

Printer Manufacturer: Company Name Canon U.S.A.,Inc. Product Information http://consumer.usa.cano n.com/ir/controller?act=ProductCatIndexAct&fcategoryid=103 Driver Update http://driveragent.com?r ef=59 [ Fax ] Printer Properties: Printer Name Default Printer Share Point Printer Port Printer Driver ver (v4.00) Device Name Print Processor Separator Page Availability Priority Print Jobs Queued Status Paper Properties: Paper Size Orientation Print Quality [ Microsoft XPS Document Writer ] Printer Properties: Printer Name riter Default Printer Share Point Printer Port Printer Driver riter (v6.00) Device Name riter Print Processor Separator Page Availability Priority Print Jobs Queued Status Microsoft XPS Document W No Not shared XPSPort: Microsoft XPS Document W Microsoft XPS Document W winprint None Always 1 0 Unknown Fax No Not shared SHRFAX: Microsoft Shared Fax Dri Fax winprint None 9:00 AM - 9:00 AM 1 0 Unknown Letter, 8.5 x 11 in Portrait 200 x 200 dpi Mono

Paper Properties: Paper Size Orientation Print Quality [ Universal Document Converter ] Printer Properties: Printer Name rter Default Printer Share Point Printer Port Printer Driver rter (v5.03) Device Name Comment Location Print Processor Separator Page Availability Priority Print Jobs Queued Status Paper Properties: Paper Size Orientation Print Quality

Letter, 8.5 x 11 in Portrait 600 x 600 dpi Color

Universal Document Conve No UDC UDC Universal Document Conve <STUB_NAME> www.print-driver.com UDC Output Files winprint None Always 1 0 Unknown A4, 210 x 297 mm Portrait 300 x 300 dpi Color

--------[ Auto Start ]------------------------------------------------------------------------------------------------IDMan Registry\User\Run \Internet Download Manager\IDMan.exe /onboot C:\Program Files

--------[ Scheduled ]-------------------------------------------------------------------------------------------------[ AutoKMS ] Task Properties: Task Name Status Application Name MS.exe Application Parameters Working Folder Comment Account Name Creator Last Run Next Run Task Triggers: Trigger #1 arting 8/19/2013 Trigger #2 AutoKMS Enabled C:\Windows\AutoKMS\AutoK

SYSTEM Unknown 8/20/2013 5:47:00 PM At 5:47 PM every day, st Run at system startup

[ DLL-files.com Fixer_UPDATES ] Task Properties: Task Name TES Status Application Name es.com Fixer\DLLFixer.exe Application Parameters Working Folder Comment Account Name Creator Last Run Next Run Task Triggers: Trigger #1 every week, starting 8/19/2013 Not scheduled C:\Program Files\Dll-Fil -updatecheck emovhicRN\Vic Tiangco Vic Tiangco Unknown 8/21/2013 3:02:00 PM At 3:02 PM every Wed of DLL-files.com Fixer_UPDA

--------[ Installed Programs ]----------------------------------------------------------------------------------------Torrent 3.3.1.29756 Unknown Acoustica Mixcraft 6 b213 Unknown Adobe Flash Player 11 Plugin 11.8.800.115 Unknown Canon Inkjet Printer/Scanner/Fax Extended Survey Program Unknown Canon MP Navigator EX 3.0 Unknown Canon MP250 series MP Drivers Unknown Canon Utilities My Printer Unknown Canon Utilities Solution Menu Unknown CCleaner 4.00 Unknown Conexant AC-Link Audio Unknown Cool Edit Pro 2.1 Unknown DAEMON Tools Pro 5.3.0.0359 Unknown Dll-Files.com Fixer wersja 2.7.72.2024 2.7.72.2024 Unknown EVEREST Ultimate Edition v5.01 5.01 Unknown ffdshow [rev 3154] [2009-12-09] 1.0 Unknown FormatFactory 2.96 2.96 Unknown Foxit Reader 5.3.1.606 Unknown Game Booster 3

3.5 Unknown Globe Broadband 11.300.05.18.158 Unknown Google Chrome 26.0.1410.43 Unknown Intel(R) Graphics Media Accelerator Driver Unknown Internet Download Manager Unknown Java 7 Update 25 7.0.250 Unknown Java Auto Updater 2.1.9.5 Unknown Microsoft .NET Framework 4.5 4.5.50709 Unknown Microsoft .NET Framework 4.5 4.5.50709 Unknown Microsoft Office Access MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office Access Setup Metadata MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office Excel MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office Groove MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office InfoPath MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office OneNote MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office Outlook MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office PowerPoint MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office Professional Plus 2010 14.0.4734.1000 Unknown Microsoft Office Professional Plus 2010 14.0.4734.1000 Unknown Microsoft Office Proof (English) 2010 14.0.4734.1000 Unknown Microsoft Office Proof (French) 2010 [french (france)] 14.0.4734.1000 Unknown Microsoft Office Proof (Spanish) 2010 [spanish (spain, international sort)] 14.0.4734.1000 Unknown Microsoft Office Proofing (English) 2010 14.0.4734.1000 Unknown Microsoft Office Publisher MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office Shared MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office Shared Setup Metadata MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Office Word MUI (English) 2010 14.0.4734.1000 Unknown Microsoft Silverlight 5.1.20125.0 Unknown Microsoft Visual C++ 2005 Redistributable 8.0.59193 Unknown Motorola SM56 Data Fax Modem 6.12.25.04 Unknown Mouse and Keyboard Recorder 3.1.9.2

Unknown Mozilla Firefox 20.0 (x86 en-US) 20.0 Unknown Nero Burning ROM 10 10.2.11000.12.100 Unknown Nero Burning ROM 10 10.5.10300 Unknown Nero Control Center 10 10.2.10600.0.6 Unknown Nero Core Components 10 2.0.17400.8.2 Unknown Notepad++ 6.3.1 Unknown Photodex Presenter Unknown ProShow Producer Unknown Skype 5.10 5.10.116 Unknown TeamViewer 8 8.0.17396 Unknown Universal Document Converter Server Edition 5.3 Unknown USB Vibration Joystick 2007.08.17 Unknown VLC media player 2.0.7 2.0.7 Unknown WinRAR archiver Unknown --------[ Licenses ]--------------------------------------------------------------------------------------------------Microsoft Internet Explorer 8.0.7601.17514 T-8C8M2-V9488-FGM44-2C9T3 Microsoft Windows 7 Ultimate T-8C8M2-V9488-FGM44-2C9T3 MHFP MHFP

--------[ File Types ]------------------------------------------------------------------------------------------------386 3G2 video/3gpp2 3GA 3GP video/3gpp 3GP2 video/3gpp2 3GPP video/3gpp 669 7Z A52 VLC media file (.3ga) VLC media file (.3gp) VLC media file (.3gp2) VLC media file (.3gpp) VLC media file (.669) WinRAR archive VLC media file (.a52) Virtual Device Driver VLC media file (.3g2)

AAC

VLC media file (.aac) audio/vnd.dlna.adts AC3 VLC media file (.ac3) ACE ACL ADT WinRAR archive AutoCorrect List File file (.adt) file (.adts) file (.aif) file (.aifc) file (.aiff) file (.amr)

VLC media audio/vnd.dlna.adts ADTS VLC media audio/vnd.dlna.adts AIF VLC media audio/aiff AIFC VLC media audio/aiff AIFF VLC media audio/aiff AMR VLC media AMV ANI AOB APE

VLC media file (.amv) Animated Cursor VLC media file (.aob) VLC media file (.ape)

APPLICATION Application Manifest application/x-ms-application APPREF-MS Application Reference ARJ ASA ASF video/x-ms-asf ASP ASX video/x-ms-asf AU audio/basic AVI video/avi AW B4S B5T B6T BAT BIN BLG Answer Wizard File VLC media file (.b4s) B5T File B6T File Windows Batch File VLC media file (.bin) Performance Monitor File VLC media file (.avi) VLC media file (.au) ASP File VLC media file (.asx) WinRAR archive ASA File VLC media file (.asf)

BMP image/bmp BWT BZ BZ2 C2R CAB CAF CAMP CAT

Bitmap Image BWT File WinRAR archive WinRAR archive C2R File WinRAR archive VLC media file (.caf) WCS Viewing Condition Profile

Security Catalog application/vnd.ms-pki.seccat CCD CCD File CDA CDI CDMP CDX CEL CER VLC media file (.cda) CDI File WCS Device Profile CDX File Cool Edit Pro loop file

Security Certificate application/x-x509-ca-cert CHESSTITANSSAVE-MS .ChessTitansSave-ms CHK CHM CMD COM Recovered File Fragments Compiled HTML Help file Windows Command Script MS-DOS Application

COMFYCAKESSAVE-MS .ComfyCakesSave-ms COMPOSITEFONT Composite Font File

CONTACT Contact File text/x-ms-contact CPL Control Panel Item CRD CRDS CRL Information Card Information Card Store

Certificate Revocation List application/pkix-crl CRT Security Certificate application/x-x509-ca-cert CRTX Microsoft Office Chart Template

CSS text/css CSV

Cascading Style Sheet Document

Microsoft Excel Comma Separated Values File application/vnd.ms-excel CUE Image Files CUR DB DBL DER Cursor Data Base File 64 bit Doubles file

Security Certificate application/x-x509-ca-cert DESKLINK Desktop Shortcut DIAGCAB DIAGCFG DIAGPKG DIB image/bmp DIC DIVX DLL Text Document VLC media file (.divx) Diagnostic Cabinet Diagnostic Configuration Diagnostic Document Bitmap Image

Application Extension application/x-msdownload DOC Microsoft Word 97 - 2003 Document application/msword DOCHTML Microsoft Word HTML Document DOCM Microsoft Word Macro-Enabled Document application/vnd.ms-word.document.macroEnabled.12 DOCMHTML DOCMHTML File DOCX Microsoft Word Document application/vnd.openxmlformats-officedocument.wordprocessingml.document DOCXML Microsoft Word XML Document DOT Microsoft Word 97 - 2003 Template application/msword DOTHTML Microsoft Word HTML Template DOTM Microsoft Word Macro-Enabled Template application/vnd.ms-word.template.macroEnabled.12 DOTX Microsoft Word Template application/vnd.openxmlformats-officedocument.wordprocessingml.template DQY Microsoft Excel ODBC Query files DRC DRV DSN DTS VLC media file (.drc) Device Driver Microsoft OLE DB Provider for ODBC Drivers VLC media file (.dts)

DV DVR DVR-MS DWD

VLC media file (.dv) Microsoft Recorded TV Show Microsoft Recorded TV Show DiamondWare Digitized file

DWFX XPS Document model/vnd.dwfx+xps EASMX XPS Document model/vnd.easmx+xps EDRWX XPS Document model/vnd.edrwx+xps ELM Microsoft Office Themes File EMF EMF File

EPRTX XPS Document model/vnd.eprtx+xps EVT EVT File EVTX EXC EXE EVTX File Text Document

Application application/x-msdownload F4V VLC media file (.f4v) FDF Foxit Reader FDF Document application/vnd.fdf FLAC VLC media file (.flac) FLV FON FREECELLSAVE-MS GADGET GCSX GIF image/gif GLOX GMMP GQSX VLC media file (.flv) Font file .FreeCellSave-ms Windows Gadget Microsoft Office SmartArt Graphic Color Variation GIF Image Microsoft Office SmartArt Graphic Layout WCS Gamut Mapping Profile Microsoft Office SmartArt Graphic Quick Style

GROUP Contact Group File text/x-ms-group GRP Microsoft Program Group GXF GZ VLC media file (.gxf) WinRAR archive

H1C H1D H1F H1H H1K H1Q H1S H1T H1V H1W HEARTSSAVE-MS HLP HTA application/hta HTM

Windows Help Collection Definition File Windows Help Validator File Windows Help Include File Windows Help Merged Hierarchy Windows Help Index File Windows Help Merged Query Index Compiled Windows Help file Windows Help Table of Contents File Windows Help Virtual Topic Definition File Windows Help Merged Keyword Index .HeartsSave-ms Help File HTML Application

HTML Document text/html HTML HTML Document text/html HXA Microsoft Help application/xml HXC Microsoft Help application/xml HXD Microsoft Help application/octet-stream HXE Microsoft Help application/xml HXF Microsoft Help application/xml HXH Microsoft Help application/octet-stream HXI Microsoft Help application/octet-stream HXK Microsoft Help application/xml HXQ Microsoft Help application/octet-stream HXR Microsoft Help application/octet-stream HXS Microsoft Help application/octet-stream HXT Microsoft Help application/xml HXV Microsoft Help application/xml HXW Microsoft Help application/octet-stream ICC ICC Profile

Attribute Definition File Collection Definition File Validator File Samples Definition File Include File Merged Hierarchy File Compiled Index File Index File Merged Query Index File Merged Attribute Index File Compiled Storage File Table of Contents File Virtual Topic Definition File Attribute Definition File

ICL ICM ICO image/x-icon IFF IFO IMG INF INI IQY text/x-ms-iqy ISO ISZ IT JAR

Icon Library ICC Profile Icon Amiga audio file VLC media file (.ifo) Image Files Setup Information Configuration Settings Microsoft Excel Web Query File Image Files ISZ File VLC media file (.it) Executable Jar File

JFIF JPEG Image image/jpeg JNLP JNLP File application/x-java-jnlp-file JNT Journal Document JOB JOD JPE image/jpeg JPEG image/jpeg JPG image/jpeg JS JSE JTP JTX Task Scheduler Task Object Microsoft.Jet.OLEDB.4.0 JPEG Image JPEG Image JPEG Image JScript Script File JScript Encoded File Journal Template

XPS Document application/x-jtx+xps LABEL Property List LEX LHA Dictionary File WinRAR archive

LIBRARY-MS Library Folder application/windows-library+xml LNK Shortcut

LOG LZH M1V video/mpeg M2T

Text Document WinRAR archive VLC media file (.m1v) file (.m2t) file (.m2ts) file (.m2v) file (.m3u) file (.m3u8)

VLC media video/vnd.dlna.mpeg-tts M2TS VLC media video/vnd.dlna.mpeg-tts M2V VLC media video/mpeg M3U VLC media audio/x-mpegurl M3U8 VLC media M4A audio/mp4 M4P M4V

VLC media file (.m4a) VLC media file (.m4p)

VLC media file (.m4v) video/mp4 MAHJONGTITANSSAVE-MS .MahjongTitansSave-ms MAPIMAIL MCL MDF MDS MDX MHT message/rfc822 MHTML message/rfc822 MID audio/mid MIDI audio/mid MIG Mail Service MCL File MDF File MDS File MDX File MHTML Document MHTML Document VLC media file (.mid) MIDI Sequence Migration Store

MINESWEEPERSAVE-MS .MinesweeperSave-ms MKA MKV MLC MLP MOD video/mpeg MOV video/quicktime MP1 VLC media file (.mp1) VLC media file (.mov) VLC media file (.mka) VLC media file (.mkv) Language Pack File_ VLC media file (.mlp) VLC media file (.mod)

MP2 audio/mpeg MP2V video/mpeg MP3 audio/mpeg MP4 video/mp4 MP4V video/mp4 MPA video/mpeg MPC MPE video/mpeg MPEG video/mpeg MPEG1 MPEG2 MPEG4 MPG video/mpeg MPV2 video/mpeg MSC MSDVD MSI MSP MSRCINCIDENT MSSTYLES MSU MTS

VLC media file (.mp2) VLC media file (.mp2v) VLC media file (.mp3) VLC media file (.mp4) VLC media file (.mp4v) VLC media file (.mpa) VLC media file (.mpc) VLC media file (.mpe) VLC media file (.mpeg) VLC media file (.mpeg1) VLC media file (.mpeg2) VLC media file (.mpeg4) VLC media file (.mpg) VLC media file (.mpv2) Microsoft Common Console Document MSDVD File Windows Installer Package Windows Installer Patch Windows Remote Assistance Invitation Windows Visual Style File Microsoft Update Standalone Package

VLC media file (.mts) video/vnd.dlna.mpeg-tts MTV VLC media file (.mtv) MX6 MX6TEMPLATE MXF MYDOCS NBS NBV NCP Mixcraft 6 Project file Mixcraft 6 Project file VLC media file (.mxf) MyDocs Drop Target CD-ROM (SecurDisc) Compilation BDMV Compilation Check Point Compilation

NDS NEROSERIAL NFO NHB NHD NRA NRB NRC NRD NRE NRG NRI NRM NRU NSV NUV OCX ODC

DiscSpan Compilation Nero Serial Number MSInfo Configuration File AVCHD(TM) BD Compilation AVCHD(TM) DVD Compilation Audio CD Compilation CD-ROM (Boot) Compilation CD-ROM (UDF/ISO) Compilation DVD-Video Compilation CD EXTRA Compilation Disc Image CD-ROM (ISO) Compilation Mixed Mode CD Compilation CD-ROM (UDF) Compilation VLC media file (.nsv) VLC media file (.nuv) ActiveX control

Microsoft Office Data Connection text/x-ms-odc ODCCUBEFILE ODCCUBEFILE File ODCDATABASEFILE ODCNEWFILE ODCTABLEFILE ODP ODCDATABASEFILE File ODCNEWFILE File ODCTABLEFILE File

OpenDocument Presentation application/vnd.oasis.opendocument.presentation ODS OpenDocument Spreadsheet application/vnd.oasis.opendocument.spreadsheet ODT OpenDocument Text application/vnd.oasis.opendocument.text OGA VLC media file (.oga) OGG OGM OGV OGX VLC media file (.ogg) VLC media file (.ogm) VLC media file (.ogv) VLC media file (.ogx)

OMA OPC OPUS OQY

VLC media file (.oma) Microsoft Clean-up Wizard File VLC media file (.opus) Microsoft Excel OLAP Query File

OSDX OpenSearch Description File application/opensearchdescription+xml OTF OpenType Font file P10 Certificate Request application/pkcs10 P12 Personal Information Exchange application/x-pkcs12 P7B PKCS #7 Certificates application/x-pkcs7-certificates P7C Digital ID File application/pkcs7-mime P7M PKCS #7 MIME Message application/pkcs7-mime P7R Certificate Request Response application/x-pkcs7-certreqresp P7S PKCS #7 Signature application/pkcs7-signature PBK Dial-Up Phonebook PCB PCM PDF PCB File Raw PCM file

Foxit Reader PDF Document application/pdf PERFMONCFG Performance Monitor Configuration PFM PFX Type 1 Font file

Personal Information Exchange application/x-pkcs12 PIF Shortcut to MS-DOS Program PKO Public Key Security Object application/vnd.ms-pki.pko PLS VLC media file (.pls) PNF PNG image/png POT Microsoft PowerPoint 97-2003 Template application/vnd.ms-powerpoint POTHTML Microsoft PowerPoint HTML Template POTM Microsoft PowerPoint Macro-Enabled Design Template application/vnd.ms-powerpoint.template.macroEnabled.12 POTX Microsoft PowerPoint Template application/vnd.openxmlformats-officedocument.presentationml.template PPA Microsoft PowerPoint 97-2003 Addin Precompiled Setup Information PNG Image

application/vnd.ms-powerpoint PPAM Microsoft PowerPoint Addin application/vnd.ms-powerpoint.addin.macroEnabled.12 PPR ProShow Project PPS Microsoft PowerPoint 97-2003 Slide Show application/vnd.ms-powerpoint PPSM Microsoft PowerPoint Macro-Enabled Slide Show application/vnd.ms-powerpoint.slideshow.macroEnabled.12 PPSX Microsoft PowerPoint Slide Show application/vnd.openxmlformats-officedocument.presentationml.slideshow PPT Microsoft PowerPoint 97-2003 Presentation application/vnd.ms-powerpoint PPTHTML Microsoft PowerPoint HTML Document PPTM Microsoft PowerPoint Macro-Enabled Presentation application/vnd.ms-powerpoint.presentation.macroEnabled.12 PPTMHTML PPTMHTML File PPTX Microsoft PowerPoint Presentation application/vnd.openxmlformats-officedocument.presentationml.presentation PPTXML Microsoft PowerPoint XML Presentation PRF PICS Rules File application/pics-rules PRINTEREXPORT Printer Migration File PS1 PS1XML PS1 File PS1XML File

PSC1 PSC1 File application/PowerShell PSD1 PSD1 File PSH PSM1 ProShow Slideshow PSM1 File

PURBLEPAIRSSAVE-MS .PurblePairsSave-ms PURBLESHOPSAVE-MS .PurbleShopSave-ms PWZ Microsoft PowerPoint Wizard application/vnd.ms-powerpoint PX Photodex Presenter Show PXS PXT PXW QCP QDS R00 R01 ProShow Slide Style ProShow Transition ProShow Web Archive VLC media file (.qcp) Directory Query WinRAR archive WinRAR archive

R02 R03 R04 R05 R06 R07 R08 R09 R10 R11 R12 R13 R14 R15 R16 R17 R18 R19 R20 R21 R22 R23 R24 R25 R26 R27 R28 R29 RAM RAR

WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive VLC media file (.ram) WinRAR archive

RAT

Rating System File application/rat-file RDP Remote Desktop Connection REC REG RELS RESMONCFG REV RLE RLL RM RMI audio/mid RMVB RQY VLC media file (.rec) Registration Entries XML Document Resource Monitor Configuration RAR recovery volume RLE File Application Extension VLC media file (.rm) VLC media file (.rmi) VLC media file (.rmvb)

Microsoft Excel OLE DB Query files text/x-ms-rqy RSMK Robot Soft Mouse and Keyboard Record File RSMR RTF Robot Soft Mouse Record File

Rich Text Format application/msword S3M VLC media file (.s3m) SAM SCF SCP SCR SCT text/scriptlet SDP VLC media file (.sdp) SEARCHCONNECTOR-MS Search Connector Folder application/windows-search-connector+xml SEARCH-MS Saved Search SES SFCACHE Cool Edit Pro session file ReadyBoost Cache File 8 bit signed file Windows Explorer Command Text Document Screen saver Windows Script Component

SHTML SHTML File text/html SKYPE Skype Content application/x-skype SLDM Microsoft PowerPoint Macro-Enabled Slide

application/vnd.ms-powerpoint.slide.macroEnabled.12 SLDX Microsoft PowerPoint Slide application/vnd.openxmlformats-officedocument.presentationml.slide SLK Microsoft Excel SLK Data Import Format application/vnd.ms-excel SLUPKG-MS XrML Digital License Package application/x-ms-license SMP SampleVision file SND VLC media file (.snd) audio/basic SOLITAIRESAVE-MS .SolitaireSave-ms SPC PKCS #7 Certificates application/x-pkcs7-certificates SPIDERSOLITAIRESAVE-MS .SpiderSolitaireSave-ms SPX SST VLC media file (.spx)

Microsoft Serialized Certificate Store application/vnd.ms-pki.certstore STL Certificate Trust List application/vnd.ms-pki.stl SVX Amiga audio file SYS TAR TAZ TBZ TBZ2 TGZ THEME THEMEPACK System file WinRAR archive WinRAR archive WinRAR archive WinRAR archive WinRAR archive Windows Theme File Windows Theme Pack

THMX Microsoft Office Theme application/vnd.ms-officetheme TIF TIF File image/tiff TIFF TIFF File image/tiff TOD VLC media file (.tod) TS VLC media file (.ts) video/vnd.dlna.mpeg-tts TTA VLC media file (.tta) TTC TTF TTS TrueType Collection Font file TrueType Font file

VLC media file (.tts) video/vnd.dlna.mpeg-tts TVC TVC File

TVS TXT text/plain UDL URL UU UUE UXDC VBE VBS VCF text/x-vcard VLC VOB VOC VOX VQF VRO VXD W64 WAB WAV audio/wav WAX

TVS File Text Document Microsoft Data Link URL File WinRAR archive WinRAR archive UXDC File VBScript Encoded File VBScript Script File vCard File VLC media file (.vlc) VLC media file (.vob) VLC media file (.voc) Dialogic VOX file VLC media file (.vqf) VLC media file (.vro) Virtual Device Driver VLC media file (.w64) Address Book File VLC media file (.wav)

Windows Media Audio shortcut audio/x-ms-wax WBCAT Windows Backup Catalog File WBK Microsoft Word Backup Document application/msword WCX Workspace Configuration File WDP Windows Media Photo image/vnd.ms-photo WEBPNP Web Point And Print File WIZ Microsoft Word Wizard application/msword WLL WLL File WM video/x-ms-wm WMA VLC media file (.wma) Windows Media Audio/Video file

audio/x-ms-wma WMD Windows Media Player Download Package application/x-ms-wmd WMDB Windows Media Library WMF WMS WMV video/x-ms-wmv WMX video/x-ms-wmx WMZ Windows application/x-ms-wmz WPL Windows application/vnd.ms-wpl WSC Windows text/scriptlet WSF Windows WSH WTV WTX WV WVX video/x-ms-wvx XA VLC media file (.xa) XAML Windows Markup File application/xaml+xml XBAP XAML Browser Application application/x-ms-xbap XEVGENXML XEVGENXML File XHT XHT File application/xhtml+xml XHTML XHTML File application/xhtml+xml XLA Microsoft Excel Add-In application/vnd.ms-excel XLAM Microsoft Excel Add-In application/vnd.ms-excel.addin.macroEnabled.12 XLD Microsoft Excel 5.0 DialogSheet application/vnd.ms-excel XLK Microsoft Excel Backup File application/vnd.ms-excel XLL Microsoft Excel XLL Add-In application/vnd.ms-excel XLM Microsoft Excel 4.0 Macro application/vnd.ms-excel XLS Microsoft Excel 97-2003 Worksheet application/vnd.ms-excel XLSB Microsoft Excel Binary Worksheet application/vnd.ms-excel.sheet.binary.macroEnabled.12 XLSHTML Microsoft Excel HTML Document Media Player Skin Package Media playlist Script Component Script File Windows Media Audio/Video playlist WMF File Windows Media Player Skin File VLC media file (.wmv)

Windows Script Host Settings File Windows Recorded TV Show Text Document VLC media file (.wv) Windows Media Audio/Video playlist

XLSM Microsoft Excel Macro-Enabled Worksheet application/vnd.ms-excel.sheet.macroEnabled.12 XLSMHTML XLSMHTML File XLSX Microsoft Excel Worksheet application/vnd.openxmlformats-officedocument.spreadsheetml.sheet XLT Microsoft Excel Template application/vnd.ms-excel XLTHTML Microsoft Excel HTML Template XLTM Microsoft Excel Macro-Enabled Template application/vnd.ms-excel.template.macroEnabled.12 XLTX Microsoft Excel Template application/vnd.openxmlformats-officedocument.spreadsheetml.template XLW Microsoft Excel Workspace application/vnd.ms-excel XLXML Microsoft Excel XML Worksheet XM XML text/xml XPS XPS Document application/vnd.ms-xpsdocument XRM-MS XrML Digital License text/xml XSL XSL Stylesheet text/xml XSPF VLC media file (.xspf) XXE Z ZFSENDTOTARGET ZIP WinRAR archive WinRAR archive Compressed (zipped) Folder SendTo Target WinRAR ZIP archive VLC media file (.xm) XML Document

--------[ Sidebar Gadgets ]-------------------------------------------------------------------------------------------[ Calendar ] Gadget Properties: Name Description alendar. Version Author Copyright URL fwlink/?LinkId=124093 Folder XML dget.xml [ Clock ] Calendar Browse the days of the c 1.1.0.0 Microsoft Corporation 2009 http://go.microsoft.com/ ProgramFiles Calendar.Gadget\en-US\ga

Gadget Properties: Name Description own time zone or any city in the world. Version Author Copyright URL fwlink/?LinkId=124093 Folder XML t.xml [ CPU Meter ] Gadget Properties: Name Description CPU and system memory (RAM). Version Author Copyright URL fwlink/?LinkId=124093 Folder XML xml [ Currency ] Gadget Properties: Name Description y to another. Version Author Copyright URL fwlink/?LinkId=124093 Folder XML dget.xml [ DAEMON Tools ] Gadget Properties: Name Description o features faster and easier. Version Author Copyright URL /products/dtproAdv Folder XML [ Feed Headlines ]

Clock Watch the clock in your 1.0.0.0 Microsoft Corporation 2009 http://go.microsoft.com/ ProgramFiles Clock.Gadget\en-US\gadge

CPU Meter See the current computer 1.0.0.0 Microsoft Corporation 2009 http://go.microsoft.com/ ProgramFiles CPU.Gadget\en-US\gadget.

Currency Convert from one currenc 1.0.0.0 Microsoft Corporation 2009 http://go.microsoft.com/ ProgramFiles Currency.Gadget\en-US\ga

DAEMON Tools Use main DAEMON Tools Pr 1.0.1.0 DAEMON Tools Gadget Copyright 2009-2010 http://www.disc-soft.com LocalAppData DT.gadget\gadget.xml

Gadget Properties: Name Description ports, and entertainment headlines. Version Author Copyright URL fwlink/?LinkId=124093 Folder XML dget.xml [ Picture Puzzle ] Gadget Properties: Name Description uzzle and try to put them in order. Version Author Copyright URL fwlink/?LinkId=124093 Folder XML US\gadget.xml [ Slide Show ] Gadget Properties: Name Description show of your pictures. Version Author Copyright URL fwlink/?LinkId=124093 Folder XML adget.xml [ Weather ] Gadget Properties: Name Description ks like around the world. Version Author Copyright URL fwlink/?LinkId=124093 Folder XML get.xml [ Windows Media Center ]

Feed Headlines Track the latest news, s 1.1.0.0 Microsoft Corporation 2009 http://go.microsoft.com/ ProgramFiles RSSFeeds.Gadget\en-US\ga

Picture Puzzle Move the pieces of the p 1.0.0.0 Microsoft Corporation 2009 http://go.microsoft.com/ ProgramFiles PicturePuzzle.Gadget\en-

Slide Show Show a continuous slide 1.0.0.0 Microsoft Corporation 2009 http://go.microsoft.com/ ProgramFiles SlideShow.Gadget\en-US\g

Weather See what the weather loo 1.1.0.0 Microsoft Corporation 2009 http://go.microsoft.com/ ProgramFiles Weather.Gadget\en-US\gad

Gadget Properties: Name Windows Media Center Description Play your latest TV reco rdings, new Internet TV clips, and favorite music and pictures. Version 1.0.0.0 Author Microsoft Corporation Copyright 2009 URL http://go.microsoft.com/ fwlink/?LinkId=124093 Folder ProgramFiles XML MediaCenter.Gadget\en-US \gadget.xml --------[ Windows Security ]------------------------------------------------------------------------------------------Operating System Properties: OS Name mate OS Service Pack Winlogon Shell User Account Control (UAC) System Restore Data Execution Prevention (DEP, NX, EDB): Supported by Operating System Supported by CPU Active (To Protect Applications) Active (To Protect Drivers) Service Pack 1 explorer.exe Disabled Enabled Yes Yes Yes Yes Microsoft Windows 7 Ulti

--------[ Windows Update ]--------------------------------------------------------------------------------------------(Automatic Update) Disabled Definition Update for Windows Defender - KB915597 (Definition 1.155.2386.0) Update 8/19/2013 --------[ Firewall ]--------------------------------------------------------------------------------------------------Windows Firewall 6.1.7600.16385 Enabled

--------[ Anti-Spyware ]----------------------------------------------------------------------------------------------Microsoft Windows Defender 5) --------[ Regional ]--------------------------------------------------------------------------------------------------Time Zone: Current Time Zone Current Time Zone Description Taipei Standard Time (UTC+08:00) Taipei 6.1.7600.16385(win7_rtm.090713-125

Change To Standard Time Change To Daylight Saving Time Language: Language Name (Native) Language Name (English) Language Name (ISO 639) Country/Region: Country Name (Native) Country Name (English) Country Name (ISO 3166) Country Code Currency: Currency Currency Currency Currency Currency Negative Name (Native) Name (English) Symbol (Native) Symbol (ISO 4217) Format Currency Format English English en United States United States US 1 US Dollar US Dollar $ USD $123,456,789.00 ($123,456,789.00) h:mm:ss tt M/d/yyyy dddd, MMMM dd, yyyy 123,456,789.00 -123,456,789.00 first, second, third 0123456789 Monday / Mon Tuesday / Tue Wednesday / Wed Thursday / Thu Friday / Fri Saturday / Sat Sunday / Sun January / Jan February / Feb March / Mar April / Apr May / May June / Jun July / Jul August / Aug September / Sep October / Oct November / Nov December / Dec Gregorian (localized) US Letter U.S.

Formatting: Time Format Short Date Format Long Date Format Number Format Negative Number Format List Format Native Digits Days of Week: Native Name Native Name Native Name Native Name Native Name Native Name Native Name Months: Native Native Native Native Native Native Native Native Native Native Native Native Name Name Name Name Name Name Name Name Name Name Name Name for for for for for for for for for for for for for for for for for for for Monday Tuesday Wednesday Thursday Friday Saturday Sunday January February March April May June July August September October November December

Miscellaneous: Calendar Type Default Paper Size Measurement System

--------[ Environment ]-----------------------------------------------------------------------------------------------__APPCOMPAT_MANIFEST __COMPAT_LAYER ALLUSERSPROFILE APPDATA CommonProgramFiles COMPUTERNAME ComSpec FP_NO_HOST_CHECK HOMEDRIVE HOMEPATH LOCALAPPDATA LOGONSERVER MOZ_PLUGIN_PATH ns\ NUMBER_OF_PROCESSORS 1 OS Windows_NT Path C:\Windows\system32;C:\Windows;C:\Windows\System32 \Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\ PATHEXT .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;. MSC PROCESSOR_ARCHITECTURE x86 PROCESSOR_IDENTIFIER x86 Family 6 Model 13 Stepping 8, GenuineIntel PROCESSOR_LEVEL 6 PROCESSOR_REVISION 0d08 ProgramData C:\ProgramData ProgramFiles C:\Program Files PSModulePath C:\Windows\system32\WindowsPowerShell\v1.0\Modules \ PUBLIC C:\Users\Public SESSIONNAME Console SystemDrive C: SystemRoot C:\Windows TEMP C:\Users\VICTIA~1\AppData\Local\Temp TMP C:\Users\VICTIA~1\AppData\Local\Temp USERDOMAIN emovhicRN USERNAME Vic Tiangco USERPROFILE C:\Users\Vic Tiangco windir C:\Windows windows_tracing_flags 3 windows_tracing_logfile C:\BVTBin\Tests\installpackage\csilogfile.log --------[ Control Panel ]---------------------------------------------------------------------------------------------Action Center Review recent messages and resolve problems with your computer. Administrative Tools Configure administrative settings for your computer. AutoPlay Change default settings for CDs, D VDs, and devices so that you can automatically play music, view pictures, instal l software, and play games. Backup and Restore Backup and restore your files and system. Monitor latest backup status and configuration. BitLocker Drive Encryption Protect your computer using BitLoc ker Drive Encryption. Color Management Change advanced color management s VistaSetup C:\ProgramData C:\Users\Vic Tiangco\AppData\Roaming C:\Program Files\Common Files EMOVHICRN C:\Windows\system32\cmd.exe NO C: \Users\Vic Tiangco C:\Users\Vic Tiangco\AppData\Local \\EMOVHICRN C:\Program Files\Foxit Software\Foxit Reader\plugi

ettings for displays, scanners, and printers. Credential Manager Manage your Windows Credentials. Date and Time Set the date, time, and time zone for your computer. Default Programs Choose which programs you want Win dows to use for activities like web browsing, editing photos, sending e-mail, an d playing music. Desktop Gadgets View the desktop gadgets installed on your computer. Device Manager View and update your hardware's se ttings and driver software. Devices and Printers View and manage devices, printers, and print jobs Display Change your display settings and m ake it easier to read what's on your screen. Ease of Access Center Make your computer easier to use. Flash Player Manage Flash Player Settings Folder Options Customize the display of files and folders. Fonts Add, change, and manage fonts on y our computer. Getting Started Learn about Windows features and s tart using them. HomeGroup View HomeGroup settings, choose sh aring options, and view or change the password. Indexing Options Change how Windows indexes items f or faster searching Internet Options Configure your Internet display an d connection settings. Java Java Control Panel Keyboard Customize your keyboard settings, such as the cursor blink rate and the character repeat rate. Location and Other Sensors Configure your sensor settings. Mouse Customize your mouse settings, suc h as the button configuration, double-click speed, mouse pointers, and motion sp eed. Network and Sharing Center Check network status, change netwo rk settings and set preferences for sharing files and printers. Notification Area Icons Select which icons and notificatio ns appear in the notification area. Parental Controls Change Parental Controls settings. Performance Information and Tools Get information about your compute r's speed and performance. If solutions to performance problems are available, W indows lets you know. Personalization Change the pictures, colors, and s ounds for this computer. Phone and Modem Configure your telephone dialing r ules and modem settings. Power Options Conserve energy or maximize perfor mance by choosing how your computer manages power. Programs and Features Uninstall or change programs on yo ur computer. Recovery Restore your system to an earlier time without affecting your files, or replace everything on your computer and re install Windows. Region and Language Customize settings for the display of languages, numbers, times, and dates. RemoteApp and Desktop Connections Manage your RemoteApp and Desktop Connections Sound Configure your audio devices or ch

ange the sound scheme for your computer. Speech Recognition Configure how speech recognition w orks on your computer. Sync Center Sync files between your computer a nd network folders System View information about your comput er, and change settings for hardware, performance, and remote connections. Taskbar and Start Menu Customize the Start Menu and the t askbar, such as the types of items to be displayed and how they should appear. Troubleshooting Troubleshoot and fix common comput er problems. User Accounts Change user account settings and p asswords for people who share this computer. Windows CardSpace Manage Information Cards used to l og on and register with websites and online services. Windows Defender Protection against spyware and pot entially unwanted software Windows Firewall Set firewall security options to h elp protect your computer from hackers and malicious software. Windows Mobility Center Adjust display brightness, volume, power options, and other commonly used mobile PC settings. Windows Update Check for software and driver upda tes, choose automatic updating settings, or view installed updates. --------[ Recycle Bin ]-----------------------------------------------------------------------------------------------C: D: G: 0 0 0 0 0 0 ? ? ? ? ? ?

--------[ System Files ]----------------------------------------------------------------------------------------------[ autoexec.bat ] REM Dummy file for NTVDM [ config.sys ] FILES=40 [ autoexec.nt ] @echo off REM AUTOEXEC.BAT is not used to initialize the MS-DOS environment. REM AUTOEXEC.NT is used to initialize the MS-DOS environment unless a REM different startup file is specified in an application's PIF. REM Install CD ROM extensions lh %SystemRoot%\system32\mscdexnt.exe REM Install network redirector (load before dosx.exe) lh %SystemRoot%\system32\redir REM Install DPMI support lh %SystemRoot%\system32\dosx

REM The following line enables Sound Blaster 2.0 support on NTVDM. REM The command for setting the BLASTER environment is as follows: REM SET BLASTER=A220 I5 D1 P330 REM where: REM A specifies the sound blaster's base I/O port REM I specifies the interrupt request line REM D specifies the 8-bit DMA channel REM P specifies the MPU-401 base I/O port REM T specifies the type of sound blaster card REM 1 - Sound Blaster 1.5 REM 2 - Sound Blaster Pro I REM 3 - Sound Blaster 2.0 REM 4 - Sound Blaster Pro II REM 6 - SOund Blaster 16/AWE 32/32/64 REM REM The default value is A220 I5 D1 T3 and P330. If any of the switches is REM e REM REM nly. REM The T switch must be set to 3, if specified. SET BLASTER=A220 I5 D1 P330 T3 REM To disable the sound blaster 2.0 support on NTVDM, specify an invalid REM SB base I/O port address. For example: REM SET BLASTER=A0 [ config.nt ] REM REM REM REM REM REM REM REM REM REM REM REM REM REM REM REM REM REM REM REM REM REM REM REM REM REM REM REM Windows MS-DOS Startup File CONFIG.SYS vs CONFIG.NT CONFIG.SYS is not used to initialize the MS-DOS environment. CONFIG.NT is used to initialize the MS-DOS environment unless a different startup file is specified in an application's PIF. ECHOCONFIG By default, no information is displayed when the MS-DOS environment is initialized. To display CONFIG.NT/AUTOEXEC.NT information, add the command echoconfig to CONFIG.NT or other startup file. NTCMDPROMPT When you return to the command prompt from a TSR or while running an MS-DOS-based application, Windows runs COMMAND.COM. This allows the TSR to remain active. To run CMD.EXE, the Windows command prompt, rather than COMMAND.COM, add the command ntcmdprompt to CONFIG.NT or other startup file. DOSONLY By default, you can start any type of application when running COMMAND.COM. If you start an application other than an MS-DOS-based application, any running TSR may be disrupted. To ensure that only MS-DOS-based applications can be started, add the command dosonly to CONFIG.NT or other startup file. EMM You can use EMM command line to configure EMM(Expanded Memory Manager). ports are virtualized, the information provided here does not have to match the real hardware setting.) NTVDM supports Sound Blaster 2.0 o left unspecified, the default value will be used. (NOTE, since all th

REM The syntax is: REM REM EMM = [A=AltRegSets] [B=BaseSegment] [RAM] REM REM AltRegSets REM specifies the total Alternative Mapping Register Sets you REM want the system to support. 1 <= AltRegSets <= 255. The REM default value is 8. REM BaseSegment REM specifies the starting segment address in the Dos conventional REM memory you want the system to allocate for EMM page frames. REM The value must be given in Hexdecimal. REM 0x1000 <= BaseSegment <= 0x4000. The value is rounded down to REM 16KB boundary. The default value is 0x4000 REM RAM REM specifies that the system should only allocate 64Kb address REM space from the Upper Memory Block(UMB) area for EMM page frames REM and leave the rests(if available) to be used by DOS to support REM loadhigh and devicehigh commands. The system, by default, would REM allocate all possible and available UMB for page frames. REM REM The EMM size is determined by pif file(either the one associated REM with your application or _default.pif). If the size from PIF file REM is zero, EMM will be disabled and the EMM line will be ignored. REM dos=high, umb device=%SystemRoot%\system32\himem.sys files=40 [ system.ini ] ; for 16-bit app support [386Enh] woafont=dosapp.fon EGA80WOA.FON=EGA80WOA.FON EGA40WOA.FON=EGA40WOA.FON CGA80WOA.FON=CGA80WOA.FON CGA40WOA.FON=CGA40WOA.FON [drivers] wave=mmdrv.dll timer=timer.drv [mci] [network] Bios=1438834079 SSID=1438834079 [ win.ini ] ; for 16-bit app support [fonts] [extensions] [mci extensions] [files] [Mail] MAPI=1 [MCI Extensions.BAK] 3g2=MPEGVideo 3gp=MPEGVideo

3gp2=MPEGVideo 3gpp=MPEGVideo aac=MPEGVideo adt=MPEGVideo adts=MPEGVideo m2t=MPEGVideo m2ts=MPEGVideo m2v=MPEGVideo m4a=MPEGVideo m4v=MPEGVideo mod=MPEGVideo mov=MPEGVideo mp4=MPEGVideo mp4v=MPEGVideo mts=MPEGVideo ts=MPEGVideo tts=MPEGVideo [Internet] URLID=1426241622 inet=1426241622 [ hosts ]

[ lmhosts.sam ]

--------[ System Folders ]--------------------------------------------------------------------------------------------Administrative Tools C:\Users\Vic Tiangco\AppData\Roaming\Microsoft\ Windows\Start Menu\Programs\Administrative Tools AppData C:\Users\Vic Tiangco\AppData\Roaming Cache C:\Users\Vic Tiangco\AppData\Local\Microsoft\Wi ndows\Temporary Internet Files CD Burning C:\Users\Vic Tiangco\AppData\Local\Microsoft\Wi ndows\Burn\Burn Common Administrative Tools C:\ProgramData\Microsoft\Windows\Start Menu\Pro grams\Administrative Tools Common AppData C:\ProgramData Common Desktop C:\Users\Public\Desktop Common Documents C:\Users\Public\Documents Common Favorites C:\Users\Vic Tiangco\Favorites Common Files C:\Program Files\Common Files Common Music C:\Users\Public\Music Common Pictures C:\Users\Public\Pictures Common Programs C:\ProgramData\Microsoft\Windows\Start Menu\Pro grams Common Start Menu C:\ProgramData\Microsoft\Windows\Start Menu Common Startup C:\ProgramData\Microsoft\Windows\Start Menu\Pro grams\Startup Common Templates C:\ProgramData\Microsoft\Windows\Templates Common Video C:\Users\Public\Videos Cookies C:\Users\Vic Tiangco\AppData\Roaming\Microsoft\

Windows\Cookies Desktop C:\Users\Vic Tiangco\Desktop Device C:\Windows\inf Favorites C:\Users\Vic Tiangco\Favorites Fonts C:\Windows\Fonts History C:\Users\Vic Tiangco\AppData\Local\Microsoft\Wi ndows\History Local AppData C:\Users\Vic Tiangco\AppData\Local My Documents C:\Users\Vic Tiangco\Documents My Music C:\Users\Vic Tiangco\Music My Pictures C:\Users\Vic Tiangco\Pictures My Video C:\Users\Vic Tiangco\Videos NetHood C:\Users\Vic Tiangco\AppData\Roaming\Microsoft\ Windows\Network Shortcuts PrintHood C:\Users\Vic Tiangco\AppData\Roaming\Microsoft\ Windows\Printer Shortcuts Profile C:\Users\Vic Tiangco Program Files C:\Program Files Programs C:\Users\Vic Tiangco\AppData\Roaming\Microsoft\ Windows\Start Menu\Programs Recent C:\Users\Vic Tiangco\AppData\Roaming\Microsoft\ Windows\Recent Resources C:\Windows\resources SendTo C:\Users\Vic Tiangco\AppData\Roaming\Microsoft\ Windows\SendTo Start Menu C:\Users\Vic Tiangco\AppData\Roaming\Microsoft\ Windows\Start Menu Startup C:\Users\Vic Tiangco\AppData\Roaming\Microsoft\ Windows\Start Menu\Programs\Startup System C:\Windows\system32 Temp C:\Users\VICTIA~1\AppData\Local\Temp\ Templates C:\Users\Vic Tiangco\AppData\Roaming\Microsoft\ Windows\Templates Windows C:\Windows --------[ Event Logs ]------------------------------------------------------------------------------------------------Application Information None 2013-08-19 14:02:20 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0xC 004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x0 0000000, 0, 1], [(?)( 5 0x00000000 30 43200)( 1 0x00000000 0 0 msft:rm/algorithm /flags/1.0 0x00000000 0)(?)(?)(?)])] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7 : ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)( ?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F01 4, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5 , 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f240c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0x

C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28db c8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 14:02:20 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0xC 004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x0 0000000, 0, 1], [(?)( 5 0x00000000 30 43200)( 1 0x00000000 0 0 msft:rm/algorithm /flags/1.0 0x00000000 0)(?)(?)(?)])] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7 : ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)( ?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F01 4, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5 , 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f240c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28db c8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information 1 2013-08-19 14:02:21 Windows Search Service 1010: The Windows Search Servic e has successfully removed the old search index. Application Information 1 2013-08-19 14:02:21 Windows Search Service 1004: The Windows Search servic e is creating the new search index {Reason: Full Index Reset}. Application Warning 1 2013-08-19 14:02:21 Windows Search Service 1008: The Windows Search Servic e is starting up and attempting to remove the old search index {Reason: Full Ind ex Reset}. Application Information None 2013-08-19 14:02:26 Software Protection Platform Service 1004: The Software Protec tion service has successfully installed the license. License Title=OEM Certific ate License Id=ed176cc3-8c60-4186-9ee9-f36716afbc7b Application Information None 2013-08-19 14:03:01 Software Protection Platform Service 1016: Proof of Purchase i nstalled successfully. ACID=7cfd4696-69a9-4af7-af36-ff3d12b6b6c8 PKeyId=9fe34 5b3-d1b9-9d2d-f76d-069544c771e4 Application Information None 2013-08-19 14:03:02 Software Protection Platform Service 1033: These policies are being excluded since they are only defined with override-only attribute. Policy Names=(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet -Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicen sing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfsclientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA) App Id=55c927 34-d682-4d71-983e-d6ec3f16059f Sku Id=7cfd4696-69a9-4af7-af36-ff3d12b6b6c8 Application Information None 2013-08-19 14:03:02 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0xC 004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(

1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x0 0000000, 0, 1], [(?)( 5 0x00000000 30 43200)( 1 0x00000000 0 0 msft:rm/algorithm /flags/1.0 0x00000000 0)(?)(?)(?)])] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7 : ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)( ?)(?)(?)])(1 )(2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F01 4, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5 , 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f240c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28db c8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information 1 2013-08-19 14:03:04 ESENT 102: Windows (2420) Windows: Th e database engine (6.01.7601.0000) started a new instance (0). Application Information 1 2013-08-19 14:03:16 Windows Search Service 1005: The Windows Search Servic e has successfully created the new search index. Application Information 1 2013-08-19 14:03:16 Windows Search Service 1003: The Windows Search Servic e started. Application Information None 2013-08-19 14:03:18 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 14:03:18 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. Application Information None 2013-08-19 14:03:19 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information None 2013-08-19 14:03:26 Desktop Window Manager 9007: The Desktop Window Manage r was unable to start because WDDM is not in use Application Information None 2013-08-19 14:03:28 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information None 2013-08-19 14:03:28 Desktop Window Manager 9007: The Desktop Window Manage r was unable to start because WDDM is not in use Application Information None 2013-08-19 14:03:30 Desktop Window Manager 9009: The Desktop Window Manage r has exited with code (0x40010004) Application Information None 2013-08-19 14:03:30 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. Application Warning None 2013-08-19 14:03:30 Wlclntfy 6001: The winlogon notification subscriber <GPClient> failed a notification event. Application Warning None 2013-08-19 14:03:30 SYSTEM Microsoft-Windows-User Profiles Service 1530: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL 1 user registry handles leaked from \Registry\User\S-1-5-21-2415673615-2399998967-532945099-1000: Proces s 380 (\Device\HarddiskVolume2\Windows\System32\winlogon.exe) has opened key \RE GISTRY\USER\S-1-5-21-2415673615-2399998967-532945099-1000 Application Information None 2013-08-19 14:03:32 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile

Service has stopped. Application Information None 2013-08-19 14:04:27 EventSystem Application Information None 2013-08-19 14:04:27 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 14:04:37 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 14:04:37 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. Application Information None 2013-08-19 14:04:40 WinMgmt Application Information None 2013-08-19 14:04:43 Desktop Window Manager 9007: The Desktop Window Manage r was unable to start because WDDM is not in use Application Information None 2013-08-19 14:04:52 WinMgmt Application Information 1 2013-08-19 14:04:54 ESENT 102: WinMail (1728) WindowsMail 0: The database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 14:04:56 ESENT 210: WinMail (1728) WindowsMail 0: A full backup is starting. Application Information 3 2013-08-19 14:04:56 ESENT 220: WinMail (1728) WindowsMail 0: Beginning the backup of the file C:\Users\Vic Tiangco\AppData\Local\Microsoft \Windows Mail\WindowsMail.MSMessageStore (size 2 Mb). Application Information 3 2013-08-19 14:04:57 ESENT 221: WinMail (1728) WindowsMail 0: Ending the backup of the file C:\Users\Vic Tiangco\AppData\Local\Microsoft\Wi ndows Mail\WindowsMail.MSMessageStore. Application Information 3 2013-08-19 14:04:57 ESENT 223: WinMail (1728) WindowsMail 0: Starting the backup of log files (range C:\Users\Vic Tiangco\AppData\Local\Mi crosoft\Windows Mail\edb00001.log - C:\Users\Vic Tiangco\AppData\Local\Microsoft \Windows Mail\edb00001.log). Application Information 3 2013-08-19 14:04:57 ESENT 225: WinMail (1728) WindowsMail 0: No log files can be truncated. Application Information 3 2013-08-19 14:04:57 ESENT 213: WinMail (1728) WindowsMail 0: The backup procedure has been successfully completed. Application Information 1 2013-08-19 14:05:02 ESENT 103: WinMail (1728) WindowsMail 0: The database engine stopped the instance (0). Application Information 1 2013-08-19 14:05:10 ESENT 102: Windows (2024) Windows: Th e database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 14:05:10 ESENT 300: Windows (2024) Windows: Th e database engine is initiating recovery steps. Application Information 3 2013-08-19 14:05:10 ESENT 301: Windows (2024) Windows: Th e database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Da ta\Applications\Windows\MSS.log. Application Information 1 2013-08-19 14:05:11 Windows Search Service 1003: The Windows Search Servic e started.

Application Information 3 2013-08-19 14:05:11 ESENT 302: Windows (2024) Windows: Th e database engine has successfully completed recovery steps. Application Error None 2013-08-19 14:05:53 WinMgmt Application Information None 2013-08-19 14:06:49 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 14:06:52 SecurityCenter 1: The Windows Security Center Service has started. Application Information None 2013-08-19 14:06:52 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 14:06:54 Software Protection Platform Service 1033: These policies are being excluded since they are only defined with override-only attribute. Policy Names=(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet -Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicen sing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfsclientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA) App Id=55c927 34-d682-4d71-983e-d6ec3f16059f Sku Id=7cfd4696-69a9-4af7-af36-ff3d12b6b6c8 Application Information None 2013-08-19 14:06:54 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 14:06:54 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information None 2013-08-19 14:07:01 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: BDATunePIA Application Information None 2013-08-19 14:07:01 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehCIR Application Information None 2013-08-19 14:07:01

.NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiProxy Application Information None 2013-08-19 14:07:15 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehExtHost Application Information None 2013-08-19 14:07:16 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter Application Information None 2013-08-19 14:07:16 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. UI Application Information None 2013-08-19 14:07:16 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiUserXp Application Information None 2013-08-19 14:07:17 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehRecObj Application Information None 2013-08-19 14:07:17 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: mcepg Application Information None 2013-08-19 14:07:17 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: mcstore Application Information None 2013-08-19 14:07:17 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: mcstoredb Application Information None 2013-08-19 14:07:18 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiVidCtl Application Information None 2013-08-19 14:07:18 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiExtens Application Information None 2013-08-19 14:07:18 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiActivScp Application Information None 2013-08-19 14:07:18 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiBmlDataCarousel Application Information None 2013-08-19 14:07:18 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiiTv Application Information None 2013-08-19 14:07:21 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiTVMSMusic Application Information None 2013-08-19 14:07:21 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. iTv.Hosting Application Information None 2013-08-19 14:07:21 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiUPnP Application Information None 2013-08-19 14:07:21 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiwmp Application Information None 2013-08-19 14:07:21 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehiWUapi Application Information None 2013-08-19 14:07:23

.NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. Shell Application Information None 2013-08-19 14:07:23 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. Interop Application Information None 2013-08-19 14:07:23 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. ITVVM Application Information None 2013-08-19 14:07:24 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. Playback Application Information None 2013-08-19 14:07:24 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. TV.Tuners.Interop Application Information None 2013-08-19 14:07:24 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. Sports Application Information None 2013-08-19 14:07:25 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: ehshell Application Information None 2013-08-19 14:07:25 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Mcx2Dvcs Application Information None 2013-08-19 14:07:25 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. iTv Application Information None 2013-08-19 14:07:26 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. iTv.Media Application Information None 2013-08-19 14:07:26 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: LoadMxf Application Information None 2013-08-19 14:07:28 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: MCESidebarCtrl Application Information None 2013-08-19 14:07:29 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: mcGlidHostObj Application Information None 2013-08-19 14:07:29 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: mcplayerinterop Application Information None 2013-08-19 14:07:30 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: mcupdate Application Information None 2013-08-19 14:07:31 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.ApplicationI d.Framework Application Information None 2013-08-19 14:07:32 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.ApplicationI d.RuleWizard

Application Information None 2013-08-19 14:07:32 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.Security.App licationId.PolicyManagement.PolicyModel Application Information None 2013-08-19 14:07:32 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.Security.App licationId.PolicyManagement.XmlHelper Application Information None 2013-08-19 14:07:32 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.Security.App licationId.PolicyManagement.PolicyManager Application Information None 2013-08-19 14:07:32 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.Security.App licationId.PolicyManagement.PolicyEngineApi.Interop Application Information None 2013-08-19 14:07:32 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.GroupPolicy. AdmTmplEditor Application Information None 2013-08-19 14:07:33 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.GroupPolicy. Interop Application Information None 2013-08-19 14:07:35 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.GroupPolicy. Reporting Application Information None 2013-08-19 14:07:35 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: SecurityAuditPoliciesS napIn Application Information None 2013-08-19 14:07:36 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. Bml Application Information None 2013-08-19 14:07:38 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.MediaCenter. Mheg Application Information None 2013-08-19 14:07:40 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.Security.App licationId.Wizards.AutomaticRuleGenerationWizard Application Information None 2013-08-19 14:07:44 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: SrpUxSnapIn Application Information None 2013-08-19 14:07:57 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information None 2013-08-19 14:10:20 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 14:10:21 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 14:12:45 Software Protection Platform Service 903: The Software Protect

ion service has stopped. Application Information None 2013-08-19 14:14:03 Desktop Window Manager 9009: The Desktop Window Manage r has exited with code (0x40010004) Application Information None 2013-08-19 14:14:03 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. Application Information None 2013-08-19 14:14:04 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 14:14:46 EventSystem Application Information None 2013-08-19 14:14:46 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 14:14:51 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 14:14:51 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. Application Information None 2013-08-19 14:14:51 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information None 2013-08-19 14:14:52 WinMgmt Application Information None 2013-08-19 14:14:57 WinMgmt Application Information 1 2013-08-19 14:15:05 ESENT 102: Windows (100) Windows: The database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 14:15:05 ESENT 300: Windows (100) Windows: The database engine is initiating recovery steps. Application Information 3 2013-08-19 14:15:05 ESENT 301: Windows (100) Windows: The database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Dat a\Applications\Windows\MSS00001.log. Application Information 1 2013-08-19 14:15:06 Windows Search Service 1003: The Windows Search Servic e started. Application Information 3 2013-08-19 14:15:06 ESENT 301: Windows (100) Windows: The database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Dat a\Applications\Windows\MSS00002.log. Application Information 3 2013-08-19 14:15:06 ESENT 301: Windows (100) Windows: The database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Dat a\Applications\Windows\MSS.log. Application Information 3 2013-08-19 14:15:06 ESENT 302: Windows (100) Windows: The database engine has successfully completed recovery steps. Application Error None 2013-08-19 14:16:29 WinMgmt Application Information None 2013-08-19 14:16:29 Microsoft-Windows-CAPI2 4097: Successful auto update of third-party root certificate:: Subject: <CN=UTN-USERFirst-Object, OU=http://www .usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US> Sha1 thum bprint: <E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46>. Application Information None 2013-08-19 14:18:17

EventSystem Application Information None 2013-08-19 14:18:17 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 14:18:21 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 14:18:21 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. Application Information None 2013-08-19 14:18:21 WinMgmt Application Information None 2013-08-19 14:18:23 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information None 2013-08-19 14:18:23 WinMgmt Application Information 1 2013-08-19 14:18:33 ESENT 102: Windows (2024) Windows: Th e database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 14:18:33 ESENT 300: Windows (2024) Windows: Th e database engine is initiating recovery steps. Application Information 3 2013-08-19 14:18:33 ESENT 301: Windows (2024) Windows: Th e database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Da ta\Applications\Windows\MSS.log. Application Information 3 2013-08-19 14:18:33 ESENT 302: Windows (2024) Windows: Th e database engine has successfully completed recovery steps. Application Information 1 2013-08-19 14:18:34 Windows Search Service 1003: The Windows Search Servic e started. Application Information None 2013-08-19 14:18:35 WinMgmt Application Warning 3 2013-08-19 14:18:37 Windows Search Service 3036: The content source <csc:/ /{S-1-5-21-2415673615-2399998967-532945099-1000}/> cannot be accessed. Context: Application, SystemIndex Catalog Details: The URL was already processed duri ng this update. If you received this message while processing alerts, then the a lerts are redundant, or else Modify should be used instead of Add. (HRESULT : 0 x80040d0d) (0x80040d0d) Application Information None 2013-08-19 14:19:45 Microsoft-Windows-CAPI2 4097: Successful auto update of third-party root certificate:: Subject: <CN=UTN-USERFirst-Object, OU=http://www .usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US> Sha1 thum bprint: <E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46>. Application Error None 2013-08-19 14:20:01 WinMgmt Application Information None 2013-08-19 14:20:26 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 14:20:27 SecurityCenter 1: The Windows Security Center Service has started. Application Information None 2013-08-19 14:20:28 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll,

msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 14:20:28 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 14:20:28 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information None 2013-08-19 14:22:28 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PnPRequestAdditionalSoftware Response: Not available Cab Id: 0 Pr oblem signature: P1: x86 P2: HID\HPQ0006&Col01 P3: 6.1.1.0 P4: 0409 P5: inp ut.inf P6: * P7: P8: P9: P10: Attached files: These files may be available here: C:\Users\Vic Tiangco\AppData\Local\Microsoft\Windows\WER\Report Queue\NonCritical_x86_c4d9ca529790a52d1ea67dc1742ddcdbba7c98b2_cab_0a101430 A nalysis symbol: Rechecking for solution: 0 Report Id: b7cb3d9b-0897-11e3-8e24 -0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 14:23:39 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 14:23:40 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 14:24:32 Desktop Window Manager 9009: The Desktop Window Manage r has exited with code (0x40010004) Application Information None 2013-08-19 14:24:32 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. Application Information None 2013-08-19 14:24:34 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 14:25:18 EventSystem Application Information None 2013-08-19 14:25:18 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully.

Application Information Winlogon .

None

2013-08-19 14:25:23 4101: Windows license validated

Application Information None 2013-08-19 14:25:23 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. Application Information None 2013-08-19 14:25:24 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information None 2013-08-19 14:25:24 WinMgmt Application Information None 2013-08-19 14:25:29 WinMgmt Application Information 1 2013-08-19 14:25:32 ESENT 102: Windows (272) Windows: The database engine (6.01.7601.0000) started a new instance (0). Application Information 1 2013-08-19 14:25:33 Windows Search Service 1003: The Windows Search Servic e started. Application Information 3 2013-08-19 14:25:33 ESENT 300: Windows (272) Windows: The database engine is initiating recovery steps. Application Information 3 2013-08-19 14:25:33 ESENT 301: Windows (272) Windows: The database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Dat a\Applications\Windows\MSS.log. Application Information 3 2013-08-19 14:25:33 ESENT 302: Windows (272) Windows: The database engine has successfully completed recovery steps. Application Information None 2013-08-19 14:26:21 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PCA2 Response: Not available Cab Id: 0 Problem signature: P1: mo bile-intel-915gm-express-chipset-driver-windows-7-sp34749.exe P2: 4.0.100.1189 P3: unknown P4: 915GM Video Driver for Vista P5: HP P6: 200 P7: -1 P8: P 9: P10: Attached files: C:\Users\Vic Tiangco\AppData\Local\Temp\{867df382 -66b2-4796-88c6-810d61a33bb3}\appcompat.txt C:\Users\Vic Tiangco\AppData\Local\ Temp\Tab48EB.tmp These files may be available here: Analysis symbol: R echecking for solution: 0 Report Id: 431676e6-0898-11e3-89d7-0016d4bcce11 Repo rt Status: 0 Application Information None 2013-08-19 14:26:21 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PCA2 Response: Not available Cab Id: 0 Problem signature: P1: mo bile-intel-915gm-express-chipset-driver-windows-7-sp34749.exe P2: 4.0.100.1189 P3: unknown P4: 915GM Video Driver for Vista P5: HP P6: 200 P7: -1 P8: P 9: P10: Attached files: C:\Users\Vic Tiangco\AppData\Local\Temp\{867df382 -66b2-4796-88c6-810d61a33bb3}\appcompat.txt C:\Users\Vic Tiangco\AppData\Local\ Temp\Tab48EB.tmp These files may be available here: C:\Users\Vic Tiangco\App Data\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_mobile-intel-915_56896f 3a343323e7b74eb4969c8b7d4eeda8a_cab_07f149f4 Analysis symbol: Rechecking fo r solution: 0 Report Id: 431676e6-0898-11e3-89d7-0016d4bcce11 Report Status: 6 Application Error None 2013-08-19 14:26:58 WinMgmt Application Information None 2013-08-19 14:27:27 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 14:27:28 SecurityCenter 1: The Windows Security Center Service has started. Application Information None 2013-08-19 14:27:30

Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 14:27:30 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 14:27:30 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information None 2013-08-19 14:28:18 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PCA2 Response: Not available Cab Id: 0 Problem signature: P1: sp 33906.exe P2: 4.0.100.1189 P3: unknown P4: Conexant CX20468-31 AC97 Audio Dri ver P5: Hewlett-Packard P6: 200 P7: -1 P8: P9: P10: Attached files: C:\Users\Vic Tiangco\AppData\Local\Temp\{7f197887-68eb-4530-aeaf-75a79c129112}\ appcompat.txt C:\Users\Vic Tiangco\AppData\Local\Temp\Tab1109.tmp These file s may be available here: Analysis symbol: Rechecking for solution: 0 Rep ort Id: 88ad19c6-0898-11e3-89d7-0016d4bcce11 Report Status: 0 Application Information None 2013-08-19 14:28:18 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PCA2 Response: Not available Cab Id: 0 Problem signature: P1: sp 33906.exe P2: 4.0.100.1189 P3: unknown P4: Conexant CX20468-31 AC97 Audio Dri ver P5: Hewlett-Packard P6: 200 P7: -1 P8: P9: P10: Attached files: C:\Users\Vic Tiangco\AppData\Local\Temp\{7f197887-68eb-4530-aeaf-75a79c129112}\ appcompat.txt C:\Users\Vic Tiangco\AppData\Local\Temp\Tab1109.tmp These file s may be available here: C:\Users\Vic Tiangco\AppData\Local\Microsoft\Windows\W ER\ReportQueue\NonCritical_sp33906.exe_697397fe5e3327b75a42aa3427f3ec0159969d_ca b_07bf1222 Analysis symbol: Rechecking for solution: 0 Report Id: 88ad19c6 -0898-11e3-89d7-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 14:29:35 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 14:29:36 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the

data section contains the new index values assigned to this service. Application Information None 2013-08-19 14:29:46 Desktop Window Manager 9009: The Desktop Window Manage r has exited with code (0x40010004) Application Information None 2013-08-19 14:29:46 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. Application Information None 2013-08-19 14:29:48 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 14:30:41 EventSystem Application Information None 2013-08-19 14:30:41 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 14:30:42 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 14:30:42 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. Application Information None 2013-08-19 14:30:42 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information None 2013-08-19 14:30:45 WinMgmt Application Information None 2013-08-19 14:30:49 WinMgmt Application Information 1 2013-08-19 14:30:51 ESENT 102: Windows (1084) Windows: Th e database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 14:30:51 ESENT 300: Windows (1084) Windows: Th e database engine is initiating recovery steps. Application Information 3 2013-08-19 14:30:51 ESENT 301: Windows (1084) Windows: Th e database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Da ta\Applications\Windows\MSS.log. Application Information 1 2013-08-19 14:30:52 Windows Search Service 1003: The Windows Search Servic e started. Application Information 3 2013-08-19 14:30:52 ESENT 302: Windows (1084) Windows: Th e database engine has successfully completed recovery steps. Application Information None 2013-08-19 14:32:05 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 14:32:05 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Error None 2013-08-19 14:32:10 WinMgmt Application Information None 2013-08-19 14:32:47 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 14:32:48 SecurityCenter 1: The Windows Security Center Service has started.

Application Information None 2013-08-19 14:32:50 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 14:32:50 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 14:32:50 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Error None 2013-08-19 14:34:17 VSS 8194: Volume Shadow Copy Servic e error: Unexpected error querying for the IVssWriterCallback interface. hr = 0 x80070005, Access is denied. . This is often caused by incorrect security sett ings in either the writer or requestor process. Operation: Gathering Write r Data Context: Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220} W riter Name: System Writer Writer Instance ID: {8ae223f3-fb78-478a-87a8-539733 7c0b0b} Application Information None 2013-08-19 14:34:34 System Restore 8194: Successfully created rest ore point (Process = C:\Users\Vic Tiangco\AppData\Local\Temp\7ZipSfx.000\DXSETUP .exe Tiangco\AppData\Local\Temp\7ZipSfx.000\DXSETUP.exe" /SILENT; Description = Installed DirectX). Application Information None 2013-08-19 14:35:09 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 14:35:09 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 14:36:01 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PCA2 Response: Not available Cab Id: 0 Problem signature: P1: ir setup.exe P2: 0.0.0.0 P3: irsetup.exe P4: unknown P5: unknown P6: 1 P7: 20 0 P8: P9: P10: Attached files: These files may be available here: C

:\Users\Vic Tiangco\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_ irsetup.exe_6c1da901735d7bbb7ec4a5edcff4aafaa60a1b1_cab_062d5d98 Analysis sym bol: Rechecking for solution: 0 Report Id: 9d013bf4-0899-11e3-be51-0016d4bcce 11 Report Status: 6 Application Information None 2013-08-19 14:37:44 VSS 8224: The VSS service is shutti ng down due to idle timeout. Application Information None 2013-08-19 14:37:50 Software Protection Platform Service 903: The Software Protect ion service has stopped. Application Information None 2013-08-19 14:45:55 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: MpTelemetry Response: Not available Cab Id: 0 Problem signature: P1: 8024001f P2: EndSearch P3: Search P4: 6.1.7601.17514 P5: MpSigDwn.dll P6: 6.1.7600.16385 P7: Windows Defender P8: P9: P10: Attached files: C:\Windows\Temp\MPTelemetrySubmit\client_manifest.txt These files may be avai lable here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_802400 1f_73aea48bd74c52b523f34668a59a345e9e5b5_cab_0f466ca0 Analysis symbol: Rech ecking for solution: 0 Report Id: fede75a1-089a-11e3-be51-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 14:46:00 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: WindowsUpdateFailure Response: Not available Cab Id: 0 Problem si gnature: P1: 7.5.7601.17514 P2: 8024001f P3: 00000000-0000-0000-0000-00000000 0000 P4: Scan P5: 101 P6: Unmanaged P7: P8: P9: P10: Attached file s: These files may be available here: Analysis symbol: Rechecking for solution: 0 Report Id: 01c65351-089b-11e3-be51-0016d4bcce11 Report Status: 0 Application Information None 2013-08-19 14:46:00 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: WindowsUpdateFailure Response: Not available Cab Id: 0 Problem si gnature: P1: 7.5.7601.17514 P2: 8024001f P3: 00000000-0000-0000-0000-00000000 0000 P4: Scan P5: 101 P6: Unmanaged P7: P8: P9: P10: Attached file s: These files may be available here: C:\ProgramData\Microsoft\Windows\WER\R eportQueue\NonCritical_7.5.7601.17514_78efc842cf92e79bab1c4f2fb5bd805f263a65_cab _049281be Analysis symbol: Rechecking for solution: 0 Report Id: 01c65351089b-11e3-be51-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 14:46:36 IJPLMSVC 1: The service is started. Application Information None 2013-08-19 14:49:23 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PCA2 Response: Not available Cab Id: 0 Problem signature: P1: CE P2REG.EXE P2: 2.0.0.0 P3: Cool Edit Pro 2.0 Registration P4: H??GD P5: Syntr illium Software Corporation P6: 1 P7: 200 P8: P9: P10: Attached files : C:\Users\Vic Tiangco\AppData\Local\Temp\{0a4692a2-5770-4d22-990c-ee22bc0c7e75 }\appcompat.txt These files may be available here: C:\Users\Vic Tiangco\AppD ata\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_CEP2REG.EXE_af3716dd3444 5e2cf5e85ee4072808c84264f37_cab_063998b3 Analysis symbol: Rechecking for so lution: 0 Report Id: 7abef634-089b-11e3-be51-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 14:50:56 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: MpTelemetry Response: Not available Cab Id: 0 Problem signature: P1: 8024001f P2: EndSearch P3: Search P4: 6.1.7601.17514 P5: MpSigDwn.dll P6: 6.1.7600.16385 P7: Windows Defender P8: P9: P10: Attached files: These files may be available here: C:\ProgramData\Microsoft\Windows\WER\Repor tQueue\NonCritical_8024001f_73aea48bd74c52b523f34668a59a345e9e5b5_0f7b04a7 An alysis symbol: Rechecking for solution: 0 Report Id: b2556bf2-089b-11e3-be510016d4bcce11 Report Status: 6 Application Information None 2013-08-19 14:51:01 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: WindowsUpdateFailure Response: Not available Cab Id: 0 Problem si

gnature: P1: 7.5.7601.17514 P2: 8024001f P3: 00000000-0000-0000-0000-00000000 0000 P4: Scan P5: 101 P6: Unmanaged P7: P8: P9: P10: Attached file s: These files may be available here: Analysis symbol: Rechecking for solution: 0 Report Id: b5505c72-089b-11e3-be51-0016d4bcce11 Report Status: 0 Application Information None 2013-08-19 14:51:01 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: WindowsUpdateFailure Response: Not available Cab Id: 0 Problem si gnature: P1: 7.5.7601.17514 P2: 8024001f P3: 00000000-0000-0000-0000-00000000 0000 P4: Scan P5: 101 P6: Unmanaged P7: P8: P9: P10: Attached file s: These files may be available here: C:\ProgramData\Microsoft\Windows\WER\R eportQueue\NonCritical_7.5.7601.17514_78efc842cf92e79bab1c4f2fb5bd805f263a65_098 f189c Analysis symbol: Rechecking for solution: 0 Report Id: b5505c72-089b -11e3-be51-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 14:55:06 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T06:55:06.690429600Z. Application Information None 2013-08-19 14:55:06 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T06:55:06.690429600Z. Application Information None 2013-08-19 14:55:10 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T06:55:10.061523400Z. Application Information None 2013-08-19 14:55:10 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T06:55:10.061523400Z. Application Information None 2013-08-19 14:55:10 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T06:55:10.975585900Z. Application Information None 2013-08-19 14:55:11 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T06:55:10.975585900Z. Application Information None 2013-08-19 14:55:11 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T06:55:11.621093700Z. Application Information None 2013-08-19 14:55:11 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T06:55:11.621093700Z. Application Information None 2013-08-19 14:55:12 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T06:55:12.056640600Z. Application Information None 2013-08-19 14:55:12 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T06:55:12.056640600Z. Application Information None 2013-08-19 14:55:21 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T06:55:21.816406200Z. Application Information None 2013-08-19 14:55:21 Vic Tiangco Microsoft-Windows-RestartManager 10005: Machine restart is req uired. Application Information None 2013-08-19 14:55:21 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T06:55:21.816406200Z. Application Information None 2013-08-19 14:55:29 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T06:55:29.566406200Z. Application Information None 2013-08-19 14:55:29 Vic Tiangco Microsoft-Windows-RestartManager 10005: Machine restart is req uired. Application Information None 2013-08-19 14:55:29 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start

ed 2013-08-19T06:55:29.566406200Z. Application Information None 2013-08-19 14:55:30 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T06:55:30.566406200Z. Application Information None 2013-08-19 14:55:30 Vic Tiangco Microsoft-Windows-RestartManager 10005: Machine restart is req uired. Application Information None 2013-08-19 14:55:30 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T06:55:30.566406200Z. Application Information None 2013-08-19 14:55:31 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T06:55:31.550781200Z. Application Information None 2013-08-19 14:55:31 Vic Tiangco Microsoft-Windows-RestartManager 10005: Machine restart is req uired. Application Information None 2013-08-19 14:55:31 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T06:55:31.550781200Z. Application Information None 2013-08-19 14:55:32 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T06:55:32.394531200Z. Application Information None 2013-08-19 14:55:32 Vic Tiangco Microsoft-Windows-RestartManager 10005: Machine restart is req uired. Application Information None 2013-08-19 14:55:32 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T06:55:32.394531200Z. Application Information None 2013-08-19 14:57:31 System Restore 8194: Successfully created rest ore point (Process = C:\Windows\system32\DrvInst.exe "4" "20" "C:\Users\VICTIA~1 \AppData\Local\Temp\{4cfaa8e4-db40-4bcd-13b3-2657c435086e}\dtsoftbus01.inf" "0" "68f824c73" "00000524" "WinSta0\Default" "000002DC" "208" "C:\Program Files\DAEM ON Tools Pro"; Description = Device Driver Package Install: DT Soft Ltd System d evices). Application Information None 2013-08-19 14:57:50 Microsoft-Windows-CAPI2 4097: Successful auto update of third-party root certificate:: Subject: <CN=GlobalSign Root CA, OU=Root CA, O=G lobalSign nv-sa, C=BE> Sha1 thumbprint: <B1BC968BD4F49D622AA89A81F2150152A41D829 C>. Application Information None 2013-08-19 14:58:59 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 14:58:59 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 15:00:14 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T07:00:14.593750000Z. Application Information None 2013-08-19 15:00:14 Vic Tiangco Microsoft-Windows-RestartManager 10005: Machine restart is req uired. Application Information None 2013-08-19 15:00:14 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T07:00:14.593750000Z. Application Information None 2013-08-19 15:00:40 VSS 8224: The VSS service is shutti ng down due to idle timeout.

Application Information None 2013-08-19 15:03:36 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PCA2 Response: Not available Cab Id: 0 Problem signature: P1: Wi nRAR v3.61 (Registered).exe P2: 0.0.0.0 P3: WinRAR v3.61 (Registered).exe P4: unknown P5: unknown P6: 1 P7: 200 P8: P9: P10: Attached files: C:\ Users\Vic Tiangco\AppData\Local\Temp\{3c12dde0-6038-4acd-96af-22b30873e8a4}\appc ompat.txt These files may be available here: C:\Users\Vic Tiangco\AppData\Lo cal\Microsoft\Windows\WER\ReportQueue\NonCritical_WinRAR v3.61 (Re_c7855f1bb8ce2 c45945ecd29399e0e44a797b16_cab_06369b53 Analysis symbol: Rechecking for sol ution: 0 Report Id: 76fa8377-089d-11e3-be51-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 15:04:06 System Restore 8194: Successfully created rest ore point (Process = C:\Program Files\Dll-Files.com Fixer\DLLFixer.exe Files\Dll -Files.com Fixer\DLLFixer.exe"; Description = DLL-Files.com Fixer Pn, sie 19, 13 15:03). Application Information None 2013-08-19 15:07:10 VSS 8224: The VSS service is shutti ng down due to idle timeout. Application Information None 2013-08-19 15:09:49 Desktop Window Manager 9009: The Desktop Window Manage r has exited with code (0xc00002fe) Application Information None 2013-08-19 15:09:49 IJPLMSVC 2: The service is finished. Application Information None 2013-08-19 15:13:44 Microsoft-Windows-CAPI2 4097: Successful auto update of third-party root certificate:: Subject: <CN=VeriSign Class 3 Public Primary Cer tification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only ", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US> Sha1 thumbprint: <4EB6D5 78499B1CCF5F581EAD56BE3D9B6744A5E5>. Application Information None 2013-08-19 15:13:45 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\Users\Vic Tiangco\AppData\LocalLow\Sun\Java\jre1.7.0_25\jre 1.7.0_25.msi. Client Process Id: 3912. Application Information None 2013-08-19 15:13:57 System Restore 8194: Successfully created rest ore point (Process = C:\Windows\system32\msiexec.exe /V; Description = Installed Java 7 Update 25). Application Information None 2013-08-19 15:14:20 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\Users\Vic Tiangco\AppData\LocalLow\Sun\Java\jre1.7.0_25\jre1.7 .0_25.msi. Client Process Id: 3912. Application Information None 2013-08-19 15:14:20 Vic Tiangco MsiInstaller 11707: Product: Java 7 Update 2 5 -- Installation operation completed successfully. Application Information None 2013-08-19 15:14:20 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Java 7 Update 25. Product Version: 7.0.250. Produc t Language: 1033. Manufacturer: Oracle. Installation success or error status: 0. Application Information None 2013-08-19 15:14:57 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\Users\Vic Tiangco\AppData\LocalLow\Sun\Java\AU\au.msi. Clie nt Process Id: 1972. Application Information None 2013-08-19 15:14:57 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 0 - 2 013-08-19T07:14:57.967773400Z. Application Information None 2013-08-19 15:15:00 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\Users\Vic Tiangco\AppData\LocalLow\Sun\Java\AU\au.msi. Client Process Id: 1972.

Application Information None 2013-08-19 15:15:00 Vic Tiangco MsiInstaller 11707: Product: Java Auto Updat er -- Installation operation completed successfully. Application Information None 2013-08-19 15:15:00 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Java Auto Updater. Product Version: 2.1.9.5. Produ ct Language: 1033. Manufacturer: Sun Microsystems, Inc.. Installation success or error status: 0. Application Information None 2013-08-19 15:15:00 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 0 start ed 2013-08-19T07:14:57.967773400Z. Application Information None 2013-08-19 15:17:14 VSS 8224: The VSS service is shutti ng down due to idle timeout. Application Information None 2013-08-19 15:17:36 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. Application Information None 2013-08-19 15:17:40 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 15:18:55 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 15:25:15 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 15:25:54 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 15:28:48 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 15:29:28 EventSystem Application Information None 2013-08-19 15:29:28 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 15:29:35 WinMgmt Application Information None 2013-08-19 15:29:39 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 15:29:39 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. Application Information None 2013-08-19 15:29:39 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information 1 2013-08-19 15:29:55 ESENT 102: Windows (304) Windows: The database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 15:29:55 ESENT 300: Windows (304) Windows: The database engine is initiating recovery steps. Application Information 3 2013-08-19 15:29:55 ESENT 301: Windows (304) Windows: The database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Dat a\Applications\Windows\MSS00003.log. Application Information 3 2013-08-19 15:30:00 ESENT 301: Windows (304) Windows: The

database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Dat a\Applications\Windows\MSS.log. Application Information None 2013-08-19 15:30:01 WinMgmt Application Information 1 2013-08-19 15:30:01 Windows Search Service 1003: The Windows Search Servic e started. Application Information 3 2013-08-19 15:30:01 ESENT 302: Windows (304) Windows: The database engine has successfully completed recovery steps. Application Error None 2013-08-19 15:31:12 WinMgmt Application Information None 2013-08-19 15:31:25 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T07:31:25.740234300Z. Application Information None 2013-08-19 15:31:33 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\ca718b0b01f596f41bb551\netfx_Full_x86.msi. Client Process I d: 644. Application Information None 2013-08-19 15:31:33 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 0 - 2 013-08-19T07:31:33.839843700Z. Application Information None 2013-08-19 15:32:03 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 15:32:13 SecurityCenter 1: The Windows Security Center Service has started. Application Information None 2013-08-19 15:34:30 Vic Tiangco Microsoft-Windows-LoadPerf 1000: Performance counters for the .NET Memory Cache 4.0 (.NET Memory Cache 4.0) service were loaded successful ly. The Record Data in the data section contains the new index values assigned t o this service. Application Information 1 2013-08-19 15:34:35 ASP.NET 4.0.30319.0 1017: Start registering ASP.NET (version 4.0.30319.0) (internal flag: 0x00000404) Application Information None 2013-08-19 15:34:40 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 15:34:40 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)

(?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 15:34:40 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information None 2013-08-19 15:34:42 Vic Tiangco Microsoft-Windows-LoadPerf 1000: Performance counters for the aspnet_state (ASP.NET State Service) service were loaded successfully. The R ecord Data in the data section contains the new index values assigned to this se rvice. Application Information None 2013-08-19 15:34:47 Vic Tiangco Microsoft-Windows-LoadPerf 1000: Performance counters for the ASP.NET_4.0.30319 (ASP.NET_4.0.30319) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this s ervice. Application Information None 2013-08-19 15:34:50 Vic Tiangco Microsoft-Windows-LoadPerf 1000: Performance counters for the ASP.NET (ASP.NET) service were loaded successfully. The Record Data in the d ata section contains the new index values assigned to this service. Application Information 1 2013-08-19 15:34:51 ASP.NET 4.0.30319.0 1019: Finish registering ASP.NE T (version 4.0.30319.0). Detailed registration logs can be found in C:\Users\VIC TIA~1\AppData\Local\Temp\ASPNETSetup_00000.log Application Warning 1 2013-08-19 15:34:51 ASP.NET 4.0.30319.0 1020: Updates to the IIS metaba se were aborted because IIS is either not installed or is disabled on this machi ne. To configure ASP.NET to run in IIS, please install or enable IIS and re-regi ster ASP.NET using aspnet_regiis.exe /i. Application Information None 2013-08-19 15:34:54 Vic Tiangco Microsoft-Windows-LoadPerf 1000: Performance counters for the {890c10c3-8c2a-4fe3-a36a-9eca153d47cb} (ServiceModel 4.0.0.0) service were l oaded successfully. The Record Data in the data section contains the new index v alues assigned to this service. Application Information None 2013-08-19 15:34:54 Vic Tiangco Microsoft-Windows-LoadPerf 1000: Performance counters for the {f6c5ad57-a5be-4259-9060-b2c4ebfccd96} (WorkflowServiceHost 4.0.0.0) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 15:34:54 Vic Tiangco Microsoft-Windows-LoadPerf 1000: Performance counters for the SMSvcHost 4.0.0.0 (SMSvcHost 4.0.0.0) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this s ervice. Application Information None 2013-08-19 15:34:56 Vic Tiangco Microsoft-Windows-LoadPerf 1000: Performance counters for the MSDTC Bridge 4.0.0.0 (MSDTC Bridge 4.0.0.0) service were loaded successfully . The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 15:34:59 Vic Tiangco Microsoft-Windows-LoadPerf 1000: Performance counters for the Windows Workflow Foundation 4.0.0.0 (Windows Workflow Foundation 4.0.0.0) se rvice were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 15:35:00 Vic Tiangco Microsoft-Windows-LoadPerf 1000: Performance counters for

the .NET CLR Networking 4.0.0.0 (.NET CLR Networking 4.0.0.0) service were loade d successfully. The Record Data in the data section contains the new index value s assigned to this service. Application Information None 2013-08-19 15:35:00 Vic Tiangco Microsoft-Windows-LoadPerf 1002: Performance counters for the .NET Data Provider for Oracle (.NET Data Provider for Oracle) service are al ready in the registry, no need to reinstall. This only happens when you install the same counter twice. The second time install will generate this event. Application Error None 2013-08-19 15:35:51 VSS 8194: Volume Shadow Copy Servic e error: Unexpected error querying for the IVssWriterCallback interface. hr = 0 x80070005, Access is denied. . This is often caused by incorrect security sett ings in either the writer or requestor process. Operation: Gathering Write r Data Context: Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220} W riter Name: System Writer Writer Instance ID: {2ddc0311-bde2-4031-994d-55a562 d4a6c3} Application Information None 2013-08-19 15:36:33 System Restore 8194: Successfully created rest ore point (Process = C:\Program Files\USB Vibration\7906\setup\setup.exe -delete r ; Description = Installed USB Vibration Joystick). Application Information None 2013-08-19 15:37:20 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\ca718b0b01f596f41bb551\netfx_Full_x86.msi. Client Process Id: 644. Application Information None 2013-08-19 15:37:20 Vic Tiangco MsiInstaller 11707: Product: Microsoft .NET Framework 4.5 -- Installation completed successfully. Application Information None 2013-08-19 15:37:20 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft .NET Framework 4.5. Product Version: 4.5 .50709. Product Language: 0. Manufacturer: Microsoft Corporation. Installation s uccess or error status: 0. Application Information None 2013-08-19 15:37:20 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 0 start ed 2013-08-19T07:31:33.839843700Z. Application Information None 2013-08-19 15:37:22 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start ed 2013-08-19T07:31:25.740234300Z. Application Information None 2013-08-19 15:37:24 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 15:37:24 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 15:39:42 Software Protection Platform Service 903: The Software Protect ion service has stopped. Application Information None 2013-08-19 15:39:46 VSS 8224: The VSS service is shutti ng down due to idle timeout. Application Information None 2013-08-19 15:45:07 Desktop Window Manager 9009: The Desktop Window Manage r has exited with code (0x40010004) Application Information None 2013-08-19 15:45:07 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. Application Information None 2013-08-19 15:45:10 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile

Service has stopped. Application Information None 2013-08-19 15:46:23 EventSystem Application Information None 2013-08-19 15:46:23 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 15:46:24 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 15:46:24 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. Application Information None 2013-08-19 15:46:25 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information None 2013-08-19 15:46:31 WinMgmt Application Information None 2013-08-19 15:46:42 WinMgmt Application Information 1 2013-08-19 15:46:43 ESENT 102: Windows (584) Windows: The database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 15:46:44 ESENT 300: Windows (584) Windows: The database engine is initiating recovery steps. Application Information 3 2013-08-19 15:46:45 ESENT 301: Windows (584) Windows: The database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Dat a\Applications\Windows\MSS.log. Application Information 3 2013-08-19 15:46:47 ESENT 302: Windows (584) Windows: The database engine has successfully completed recovery steps. Application Information 1 2013-08-19 15:46:48 Windows Search Service 1003: The Windows Search Servic e started. Application Error None 2013-08-19 15:47:38 WinMgmt Application Information None 2013-08-19 15:48:25 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: c:\77d7a2687dd9950ba044a760473f4f5e\Silverlight.msi. Client Pr ocess Id: 3216. Application Information None 2013-08-19 15:48:26 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 0 - 2 013-08-19T07:48:26.339843700Z. Application Information None 2013-08-19 15:48:29 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: c:\77d7a2687dd9950ba044a760473f4f5e\Silverlight.msi. Client Proce ss Id: 3216. Application Information None 2013-08-19 15:48:29 Vic Tiangco MsiInstaller 11707: Product: Microsoft Silve rlight -- Installation completed successfully. Application Information None 2013-08-19 15:48:29 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Silverlight. Product Version: 1.0.0.0. P roduct Language: 1033. Manufacturer: Microsoft Corporation. Installation success or error status: 0. Application Information None 2013-08-19 15:48:29 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 0 start ed 2013-08-19T07:48:26.339843700Z. Application Information None 2013-08-19 15:48:30 Vic Tiangco

MsiInstaller 1040: Beginning a Windows Insta ller transaction: {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}. Client Process Id: 321 6. Application Information None 2013-08-19 15:48:31 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 0 - 2 013-08-19T07:48:31.011718700Z. Application Information None 2013-08-19 15:48:36 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: {89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}. Client Process Id: 3216. Application Information None 2013-08-19 15:48:36 Vic Tiangco MsiInstaller 1022: Product: Microsoft Silver light - Update 'Microsoft Silverlight 5.1.20125.0' installed successfully. Application Information None 2013-08-19 15:48:36 Vic Tiangco MsiInstaller 1036: Windows Installer install ed an update. Product Name: Microsoft Silverlight. Product Version: 5.1.20125.0. Product Language: 1033. Manufacturer: Microsoft Corporation. Update Name: Micro soft Silverlight 5.1.20125.0. Installation success or error status: 0. Application Information None 2013-08-19 15:48:36 Vic Tiangco MsiInstaller 11728: Product: Microsoft Silve rlight -- Configuration completed successfully. Application Information None 2013-08-19 15:48:36 Vic Tiangco MsiInstaller 1035: Windows Installer reconfi gured the product. Product Name: Microsoft Silverlight. Product Version: 5.1.201 25.0. Product Language: 1033. Manufacturer: Microsoft Corporation. Reconfigurati on success or error status: 0. Application Information None 2013-08-19 15:48:36 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 0 start ed 2013-08-19T07:48:31.011718700Z. Application Information None 2013-08-19 15:48:57 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 15:48:58 SecurityCenter 1: The Windows Security Center Service has started. Application Information None 2013-08-19 15:48:59 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 15:48:59 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x

C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 15:48:59 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information None 2013-08-19 15:49:31 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: D:\Courseware 2013\Skype\SkypeSetup_5.10.0.116.msi. Client Pro cess Id: 268. Application Information None 2013-08-19 15:49:49 System Restore 8194: Successfully created rest ore point (Process = C:\Windows\system32\msiexec.exe /V; Description = Installed Skype 5.10). Application Information None 2013-08-19 15:49:49 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 0 - 2 013-08-19T07:49:49.289062500Z. Application Information None 2013-08-19 15:50:03 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: D:\Courseware 2013\Skype\SkypeSetup_5.10.0.116.msi. Client Proces s Id: 268. Application Information None 2013-08-19 15:50:03 Vic Tiangco MsiInstaller 11707: Product: Skype 5.10 -- In stallation completed successfully. Application Information None 2013-08-19 15:50:03 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Skype 5.10. Product Version: 5.10.116. Product Lang uage: 1033. Manufacturer: Skype Technologies S.A.. Installation success or error status: 0. Application Information None 2013-08-19 15:50:03 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 0 start ed 2013-08-19T07:49:49.289062500Z. Application Information 1 2013-08-19 15:50:11 SkypeUpdate 100: Service started. Application Information None 2013-08-19 15:50:40 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 15:50:40 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information 1 2013-08-19 15:51:11 SkypeUpdate 103: SkypeUpdate service is shu tting down due to idle timeout. Application Information 1 2013-08-19 15:51:12 SkypeUpdate 101: Service stopped. Application Information None 2013-08-19 15:53:00 VSS 8224: The VSS service is shutti ng down due to idle timeout. Application Information None 2013-08-19 15:54:26 Software Protection Platform Service 903: The Software Protect ion service has stopped. Application Information None 2013-08-19 15:56:14 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries.

Application Information None 2013-08-19 15:56:14 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 15:56:46 System Restore 8194: Successfully created rest ore point (Process = C:\Users\VICTIA~1\AppData\Local\Temp\OWP36C7.tmp\setup.exe; Description = Installed Microsoft Office Professional Plus 2010). Application Information None 2013-08-19 15:57:00 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C \OfficeMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:57:28 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Of ficeMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:57:28 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Shared MUI (English) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:57:28 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Shared MUI (English) 2010. Produc t Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corpo ration. Installation success or error status: 0. Application Information None 2013-08-19 15:57:29 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C \OfficeMUISet.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:57:36 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\Of ficeMUISet.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:57:36 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Shared Setup Metadata MUI (English) 2010 -- Installation operation completed s uccessfully. Application Information None 2013-08-19 15:57:36 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Shared Setup Metadata MUI (Englis h) 2010. Product Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corporation. Installation success or error status: 0. Application Information None 2013-08-19 15:57:36 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C \PowerPointMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:57:54 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Po werPointMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:57:54 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e PowerPoint MUI (English) 2010 -- Installation operation completed successfully . Application Information None 2013-08-19 15:57:54 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office PowerPoint MUI (English) 2010. Pr oduct Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft C orporation. Installation success or error status: 0. Application Information None 2013-08-19 15:57:54 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta

ller transaction: C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C \ExcelMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:06 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Ex celMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:06 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Excel MUI (English) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:58:06 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Excel MUI (English) 2010. Product Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corpor ation. Installation success or error status: 0. Application Information None 2013-08-19 15:58:06 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C \GrooveMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:16 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\Gr ooveMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:16 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Groove MUI (English) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:58:16 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Groove MUI (English) 2010. Produc t Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corpo ration. Installation success or error status: 0. Application Information None 2013-08-19 15:58:17 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C \OutlookMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:30 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Ou tlookMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:30 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Outlook MUI (English) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:58:30 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Outlook MUI (English) 2010. Produ ct Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corp oration. Installation success or error status: 0. Application Information None 2013-08-19 15:58:30 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C \Proof.es\Proof.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:34 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Pr oof.es\Proof.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:34 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Proof (Spanish) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:58:34 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Proof (Spanish) 2010. Product Ver

sion: 14.0.4734.1000. Product Language: 3082. Manufacturer: Microsoft Corporatio n. Installation success or error status: 0. Application Information None 2013-08-19 15:58:35 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C \Proof.fr\Proof.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:38 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Proof (French) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:58:38 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Proof (French) 2010. Product Vers ion: 14.0.4734.1000. Product Language: 1036. Manufacturer: Microsoft Corporation . Installation success or error status: 0. Application Information None 2013-08-19 15:58:39 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Pr oof.fr\Proof.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:39 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C \Proof.en\Proof.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:43 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Pr oof.en\Proof.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:43 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Proof (English) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:58:43 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Proof (English) 2010. Product Ver sion: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corporatio n. Installation success or error status: 0. Application Information None 2013-08-19 15:58:43 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C \Proofing.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:47 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Pr oofing.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:58:47 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Proofing (English) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:58:47 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Proofing (English) 2010. Product Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corpora tion. Installation success or error status: 0. Application Information None 2013-08-19 15:58:47 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C \OneNoteMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:00 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\On eNoteMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:00 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic

e OneNote MUI (English) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:59:00 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office OneNote MUI (English) 2010. Produ ct Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corp oration. Installation success or error status: 0. Application Information None 2013-08-19 15:59:00 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C \InfoPathMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:15 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e InfoPath MUI (English) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:59:15 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office InfoPath MUI (English) 2010. Prod uct Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Cor poration. Installation success or error status: 0. Application Information None 2013-08-19 15:59:16 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\In foPathMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:16 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C \Access.en-us\AccessMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:32 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Access MUI (English) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:59:32 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Access MUI (English) 2010. Produc t Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corpo ration. Installation success or error status: 0. Application Information None 2013-08-19 15:59:33 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Ac cess.en-us\AccessMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:33 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C \AccessMUISet.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:36 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Ac cessMUISet.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:36 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Access Setup Metadata MUI (English) 2010 -- Installation operation completed s uccessfully. Application Information None 2013-08-19 15:59:36 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Access Setup Metadata MUI (Englis h) 2010. Product Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corporation. Installation success or error status: 0. Application Information None 2013-08-19 15:59:36 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C \PublisherMUI.msi. Client Process Id: 2208.

Application Information None 2013-08-19 15:59:42 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\Pu blisherMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:42 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Publisher MUI (English) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:59:42 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Publisher MUI (English) 2010. Pro duct Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Co rporation. Installation success or error status: 0. Application Information None 2013-08-19 15:59:42 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C \WordMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:51 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Wo rdMUI.msi. Client Process Id: 2208. Application Information None 2013-08-19 15:59:51 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Word MUI (English) 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 15:59:51 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Word MUI (English) 2010. Product Version: 14.0.4734.1000. Product Language: 1033. Manufacturer: Microsoft Corpora tion. Installation success or error status: 0. Application Information None 2013-08-19 15:59:51 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C \ProPlusWW.msi. Client Process Id: 2208. Application Information None 2013-08-19 16:00:07 VSS 8224: The VSS service is shutti ng down due to idle timeout. Application Information None 2013-08-19 16:01:39 Office Software Protection Platform Service 900: The Software Protection service is starting. Application Information None 2013-08-19 16:01:40 Office Software Protection Platform Service 902: The Software Protection service has started. 14.0.370.400 Application Information None 2013-08-19 16:01:44 Office Software Protection Platform Service 8206: Token Store not found. Recreating empty Token Store. Application Information None 2013-08-19 16:01:44 Office Software Protection Platform Service 1066: Initializati on status for service objects. C:\Program Files\Common Files\Microsoft Shared\O fficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x000 00000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareP rotectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000 000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatf orm\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DL L, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 16:01:44 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Gener ic Rights Account Certificate (Private) License Id=5f7130f8-17f4-4735-8fd9-9827 2e7fd5e5

Application Information None 2013-08-19 16:01:44 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Gener ic Rights Account Certificate (Public) License Id=09713a06-3d2a-47c9-b20a-2bfe9 4dd18f2 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Gener ic Security Processor Certificate (Private) License Id=cb9c4ceb-1b86-4457-8918cb2fb95ad5af Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Gener ic Security Processor Certificate (Public) License Id=c6134e36-57f5-4705-87d9-2 f3f08efc83d Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-PKC Issuance License License Id=9e54f6ea-be00-4909-84d0-3cbce8e57e5d Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-PLUGIN-MANIFEST Issuance License License Id=27f341f4-c27b-4fde-a556-3a5ee00eb d8c Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-PPD Issuance License License Id=9508580c-068f-4ddf-b7b8-df89ac541bbc Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-RAC Issuance License License Id=95c2c6b8-ea2f-431d-8902-eeafc6376965 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-ROOT Issuance License License Id=80e74f83-3c1f-448d-bacd-5bb3d73fdcc4 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-SPC Issuance License License Id=57d6dc1b-f556-4f5b-935b-3b379fd9dda8 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-STIL Issuance License License Id=285583cd-fc43-4806-ace6-d247b7edd434 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-UL Issuance License License Id=4961cc30-d690-43be-910c-8e2db01fc5ad Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-UL-OEM Issuance License License Id=9fb32152-3abd-4c4c-a5e1-467a1c50eb30 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-UL-OOB Issuance License License Id=7e3094cf-ce3e-4ed4-8c8c-20c2be1add03 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-UL-PHN Issuance License License Id=812f33a7-edaf-404b-a05a-f4397954033c

Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=CLIEN T-WGALIC Issuance License License Id=770c4fab-e917-4899-a2cc-a76b894d5d3d Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=XrML 2.1 License - Product Key Configuration License Id=8d0bdca0-33c9-43bd-8729-9871 bba08c71 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-Volume License (Public) License Id=e2e326c2-ca6a-4577-a305-9d1e03fc5773 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-Volume License (Private) License Id=82bb1ddf-033e-4de5-a65f-88465f74aec f Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-OOB License (Public) License Id=7bcc5eee-f730-4c93-97c4-877e27333324 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-OOB License (Private) License Id=2453acfb-0e3f-49b2-9a78-209b1ff3908c Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 - Product PPD License (Security-SPP-Component-SKU-OfficeProPlus-KMS_Client) License Id=cb7fd957-6868-58b3-086e-cd303db4a8c5 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=XrML 2.1 License - {msft:sl/RAC/VOLUME/PRIVATE} License Id=eb981526-3397-447c-9e08-6 7f546a23f65 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=XrML 2.1 License - {msft:sl/RAC/VOLUME/PRIVATE} License Id=eb981526-3397-447c-9e08-6 7f546a23f65 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 Publishing License (Public) License Id=d8f1b81d-bca4-4879-aea8-3845a14c482 4 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 Publishing License (Private) License Id=3ff0b18b-c7e1-470a-96e1-fc6fc346ed 5a Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-PHN License (Public) License Id=64026624-f349-46f0-87db-37442cf6f3da Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-PHN License (Private) License Id=98aa5ac0-0173-4df5-a223-670bb3bdef16

Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-OOB License (Public) License Id=70202bca-2321-4f18-a3ff-29cd3ba38307 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-OOB License (Private) License Id=4d9f9ff4-b7f5-452b-9587-8d2b38dd0c45 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 - Product PPD License (Security-SPP-Component-SKU-OfficeProPlus-MAK) Licen se Id=f27036d3-9c72-40d1-4b15-fb058ead0470 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 Publishing License (Public) License Id=ba56ca2a-1bcc-42a6-942b-a028288538f 0 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 Publishing License (Private) License Id=3e5fd99c-6695-4e20-acd9-aac39450e8 f0 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-PHN License (Public) License Id=eaa7248f-f01e-49f9-b4a7-3b91e93071f4 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-PHN License (Private) License Id=19f33eae-0433-486d-88b7-cdab1d569835 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-OOB License (Public) License Id=4637b7ac-35d2-4b4b-90d0-cc565abde0a6 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 UL-OOB License (Private) License Id=f68958fc-afc0-46fd-b92b-12fa0f2b21c7 Application Information None 2013-08-19 16:01:45 Office Software Protection Platform Service 1004: The Software Protection service has successfully installed the license. License Title=Offic e 14 - Product PPD License (Security-SPP-Component-SKU-OfficeProPlusAcad-MAK) L icense Id=54369957-b369-15be-8690-2342fef6c903 Application Information None 2013-08-19 16:01:51 Office Software Protection Platform Service 1016: Proof of Pur chase installed successfully. ACID=6f327760-8c5c-417c-9b61-836a98287e0c PKeyI d=bf9e64e9-452c-4e05-8f74-16eb7fbf2726 Application Information None 2013-08-19 16:01:52 Office Software Protection Platform Service 1025: Grace period has been started. Grace days=30 Grace type=5. Application Information None 2013-08-19 16:01:52 Office Software Protection Platform Service 1033: These polici es are being excluded since they are only defined with override-only attribute. Policy Names=(Security-SPP-Reserved-EnableNotificationMode) App Id=59a52881-a 989-479d-af46-f275c6370663 Sku Id=6f327760-8c5c-417c-9b61-836a98287e0c Application Information None 2013-08-19 16:01:52 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79

88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f3277 60-8c5c-417c-9b61-836a98287e0c, 1, 0 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algor ithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x000 00000 30 43200)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(? )(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [( ?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:01:56 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: MpTelemetry Response: Not available Cab Id: 0 Problem signature: P1: 8024402c P2: EndSearch P3: Search P4: 6.1.7601.17514 P5: MpSigDwn.dll P6: 6.1.7600.16385 P7: Windows Defender P8: P9: P10: Attached files: C:\Windows\Temp\MPTelemetrySubmit\client_manifest.txt These files may be avai lable here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_802440 2c_eae1492941e9345dd519441a16a35f278cd6238_cab_0d16ed4a Analysis symbol: Re checking for solution: 0 Report Id: 9d5e18a4-08a5-11e3-8d6f-0016d4bcce11 Repor t Status: 6 Application Information None 2013-08-19 16:02:37 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f3277 60-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algor ithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x000 00000 30 43200)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(? )(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [( ?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Error None 2013-08-19 16:02:38 WinMgmt Application Information 1 2013-08-19 16:02:51 ESENT 103: Windows (584) Windows: The database engine stopped the instance (0). Application Information 1 2013-08-19 16:02:51 Windows Search Service 1013: Windows Search Service st opped normally. Application Information 1 2013-08-19 16:02:52 ESENT 102: Windows (3804) Windows: Th e database engine (6.01.7601.0000) started a new instance (0). Application Information 1 2013-08-19 16:02:53 Windows Search Service 1003: The Windows Search Servic e started. Application Information None 2013-08-19 16:02:54 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Pr oPlusWW.msi. Client Process Id: 2208. Application Information None 2013-08-19 16:02:54 Vic Tiangco MsiInstaller 11707: Product: Microsoft Offic e Professional Plus 2010 -- Installation operation completed successfully. Application Information None 2013-08-19 16:02:54 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Office Professional Plus 2010. Product V ersion: 14.0.4734.1000. Product Language: 0. Manufacturer: Microsoft Corporation . Installation success or error status: 0. Application Information None 2013-08-19 16:05:03 .NET Runtime Optimization Service 1130: .NET Runtime Optimizat ion Service (2.0.50727.5420) - Installed from repository: Microsoft.Security.App licationId.PolicyManagement.Cmdlets Application Information None 2013-08-19 16:06:58 Windows Error Reporting 1001: Fault bucket , type 0 Ev

ent Name: MpTelemetry Response: Not available Cab Id: 0 Problem signature: P1: 8024402c P2: EndSearch P3: Search P4: 6.1.7601.17514 P5: MpSigDwn.dll P6: 6.1.7600.16385 P7: Windows Defender P8: P9: P10: Attached files: These files may be available here: C:\ProgramData\Microsoft\Windows\WER\Repor tQueue\NonCritical_8024402c_eae1492941e9345dd519441a16a35f278cd6238_0bdf887d Analysis symbol: Rechecking for solution: 0 Report Id: 515adef0-08a6-11e3-8d6 f-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 16:08:10 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f3277 60-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algor ithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x000 00000 30 43194)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(? )(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [( ?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:08:10 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 6f3277 60-8c5c-417c-9b61-836a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algor ithm/volume/1.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x000 00000 30 43194)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(? )(?)])] 3: fdf3ecb9-b56f-43b2-a9b8-1b48b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [( ?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:10:04 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\Users\VICTIA~1\AppData\Local\Temp\IXP000.TMP\vcredist.msi. Client Process Id: 3716. Application Information None 2013-08-19 16:10:19 System Restore 8194: Successfully created rest ore point (Process = C:\Windows\system32\msiexec.exe /V; Description = Installed Microsoft Visual C++ 2005 Redistributable). Application Information None 2013-08-19 16:10:20 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 0 - 2 013-08-19T08:10:20.263671800Z. Application Information None 2013-08-19 16:10:49 SYSTEM MsiInstaller 1042: Ending a Windows Installe r transaction: C:\Users\VICTIA~1\AppData\Local\Temp\IXP000.TMP\vcredist.msi. Cli ent Process Id: 3716. Application Information None 2013-08-19 16:10:49 Vic Tiangco MsiInstaller 11707: Product: Microsoft Visua l C++ 2005 Redistributable -- Installation completed successfully. Application Information None 2013-08-19 16:10:49 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Microsoft Visual C++ 2005 Redistributable. Product Version: 8.0.59193. Product Language: 0. Manufacturer: Microsoft Corporation. I nstallation success or error status: 0. Application Information None 2013-08-19 16:10:49 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 0 start ed 2013-08-19T08:10:20.263671800Z. Application Information None 2013-08-19 16:11:01 Desktop Window Manager 9009: The Desktop Window Manage r has exited with code (0x40010004) Application Information None 2013-08-19 16:11:01 Wlclntfy 6000: The winlogon notification

subscriber <SessionEnv> was unavailable to handle a notification event. Application Warning None 2013-08-19 16:11:02 SYSTEM Microsoft-Windows-User Profiles Service 1530: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards. DETAIL 2 user registry handles leaked from \Registry\User\S-1-5-21-2415673615-2399998967-532945099-1000: Proces s 3264 (\Device\HarddiskVolume2\Windows\System32\msiexec.exe) has opened key \RE GISTRY\USER\S-1-5-21-2415673615-2399998967-532945099-1000\Software\Microsoft\Win dows\CurrentVersion\Explorer\FileExts Process 3264 (\Device\HarddiskVolume2\Wind ows\System32\msiexec.exe) has opened key \REGISTRY\USER\S-1-5-21-2415673615-2399 998967-532945099-1000\Software\Microsoft\Windows\CurrentVersion\Explorer Application Information None 2013-08-19 16:11:09 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 16:12:25 EventSystem Application Information None 2013-08-19 16:12:25 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 16:12:27 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 16:12:27 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. Application Information None 2013-08-19 16:12:27 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information 1 2013-08-19 16:12:29 SkypeUpdate 100: Service started. Application Information None 2013-08-19 16:12:34 WinMgmt Application Information None 2013-08-19 16:12:52 WinMgmt Application Information 1 2013-08-19 16:12:53 ESENT 102: Windows (528) Windows: The database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 16:12:54 ESENT 300: Windows (528) Windows: The database engine is initiating recovery steps. Application Information 3 2013-08-19 16:12:55 ESENT 301: Windows (528) Windows: The database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Dat a\Applications\Windows\MSS.log. Application Information 3 2013-08-19 16:12:56 ESENT 302: Windows (528) Windows: The database engine has successfully completed recovery steps. Application Information 1 2013-08-19 16:12:57 Windows Search Service 1003: The Windows Search Servic e started. Application Error None 2013-08-19 16:13:41 WinMgmt Application Information None 2013-08-19 16:14:09 Vic Tiangco MsiInstaller 1040: Beginning a Windows Insta ller transaction: C:\Users\Vic Tiangco\AppData\Local\Temp\NeroInstallFiles\NERO2 0101008164809345\Nero.BurningROMSuite.msi. Client Process Id: 304. Application Information None 2013-08-19 16:14:27 System Restore 8194: Successfully created rest ore point (Process = C:\Windows\system32\msiexec.exe /V; Description = Installed

Nero Burning ROM 10.). Application Information None 2013-08-19 16:14:28 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 0 - 2 013-08-19T08:14:28.107421800Z. Application Information 1 2013-08-19 16:14:29 SkypeUpdate 103: SkypeUpdate service is shu tting down due to idle timeout. Application Information 1 2013-08-19 16:14:30 SkypeUpdate 101: Service stopped. Application Information None 2013-08-19 16:14:36 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 0 start ed 2013-08-19T08:14:28.107421800Z. Application Information None 2013-08-19 16:14:41 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 0 - 2 013-08-19T08:14:41.138671800Z. Application Information None 2013-08-19 16:14:44 Vic Tiangco MsiInstaller 11707: Product: Nero Control Ce nter 10 -- Installation operation completed successfully. Application Information None 2013-08-19 16:14:44 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Nero Control Center 10. Product Version: 10.2.1060 0.0.6. Product Language: 1033. Manufacturer: Nero AG. Installation success or er ror status: 0. Application Information None 2013-08-19 16:14:44 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 0 start ed 2013-08-19T08:14:41.138671800Z. Application Information None 2013-08-19 16:14:49 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 0 - 2 013-08-19T08:14:49.060546800Z. Application Information None 2013-08-19 16:14:52 Vic Tiangco MsiInstaller 11707: Product: Nero Core Compo nents 10 -- Installation operation completed successfully. Application Information None 2013-08-19 16:14:52 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Nero Core Components 10. Product Version: 2.0.1740 0.8.2. Product Language: 1033. Manufacturer: Nero AG. Installation success or er ror status: 0. Application Information None 2013-08-19 16:14:52 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 0 start ed 2013-08-19T08:14:49.060546800Z. Application Information None 2013-08-19 16:14:59 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 16:14:59 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 0 - 2 013-08-19T08:14:59.355468700Z. Application Information None 2013-08-19 16:15:13 SecurityCenter 1: The Windows Security Center Service has started. Application Information None 2013-08-19 16:16:06 Office Software Protection Platform Service 900: The Software Protection service is starting. Application Information None 2013-08-19 16:16:14 Vic Tiangco MsiInstaller 11707: Product: Nero Burning RO M 10 -- Installation operation completed successfully. Application Information None 2013-08-19 16:16:14 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Nero Burning ROM 10. Product Version: 10.2.11000.1 2.100. Product Language: 1033. Manufacturer: Nero AG. Installation success or er ror status: 0.

Application Information None 2013-08-19 16:16:14 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 0 start ed 2013-08-19T08:14:59.355468700Z. Application Information None 2013-08-19 16:16:17 Office Software Protection Platform Service 1066: Initializati on status for service objects. C:\Program Files\Common Files\Microsoft Shared\O fficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x000 00000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareP rotectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000 000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatf orm\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DL L, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 16:16:17 Office Software Protection Platform Service 902: The Software Protection service has started. 14.0.370.400 Application Information None 2013-08-19 16:16:17 Vic Tiangco MsiInstaller 1042: Ending a Windows Installe r transaction: C:\Users\Vic Tiangco\AppData\Local\Temp\NeroInstallFiles\NERO2010 1008164809345\Nero.BurningROMSuite.msi. Client Process Id: 3332. Application Information None 2013-08-19 16:16:18 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 16:16:21 Software Protection Platform Service 1033: These policies are being excluded since they are only defined with override-only attribute. Policy Names=(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet -Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicen sing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfsclientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA) App Id=55c927 34-d682-4d71-983e-d6ec3f16059f Sku Id=7cfd4696-69a9-4af7-af36-ff3d12b6b6c8 Application Information None 2013-08-19 16:16:21 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:16:21

Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information None 2013-08-19 16:16:23 Vic Tiangco MsiInstaller 11707: Product: Nero Burning RO M 10 -- Installation operation completed successfully. Application Information None 2013-08-19 16:16:23 Vic Tiangco MsiInstaller 1033: Windows Installer install ed the product. Product Name: Nero Burning ROM 10. Product Version: 10.5.10300. Product Language: 1033. Manufacturer: Nero AG. Installation success or error sta tus: 0. Application Information None 2013-08-19 16:16:45 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:16:46 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/v olume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x000 00000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43186)( 1 0x 00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] Application Information None 2013-08-19 16:16:47 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b4 8b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:16:53 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:16:54 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/v olume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x000 00000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43185)( 1 0x 00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] Application Information None 2013-08-19 16:16:55 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b4 8b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:16:56 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/v olume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x000 00000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43185)( 1 0x 00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] Application Information None 2013-08-19 16:16:56 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:16:57

Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/v olume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x000 00000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43185)( 1 0x 00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] Application Information None 2013-08-19 16:16:58 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b4 8b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:16:58 Office Software Protection Platform Service 903: The Software Protection service has stopped. Application Information None 2013-08-19 16:17:01 Office Software Protection Platform Service 900: The Software Protection service is starting. Application Information None 2013-08-19 16:17:02 Office Software Protection Platform Service 1066: Initializati on status for service objects. C:\Program Files\Common Files\Microsoft Shared\O fficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x000 00000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareP rotectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000 000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatf orm\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DL L, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 16:17:02 Office Software Protection Platform Service 902: The Software Protection service has started. 14.0.370.400 Application Information None 2013-08-19 16:17:02 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:17:03 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/v olume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x000 00000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43185)( 1 0x 00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] Application Information None 2013-08-19 16:17:04 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b4 8b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:17:05 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/v olume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x000 00000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43185)( 1 0x 00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] Application Information None 2013-08-19 16:17:06 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528

81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:17:07 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/v olume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x000 00000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43185)( 1 0x 00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] Application Information None 2013-08-19 16:17:07 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b4 8b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:17:08 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:08 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 4501032, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:17:09 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:09 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 9006136, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:17:10 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:10 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 9007672, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:17:11 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:11 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 9008248, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:17:11 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:11 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 9007032, 0, 0, 0, 0, 1601/01/01 00:00

Application Information None 2013-08-19 16:17:12 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:12 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 9007736, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:17:13 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:13 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 9008184, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:17:13 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:13 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 9007096, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:17:14 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:14 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 9008056, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:17:15 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:15 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 9007224, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:17:15 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:17:16 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F056 30 0 msft:rm/algorithm/v olume/1.0 0x00000000 0)(?)( 1 0xC004F056 30 0 msft:rm/algorithm/volume/1.0 0x000 00000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 1], [(?)( 5 0x00000000 30 43185)( 1 0x 00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)(?)])] Application Information None 2013-08-19 16:17:17 Office Software Protection Platform Service 1003: The Software

Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b4 8b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:17:18 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:17, 0, 2, 43185, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:17:18 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2013/08/19 08:17 Application Information None 2013-08-19 16:17:25 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 16:17:25 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 16:17:34 VSS 8224: The VSS service is shutti ng down due to idle timeout. Application Information None 2013-08-19 16:21:34 Software Protection Platform Service 903: The Software Protect ion service has stopped. Application Information None 2013-08-19 16:28:04 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: MpTelemetry Response: Not available Cab Id: 0 Problem signature: P1: 8024402c P2: EndSearch P3: Search P4: 6.1.7601.17514 P5: MpSigDwn.dll P6: 6.1.7600.16385 P7: Windows Defender P8: P9: P10: Attached files: These files may be available here: C:\ProgramData\Microsoft\Windows\WER\Repor tQueue\NonCritical_8024402c_eae1492941e9345dd519441a16a35f278cd6238_00ff0565 Analysis symbol: Rechecking for solution: 0 Report Id: 441cdd17-08a9-11e3-845 6-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 16:33:08 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: MpTelemetry Response: Not available Cab Id: 0 Problem signature: P1: 8024402c P2: EndSearch P3: Search P4: 6.1.7601.17514 P5: MpSigDwn.dll P6: 6.1.7600.16385 P7: Windows Defender P8: P9: P10: Attached files: These files may be available here: C:\ProgramData\Microsoft\Windows\WER\Repor tQueue\NonCritical_8024402c_eae1492941e9345dd519441a16a35f278cd6238_0bf7a9b1 Analysis symbol: Rechecking for solution: 0 Report Id: f9606bb2-08a9-11e3-845 6-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 16:38:18 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 16:38:18 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 16:40:28 Vic Tiangco Microsoft-Windows-RestartManager 10000: Starting session 1 - 2 013-08-19T08:40:28.555664000Z. Application Information None 2013-08-19 16:40:28 Vic Tiangco Microsoft-Windows-RestartManager 10005: Machine restart is req uired. Application Information None 2013-08-19 16:40:28 Vic Tiangco Microsoft-Windows-RestartManager 10001: Ending session 1 start

ed 2013-08-19T08:40:28.555664000Z. Application Information None 2013-08-19 16:41:06 Desktop Window Manager 9009: The Desktop Window Manage r has exited with code (0x40010004) Application Information None 2013-08-19 16:41:06 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. Application Information None 2013-08-19 16:41:10 Office Software Protection Platform Service 903: The Software Protection service has stopped. Application Information None 2013-08-19 16:41:11 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 16:42:17 EventSystem Application Information None 2013-08-19 16:42:17 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 16:42:19 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 16:42:19 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. Application Information None 2013-08-19 16:42:19 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information 1 2013-08-19 16:42:21 SkypeUpdate 100: Service started. Application Information None 2013-08-19 16:42:24 WinMgmt Application Information None 2013-08-19 16:42:31 WinMgmt Application Information 1 2013-08-19 16:42:37 ESENT 102: Windows (1608) Windows: Th e database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 16:42:37 ESENT 300: Windows (1608) Windows: Th e database engine is initiating recovery steps. Application Information 3 2013-08-19 16:42:37 ESENT 301: Windows (1608) Windows: Th e database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Da ta\Applications\Windows\MSS.log. Application Information None 2013-08-19 16:42:43 Office Software Protection Platform Service 900: The Software Protection service is starting. Application Information None 2013-08-19 16:42:46 Office Software Protection Platform Service 1066: Initializati on status for service objects. C:\Program Files\Common Files\Microsoft Shared\O fficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x000 00000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareP rotectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000 000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatf orm\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DL L, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 16:42:46 Office Software Protection Platform Service 902: The Software Protection service has started. 14.0.370.400 Application Information None 2013-08-19 16:42:47

Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 16:42:48 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 16:42:48 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:42:48 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information 3 2013-08-19 16:42:49 ESENT 302: Windows (1608) Windows: Th e database engine has successfully completed recovery steps. Application Information 1 2013-08-19 16:42:53 Windows Search Service 1003: The Windows Search Servic e started. Application Information None 2013-08-19 16:42:58 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:00 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algor ithm/volume/1.0 0x00000000 259175)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:01 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b4 8b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:02 Office Software Protection Platform Service 12288: The client

has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:43, 0, 1, 259175, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:43:02 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x8007000D, 0x00050C31, 2150408, 0, 0, 0, 0, 1601/01/01 00:00 Application Information None 2013-08-19 16:43:03 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:43, 0, 1, 259175, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:43:03 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2013/08/19 08:43 Application Information None 2013-08-19 16:43:03 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:06 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 436cef53-8387-4692-bb4a-9492cd8226 0e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:08 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:09 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 57a232fe-0931-48fe-9389-e4586967c6 61, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:11 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 7cfd4696-69a9-4af7-af36-ff3d12b6b6 c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bio s/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:11 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682

-4d71-983e-d6ec3f16059f Licensing Status= 1: 8ec16e01-e86f-415f-b333-1819f41452 94, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:13 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: a0cde89c-3304-4157-b61c-c8ad785d1f ad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:15 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: ac96e1a8-6cc4-4310-a4ff-332ce77fb5 b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:15 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:15 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: b2c4b9f6-3ee6-4a2a-a361-64ad3b61de d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:17 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: bba42084-cacd-4ad4-b606-9f3d6c93b2 c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:19 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: c619d61c-c2f2-40c3-ab3f-c5924314b0 f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:43:21 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: cfb3e52c-d707-4861-af51-11b27ee616 9c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Error None 2013-08-19 16:43:39 WinMgmt Application Information 1 2013-08-19 16:44:21 SkypeUpdate 103: SkypeUpdate service is shu tting down due to idle timeout. Application Information 1 2013-08-19 16:44:22 SkypeUpdate 101: Service stopped. Application Information None 2013-08-19 16:44:36

SecurityCenter 1: The Windows Security Center Service has started. Application Information None 2013-08-19 16:46:33 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 16:46:34 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 16:47:37 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PnPRequestAdditionalSoftware Response: Not available Cab Id: 0 Pr oblem signature: P1: x86 P2: USB\VID_1A2C&PID_0023&REV_0110&MI_00 P3: 6.1.1.0 P4: 0409 P5: input.inf P6: * P7: P8: P9: P10: Attached files: These files may be available here: C:\Users\Vic Tiangco\AppData\Local\Microsoft \Windows\WER\ReportQueue\NonCritical_x86_a643a4308dacc59d8c5d86e89f77fc8223298_c ab_0a1975b4 Analysis symbol: Rechecking for solution: 0 Report Id: fe87935 1-08ab-11e3-8671-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 16:47:37 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PnPRequestAdditionalSoftware Response: Not available Cab Id: 0 Pr oblem signature: P1: x86 P2: USB\VID_1A2C&PID_0023&REV_0110&MI_01 P3: 6.1.1.0 P4: 0409 P5: input.inf P6: * P7: P8: P9: P10: Attached files: These files may be available here: C:\Users\Vic Tiangco\AppData\Local\Microsoft \Windows\WER\ReportQueue\NonCritical_x86_3ed633e358777265fed4752c3248d4961376474 7_cab_0a19768f Analysis symbol: Rechecking for solution: 0 Report Id: fe87 9352-08ab-11e3-8671-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 16:47:40 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PnPRequestAdditionalSoftware Response: Not available Cab Id: 0 Pr oblem signature: P1: x86 P2: HID\VID_1A2C&PID_0023&REV_0110&MI_01&Col02 P3: 6 .1.1.0 P4: 0409 P5: input.inf P6: * P7: P8: P9: P10: Attached file s: These files may be available here: C:\Users\Vic Tiangco\AppData\Local\Mic rosoft\Windows\WER\ReportQueue\NonCritical_x86_bd4b8701dcd88f198397ec8ca5e368143 b35bb7_cab_0a19845a Analysis symbol: Rechecking for solution: 0 Report Id: fe879353-08ab-11e3-8671-0016d4bcce11 Report Status: 6 Application Information None 2013-08-19 16:48:23 Software Protection Platform Service 903: The Software Protect ion service has stopped. Application Information None 2013-08-19 16:55:14 Desktop Window Manager 9009: The Desktop Window Manage r has exited with code (0x40010004) Application Information None 2013-08-19 16:55:14 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. Application Information None 2013-08-19 16:55:15 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 16:56:18 EventSystem Application Information None 2013-08-19 16:56:18 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 16:56:20 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 16:56:20 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.

Application Information None 2013-08-19 16:56:21 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information 1 2013-08-19 16:56:22 SkypeUpdate 100: Service started. Application Information None 2013-08-19 16:56:24 WinMgmt Application Information None 2013-08-19 16:56:25 WinMgmt Application Information None 2013-08-19 16:56:35 Office Software Protection Platform Service 900: The Software Protection service is starting. Application Information None 2013-08-19 16:56:40 Office Software Protection Platform Service 1066: Initializati on status for service objects. C:\Program Files\Common Files\Microsoft Shared\O fficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x000 00000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareP rotectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000 000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatf orm\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DL L, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 16:56:40 Office Software Protection Platform Service 902: The Software Protection service has started. 14.0.370.400 Application Information 1 2013-08-19 16:56:40 ESENT 102: Windows (2188) Windows: Th e database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 16:56:40 ESENT 300: Windows (2188) Windows: Th e database engine is initiating recovery steps. Application Information 3 2013-08-19 16:56:40 ESENT 301: Windows (2188) Windows: Th e database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Da ta\Applications\Windows\MSS.log. Application Information 3 2013-08-19 16:56:41 ESENT 302: Windows (2188) Windows: Th e database engine has successfully completed recovery steps. Application Information None 2013-08-19 16:56:42 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information 1 2013-08-19 16:56:42 Windows Search Service 1003: The Windows Search Servic e started. Application Information None 2013-08-19 16:56:44 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 16:56:44 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(

2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:44 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information None 2013-08-19 16:56:51 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:53 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algor ithm/volume/1.0 0x00000000 259187)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:53 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b4 8b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:54 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 08:56, 0, 1, 259187, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 16:56:55 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2013/08/19 08:56 Application Information None 2013-08-19 16:56:55 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:55 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 436cef53-8387-4692-bb4a-9492cd8226 0e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:55 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(

?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:56 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 57a232fe-0931-48fe-9389-e4586967c6 61, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:56 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 7cfd4696-69a9-4af7-af36-ff3d12b6b6 c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bio s/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:56 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 8ec16e01-e86f-415f-b333-1819f41452 94, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:57 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: a0cde89c-3304-4157-b61c-c8ad785d1f ad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:57 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: ac96e1a8-6cc4-4310-a4ff-332ce77fb5 b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:57 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:57

Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: b2c4b9f6-3ee6-4a2a-a361-64ad3b61de d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:58 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: bba42084-cacd-4ad4-b606-9f3d6c93b2 c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:58 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: c619d61c-c2f2-40c3-ab3f-c5924314b0 f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 16:56:58 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: cfb3e52c-d707-4861-af51-11b27ee616 9c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Error None 2013-08-19 16:57:37 WinMgmt Application Information None 2013-08-19 16:58:02 Desktop Window Manager 9009: The Desktop Window Manage r has exited with code (0x40010004) Application Information None 2013-08-19 16:58:02 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. Application Information None 2013-08-19 16:58:04 SYSTEM Microsoft-Windows-User Profiles Service 1532: The User Profile Service has stopped. Application Information None 2013-08-19 17:45:53 EventSystem Application Information None 2013-08-19 17:45:53 SYSTEM Microsoft-Windows-User Profiles Service 1531: The User Profile Service has started successfully. Application Information None 2013-08-19 17:45:57 Winlogon 4101: Windows license validated . Application Information None 2013-08-19 17:45:57 Wlclntfy 6000: The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event. Application Information None 2013-08-19 17:46:06 Desktop Window Manager 9003: The Desktop Window Manage r was unable to start because a composited theme is not in use Application Information 1 2013-08-19 17:46:17 SkypeUpdate 100: Service started. Application Information None 2013-08-19 17:46:39 WinMgmt Application Information None 2013-08-19 17:46:46 WinMgmt Application Information 1 2013-08-19 17:46:50 ESENT 102: Windows (2076) Windows: Th e database engine (6.01.7601.0000) started a new instance (0). Application Information 3 2013-08-19 17:46:50 ESENT 300: Windows (2076) Windows: Th e database engine is initiating recovery steps. Application Information 3 2013-08-19 17:46:50 ESENT 301: Windows (2076) Windows: Th e database engine has begun replaying logfile C:\ProgramData\Microsoft\Search\Da ta\Applications\Windows\MSS.log.

Application Information None 2013-08-19 17:46:51 Office Software Protection Platform Service 900: The Software Protection service is starting. Application Information 3 2013-08-19 17:46:51 ESENT 302: Windows (2076) Windows: Th e database engine has successfully completed recovery steps. Application Information 1 2013-08-19 17:46:54 Windows Search Service 1003: The Windows Search Servic e started. Application Information None 2013-08-19 17:46:56 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: BlueScreen Response: Not available Cab Id: 0 Problem signature: P1: P2: P3: P4: P5: P6: P7: P8: P9: P10: Attached files: C:\Windows\Minidump\081913-24656-01.dmp C:\Users\Vic Tiangco\AppData\Local\Temp \WER-38953-0.sysdata.xml These files may be available here: C:\Users\Vic Tia ngco\AppData\Local\Microsoft\Windows\WER\ReportArchive\Kernel_0_0_cab_058578e4 Analysis symbol: Rechecking for solution: 0 Report Id: 081913-24656-01 Rep ort Status: 2 Application Information None 2013-08-19 17:46:57 Office Software Protection Platform Service 1066: Initializati on status for service objects. C:\Program Files\Common Files\Microsoft Shared\O fficeSoftwareProtectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/phone/1.0, 0x000 00000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareP rotectionPlatform\OSPPOBJS.DLL, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000 000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatf orm\OSPPOBJS.DLL, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS.DL L, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 17:46:57 Office Software Protection Platform Service 902: The Software Protection service has started. 14.0.370.400 Application Information None 2013-08-19 17:46:59 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 17:47:02 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 17:47:02 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592

4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:03 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information None 2013-08-19 17:47:10 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 191301d3-a579-428c-b0c7-d79 88500f9e3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:11 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: 6f327760-8c5c-417c-9b61-836 a98287e0c, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 30 0 msft:rm/algor ithm/volume/1.0 0x00000000 259150)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:12 Office Software Protection Platform Service 1003: The Software Protection service has completed licensing status check. Application Id=59a528 81-a989-479d-af46-f275c6370663 Licensing Status= 1: fdf3ecb9-b56f-43b2-a9b8-1b4 8b6bae1a7, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:13 Office Software Protection Platform Service 12288: The client has sent an activation request to the key management service machine. Info: 0x 00000000, 0x00000000, 127.0.0.1:1688, eda7c176-72f0-44d5-9dc6-74f23c070081, 2013 /08/19 09:47, 0, 1, 259150, 6f327760-8c5c-417c-9b61-836a98287e0c, 5 Application Information None 2013-08-19 17:47:13 Office Software Protection Platform Service 12289: The client has processed an activation response from the key management service machine. I nfo: 0x00000000, 0x00000000, 1, 0, 26, 120, 10080, 2013/08/19 09:47 Application Information None 2013-08-19 17:47:14 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:14 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 436cef53-8387-4692-bb4a-9492cd8226 0e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:14 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5

2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:15 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 57a232fe-0931-48fe-9389-e4586967c6 61, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:15 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 7cfd4696-69a9-4af7-af36-ff3d12b6b6 c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bio s/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:15 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 8ec16e01-e86f-415f-b333-1819f41452 94, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:16 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: a0cde89c-3304-4157-b61c-c8ad785d1f ad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:16 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: ac96e1a8-6cc4-4310-a4ff-332ce77fb5 b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:16 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:17 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: b2c4b9f6-3ee6-4a2a-a361-64ad3b61de d5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:17 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: bba42084-cacd-4ad4-b606-9f3d6c93b2 c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:17

Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: c619d61c-c2f2-40c3-ab3f-c5924314b0 f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 17:47:17 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: cfb3e52c-d707-4861-af51-11b27ee616 9c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Error None 2013-08-19 17:47:20 WinMgmt Application Information 1 2013-08-19 17:48:17 SkypeUpdate 103: SkypeUpdate service is shu tting down due to idle timeout. Application Information 1 2013-08-19 17:48:18 SkypeUpdate 101: Service stopped. Application Information None 2013-08-19 17:48:44 SecurityCenter 1: The Windows Security Center Service has started. Application Information None 2013-08-19 17:50:49 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 17:50:49 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 17:52:18 Software Protection Platform Service 903: The Software Protect ion service has stopped. Application Information None 2013-08-19 17:54:42 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 17:54:42 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Application Information None 2013-08-19 18:02:17 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 18:02:18 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 18:02:18 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682 -4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000

0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 18:02:18 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information None 2013-08-19 18:07:18 Software Protection Platform Service 903: The Software Protect ion service has stopped. Application Information None 2013-08-19 18:49:30 System Restore 8194: Successfully created rest ore point (Process = C:\Windows\system32\svchost.exe -k netsvcs; Description = W indows Update). Application Information None 2013-08-19 18:53:11 VSS 8224: The VSS service is shutti ng down due to idle timeout. Application Information None 2013-08-19 20:48:51 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PnPRequestAdditionalSoftware Response: Not available Cab Id: 0 Pr oblem signature: P1: x86 P2: USB\VID_1D57&PID_0016&REV_0021 P3: 6.1.1.0 P4: 0409 P5: input.inf P6: * P7: P8: P9: P10: Attached files: These files may be available here: C:\Users\Vic Tiangco\AppData\Local\Microsoft\Windo ws\WER\ReportQueue\NonCritical_x86_f484c0f15c1e5a491597958a92564c404567493f_cab_ 0e9802dd Analysis symbol: Rechecking for solution: 0 Report Id: b2151d68-0 8cd-11e3-a9a7-0016d4bcce11 Report Status: 4 Application Information None 2013-08-19 20:50:36 Windows Error Reporting 1001: Fault bucket , type 0 Ev ent Name: PnPDeviceProblemCode Response: Not available Cab Id: 0 Problem si gnature: P1: x86 P2: USB\UNKNOWN P3: {36fc9e60-c465-11cf-8056-444553540000} P4: 0000002B P5: unknown P6: unknown P7: unknown P8: P9: P10: Attach ed files: C:\Users\Vic Tiangco\AppData\Local\Temp\DMI9F47.tmp.log.xml C:\Windo ws\inf\usb.inf These files may be available here: C:\Users\Vic Tiangco\AppDa ta\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x86_a796cc5babf24d790d38c fc7dd844dad2e847e4_cab_022d9ff3 Analysis symbol: Rechecking for solution: 0 Report Id: f11457f7-08cd-11e3-a9a7-0016d4bcce11 Report Status: 4 Application Information None 2013-08-19 23:24:41 Software Protection Platform Service 900: The Software Protect ion service is starting. Application Information None 2013-08-19 23:24:45 Software Protection Platform Service 1066: Initialization stat us for service objects. C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunct ionality/agent/7.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft :rm/algorithm/phone/1.0, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000 C:\Windows\system32\sppobjs .dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000 C:\Windows\system32\spp objs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000 C:\Windows\sy stem32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000 Application Information None 2013-08-19 23:24:45 Software Protection Platform Service 1003: The Software Protec tion service has completed licensing status check. Application Id=55c92734-d682

-4d71-983e-d6ec3f16059f Licensing Status= 1: 022a1afb-b893-4190-92c3-8f69a49839 fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 2: 436cef53-8387 -4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )( 2 )] 3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)( ?)(?)(?)(?)(?)])(1 )(2 )] 4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x0 0000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )] 5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004 F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 6: a0cde89c-3304-4157-b61c-c8ad785d1 fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 7: ac96e1a8-6cc 4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 ) (2 )] 8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?) (?)(?)(?)(?)(?)])(1 )(2 )] 9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0x C004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 10: c619d61c-c2f2-40c3-ab3f-c592 4314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 11: cfb3e5 2c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?) ])(1 )(2 )] 12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0 ], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] 13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )] Application Information None 2013-08-19 23:24:45 Software Protection Platform Service 902: The Software Protect ion service has started. 6.1.7601.17514 Application Information None 2013-08-19 23:26:32 SYSTEM Microsoft-Windows-LoadPerf 1001: Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data conta ins the new values of the system Last Counter and Last Help registry entries. Application Information None 2013-08-19 23:26:32 SYSTEM Microsoft-Windows-LoadPerf 1000: Performance counters for the WmiApRpl (WmiApRpl) service were loaded successfully. The Record Data in the data section contains the new index values assigned to this service. Security Audit Success 12288 2013-08-19 14:02:18 Microsoft-Windows-Security-Auditing 4616: The system time was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Process Information: Proces s ID: 0x13c Name: C:\Windows\System32\oobe\msoobe.exe Previous Time: 2013 -08-19T21:02:18.265625000Z New Time: 2013-08-19T06:02:18.187000000Z This ev ent is generated when the system time is changed. It is normal for the Windows T ime Service, which runs with System privilege, to change the system time on a re gular basis. Other system time changes may be indicative of attempts to tamper w ith the computer. Security Audit Success 13824 2013-08-19 14:02:18 Microsoft-Windows-Security-Auditing 4720: A user account was c reated. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 New Account: Security ID: S -1-5-21-2415673615-2399998967-532945099-1000 Account Name: Vic Tiangco Acco unt Domain: emovhicRN Attributes: SAM Account Name: Vic Tiangco Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%179 3 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 Allowed To Delegate To: - Old UAC Value: 0x0 New UAC Value: 0x15 User Account Control: %%2080 %%2082 %%2084 User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges Security Audit Success 13824 2013-08-19 14:02:18 Microsoft-Windows-Security-Auditing 4722: A user account was e nabled. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Name: Vic Tiangco A ccount Domain: emovhicRN Security Audit Success 13824 2013-08-19 14:02:18 Microsoft-Windows-Security-Auditing 4738: A user account was c hanged. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1FLH44Q2B$

Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Name: Vic Tiangco A ccount Domain: emovhicRN Changed Attributes: SAM Account Name: Vic Tiangco Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Ho me Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstat ions: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Gr oup ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x15 New UAC Value: 0x 14 User Account Control: %%2048 User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: Security Audit Success 13826 2013-08-19 14:02:18 Microsoft-Windows-Security-Auditing 4728: A member was added t o a security-enabled global group. Subject: Security ID: S-1-5-18 Accoun t Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Mem ber: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Group: Security ID: S-1-5-21-2415673615-2399998967-532945099-513 G roup Name: None Group Domain: emovhicRN Additional Information: Privile ges: Security Audit Success 13826 2013-08-19 14:02:18 Microsoft-Windows-Security-Auditing 4732: A member was added t o a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Memb er: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Name : Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Additional Information: Privileges: Security Audit Success 13826 2013-08-19 14:02:18 Microsoft-Windows-Security-Auditing 4732: A member was added t o a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Memb er: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Name : Group: Security ID: S-1-5-32-544 Group Name: Administrators Grou p Domain: Builtin Additional Information: Privileges: Security Audit Success 13824 2013-08-19 14:02:19 Microsoft-Windows-Security-Auditing 4738: A user account was c hanged. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Name: Vic Tiangco A ccount Domain: emovhicRN Changed Attributes: SAM Account Name: Vic Tiangco Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Ho me Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstat ions: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Gr oup ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x14 New UAC Value: 0x 214 User Account Control: %%2089 User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: Security Audit Success 13824 2013-08-19 14:02:19 Microsoft-Windows-Security-Auditing 4738: A user account was c hanged. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Name: Vic Tiangco A ccount Domain: emovhicRN Changed Attributes: SAM Account Name: Vic Tiangco Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Ho me Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstat ions: %%1793 Password Last Set: 8/19/2013 2:02:19 PM Account Expires: %%179 4 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x214 New UAC Value: 0x214 User Account Control: - User Parameters: - SID History: - Logon Hours: %%1797 Additional Information: Privileges: Security Audit Success 13824 2013-08-19 14:02:19 Microsoft-Windows-Security-Auditing 4724: An attempt was made to reset an account's password. Subject: Security ID: S-1-5-18 Account N ame: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Accoun

t Name: Vic Tiangco Account Domain: emovhicRN Security Audit Success 13824 2013-08-19 14:02:19 Microsoft-Windows-Security-Auditing 4738: A user account was c hanged. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Name: Vic Tiangco A ccount Domain: emovhicRN Changed Attributes: SAM Account Name: - Display Name: - User Principal Name: - Home Directory: - Home Drive: - Scrip t Path: - Profile Path: - User Workstations: - Password Last Set: - Ac count Expires: - Primary Group ID: - AllowedToDelegateTo: - Old UAC Value : - New UAC Value: - User Account Control: - User Parameters: - SID Hi story: - Logon Hours: Additional Information: Privileges: Security Audit Success 13826 2013-08-19 14:02:19 Microsoft-Windows-Security-Auditing 4733: A member was removed from a security-enabled local group. Subject: Security ID: S-1-5-18 Acc ount Name: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Member: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Name: Group: Security ID: S-1-5-32-545 Group Name: Users Group Dom ain: Builtin Additional Information: Privileges: Security Audit Success 12544 2013-08-19 14:02:20 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1 FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: N T AUTHORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000 000} Process Information: Process ID: 0x1b8 Process Name: C:\Windows\Sy stem32\services.exe Network Information: Workstation Name: Source Networ k Address: - Source Port: Detailed Authentication Information: Logon P rocess: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a l ogon session is created. It is generated on the computer that was accessed. T he subject fields indicate the account on the local system which requested the l ogon. This is most commonly a service such as the Server service, or a local pro cess such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (n etwork). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate wh ere a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields pr ovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated sessio n key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:02:20 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:03:10 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: WIN-LQ1FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUI D: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Use d: Account Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {000 00000-0000-0000-0000-000000000000} Target Server: Target Server Name: local

host Additional Information: localhost Process Information: Process ID: 0x17c Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a proce ss attempts to log on an account by explicitly specifying that account s credentia ls. This most commonly occurs in batch-type configurations such as scheduled ta sks, or when using the RUNAS command. Security Audit Success 12544 2013-08-19 14:03:10 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1 FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Logon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Accou nt Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x53d3a Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x17c Process Name: C:\Windows\System32\winlogon.exe Network Informat ion: Workstation Name: WIN-LQ1FLH44Q2B Source Network Address: 127.0.0.1 S ource Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTL M only): - Key Length: 0 This event is generated when a logon session is c reated. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is mos t commonly a service such as the Server service, or a local process such as Winl ogon.exe or Services.exe. The logon type field indicates the kind of logon th at occurred. The most common types are 2 (interactive) and 3 (network). The N ew Logon fields indicate the account for whom the new logon was created, i.e. th e account that was logged on. The network fields indicate where a remote logo n request originated. Workstation name is not always available and may be left b lank in some cases. The authentication information fields provide detailed in formation about this specific logon request. - Logon GUID is a unique identifi er that can be used to correlate this event with a KDC event. - Transited serv ices indicate which intermediate services have participated in this logon reques t. - Package name indicates which sub-protocol was used among the NTLM protoco ls. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:03:10 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-LQ1 FLH44Q2B$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Logon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Accou nt Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x53d81 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x17c Process Name: C:\Windows\System32\winlogon.exe Network Informat ion: Workstation Name: WIN-LQ1FLH44Q2B Source Network Address: 127.0.0.1 S ource Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTL M only): - Key Length: 0 This event is generated when a logon session is c reated. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is mos t commonly a service such as the Server service, or a local process such as Winl ogon.exe or Services.exe. The logon type field indicates the kind of logon th at occurred. The most common types are 2 (interactive) and 3 (network). The N ew Logon fields indicate the account for whom the new logon was created, i.e. th e account that was logged on. The network fields indicate where a remote logo n request originated. Workstation name is not always available and may be left b lank in some cases. The authentication information fields provide detailed in formation about this specific logon request. - Logon GUID is a unique identifi er that can be used to correlate this event with a KDC event. - Transited serv ices indicate which intermediate services have participated in this logon reques t. - Package name indicates which sub-protocol was used among the NTLM protoco ls. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

Audit Success 12548 2013-08-19 14:03:10 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0x53d3a Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDeb ugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 103 2013-08-19 14:03:30 Microsoft-Windows-Eventlog 1100: The event logging service has shut down. Security Audit Success 12545 2013-08-19 14:03:30 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x53d81 T his event is generated when a logoff is initiated. No further user-initiated act ivity can occur. This event can be interpreted as a logoff event. Security Audit Success 12288 2013-08-19 14:04:17 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 14:04:18 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 13568 2013-08-19 14:04:21 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x698e Security Audit Success 12544 2013-08-19 14:04:22 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1b8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub

Security

ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:04:22 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:04:23 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1b8 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:04:23 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x1b8 Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:04:23 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:04:23 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:04:24 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1b8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:04:24 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1b8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag

e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:04:24 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:04:24 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:04:31 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1b8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:04:31 Microsoft-Windows-Security-Auditing 4672: Special privileges a

ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 14:04:33 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12544 2013-08-19 14:04:33 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {000000000000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x17c Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that account s credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 14:04:33 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xf043 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 17c Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12544 2013-08-19 14:04:33 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xf069 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 17c Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): -

Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12548 2013-08-19 14:04:33 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0xf043 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebu gPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 14:04:36 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 14:04:46 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x139b7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: Network Information: Wor kstation Name: Source Network Address: - Source Port: Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 14:05:10 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1b8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr

ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:05:10 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:06:49 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1b8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:06:49 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege

Audit Success 12545 2013-08-19 14:14:03 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xf069 Th is event is generated when a logoff is initiated. No further user-initiated acti vity can occur. This event can be interpreted as a logoff event. Security Audit Success 103 2013-08-19 14:14:04 Microsoft-Windows-Eventlog 1100: The event logging service has shut down. Security Audit Success 12288 2013-08-19 14:14:43 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 14:14:44 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:14:44 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra

Security

nsited services ogon request. TLM protocols. This will be 0 Security

indicate which intermediate services have participated in this l - Package name indicates which sub-protocol was used among the N - Key length indicates the length of the generated session key. if no session key was requested. Audit Success 12548 2013-08-19 14:14:44 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 14:14:44 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x651b Security Audit Success 12544 2013-08-19 14:14:45 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:14:45 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available

and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:14:45 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:14:45 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:14:45

Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:14:45 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:14:45 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:14:45 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:14:48 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:14:48 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 14:14:49

Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12544 2013-08-19 14:14:49 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {000000000000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x184 Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that account s credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 14:14:49 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xea20 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 184 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12544 2013-08-19 14:14:49 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xea4d Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 184 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha

t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12548 2013-08-19 14:14:49 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0xea20 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebu gPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 14:14:50 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 14:14:52 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x131bf Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: Network Information: Wor kstation Name: Source Network Address: - Source Port: Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 14:14:52 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind

of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:14:52 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:15:05 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:15:05 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12288 2013-08-19 14:18:15 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 14:18:15 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco

unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:18:15 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:18:15 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 14:18:15 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x6530 Security Audit Success 101 2013-08-19 14:18:16

Microsoft-Windows-Eventlog 1101: Audit events have been dr opped by the transport. 0 Security Audit Success 12544 2013-08-19 14:18:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:18:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:18:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:18:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:18:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:18:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:18:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr

imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:18:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:18:19 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:18:19 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 14:18:20 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12544 2013-08-19 14:18:20 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {000000000000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x184 Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that account s credentials. T

his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 14:18:20 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xea0a Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 184 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12544 2013-08-19 14:18:20 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xea37 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 184 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12548 2013-08-19 14:18:20 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo

n ID: 0xea0a Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebu gPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 14:18:21 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 14:18:23 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x131d0 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: Network Information: Wor kstation Name: Source Network Address: - Source Port: Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 14:18:23 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:18:23 Microsoft-Windows-Security-Auditing 4672: Special privileges a

ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:18:31 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:18:31 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12290 2013-08-19 14:23:08 Microsoft-Windows-Security-Auditing 5056: A cryptographic self test was performed. Subject: Security ID: S-1-5-18 Account Name: EMOVH ICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Module: ncrypt.dll Return Code: 0x0 Security Audit Success 12545 2013-08-19 14:24:32 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xea37 Th is event is generated when a logoff is initiated. No further user-initiated acti vity can occur. This event can be interpreted as a logoff event. Security Audit Success 103 2013-08-19 14:24:34 Microsoft-Windows-Eventlog 1100: The event logging service has shut down. Security Audit Success 12288 2013-08-19 14:25:16 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 14:25:16 Microsoft-Windows-Security-Auditing 4624: An account was succe

ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when

a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma

y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:25:17

Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 14:25:17 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x6f70 Security Audit Success 12290 2013-08-19 14:25:18 Microsoft-Windows-Security-Auditing 5056: A cryptographic self test was performed. Subject: Security ID: S-1-5-18 Account Name: EMOVH ICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Module: ncrypt.dll Return Code: 0x0 Security Audit Success 12544 2013-08-19 14:25:22 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {000000000000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x194 Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that account s credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 14:25:22 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xef95 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 194 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12548 2013-08-19 14:25:22 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0xef95 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege

SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebu gPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 14:25:23 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12544 2013-08-19 14:25:23 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:25:23 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 14:25:24 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 14:25:24 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x13fea Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: Network Information: Wor kstation Name: Source Network Address: - Source Port: Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati

on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 14:25:25 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:25:25 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:25:32 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a

remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:25:32 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12545 2013-08-19 14:29:46 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xef95 Th is event is generated when a logoff is initiated. No further user-initiated acti vity can occur. This event can be interpreted as a logoff event. Security Audit Success 103 2013-08-19 14:29:48 Microsoft-Windows-Eventlog 1100: The event logging service has shut down. Security Audit Success 12288 2013-08-19 14:30:33 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 14:30:33 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 13568 2013-08-19 14:30:33 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x6d1d Security Audit Success 12544 2013-08-19 14:30:40 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC

RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:30:40 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:30:40 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a

logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:30:40 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:30:40 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:30:40 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:30:40 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:30:40

Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:30:41 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:30:41 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12290 2013-08-19 14:30:42 Microsoft-Windows-Security-Auditing 5056: A cryptographic self test was performed. Subject: Security ID: S-1-5-18 Account Name: EMOVH ICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Module: ncrypt.dll Return Code: 0x0 Security Audit Success 12544 2013-08-19 14:30:42 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {000000000000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x1f4 Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that account s credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 14:30:42

Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x101dc Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0 x1f4 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentic ation Package: Negotiate Transited Services: - Package Name (NTLM only): Key Length: 0 This event is generated when a logon session is created. It i s generated on the computer that was accessed. The subject fields indicate th e account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fie lds indicate the account for whom the new logon was created, i.e. the account th at was logged on. The network fields indicate where a remote logon request or iginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information ab out this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicat e which intermediate services have participated in this logon request. - Packa ge name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no s ession key was requested. Security Audit Success 12548 2013-08-19 14:30:42 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0x101dc Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDeb ugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 14:30:44 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12544 2013-08-19 14:30:44 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N

TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:30:44 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 14:30:45 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 14:30:45 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x19a37 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: Network Information: Wor kstation Name: Source Network Address: - Source Port: Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 14:30:45 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq

ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:30:45 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:30:51 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:30:51 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:33:40 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon.

This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:33:40 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:34:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:34:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon.

This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:34:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:34:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 14:34:44 Microsoft-Windows-Security-Auditing 4904: An attempt was made to register a security event source. Subject : Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0xdc8 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x6c384 Security Audit Success 13568 2013-08-19 14:34:44 Microsoft-Windows-Security-Auditing 4905: An attempt was made to unregister a security event source. Subject Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0xdc8 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x6c384 Security Audit Success 12544 2013-08-19 14:41:46 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma

y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:41:46 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 14:57:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 14:57:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma

y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 14:57:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 14:57:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 14:57:40 Microsoft-Windows-Security-Auditing 4904: An attempt was made to register a security event source. Subject : Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0xfb4 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x195dc2 Security Audit Success 13568 2013-08-19 14:57:40 Microsoft-Windows-Security-Auditing 4905: An attempt was made to unregister a security event source. Subject Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0xfb4 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x195dc2 Security Audit Success 12544 2013-08-19 15:03:56 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key.

This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:03:56 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:03:56 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:03:56 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 15:04:10 Microsoft-Windows-Security-Auditing 4904: An attempt was made to register a security event source. Subject : Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0xf0c Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x2b5f00 Security Audit Success 13568 2013-08-19 15:04:10 Microsoft-Windows-Security-Auditing 4905: An attempt was made to unregister a security event source. Subject Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0xf0c Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x2b5f00 Security Audit Success 12544 2013-08-19 15:07:37 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH

ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:07:37 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:13:44 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:13:44 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh

ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:13:45 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:13:45 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1a0 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:13:45 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh

ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:13:45 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 15:14:14 Microsoft-Windows-Security-Auditing 4904: An attempt was made to register a security event source. Subject : Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0x748 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x39fcb0 Security Audit Success 13568 2013-08-19 15:14:14 Microsoft-Windows-Security-Auditing 4905: An attempt was made to unregister a security event source. Subject Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0x748 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x39fcb0 Security Audit Success 12545 2013-08-19 15:17:36 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x101dc T his event is generated when a logoff is initiated. No further user-initiated act ivity can occur. This event can be interpreted as a logoff event. Security Audit Success 103 2013-08-19 15:17:43 Microsoft-Windows-Eventlog 1100: The event logging service has shut down. Security Audit Success 12288 2013-08-19 15:18:36 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 15:18:36 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated

session key. This will be 0 if no session key was requested. Security Audit Success 13568 2013-08-19 15:18:36 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x6e12 Security Audit Success 12544 2013-08-19 15:18:54 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1d8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:18:54 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1d8 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:18:54 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo

gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1d8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:18:54 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:18:54 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:18:54 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:18:55 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {000000000000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x1e4 Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that account s credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 15:18:55 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo

gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xaf8a Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 1e4 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12548 2013-08-19 15:18:55 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0xaf8a Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebu gPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12545 2013-08-19 15:25:13 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xaf8a Th is event is generated when a logoff is initiated. No further user-initiated acti vity can occur. This event can be interpreted as a logoff event. Security Audit Success 12288 2013-08-19 15:25:52 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 15:25:52 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU

ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 13568 2013-08-19 15:25:52 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x7563 Security Audit Success 12544 2013-08-19 15:25:53 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:25:53 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested.

Audit Success 12544 2013-08-19 15:25:53 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:25:53 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:25:53 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege

Security

Audit Success 12548 2013-08-19 15:25:53 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:25:53 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:25:53 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:25:57 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {000000000000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x20c Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that account s credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 15:25:57 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xb5e1 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 20c Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se

Security

ssion key was requested. Security Audit Success 12548 2013-08-19 15:25:57 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0xb5e1 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebu gPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12545 2013-08-19 15:28:47 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xb5e1 Th is event is generated when a logoff is initiated. No further user-initiated acti vity can occur. This event can be interpreted as a logoff event. Security Audit Success 12288 2013-08-19 15:29:26 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 15:29:26 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 13568 2013-08-19 15:29:26 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x743b Security Audit Success 12544 2013-08-19 15:29:27 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s

uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:29:27 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:29:27 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.

- Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:29:27 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:29:27 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:29:27 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr

imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:29:27 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:29:27 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:29:27 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:29:27 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12290 2013-08-19 15:29:28 Microsoft-Windows-Security-Auditing 5056: A cryptographic self test was performed. Subject: Security ID: S-1-5-18 Account Name: EMOVH ICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Module: ncrypt.dll Return Code: 0x0 Security Audit Success 12544 2013-08-19 15:29:31 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key.

This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:29:31 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 15:29:32 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12292 2013-08-19 15:29:35 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 15:29:35 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {000000000000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x21c Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that account s credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 15:29:35 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x12fed Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0 x21c Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentic ation Package: Negotiate Transited Services: - Package Name (NTLM only): Key Length: 0 This event is generated when a logon session is created. It i s generated on the computer that was accessed. The subject fields indicate th e account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fie lds indicate the account for whom the new logon was created, i.e. the account th at was logged on. The network fields indicate where a remote logon request or iginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information ab out this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicat e which intermediate services have participated in this logon request. - Packa ge name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no s ession key was requested. Security Audit Success 12548 2013-08-19 15:29:35 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0x12fed Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege

SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDeb ugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:29:37 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x14117 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: Network Information: Wor kstation Name: Source Network Address: - Source Port: Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 15:29:52 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:29:52 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile

ge

SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:30:02 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:30:02 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:31:32 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N

TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:31:32 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:35:48 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:35:48 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1c8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N

TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:35:48 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:35:48 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 15:36:46 Microsoft-Windows-Security-Auditing 4904: An attempt was made to register a security event source. Subject : Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0x8e8 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0xa5a8a Security Audit Success 13568 2013-08-19 15:36:46 Microsoft-Windows-Security-Auditing 4905: An attempt was made to unregister a security event source. Subject Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0x8e8 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0xa5a8a Security Audit Success 12545 2013-08-19 15:45:07 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x12fed T his event is generated when a logoff is initiated. No further user-initiated act ivity can occur. This event can be interpreted as a logoff event. Security Audit Success 103 2013-08-19 15:45:10 Microsoft-Windows-Eventlog 1100: The event logging service has shut down. Security Audit Success 12288 2013-08-19 15:46:10 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 15:46:10 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic

ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 13568 2013-08-19 15:46:10 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x6e49 Security Audit Success 12544 2013-08-19 15:46:21 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:46:21 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated

in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:46:21 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:46:21 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:46:21 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:46:21 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:46:22 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon.

This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:46:22 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:46:22 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:46:22 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12290 2013-08-19 15:46:24 Microsoft-Windows-Security-Auditing 5056: A cryptographic self test was performed. Subject: Security ID: S-1-5-18 Account Name: EMOVH ICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Module: ncrypt.dll Return Code: 0x0

Audit Success 12544 2013-08-19 15:46:24 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {000000000000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x1d0 Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that account s credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 15:46:24 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xfdaf Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 1d0 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12548 2013-08-19 15:46:24 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0xfdaf Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebu gPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:46:25 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon.

Security

This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:46:25 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 15:46:26 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12292 2013-08-19 15:46:27 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 15:46:31 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x1ac42 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: Network Information: Wor kstation Name: Source Network Address: - Source Port: Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 15:46:43 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32

\services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:46:43 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:46:43 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:46:43 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege

SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:48:25 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:48:25 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:49:31 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key.

This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:49:31 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:49:32 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:49:32 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 15:50:00 Microsoft-Windows-Security-Auditing 4904: An attempt was made to register a security event source. Subject : Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0x924 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x7fdf4 Security Audit Success 13568 2013-08-19 15:50:00 Microsoft-Windows-Security-Auditing 4905: An attempt was made to unregister a security event source. Subject Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0x924 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x7fdf4 Security Audit Success 12544 2013-08-19 15:54:56 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH

ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:54:56 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 15:56:33 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 15:56:33 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH

ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 15:56:33 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 15:56:33 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 15:57:07 Microsoft-Windows-Security-Auditing 4904: An attempt was made to register a security event source. Subject : Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0x568 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0xec296 Security Audit Success 13568 2013-08-19 15:57:07 Microsoft-Windows-Security-Auditing 4905: An attempt was made to unregister a security event source. Subject Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0x568 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0xec296 Security Audit Success 12544 2013-08-19 16:01:53 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s

ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:01:53 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:02:52 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:02:52 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:10:04 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC

RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:10:04 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:10:05 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1ec Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:10:05 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST

EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 16:10:32 Microsoft-Windows-Security-Auditing 4904: An attempt was made to register a security event source. Subject : Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0xa9c Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x1f1855 Security Audit Success 13568 2013-08-19 16:10:32 Microsoft-Windows-Security-Auditing 4905: An attempt was made to unregister a security event source. Subject Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0xa9c Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x1f1855 Security Audit Success 12545 2013-08-19 16:11:01 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xfdaf Th is event is generated when a logoff is initiated. No further user-initiated acti vity can occur. This event can be interpreted as a logoff event. Security Audit Success 103 2013-08-19 16:11:08 Microsoft-Windows-Eventlog 1100: The event logging service has shut down. Security Audit Success 12288 2013-08-19 16:12:13 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 16:12:13 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 13568 2013-08-19 16:12:13 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x6e2e Security Audit Success 12544 2013-08-19 16:12:23 Microsoft-Windows-Security-Auditing 4624: An account was succe

ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:12:23 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:12:24 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 16:12:24 Microsoft-Windows-Security-Auditing 4624: An account was succe

ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 16:12:24 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:12:24 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 16:12:24 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege

Audit Success 12548 2013-08-19 16:12:24 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12290 2013-08-19 16:12:25 Microsoft-Windows-Security-Auditing 5056: A cryptographic self test was performed. Subject: Security ID: S-1-5-18 Account Name: EMOVH ICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Module: ncrypt.dll Return Code: 0x0 Security Audit Success 12544 2013-08-19 16:12:25 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:12:25 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:12:26 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {000000000000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x1d0 Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that account s credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command.

Security

Audit Success 12544 2013-08-19 16:12:26 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x10897 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0 x1d0 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentic ation Package: Negotiate Transited Services: - Package Name (NTLM only): Key Length: 0 This event is generated when a logon session is created. It i s generated on the computer that was accessed. The subject fields indicate th e account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fie lds indicate the account for whom the new logon was created, i.e. the account th at was logged on. The network fields indicate where a remote logon request or iginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information ab out this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicat e which intermediate services have participated in this logon request. - Packa ge name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no s ession key was requested. Security Audit Success 12548 2013-08-19 16:12:26 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0x10897 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDeb ugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 16:12:27 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12544 2013-08-19 16:12:27 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l

Security

ogon request. TLM protocols. This will be 0 Security

- Package name indicates which sub-protocol was used among the N - Key length indicates the length of the generated session key. if no session key was requested. Audit Success 12548 2013-08-19 16:12:27 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 16:12:28 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 16:12:34 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x1a632 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: Network Information: Wor kstation Name: Source Network Address: - Source Port: Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 16:12:53 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide

detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 16:12:53 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:12:53 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 16:12:53 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:13:02 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub

ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:13:02 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:14:09 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 16:14:09 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub

ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:14:09 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 16:14:09 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 16:14:34 Microsoft-Windows-Security-Auditing 4904: An attempt was made to register a security event source. Subject : Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0xab8 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x4db66 Security Audit Success 13568 2013-08-19 16:14:34 Microsoft-Windows-Security-Auditing 4905: An attempt was made to unregister a security event source. Subject Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0xab8 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x4db66 Security Audit Success 12544 2013-08-19 16:20:13 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1fc Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a

remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:20:13 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12545 2013-08-19 16:41:06 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x10897 T his event is generated when a logoff is initiated. No further user-initiated act ivity can occur. This event can be interpreted as a logoff event. Security Audit Success 103 2013-08-19 16:41:12 Microsoft-Windows-Eventlog 1100: The event logging service has shut down. Security Audit Success 12288 2013-08-19 16:42:15 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 16:42:15 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 13568 2013-08-19 16:42:15 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x780b Security Audit Success 12544 2013-08-19 16:42:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC

RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1f8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 16:42:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1f8 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 16:42:16 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x1f8 Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a

logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:42:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 16:42:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 16:42:16 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:42:17 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1f8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 16:42:17

Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1f8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:42:17 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 16:42:17 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12290 2013-08-19 16:42:18 Microsoft-Windows-Security-Auditing 5056: A cryptographic self test was performed. Subject: Security ID: S-1-5-18 Account Name: EMOVH ICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Module: ncrypt.dll Return Code: 0x0 Security Audit Success 12544 2013-08-19 16:42:18 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {000000000000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x1cc Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that account s credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 16:42:18

Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xfd59 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x 1cc Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentica tion Package: Negotiate Transited Services: - Package Name (NTLM only): Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or S ervices.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fiel ds indicate the account for whom the new logon was created, i.e. the account tha t was logged on. The network fields indicate where a remote logon request ori ginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information abo ut this specific logon request. - Logon GUID is a unique identifier that can b e used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Packag e name indicates which sub-protocol was used among the NTLM protocols. - Key l ength indicates the length of the generated session key. This will be 0 if no se ssion key was requested. Security Audit Success 12548 2013-08-19 16:42:18 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0xfd59 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebu gPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:42:19 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1f8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:42:19

Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 16:42:20 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12292 2013-08-19 16:42:21 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 16:42:24 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x19a4a Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: Network Information: Wor kstation Name: Source Network Address: - Source Port: Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 16:42:32 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1f8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq

ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:42:32 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:42:37 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1f8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:42:37 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:55:12 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1f8 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon.

This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:55:12 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12545 2013-08-19 16:55:14 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0xfd59 Th is event is generated when a logoff is initiated. No further user-initiated acti vity can occur. This event can be interpreted as a logoff event. Security Audit Success 103 2013-08-19 16:55:15 Microsoft-Windows-Eventlog 1100: The event logging service has shut down. Security Audit Success 12288 2013-08-19 16:56:14 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 16:56:14 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 16:56:14

Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x200 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:56:14 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 16:56:14 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x7415 Security Audit Success 12544 2013-08-19 16:56:15 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x200 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am

ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 16:56:15 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x200 Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:56:15 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 16:56:15 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:56:17 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x200 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra

nsited services ogon request. TLM protocols. This will be 0 Security

indicate which intermediate services have participated in this l - Package name indicates which sub-protocol was used among the N - Key length indicates the length of the generated session key. if no session key was requested. Audit Success 12544 2013-08-19 16:56:17 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x200 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:56:17 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 16:56:17 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12290 2013-08-19 16:56:18 Microsoft-Windows-Security-Auditing 5056: A cryptographic self test was performed. Subject: Security ID: S-1-5-18 Account Name: EMOVH ICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Module: ncrypt.dll Return Code: 0x0 Security Audit Success 12544 2013-08-19 16:56:19 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0 0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {000000000000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x1d4 Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw

ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that account s credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 16:56:19 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x103f7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0 x1d4 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentic ation Package: Negotiate Transited Services: - Package Name (NTLM only): Key Length: 0 This event is generated when a logon session is created. It i s generated on the computer that was accessed. The subject fields indicate th e account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fie lds indicate the account for whom the new logon was created, i.e. the account th at was logged on. The network fields indicate where a remote logon request or iginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information ab out this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicat e which intermediate services have participated in this logon request. - Packa ge name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no s ession key was requested. Security Audit Success 12548 2013-08-19 16:56:19 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0x103f7 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDeb ugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:56:20 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x200 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra

nsited services ogon request. TLM protocols. This will be 0 Security

indicate which intermediate services have participated in this l - Package name indicates which sub-protocol was used among the N - Key length indicates the length of the generated session key. if no session key was requested. Audit Success 12548 2013-08-19 16:56:20 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 16:56:21 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12292 2013-08-19 16:56:23 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 16:56:24 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x1a222 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: Network Information: Wor kstation Name: Source Network Address: - Source Port: Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 16:56:31 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x200 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network

). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:56:31 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:56:37 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x200 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:56:37 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 16:56:40 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x200 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr

ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 16:56:40 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12545 2013-08-19 16:58:02 Microsoft-Windows-Security-Auditing 4647: User initiated logof f: Subject: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x103f7 T his event is generated when a logoff is initiated. No further user-initiated act ivity can occur. This event can be interpreted as a logoff event. Security Audit Success 103 2013-08-19 16:58:04 Microsoft-Windows-Eventlog 1100: The event logging service has shut down. Security Audit Success 12288 2013-08-19 17:45:43 Microsoft-Windows-Security-Auditing 4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. Security Audit Success 12544 2013-08-19 17:45:43 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 0 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0 x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Informatio n: Process ID: 0x4 Process Name: Network Information: Workstation Na me: - Source Network Address: - Source Port: Detailed Authentication I nformation: Logon Process: - Authentication Package: - Transited Services : - Package Name (NTLM only): - Key Length: 0 This event is generated wh en a logon session is created. It is generated on the computer that was accessed . The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a loc al process such as Winlogon.exe or Services.exe. The logon type field indicat es the kind of logon that occurred. The most common types are 2 (interactive) an d 3 (network). The New Logon fields indicate the account for whom the new log on was created, i.e. the account that was logged on. The network fields indic ate where a remote logon request originated. Workstation name is not always avai lable and may be left blank in some cases. The authentication information fie lds provide detailed information about this specific logon request. - Logon GU ID is a unique identifier that can be used to correlate this event with a KDC ev

ent. - Transited services indicate which intermediate services have participat ed in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 13568 2013-08-19 17:45:44 Microsoft-Windows-Security-Auditing 4902: The Per-user audit p olicy table was created. Number of Elements: 0 Policy ID: 0x86b5 Security Audit Success 12544 2013-08-19 17:45:47 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 17:45:47 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 17:45:52 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Logon GUID: {00000000-0000-0000-0000-000000 000000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows \System32\services.exe Network Information: Workstation Name: Source Net work Address: - Source Port: Detailed Authentication Information: Logo n Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested th e logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always availab

le and may be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event . - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used am ong the NTLM protocols. - Key length indicates the length of the generated ses sion key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 17:45:52 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETW ORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: S eAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12290 2013-08-19 17:45:53 Microsoft-Windows-Security-Auditing 5056: A cryptographic self test was performed. Subject: Security ID: S-1-5-18 Account Name: EMOVH ICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Module: ncrypt.dll Return Code: 0x0 Security Audit Success 12544 2013-08-19 17:45:53 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Logon GUID: {00000000-0000-0000-0000-00000000 0000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows\S ystem32\services.exe Network Information: Workstation Name: Source Netwo rk Address: - Source Port: Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local pr ocess such as Winlogon.exe or Services.exe. The logon type field indicates th e kind of logon that occurred. The most common types are 2 (interactive) and 3 ( network). The New Logon fields indicate the account for whom the new logon wa s created, i.e. the account that was logged on. The network fields indicate w here a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The authentication information fields p rovide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used amon g the NTLM protocols. - Key length indicates the length of the generated sessi on key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 17:45:53 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat

ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12544 2013-08-19 17:45:53 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 17:45:53 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCA L SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeA ssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 17:45:53 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12548 2013-08-19 17:45:53 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 17:45:56 Microsoft-Windows-Security-Auditing 4648: A logon was attempte d using explicit credentials. Subject: Security ID: S-1-5-18 Account Nam e: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {0

0000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: A ccount Name: Vic Tiangco Account Domain: emovhicRN Logon GUID: {000000000000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x24c Process Name: C:\Windows\System32\winlogon.exe Network Information: Netw ork Address: 127.0.0.1 Port: 0 This event is generated when a process att empts to log on an account by explicitly specifying that account s credentials. T his most commonly occurs in batch-type configurations such as scheduled tasks, o r when using the RUNAS command. Security Audit Success 12544 2013-08-19 17:45:56 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 2 New Lo gon: Security ID: S-1-5-21-2415673615-2399998967-532945099-1000 Account Nam e: Vic Tiangco Account Domain: emovhicRN Logon ID: 0x114a7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0 x24c Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: EMOVHICRN Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentic ation Package: Negotiate Transited Services: - Package Name (NTLM only): Key Length: 0 This event is generated when a logon session is created. It i s generated on the computer that was accessed. The subject fields indicate th e account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fie lds indicate the account for whom the new logon was created, i.e. the account th at was logged on. The network fields indicate where a remote logon request or iginated. Workstation name is not always available and may be left blank in some cases. The authentication information fields provide detailed information ab out this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicat e which intermediate services have participated in this logon request. - Packa ge name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no s ession key was requested. Security Audit Success 12548 2013-08-19 17:45:56 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-21-2415673615-2399998967 -532945099-1000 Account Name: Vic Tiangco Account Domain: emovhicRN Logo n ID: 0x114a7 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeImp ersonatePrivilege Security Audit Success 12544 2013-08-19 17:46:09 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat

ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 17:46:09 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12292 2013-08-19 17:46:16 Microsoft-Windows-Security-Auditing 5033: The Windows Firewall Driver started successfully. Security Audit Success 12292 2013-08-19 17:46:35 Microsoft-Windows-Security-Auditing 5024: The Windows Firewall service started successfully. Security Audit Success 12544 2013-08-19 17:46:40 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Acco unt Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: S-1-5-7 Account Name: ANONYMOUS LOGON Account Domain: NT AUTHORITY Logo n ID: 0x202db Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x0 Process Name: Network Information: Wor kstation Name: Source Network Address: - Source Port: Detailed Authen tication Information: Logon Process: NtLmSsp Authentication Package: NTLM Transited Services: - Package Name (NTLM only): NTLM V1 Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the lo cal system which requested the logon. This is most commonly a service such as th e Server service, or a local process such as Winlogon.exe or Services.exe. Th e logon type field indicates the kind of logon that occurred. The most common ty pes are 2 (interactive) and 3 (network). The New Logon fields indicate the ac count for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstati on name is not always available and may be left blank in some cases. The auth entication information fields provide detailed information about this specific l ogon request. - Logon GUID is a unique identifier that can be used to correlat e this event with a KDC event. - Transited services indicate which intermediat e services have participated in this logon request. - Package name indicates w hich sub-protocol was used among the NTLM protocols. - Key length indicates th e length of the generated session key. This will be 0 if no session key was requ ested. Security Audit Success 12544 2013-08-19 17:46:42 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s

ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 17:46:42 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 17:46:51 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 17:46:51 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 17:46:56 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC

RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 17:46:56 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 18:49:09 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 18:49:09 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST

EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 12544 2013-08-19 18:49:11 Microsoft-Windows-Security-Auditing 4624: An account was succe ssfully logged on. Subject: Security ID: S-1-5-18 Account Name: EMOVHIC RN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Type: 5 New Lo gon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTH ORITY Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x1e4 Process Name: C:\Windows\System32 \services.exe Network Information: Workstation Name: Source Network Addr ess: - Source Port: Detailed Authentication Information: Logon Process : Advapi Authentication Package: Negotiate Transited Services: - Packag e Name (NTLM only): - Key Length: 0 This event is generated when a logon s ession is created. It is generated on the computer that was accessed. The sub ject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process s uch as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network ). The New Logon fields indicate the account for whom the new logon was creat ed, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and ma y be left blank in some cases. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a uniq ue identifier that can be used to correlate this event with a KDC event. - Tra nsited services indicate which intermediate services have participated in this l ogon request. - Package name indicates which sub-protocol was used among the N TLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested. Security Audit Success 12548 2013-08-19 18:49:11 Microsoft-Windows-Security-Auditing 4672: Special privileges a ssigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYST EM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPr imaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnersh ipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivile ge SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege Security Audit Success 13568 2013-08-19 18:50:11 Microsoft-Windows-Security-Auditing 4904: An attempt was made to register a security event source. Subject : Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0x574 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x10c180 Security Audit Success 13568 2013-08-19 18:50:11 Microsoft-Windows-Security-Auditing 4905: An attempt was made to unregister a security event source. Subject Security ID: S-1-5-18 Acc ount Name: EMOVHICRN$ Account Domain: WORKGROUP Logon ID: 0x3e7 Proces s: Process ID: 0x574 Process Name: C:\Windows\System32\VSSVC.exe Event So urce: Source Name: VSSAudit Event Source ID: 0x10c180 System Information None 2010-11-21 05:57:42 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2010-11-21 05:57:42 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information None 2010-11-21 05:57:42 Service Control Manager 7036: The Software Protection s ervice entered the stopped state.

Information None 2010-11-21 05:57:42 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2010-11-21 05:57:42 Service Control Manager 7036: The Windows Modules Insta ller service entered the stopped state. System Information None 2010-11-21 05:57:42 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Information 7010 2010-11-21 05:57:42 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Information 103 2010-11-21 05:57:43 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2010-11-21 05:57:46 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 14:02:18 SYSTEM Microsoft-Windows-Kernel-General 1: Incorrect function. System Information None 2013-08-19 14:03:03 SYSTEM USER32 1074: The process C:\Windows\sy stem32\shutdown.exe (WIN-LQ1FLH44Q2B) has initiated the restart of computer EMOV HICRN on behalf of user NT AUTHORITY\SYSTEM for the following reason: No title f or this reason could be found Reason Code: 0x800000ff Shutdown Type: resta rt Comment: System Information 1101 2013-08-19 14:03:13 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information None 2013-08-19 14:03:16 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 14:03:18 Vic Tiangco Microsoft-Windows-GroupPolicy 1501: The Group Policy settings for the user were processed successfully. There were no changes detected since the last successful processing of Group Policy. System Information None 2013-08-19 14:03:21 Service Control Manager 7036: The Application Informati on service entered the running state. System Information 7005 2013-08-19 14:03:28 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service AsyncMac for Device Instance ID SW\{EEAB7790C514-11D1-B42B-00805FC1270E}\ASYNCMAC with the following status: 0. System Information None 2013-08-19 14:03:29 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 14:03:30 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 14:03:30 Service Control Manager 7036: The Power service entered the stopped state. System Information None 2013-08-19 14:03:30 Service Control Manager 7036: The DHCP Client service e ntered the stopped state. System Information None 2013-08-19 14:03:30 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the stopped state. System Information None 2013-08-19 14:03:30 Service Control Manager 7036: The Distributed Link Trac

System

king Client service entered the stopped state. System Information None 2013-08-19 14:03:30 Service Control Manager 7036: The Diagnostic Service Ho st service entered the stopped state. System Information 4 2013-08-19 14:03:30 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51047: DHCPv6 client service i s stopped. ShutDown Flag value is 1 System Information 4 2013-08-19 14:03:30 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50037: DHCPv4 client service is stopped. ShutDown Flag value is 1 System Information 7005 2013-08-19 14:03:30 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver for Device Instance ID SW\{EEAB7790-C514-11D1 -B42B-00805FC1270E}\ASYNCMAC with the following status: 0x0. System Information None 2013-08-19 14:03:31 EventLog 6006: The Event log service was stopped. System Information None 2013-08-19 14:03:31 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 14:03:31 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the stopped state. System Information None 2013-08-19 14:03:31 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 14:03:31 Service Control Manager 7036: The Windows Management In strumentation service entered the stopped state. System Information None 2013-08-19 14:03:31 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information 1102 2013-08-19 14:03:31 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information 7010 2013-08-19 14:03:31 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Information None 2013-08-19 14:03:32 Service Control Manager 7036: The Superfetch service en tered the stopped state. System Information None 2013-08-19 14:03:32 Service Control Manager 7036: The Windows Modules Insta ller service entered the stopped state. System Information None 2013-08-19 14:03:32 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Information None 2013-08-19 14:03:32 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 14:03:32 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Information 103 2013-08-19 14:03:32 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 14:03:36 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 14:03:55 SYSTEM

Microsoft-Windows-Kernel-General 12: The access code is invali d. Information None 2013-08-19 14:03:55 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 86 2013-08-19 14:04:09 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information 4 2013-08-19 14:04:10 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Warning None 2013-08-19 14:04:15 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 14:04:22 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 14:04:22 Service Control Manager 7036: The Power service entered the running state. System Information 7010 2013-08-19 14:04:22 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Information None 2013-08-19 14:04:23 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 14:04:23 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 14:04:23 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 14:04:23 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information None 2013-08-19 14:04:24 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 14:04:24 EventLog 6005: The Event log service was started. System Information None 2013-08-19 14:04:24 EventLog 6013: The system uptime is 28 s econds. System Information None 2013-08-19 14:04:24 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 14:04:24 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 14:04:25 System

Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 14:04:25 Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 14:04:27 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 14:04:27 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 14:04:27 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 14:04:27 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 14:04:27 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 14:04:27 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 14:04:27 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 14:04:27 Service Control Manager 7036: The Security Accounts Man ager service entered the running state. System Information None 2013-08-19 14:04:28 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 14:04:28 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information 4 2013-08-19 14:04:28 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started System Information None 2013-08-19 14:04:29 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information None 2013-08-19 14:04:29 Service Control Manager 7036: The DNS Client service en tered the running state. System Information None 2013-08-19 14:04:29 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information 4 2013-08-19 14:04:29 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i s started System Information None 2013-08-19 14:04:31 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 14:04:32 Service Control Manager 7036: The Print Spooler service entered the running state. System Information None 2013-08-19 14:04:33 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information None 2013-08-19 14:04:34

Service Control Manager 7036: ice entered the running state. System Information 1101 2013-08-19 Microsoft-Windows-Winlogon 7001: or Customer Experience Improvement Program System Information None 2013-08-19 Service Control Manager 7036: ntered the running state. System Information None 2013-08-19 Service Control Manager 7036: vice service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: s service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: tered the running state. System Information None 2013-08-19 Service Control Manager 7036: king Client service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: eness service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: strumentation service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: ered the running state. System Information None 2013-08-19 Service Control Manager 7036: d the running state. System Information None 2013-08-19 Service Control Manager 7036: st service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: t service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: rator Service service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: vice entered the running state. System Information None 2013-08-19 Service Control Manager 7036: e service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: e entered the running state. System Information None 2013-08-19 Service Control Manager 7036: ervice entered the running state. System Information None 2013-08-19 Service Control Manager 7036: t Transfer Service service entered the running state. System Information None 2013-08-19

The Windows Firewall serv 14:04:34 SYSTEM User Logon Notification f 14:04:35 The Workstation service e 14:04:35 The Diagnostic Policy Ser 14:04:37 The Cryptographic Service 14:04:38 The Superfetch service en 14:04:39 The Distributed Link Trac 14:04:39 The Network Location Awar 14:04:40 The Windows Management In 14:04:43 The IP Helper service ent 14:04:46 The Server service entere 14:04:46 The Diagnostic Service Ho 14:04:47 The Diagnostic System Hos 14:04:48 The Portable Device Enume 14:04:48 The Network List Service 14:04:57 The Protected Storage ser 14:05:03 The Application Experienc 14:05:11 The Windows Search servic 14:05:26 The Network Connections s 14:06:46 The Background Intelligen 14:06:47

Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the running state. System Information None 2013-08-19 14:06:47 Service Control Manager 7036: The SSDP Discovery servic e entered the running state. System Information None 2013-08-19 14:06:48 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 14:06:48 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 14:06:49 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 14:06:50 Service Control Manager 7036: The Windows Defender serv ice entered the running state. System Information None 2013-08-19 14:06:50 Service Control Manager 7036: The Security Center servi ce entered the running state. System Information None 2013-08-19 14:06:53 Service Control Manager 7036: The Windows Update servic e entered the running state. System Information None 2013-08-19 14:07:03 Service Control Manager 7036: The Application Informati on service entered the running state. System Information None 2013-08-19 14:09:24 Service Control Manager 7036: The Multimedia Class Sche duler service entered the stopped state. System Information None 2013-08-19 14:11:58 Vic Tiangco Microsoft-Windows-GroupPolicy 1503: The Group Policy settings for the user were processed successfully. New settings from 1 Group Policy obje cts were detected and applied. System Information None 2013-08-19 14:11:59 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 14:12:45 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 14:13:32 SYSTEM Microsoft-Windows-GroupPolicy 1502: The Group Policy settings for the computer were processed successfully. New settings from 1 Group Policy objects were detected and applied. System Information None 2013-08-19 14:13:33 SYSTEM Microsoft-Windows-GroupPolicy 1500: The Group Policy settings for the computer were processed successfully. There were no changes detected si nce the last successful processing of Group Policy. System Information None 2013-08-19 14:14:02 Vic Tiangco USER32 1074: The process Explorer.EXE has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: Other (Unplanned) Reason Code: 0x0 Shutd own Type: restart Comment: System Information None 2013-08-19 14:14:03 Service Control Manager 7036: The Windows Update servic e entered the stopped state. System Information None 2013-08-19 14:14:03 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 14:14:03 Vic Tiangco USER32 1074: The process C:\Windows\sy

stem32\winlogon.exe (EMOVHICRN) has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: No title for t his reason could be found Reason Code: 0x500ff Shutdown Type: restart C omment: System Information 1102 2013-08-19 14:14:03 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information None 2013-08-19 14:14:04 EventLog 6006: The Event log service was stopped. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The DHCP Client service e ntered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Power service entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Windows Defender serv ice entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Diagnostic Service Ho st service entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Distributed Link Trac king Client service entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The SSDP Discovery servic e entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information None 2013-08-19 14:14:04 Service Control Manager 7036: The Security Center servi ce entered the stopped state. System Information 4 2013-08-19 14:14:04 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51047: DHCPv6 client service i s stopped. ShutDown Flag value is 1 System Information 4 2013-08-19 14:14:04 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50037: DHCPv4 client service is stopped. ShutDown Flag value is 1 System Information 7010 2013-08-19 14:14:04 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug

and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Information None 2013-08-19 14:14:05 Service Control Manager 7036: The Windows Management In strumentation service entered the stopped state. System Information None 2013-08-19 14:14:05 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the stopped state. System Information None 2013-08-19 14:14:05 Service Control Manager 7036: The Superfetch service en tered the stopped state. System Information None 2013-08-19 14:14:05 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Information None 2013-08-19 14:14:06 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Information 103 2013-08-19 14:14:07 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 14:14:11 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 14:14:29 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 14:14:29 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 86 2013-08-19 14:14:35 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information 4 2013-08-19 14:14:36 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Warning None 2013-08-19 14:14:41 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 14:14:45 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 14:14:45 EventLog 6005: The Event log service was started. System Information None 2013-08-19 14:14:45 EventLog 6013: The system uptime is 15 s econds. System Information None 2013-08-19 14:14:45 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 14:14:45 Service Control Manager 7036: The Power service entered the running state. System Information None 2013-08-19 14:14:45

Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 14:14:45 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 14:14:45 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 14:14:45 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 14:14:45 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 14:14:45 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information 7010 2013-08-19 14:14:45 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The Security Accounts Man ager service entered the running state. System Information None 2013-08-19 14:14:46 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 14:14:47 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information None 2013-08-19 14:14:47 Service Control Manager 7036: The DNS Client service en

tered the running state. System Information None 2013-08-19 14:14:47 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information None 2013-08-19 14:14:47 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information 4 2013-08-19 14:14:47 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started System Information 4 2013-08-19 14:14:47 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i s started System Information None 2013-08-19 14:14:48 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 14:14:48 Service Control Manager 7036: The Print Spooler service entered the running state. System Information None 2013-08-19 14:14:49 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information None 2013-08-19 14:14:49 Service Control Manager 7036: The Windows Firewall serv ice entered the running state. System Information None 2013-08-19 14:14:49 Service Control Manager 7036: The Workstation service e ntered the running state. System Information 1101 2013-08-19 14:14:49 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information None 2013-08-19 14:14:50 Service Control Manager 7036: The Cryptographic Service s service entered the running state. System Information None 2013-08-19 14:14:50 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the running state. System Information None 2013-08-19 14:14:50 Service Control Manager 7036: The Network Location Awar eness service entered the running state. System Information None 2013-08-19 14:14:50 Service Control Manager 7036: The Superfetch service en tered the running state. System Information None 2013-08-19 14:14:50 Service Control Manager 7036: The Distributed Link Trac king Client service entered the running state. System Information None 2013-08-19 14:14:50 Service Control Manager 7036: The Windows Management In strumentation service entered the running state. System Information None 2013-08-19 14:14:51 Service Control Manager 7036: The IP Helper service ent ered the running state. System Information None 2013-08-19 14:14:52 Service Control Manager 7036: The Server service entere d the running state. System Information None 2013-08-19 14:14:52 Service Control Manager 7036: The Diagnostic Service Ho st service entered the running state. System Information None 2013-08-19 14:14:52 Service Control Manager 7036: The Network List Service

service entered the running state. System Information None 2013-08-19 14:14:53 Service Control Manager 7036: The Windows Defender serv ice entered the running state. System Information None 2013-08-19 14:14:53 Service Control Manager 7036: The Diagnostic System Hos t service entered the running state. System Information None 2013-08-19 14:14:54 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 14:15:05 Service Control Manager 7036: The Network Connections s ervice entered the running state. System Information None 2013-08-19 14:15:06 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 14:16:05 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 14:16:26 Service Control Manager 7036: The Application Informati on service entered the running state. System Information None 2013-08-19 14:16:30 Service Control Manager 7036: The Secondary Logon servi ce entered the running state. System Information None 2013-08-19 14:16:39 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 14:16:39 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Information None 2013-08-19 14:16:54 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 14:16:56 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the running state. System Information None 2013-08-19 14:16:57 Service Control Manager 7036: The SSDP Discovery servic e entered the running state. System Information None 2013-08-19 14:16:58 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the running state. System Information None 2013-08-19 14:17:01 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 14:17:07 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 14:17:09 Service Control Manager 7036: The Security Center servi ce entered the running state. System Information None 2013-08-19 14:18:03 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 14:18:03 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 63 2013-08-19 14:18:08 SYSTEM

Microsoft-Windows-Kernel-Power 41: The system has rebooted wit hout cleanly shutting down first. This error could be caused if the system stopp ed responding, crashed, or lost power unexpectedly. System Information 4 2013-08-19 14:18:10 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Information 86 2013-08-19 14:18:10 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information None 2013-08-19 14:18:16 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 14:18:16 EventLog 6005: The Event log service was started. System Information None 2013-08-19 14:18:16 EventLog 6013: The system uptime is 12 s econds. System Information None 2013-08-19 14:18:16 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 14:18:16 Service Control Manager 7036: The Power service entered the running state. System Information None 2013-08-19 14:18:16 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 14:18:16 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 14:18:16 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 14:18:16 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 14:18:16 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 14:18:16 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information 7010 2013-08-19 14:18:16 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Warning None 2013-08-19 14:18:16 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 14:18:17

Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The Security Accounts Man ager service entered the running state. System Information None 2013-08-19 14:18:17 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 14:18:18 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information None 2013-08-19 14:18:18 Service Control Manager 7036: The DNS Client service en tered the running state. System Information None 2013-08-19 14:18:18 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information None 2013-08-19 14:18:18 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information 4 2013-08-19 14:18:18 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started System Information 4 2013-08-19 14:18:18 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i s started System Information None 2013-08-19 14:18:19 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 14:18:19 Service Control Manager 7036: The Print Spooler service entered the running state. System Information None 2013-08-19 14:18:20 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information None 2013-08-19 14:18:20 Service Control Manager 7036: The Windows Firewall serv ice entered the running state. System Information None 2013-08-19 14:18:20

Service Control Manager 7036: ntered the running state. System Information 1101 2013-08-19 Microsoft-Windows-Winlogon 7001: or Customer Experience Improvement Program System Information None 2013-08-19 Service Control Manager 7036: s service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: vice service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: eness service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: tered the running state. System Information None 2013-08-19 Service Control Manager 7036: king Client service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: strumentation service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: ered the running state. System Information None 2013-08-19 Service Control Manager 7036: d the running state. System Information None 2013-08-19 Service Control Manager 7036: st service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: ice entered the running state. System Information None 2013-08-19 Service Control Manager 7036: t service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: rator Service service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: ervice entered the running state. System Information None 2013-08-19 Service Control Manager 7036: e entered the running state. System Information None 2013-08-19 Service Control Manager 7036: e service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: on service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: ce entered the running state. System Information None 2013-08-19

The Workstation service e 14:18:20 SYSTEM User Logon Notification f 14:18:21 The Cryptographic Service 14:18:21 The Diagnostic Policy Ser 14:18:21 The Network Location Awar 14:18:21 The Superfetch service en 14:18:21 The Distributed Link Trac 14:18:21 The Windows Management In 14:18:21 The IP Helper service ent 14:18:23 The Server service entere 14:18:23 The Diagnostic Service Ho 14:18:23 The Network List Service 14:18:23 The Windows Defender serv 14:18:23 The Diagnostic System Hos 14:18:23 The Portable Device Enume 14:18:33 The Network Connections s 14:18:33 The Windows Search servic 14:19:20 The Application Experienc 14:19:43 The Application Informati 14:19:47 The Secondary Logon servi 14:19:53

Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 14:19:53 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Information None 2013-08-19 14:20:23 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the running state. System Information None 2013-08-19 14:20:23 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 14:20:24 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the running state. System Information None 2013-08-19 14:20:25 Service Control Manager 7036: The SSDP Discovery servic e entered the running state. System Information None 2013-08-19 14:20:25 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 14:20:26 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 14:20:26 Service Control Manager 7036: The Security Center servi ce entered the running state. System Information None 2013-08-19 14:20:28 Service Control Manager 7036: The Windows Update servic e entered the running state. System Information None 2013-08-19 14:20:58 SYSTEM Service Control Manager 7040: The start type of the pcm cia service was changed from boot start to demand start. System Information None 2013-08-19 14:20:58 SYSTEM Service Control Manager 7040: The start type of the pcm cia service was changed from demand start to boot start. System Information 7005 2013-08-19 14:20:58 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service pci for Device Instance ID PCI\VEN_1524&DEV_1 410&SUBSYS_30C4103C&REV_01\4&22BBBD73&0&30F0 with the following status: 0. System Information 7005 2013-08-19 14:20:58 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service pcmcia for Device Instance ID PCI\VEN_1524&DE V_1410&SUBSYS_30C4103C&REV_01\4&22BBBD73&0&30F0 with the following status: 0. System Information 7005 2013-08-19 14:20:59 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\ecb2kxp.inf_x86_neutral_696cf14 6fd471338\ecb2kxp.inf for Device Instance ID PCI\VEN_1524&DEV_1410&SUBSYS_30C410 3C&REV_01\4&22BBBD73&0&30F0 with the following status: 0x0. System Information 7005 2013-08-19 14:21:07 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\ich6usb.inf_x86_neutral_55333de 56c472d6f\ich6usb.inf for Device Instance ID PCI\VEN_8086&DEV_2658&SUBSYS_30C410 3C&REV_03\3&21436425&0&E8 with the following status: 0x0. System Information 7005 2013-08-19 14:21:09 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service usbehci for Device Instance ID PCI\VEN_8086&D EV_265C&SUBSYS_30C4103C&REV_03\3&21436425&0&EF with the following status: 0. System Information 7005 2013-08-19 14:21:09 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\ich6usb.inf_x86_neutral_55333de

56c472d6f\ich6usb.inf for Device Instance ID PCI\VEN_8086&DEV_265C&SUBSYS_30C410 3C&REV_03\3&21436425&0&EF with the following status: 0x0. System Information 7005 2013-08-19 14:21:12 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service intelide for Device Instance ID PCI\VEN_8086& DEV_266F&SUBSYS_30C4103C&REV_03\3&21436425&0&F9 with the following status: 0. System Information 7005 2013-08-19 14:21:12 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service intelide for Device Instance ID PCI\VEN_8086& DEV_266F&SUBSYS_30C4103C&REV_03\3&21436425&0&F9 with the following status: 0. System Information 7005 2013-08-19 14:21:32 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\ich6id2.inf_x86_neutral_3dfe645 033cbc187\ich6id2.inf for Device Instance ID PCI\VEN_8086&DEV_266F&SUBSYS_30C410 3C&REV_03\3&21436425&0&F9 with the following status: 0x0. System Information 7005 2013-08-19 14:21:35 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\915m.inf_x86_neutral_11dcda8552 c338a2\915m.inf for Device Instance ID PCI\VEN_8086&DEV_2590&SUBSYS_30C4103C&REV _03\3&21436425&0&00 with the following status: 0x0. System Information 7005 2013-08-19 14:21:38 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service msisadrv for Device Instance ID PCI\VEN_8086& DEV_2641&SUBSYS_30C4103C&REV_03\3&21436425&0&F8 with the following status: 0. System Information 7005 2013-08-19 14:21:38 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service msisadrv for Device Instance ID PCI\VEN_8086& DEV_2641&SUBSYS_30C4103C&REV_03\3&21436425&0&F8 with the following status: 0. System Information 7005 2013-08-19 14:21:38 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\ich6core.inf_x86_neutral_de120f 06592fa8da\ich6core.inf for Device Instance ID PCI\VEN_8086&DEV_2641&SUBSYS_30C4 103C&REV_03\3&21436425&0&F8 with the following status: 0x0. System Information None 2013-08-19 14:21:55 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: smserial Service File Name: system32\DRIVERS\s mserial.sys Service Type: kernel mode driver Service Start Type: demand star t Service Account: System Information 7005 2013-08-19 14:21:55 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service smserial for Device Instance ID PCI\VEN_8086& DEV_266D&SUBSYS_30C4103C&REV_03\3&21436425&0&F3 with the following status: 0. System Information None 2013-08-19 14:22:03 Service Control Manager 7036: The Telephony service ent ered the running state. System Information 7005 2013-08-19 14:22:18 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\smserial.inf_x86_neutral_81523e db05aecafc\smserial.inf for Device Instance ID PCI\VEN_8086&DEV_266D&SUBSYS_30C4 103C&REV_03\3&21436425&0&F3 with the following status: 0x0. System Information None 2013-08-19 14:22:23 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: HP Hotkey Device Service File Name: system32\D RIVERS\cpqbttn.sys Service Type: kernel mode driver Service Start Type: dema nd start Service Account: System Information 7005 2013-08-19 14:22:24 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service HBtnKey for Device Instance ID ACPI\HPQ0006\2 &DABA3FF&2 with the following status: 0. System Information 7005 2013-08-19 14:22:24 SYSTEM

Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\hphkbuttn.inf_x86_neutral_49b05 e758052cd95\hphkbuttn.inf for Device Instance ID ACPI\HPQ0006\2&DABA3FF&2 with t he following status: 0x0. System Information 7005 2013-08-19 14:22:27 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\input.inf_x86_neutral_9e1eba572 4be176f\input.inf for Device Instance ID HID\HPQ0006&COL01\3&2AD7045C&0&0000 wit h the following status: 0x0. System Information 7005 2013-08-19 14:22:28 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service kbdhid for Device Instance ID HID\HPQ0006&COL 02\3&2AD7045C&0&0001 with the following status: 0. System Information 7005 2013-08-19 14:22:29 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service kbdclass for Device Instance ID HID\HPQ0006&C OL02\3&2AD7045C&0&0001 with the following status: 0. System Information 7005 2013-08-19 14:22:29 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\keyboard.inf_x86_neutral_50ad65 9974198591\keyboard.inf for Device Instance ID HID\HPQ0006&COL02\3&2AD7045C&0&00 01 with the following status: 0x0. System Information None 2013-08-19 14:23:05 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows XP Service File Name: system32\DRIVERS\w29n51.sys Service Type: kernel mode driver Service Start Type: demand start Service Account: Information 7005 2013-08-19 14:23:05 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service w29n51 for Device Instance ID PCI\VEN_8086&DE V_4220&SUBSYS_12F6103C&REV_05\4&22BBBD73&0&20F0 with the following status: 0. System Information None 2013-08-19 14:23:07 SYSTEM Service Control Manager 7040: The start type of the WLA N AutoConfig service was changed from demand start to auto start. System Information None 2013-08-19 14:23:08 Service Control Manager 7036: The CNG Key Isolation ser vice entered the running state. System Information None 2013-08-19 14:23:08 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the running state. System Information 7005 2013-08-19 14:23:08 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\w29n51.inf_x86_neutral_b409a608 3a818595\w29n51.inf for Device Instance ID PCI\VEN_8086&DEV_4220&SUBSYS_12F6103C &REV_05\4&22BBBD73&0&20F0 with the following status: 0x0. System Information 7005 2013-08-19 14:23:11 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service tunnel for Device Instance ID ROOT\*ISATAP\00 01 with the following status: 0. System Information None 2013-08-19 14:23:12 Service Control Manager 7036: The WinHTTP Web Proxy Aut o-Discovery Service service entered the running state. System Information None 2013-08-19 14:23:14 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the running state. System Information None 2013-08-19 14:23:14 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4000: WLAN AutoConfig servic e has successfully started. System Information None 2013-08-19 14:23:15 System

Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the stopped state. System Information None 2013-08-19 14:23:15 SYSTEM Service Control Manager 7042: The TCP/IP NetBIOS Helper service was successfully sent a stop control. The reason specified was: 0x4 0030011 [Operating System: Network Connectivity (Planned)] Comment: None System Information None 2013-08-19 14:23:16 Service Control Manager 7036: The Multimedia Class Sche duler service entered the stopped state. System Information None 2013-08-19 14:23:36 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Intel(R) USB 3.0 Host Controller Switch Driver Service File Name: system32\DRIVERS\iusb3hcs.sys Service Type: kernel mode dr iver Service Start Type: boot start Service Account: System Information 7005 2013-08-19 14:23:37 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service iusb3hcs for Device Instance ID ACPI\PNP0A08\ 2&DABA3FF&2 with the following status: 0. System Information 7005 2013-08-19 14:23:37 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service pci for Device Instance ID ACPI\PNP0A08\2&DAB A3FF&2 with the following status: 0. System Information 7005 2013-08-19 14:23:39 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\iusb3hcs.inf_x86_neutral_a9efb8 78eb3021e2\iusb3hcs.inf for Device Instance ID ACPI\PNP0A08\2&DABA3FF&2 with the following status: 0x0. System Information None 2013-08-19 14:24:10 Service Control Manager 7036: The Telephony service ent ered the stopped state. System Information None 2013-08-19 14:24:30 Vic Tiangco USER32 1074: The process C:\Windows\Sy stem32\shutdown.exe (EMOVHICRN) has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: No title for t his reason could be found Reason Code: 0x800000ff Shutdown Type: restart Comment: System Information 1102 2013-08-19 14:24:32 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information None 2013-08-19 14:24:33 Service Control Manager 7036: The Windows Update servic e entered the stopped state. System Information None 2013-08-19 14:24:33 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 14:24:33 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the stopped state. System Information None 2013-08-19 14:24:34 EventLog 6006: The Event log service was stopped. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The DHCP Client service e ntered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Power service entered the stopped state.

Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Distributed Link Trac king Client service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Diagnostic Service Ho st service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The SSDP Discovery servic e entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Security Center servi ce entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Windows Management In strumentation service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Windows Defender serv ice entered the stopped state. System Information None 2013-08-19 14:24:34 Service Control Manager 7036: The Superfetch service en tered the stopped state. System Information 4 2013-08-19 14:24:34 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51047: DHCPv6 client service i s stopped. ShutDown Flag value is 1 System Information 4 2013-08-19 14:24:34 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50037: DHCPv4 client service is stopped. ShutDown Flag value is 1 System Information 7010 2013-08-19 14:24:34 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Warning None 2013-08-19 14:24:34 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4001: WLAN AutoConfig servic e has successfully stopped. System Information None 2013-08-19 14:24:35 Service Control Manager 7036: The Cryptographic Service

System

s service entered the stopped state. System Information None 2013-08-19 14:24:35 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 14:24:35 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Information 103 2013-08-19 14:24:36 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 14:24:40 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 14:24:59 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 14:24:59 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 86 2013-08-19 14:25:06 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information 4 2013-08-19 14:25:13 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Information None 2013-08-19 14:25:17 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 14:25:17 EventLog 6005: The Event log service was started. System Information None 2013-08-19 14:25:17 EventLog 6013: The system uptime is 18 s econds. System Information None 2013-08-19 14:25:17 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 14:25:17 Service Control Manager 7036: The Power service entered the running state. System Information None 2013-08-19 14:25:17 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 14:25:17 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 14:25:17 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 14:25:17 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 14:25:17 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv'

(6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information 7010 2013-08-19 14:25:17 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The Security Accounts Man ager service entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The CNG Key Isolation ser vice entered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The DNS Client service en tered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information None 2013-08-19 14:25:18 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the running state. System Information 4 2013-08-19 14:25:18 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started

System s started System

Information 4 2013-08-19 14:25:18 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i Warning E100B None 2013-08-19 14:25:18 4: There is no connection for t

his connection ID System Information None 2013-08-19 14:25:19 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the running state. System Information None 2013-08-19 14:25:19 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4000: WLAN AutoConfig servic e has successfully started. System Information None 2013-08-19 14:25:22 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information None 2013-08-19 14:25:23 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 14:25:23 Service Control Manager 7036: The Print Spooler service entered the running state. System Information None 2013-08-19 14:25:23 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information None 2013-08-19 14:25:23 Service Control Manager 7036: The Windows Firewall serv ice entered the running state. System Information None 2013-08-19 14:25:23 Service Control Manager 7036: The Workstation service e ntered the running state. System Information None 2013-08-19 14:25:23 Service Control Manager 7036: The Cryptographic Service s service entered the running state. System Information 1101 2013-08-19 14:25:23 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information None 2013-08-19 14:25:24 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the running state. System Information None 2013-08-19 14:25:24 Service Control Manager 7036: The Network Location Awar eness service entered the running state. System Information None 2013-08-19 14:25:24 Service Control Manager 7036: The Superfetch service en tered the running state. System Information None 2013-08-19 14:25:24 Service Control Manager 7036: The Distributed Link Trac king Client service entered the running state. System Information None 2013-08-19 14:25:24 Service Control Manager 7036: The Windows Management In strumentation service entered the running state. System Information None 2013-08-19 14:25:24 Service Control Manager 7036: The IP Helper service ent ered the running state. System Information None 2013-08-19 14:25:25 Service Control Manager 7036: The Server service entere d the running state. System Information None 2013-08-19 14:25:25 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the stopped state.

Information None 2013-08-19 14:25:25 Service Control Manager 7036: The Diagnostic Service Ho st service entered the running state. System Information None 2013-08-19 14:25:25 Service Control Manager 7036: The Network List Service service entered the running state. System Information None 2013-08-19 14:25:25 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 14:25:25 Service Control Manager 7036: The Diagnostic System Hos t service entered the running state. System Information None 2013-08-19 14:25:25 Service Control Manager 7036: The Windows Defender serv ice entered the running state. System Information None 2013-08-19 14:25:25 SYSTEM Service Control Manager 7042: The TCP/IP NetBIOS Helper service was successfully sent a stop control. The reason specified was: 0x4 0030011 [Operating System: Network Connectivity (Planned)] Comment: None System Information None 2013-08-19 14:25:29 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 14:25:32 Service Control Manager 7036: The Network Connections s ervice entered the running state. System Information None 2013-08-19 14:25:33 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 14:26:23 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 14:26:23 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Information None 2013-08-19 14:26:46 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: ialm Service File Name: system32\DRIVERS\igxpm p32.sys Service Type: kernel mode driver Service Start Type: demand start S ervice Account: System Information 7005 2013-08-19 14:26:48 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service ialm for Device Instance ID PCI\VEN_8086&DEV_ 2592&SUBSYS_30C4103C&REV_03\3&21436425&0&10 with the following status: 0. System Information 7005 2013-08-19 14:26:49 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\igxp32.inf_x86_neutral_4520f25b da852aac\igxp32.inf for Device Instance ID PCI\VEN_8086&DEV_2592&SUBSYS_30C4103C &REV_03\3&21436425&0&10 with the following status: 0x0. System Information 7005 2013-08-19 14:26:52 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service ialm for Device Instance ID PCI\VEN_8086&DEV_ 2792&SUBSYS_30C4103C&REV_03\3&21436425&0&11 with the following status: 0. System Information 7005 2013-08-19 14:26:56 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service ialm for Device Instance ID PCI\VEN_8086&DEV_ 2592&SUBSYS_30C4103C&REV_03\3&21436425&0&10 with the following status: 0. System Information 7005 2013-08-19 14:26:57 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\igxp32.inf_x86_neutral_4520f25b da852aac\igxp32.inf for Device Instance ID PCI\VEN_8086&DEV_2792&SUBSYS_30C4103C

System

&REV_03\3&21436425&0&11 with the following status: 0x0. System Information None 2013-08-19 14:27:25 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 14:27:25 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the running state. System Information None 2013-08-19 14:27:25 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the running state. System Information None 2013-08-19 14:27:26 Service Control Manager 7036: The SSDP Discovery servic e entered the running state. System Information None 2013-08-19 14:27:27 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 14:27:27 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 14:27:28 Service Control Manager 7036: The Security Center servi ce entered the running state. System Information None 2013-08-19 14:27:29 Service Control Manager 7036: The Windows Update servic e entered the running state. System Information None 2013-08-19 14:28:20 SYSTEM Microsoft-Windows-Application-Experience 206: The Program Comp atibility Assistant service successfully performed phase two initialization. System Information None 2013-08-19 14:28:45 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Conexant AMC Audio Service File Name: system32 \drivers\camc6aud.sys Service Type: kernel mode driver Service Start Type: d emand start Service Account: System Information None 2013-08-19 14:28:46 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: CAMCHALA Service File Name: system32\drivers\c amc6hal.sys Service Type: kernel mode driver Service Start Type: demand star t Service Account: System Information 7005 2013-08-19 14:28:46 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service CAMCAUD for Device Instance ID PCI\VEN_8086&D EV_266E&SUBSYS_30C4103C&REV_03\3&21436425&0&F2 with the following status: 0. System Information 7005 2013-08-19 14:28:47 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service CAMCHALA for Device Instance ID PCI\VEN_8086& DEV_266E&SUBSYS_30C4103C&REV_03\3&21436425&0&F2 with the following status: 0. System Information 7005 2013-08-19 14:28:49 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\vlg103ca.inf_x86_neutral_c4c16f 781df119e8\vlg103ca.inf for Device Instance ID PCI\VEN_8086&DEV_266E&SUBSYS_30C4 103C&REV_03\3&21436425&0&F2 with the following status: 0x0. System Information None 2013-08-19 14:28:50 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Microsoft Streaming Service Proxy Service File Name: system32\drivers\MSKSSRV.sys Service Type: kernel mode driver Service Start Type: demand start Service Account: System Information None 2013-08-19 14:28:51 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Microsoft Streaming Quality Manager Proxy Servi ce File Name: system32\drivers\MSPQM.sys Service Type: kernel mode driver Se

rvice Start Type: demand start Service Account: System Information 7005 2013-08-19 14:28:51 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service MSKSSRV for Device Instance ID SW\{96E080C7-1 43C-11D1-B40F-00A0C9223196}\{3C0D501A-140B-11D1-B40F-00A0C9223196} with the foll owing status: 0. System Information 7005 2013-08-19 14:28:51 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\ksfilter.inf_x86_neutral_92aac3 fbbef4a5e4\ksfilter.inf for Device Instance ID SW\{96E080C7-143C-11D1-B40F-00A0C 9223196}\{3C0D501A-140B-11D1-B40F-00A0C9223196} with the following status: 0x0. Information None 2013-08-19 14:28:52 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Microsoft Streaming Clock Proxy Service File Na me: system32\drivers\MSPCLOCK.sys Service Type: kernel mode driver Service S tart Type: demand start Service Account: System Information 7005 2013-08-19 14:28:52 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service MSPQM for Device Instance ID SW\{DDF4358E-BB2 C-11D0-A42F-00A0C9223196}\{97EBAACB-95BD-11D0-A3EA-00A0C9223196} with the follow ing status: 0. System Information 7005 2013-08-19 14:28:52 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\ksfilter.inf_x86_neutral_92aac3 fbbef4a5e4\ksfilter.inf for Device Instance ID SW\{DDF4358E-BB2C-11D0-A42F-00A0C 9223196}\{97EBAACB-95BD-11D0-A3EA-00A0C9223196} with the following status: 0x0. Information None 2013-08-19 14:28:53 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Microsoft Streaming Tee/Sink-to-Sink Converter Service File Name: system32\drivers\MSTEE.sys Service Type: kernel mode drive r Service Start Type: demand start Service Account: System Information 7005 2013-08-19 14:28:53 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service MSPCLOCK for Device Instance ID SW\{97EBAACC95BD-11D0-A3EA-00A0C9223196}\{53172480-4791-11D0-A5D6-28DB04C10000} with the fol lowing status: 0. System Information 7005 2013-08-19 14:28:53 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\ksfilter.inf_x86_neutral_92aac3 fbbef4a5e4\ksfilter.inf for Device Instance ID SW\{97EBAACC-95BD-11D0-A3EA-00A0C 9223196}\{53172480-4791-11D0-A5D6-28DB04C10000} with the following status: 0x0. Information 7005 2013-08-19 14:28:54 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service MSTEE for Device Instance ID SW\{CFD669F1-9BC 2-11D0-8299-0000F822FE8A}\{CF1DDA2C-9743-11D0-A3EE-00A0C9223196} with the follow ing status: 0. System Information 7005 2013-08-19 14:28:54 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\ksfilter.inf_x86_neutral_92aac3 fbbef4a5e4\ksfilter.inf for Device Instance ID SW\{CFD669F1-9BC2-11D0-8299-0000F 822FE8A}\{CF1DDA2C-9743-11D0-A3EE-00A0C9223196} with the following status: 0x0. Information None 2013-08-19 14:28:55 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Microsoft Trusted Audio Drivers Service File Na me: system32\drivers\drmkaud.sys Service Type: kernel mode driver Service St art Type: demand start Service Account: System System System System

Information 7005 2013-08-19 14:28:55 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service MSTEE for Device Instance ID SW\{CFD669F1-9BC 2-11D0-8299-0000F822FE8A}\{0A4252A0-7E70-11D0-A5D6-28DB04C10000} with the follow ing status: 0. System Information 7005 2013-08-19 14:28:55 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\ksfilter.inf_x86_neutral_92aac3 fbbef4a5e4\ksfilter.inf for Device Instance ID SW\{CFD669F1-9BC2-11D0-8299-0000F 822FE8A}\{0A4252A0-7E70-11D0-A5D6-28DB04C10000} with the following status: 0x0. Information 7005 2013-08-19 14:28:56 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service drmkaud for Device Instance ID SW\{EEC12DB6-A D9C-4168-8658-B03DAEF417FE}\{ABD61E00-9350-47E2-A632-4438B90C6641} with the foll owing status: 0. System Information 7005 2013-08-19 14:28:56 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\wdmaudio.inf_x86_neutral_aed2a4 456700dfde\wdmaudio.inf for Device Instance ID SW\{EEC12DB6-AD9C-4168-8658-B03DA EF417FE}\{ABD61E00-9350-47E2-A632-4438B90C6641} with the following status: 0x0. Information None 2013-08-19 14:29:43 Vic Tiangco USER32 1074: The process Explorer.EXE has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: Other (Unplanned) Reason Code: 0x0 Shutd own Type: restart Comment: System Information None 2013-08-19 14:29:46 Vic Tiangco USER32 1074: The process C:\Windows\sy stem32\winlogon.exe (EMOVHICRN) has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: No title for t his reason could be found Reason Code: 0x500ff Shutdown Type: restart C omment: System Information 1102 2013-08-19 14:29:46 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information None 2013-08-19 14:29:47 Service Control Manager 7036: The Windows Update servic e entered the stopped state. System Information None 2013-08-19 14:29:47 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 14:29:48 EventLog 6006: The Event log service was stopped. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Power service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The DHCP Client service e ntered the stopped state. System System

System

Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Distributed Link Trac king Client service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Windows Defender serv ice entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Diagnostic Service Ho st service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The SSDP Discovery servic e entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Security Center servi ce entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Windows Management In strumentation service entered the stopped state. System Information None 2013-08-19 14:29:48 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the stopped state. System Information 4 2013-08-19 14:29:48 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51047: DHCPv6 client service i s stopped. ShutDown Flag value is 1 System Information 4 2013-08-19 14:29:48 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50037: DHCPv4 client service is stopped. ShutDown Flag value is 1 System Information 7010 2013-08-19 14:29:48 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Warning None 2013-08-19 14:29:48 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4001: WLAN AutoConfig servic e has successfully stopped. System Information None 2013-08-19 14:29:49 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 14:29:49 Service Control Manager 7036: The Superfetch service en tered the stopped state. System Information None 2013-08-19 14:29:49 Service Control Manager 7036: The Cryptographic Service

System

s service entered the stopped state. System Information None 2013-08-19 14:29:49 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Information 103 2013-08-19 14:29:49 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 14:29:54 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 14:30:12 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 14:30:12 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 86 2013-08-19 14:30:19 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information 4 2013-08-19 14:30:28 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Warning None 2013-08-19 14:30:33 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 14:30:40 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 14:30:40 EventLog 6005: The Event log service was started. System Information None 2013-08-19 14:30:40 EventLog 6013: The system uptime is 27 s econds. System Information None 2013-08-19 14:30:40 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 14:30:40 Service Control Manager 7036: The Power service entered the running state. System Information None 2013-08-19 14:30:40 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 14:30:40 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 14:30:40 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 14:30:40 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 14:30:40 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv'

(6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information 7010 2013-08-19 14:30:40 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 14:30:41 Service Control Manager 7036: The Security Accounts Man ager service entered the running state. System Information None 2013-08-19 14:30:42 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information None 2013-08-19 14:30:42 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 14:30:42 Service Control Manager 7036: The CNG Key Isolation ser vice entered the running state. System Information None 2013-08-19 14:30:42 Service Control Manager 7036: The DNS Client service en tered the running state. System Information None 2013-08-19 14:30:42 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information 1101 2013-08-19 14:30:42 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information 4 2013-08-19 14:30:42 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started

System s started System

Information 4 2013-08-19 14:30:42 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i

Information None 2013-08-19 14:30:43 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the running state. System Information None 2013-08-19 14:30:43 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the running state. System Information None 2013-08-19 14:30:43 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information None 2013-08-19 14:30:43 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4000: WLAN AutoConfig servic e has successfully started. System Information None 2013-08-19 14:30:44 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 14:30:44 Service Control Manager 7036: The Print Spooler service entered the running state. System Information None 2013-08-19 14:30:44 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information None 2013-08-19 14:30:44 Service Control Manager 7036: The Windows Firewall serv ice entered the running state. System Information None 2013-08-19 14:30:44 Service Control Manager 7036: The Workstation service e ntered the running state. System Information None 2013-08-19 14:30:44 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Cryptographic Service s service entered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Superfetch service en tered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Distributed Link Trac king Client service entered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Windows Management In strumentation service entered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Network Location Awar eness service entered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The IP Helper service ent ered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Server service entere d the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the stopped state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Diagnostic Service Ho st service entered the running state.

Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Network List Service service entered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Windows Defender serv ice entered the running state. System Information None 2013-08-19 14:30:45 Service Control Manager 7036: The Diagnostic System Hos t service entered the running state. System Information None 2013-08-19 14:30:45 SYSTEM Service Control Manager 7042: The TCP/IP NetBIOS Helper service was successfully sent a stop control. The reason specified was: 0x4 0030011 [Operating System: Network Connectivity (Planned)] Comment: None System Information None 2013-08-19 14:30:52 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 14:30:53 Service Control Manager 7036: The Network Connections s ervice entered the running state. System Information 7005 2013-08-19 14:30:56 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service monitor for Device Instance ID DISPLAY\CMO152 6\4&36585A91&0&80871400&00&22 with the following status: 0. System Information 7005 2013-08-19 14:30:56 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\monitor.inf_x86_neutral_f7168ca 1d7f8ec24\monitor.inf for Device Instance ID DISPLAY\CMO1526\4&36585A91&0&808714 00&00&22 with the following status: 0x0. System Information 7005 2013-08-19 14:30:57 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service monitor for Device Instance ID DISPLAY\CMO152 6\4&7DA7843&0&80861500&00&02 with the following status: 0. System Information 7005 2013-08-19 14:30:57 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\monitor.inf_x86_neutral_f7168ca 1d7f8ec24\monitor.inf for Device Instance ID DISPLAY\CMO1526\4&7DA7843&0&8086150 0&00&02 with the following status: 0x0. System Information 7005 2013-08-19 14:30:58 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service monitor for Device Instance ID DISPLAY\CMO152 6\4&7DA7843&0&00000400&00&02 with the following status: 0. System Information 7005 2013-08-19 14:30:58 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\monitor.inf_x86_neutral_f7168ca 1d7f8ec24\monitor.inf for Device Instance ID DISPLAY\CMO1526\4&7DA7843&0&0000040 0&00&02 with the following status: 0x0. System Information None 2013-08-19 14:32:45 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the running state. System Information None 2013-08-19 14:32:45 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 14:32:46 Service Control Manager 7036: The Microsoft .NET Framew

System

ork NGEN v2.0.50727_X86 service entered the running state. System Information None 2013-08-19 14:32:47 Service Control Manager 7036: The SSDP Discovery servic e entered the running state. System Information None 2013-08-19 14:32:47 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 14:32:47 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 14:32:48 Service Control Manager 7036: The Security Center servi ce entered the running state. System Information None 2013-08-19 14:32:50 Service Control Manager 7036: The Windows Update servic e entered the running state. System Information None 2013-08-19 14:33:32 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 14:33:32 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Information None 2013-08-19 14:33:32 SYSTEM Microsoft-Windows-Application-Experience 206: The Program Comp atibility Assistant service successfully performed phase two initialization. System Information None 2013-08-19 14:33:40 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the running state. System Information None 2013-08-19 14:34:16 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the running state. System Information None 2013-08-19 14:34:16 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the running state. System Information 7005 2013-08-19 14:34:28 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\volsnap.inf_x86_neutral_42f862e 05fcb0306\volsnap.inf for Device Instance ID STORAGE\VOLUMESNAPSHOT\HARDDISKVOLU MESNAPSHOT1 with the following status: 0x0. System Information None 2013-08-19 14:35:40 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the stopped state. System Information None 2013-08-19 14:37:44 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2013-08-19 14:37:50 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 14:40:44 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the stopped state. System Information None 2013-08-19 14:41:46 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the running state. System Information None 2013-08-19 14:43:47 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the stopped state. System Information None 2013-08-19 14:45:56 Service Control Manager 7036: The WinHTTP Web Proxy Aut o-Discovery Service service entered the running state.

Information None 2013-08-19 14:46:14 Service Control Manager 7036: The Windows Image Acquisi tion (WIA) service entered the running state. System Information None 2013-08-19 14:46:34 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: Canon Inkjet Printer/Scanner/Fax Extended Survey Program Service File Name: C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE Service Type: user mode service Service Start Type: auto start Service Account: Lo calSystem System Information None 2013-08-19 14:46:36 Service Control Manager 7036: The Canon Inkjet Printer/ Scanner/Fax Extended Survey Program service entered the running state. System Information None 2013-08-19 14:46:45 Service Control Manager 7036: The Windows Image Acquisi tion (WIA) service entered the stopped state. System Information None 2013-08-19 14:47:03 Service Control Manager 7036: The Windows Image Acquisi tion (WIA) service entered the running state. System Information None 2013-08-19 14:47:34 Service Control Manager 7036: The Windows Image Acquisi tion (WIA) service entered the stopped state. System Information None 2013-08-19 14:51:31 Application Popup 26: Application popup: Cool Edi t Pro: coolpro2.exe - System Error : The program can't start because WMVCore2.DL L is missing from your computer. Try reinstalling the program to fix this proble m. System Information None 2013-08-19 14:52:10 Application Popup 26: Application popup: Cool Edi t Pro: coolpro2.exe - System Error : The program can't start because WMVCore2.DL L is missing from your computer. Try reinstalling the program to fix this proble m. System Information None 2013-08-19 14:57:16 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the running state. System Information None 2013-08-19 14:57:16 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the running state. System Information 7005 2013-08-19 14:57:24 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\volsnap.inf_x86_neutral_42f862e 05fcb0306\volsnap.inf for Device Instance ID STORAGE\VOLUMESNAPSHOT\HARDDISKVOLU MESNAPSHOT2 with the following status: 0x0. System Information None 2013-08-19 14:57:36 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: DAEMON Tools Virtual Bus Driver Service File Na me: system32\DRIVERS\dtsoftbus01.sys Service Type: kernel mode driver Servic e Start Type: demand start Service Account: System Information 7005 2013-08-19 14:57:37 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service dtsoftbus01 for Device Instance ID ROOT\SYSTE M\0001 with the following status: 0. System Information 7005 2013-08-19 14:57:39 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\dtsoftbus01.inf_x86_neutral_69c 903f7faf9ade2\dtsoftbus01.inf for Device Instance ID ROOT\SYSTEM\0001 with the f ollowing status: 0x0. System Information 7005 2013-08-19 14:57:43 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service cdrom for Device Instance ID DTSOFTBUS&REV1\D TCDROM&REV1\1&79F5D87&0&00 with the following status: 0.

System

Information 7005 2013-08-19 14:57:44 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\cdrom.inf_x86_neutral_6381e0967 5524225\cdrom.inf for Device Instance ID DTSOFTBUS&REV1\DTCDROM&REV1\1&79F5D87&0 &00 with the following status: 0x0. System Information None 2013-08-19 14:57:46 Service Control Manager 7036: The Secondary Logon servi ce entered the running state. System Information None 2013-08-19 15:00:40 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2013-08-19 15:01:36 Service Control Manager 7036: The Application Managemen t service entered the running state. System Information None 2013-08-19 15:03:18 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: Adobe Flash Player Update Service Service File Name: C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe Service Type: user mode service Service Start Type: demand start Service Account: L ocalSystem System Information None 2013-08-19 15:03:40 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the stopped state. System Information None 2013-08-19 15:03:56 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the running state. System Information None 2013-08-19 15:03:57 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the running state. System Information 7005 2013-08-19 15:04:02 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\volsnap.inf_x86_neutral_42f862e 05fcb0306\volsnap.inf for Device Instance ID STORAGE\VOLUMESNAPSHOT\HARDDISKVOLU MESNAPSHOT3 with the following status: 0x0. System Information None 2013-08-19 15:07:10 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2013-08-19 15:07:37 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the running state. System Information None 2013-08-19 15:09:13 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: WinRing0_1_2_0 Service File Name: C:\Program F iles\IObit\Game Booster 3\Driver\WinRing0.sys Service Type: kernel mode driver Service Start Type: demand start Service Account: System Information None 2013-08-19 15:09:37 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the stopped state. System Information None 2013-08-19 15:09:47 Service Control Manager 7036: The Application Experienc e service entered the stopped state. System Information None 2013-08-19 15:09:47 Service Control Manager 7036: The Application Managemen t service entered the stopped state. System Information None 2013-08-19 15:09:47 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the stopped state. System Information None 2013-08-19 15:09:47 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state.

System

Information None 2013-08-19 15:09:48 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the stopped state. System Information None 2013-08-19 15:09:48 Service Control Manager 7036: The Diagnostic Service Ho st service entered the stopped state. System Information None 2013-08-19 15:09:48 Service Control Manager 7036: The Offline Files service entered the stopped state. System Information None 2013-08-19 15:09:48 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the stopped state. System Information None 2013-08-19 15:09:48 Service Control Manager 7036: The Print Spooler service entered the stopped state. System Information None 2013-08-19 15:09:48 Service Control Manager 7036: The SSDP Discovery servic e entered the stopped state. System Information None 2013-08-19 15:09:48 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the stopped state. System Information None 2013-08-19 15:09:48 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the stopped state. System Information None 2013-08-19 15:09:48 SYSTEM Microsoft-Windows-Application-Experience 200: The Program Comp atibility Assistant service was stopped successfully. System Information None 2013-08-19 15:09:49 Service Control Manager 7036: The Themes service entere d the stopped state. System Information None 2013-08-19 15:09:49 Service Control Manager 7036: The Distributed Link Trac king Client service entered the stopped state. System Information None 2013-08-19 15:09:49 Service Control Manager 7036: The WinHTTP Web Proxy Aut o-Discovery Service service entered the stopped state. System Information None 2013-08-19 15:09:49 Service Control Manager 7036: The Canon Inkjet Printer/ Scanner/Fax Extended Survey Program service entered the stopped state. System Information None 2013-08-19 15:09:49 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the stopped state. System Information None 2013-08-19 15:09:50 Service Control Manager 7036: The IP Helper service ent ered the stopped state. System Information None 2013-08-19 15:10:07 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 15:10:13 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 15:10:13 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Information None 2013-08-19 15:11:17 Vic Tiangco Service Control Manager 7040: The start type of the Vol ume Shadow Copy service was changed from demand start to disabled. System Information None 2013-08-19 15:11:24 Vic Tiangco Service Control Manager 7040: The start type of the Vol ume Shadow Copy service was changed from disabled to demand start.

System

Information None 2013-08-19 15:11:25 Service Control Manager 7036: The Telephony service ent ered the running state. System Information None 2013-08-19 15:11:25 Service Control Manager 7036: The Secure Socket Tunneli ng Protocol Service service entered the running state. System Information None 2013-08-19 15:11:30 Service Control Manager 7036: The Remote Access Connect ion Manager service entered the running state. System Information None 2013-08-19 15:11:46 SYSTEM Microsoft-Windows-Application-Experience 206: The Program Comp atibility Assistant service successfully performed phase two initialization. System Information None 2013-08-19 15:12:01 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: IDMWFP Service File Name: system32\DRIVERS\idm wfp.sys Service Type: kernel mode driver Service Start Type: auto start Ser vice Account: System Information None 2013-08-19 15:12:07 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 15:13:44 Service Control Manager 7036: The Windows Installer ser vice entered the running state. System Information None 2013-08-19 15:13:45 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the running state. System Information None 2013-08-19 15:13:45 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the running state. System Information 7005 2013-08-19 15:13:52 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\volsnap.inf_x86_neutral_42f862e 05fcb0306\volsnap.inf for Device Instance ID STORAGE\VOLUMESNAPSHOT\HARDDISKVOLU MESNAPSHOT4 with the following status: 0x0. System Information None 2013-08-19 15:16:08 Vic Tiangco Service Control Manager 7040: The start type of the Can on Inkjet Printer/Scanner/Fax Extended Survey Program service was changed from a uto start to disabled. System Information None 2013-08-19 15:16:09 Vic Tiangco Service Control Manager 7040: The start type of the WWA N AutoConfig service was changed from demand start to disabled. System Information None 2013-08-19 15:16:09 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Driver Foundation - User-mode Driver Framework service was changed from dem and start to disabled. System Information None 2013-08-19 15:16:10 Vic Tiangco Service Control Manager 7040: The start type of the Por table Device Enumerator Service service was changed from demand start to disable d. System Information None 2013-08-19 15:16:10 Vic Tiangco Service Control Manager 7040: The start type of the Par ental Controls service was changed from demand start to disabled. System Information None 2013-08-19 15:16:10 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Media Player Network Sharing Service service was changed from demand start to disabled. System Information None 2013-08-19 15:16:11 Vic Tiangco Service Control Manager 7040: The start type of the WMI Performance Adapter service was changed from demand start to disabled. System Information None 2013-08-19 15:16:11 Vic Tiangco

System

Service Control Manager 7040: The start type of the Win dows Remote Management (WS-Management) service was changed from demand start to disabled. System Information None 2013-08-19 15:16:12 Vic Tiangco Service Control Manager 7040: The start type of the Win HTTP Web Proxy Auto-Discovery Service service was changed from demand start to d isabled. System Information None 2013-08-19 15:16:12 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Error Reporting Service service was changed from demand start to disabled. Information None 2013-08-19 15:16:13 Vic Tiangco Service Control Manager 7040: The start type of the Pro blem Reports and Solutions Control Panel Support service was changed from demand start to disabled. System Information None 2013-08-19 15:16:13 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Event Collector service was changed from demand start to disabled. System Information None 2013-08-19 15:16:13 Vic Tiangco Service Control Manager 7040: The start type of the Web Client service was changed from demand start to disabled. System Information None 2013-08-19 15:16:14 Vic Tiangco Service Control Manager 7040: The start type of the Dia gnostic System Host service was changed from demand start to disabled. System Information None 2013-08-19 15:16:14 Vic Tiangco Service Control Manager 7040: The start type of the Dia gnostic Service Host service was changed from demand start to disabled. System Information None 2013-08-19 15:16:15 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Color System service was changed from demand start to disabled. System Information None 2013-08-19 15:16:15 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Connect Now - Config Registrar service was changed from demand start to dis abled. System Information None 2013-08-19 15:16:16 Vic Tiangco Service Control Manager 7040: The start type of the Blo ck Level Backup Engine Service service was changed from demand start to disabled . System Information None 2013-08-19 15:16:16 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Biometric Service service was changed from demand start to disabled. System Information None 2013-08-19 15:16:17 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Time service was changed from demand start to disabled. System Information None 2013-08-19 15:16:17 Vic Tiangco Service Control Manager 7040: The start type of the Vir tual Disk service was changed from demand start to disabled. System Information None 2013-08-19 15:16:17 Vic Tiangco Service Control Manager 7040: The start type of the Cre dential Manager service was changed from demand start to disabled. System Information None 2013-08-19 15:16:18 Vic Tiangco Service Control Manager 7040: The start type of the Des ktop Window Manager Session Manager service was changed from auto start to disab led. System Information None 2013-08-19 15:16:18 Vic Tiangco Service Control Manager 7040: The start type of the UPn P Device Host service was changed from demand start to disabled. System Information None 2013-08-19 15:16:19 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Desktop Services UserMode Port Redirector service was changed from demand st System

art to disabled. System Information None 2013-08-19 15:16:19 Vic Tiangco Service Control Manager 7040: The start type of the Int eractive Services Detection service was changed from demand start to disabled. System Information None 2013-08-19 15:16:20 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Modules Installer service was changed from demand start to disabled. System Information None 2013-08-19 15:16:20 Vic Tiangco Service Control Manager 7040: The start type of the Dis tributed Link Tracking Client service was changed from auto start to disabled. System Information None 2013-08-19 15:16:21 Vic Tiangco Service Control Manager 7040: The start type of the Thr ead Ordering Server service was changed from demand start to disabled. System Information None 2013-08-19 15:16:21 Vic Tiangco Service Control Manager 7040: The start type of the The mes service was changed from auto start to disabled. System Information None 2013-08-19 15:16:21 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Desktop Services service was changed from demand start to disabled. System Information None 2013-08-19 15:16:22 Vic Tiangco Service Control Manager 7040: The start type of the TPM Base Services service was changed from demand start to disabled. System Information None 2013-08-19 15:16:22 Vic Tiangco Service Control Manager 7040: The start type of the Tab let PC Input Service service was changed from demand start to disabled. System Information None 2013-08-19 15:16:23 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Image Acquisition (WIA) service was changed from demand start to disabled. Information None 2013-08-19 15:16:23 Vic Tiangco Service Control Manager 7040: The start type of the SSD P Discovery service was changed from demand start to disabled. System Information None 2013-08-19 15:16:24 Vic Tiangco Service Control Manager 7040: The start type of the SPP Notification Service service was changed from demand start to disabled. System Information None 2013-08-19 15:16:24 Vic Tiangco Service Control Manager 7040: The start type of the Pri nt Spooler service was changed from auto start to disabled. System Information None 2013-08-19 15:16:24 Vic Tiangco Service Control Manager 7040: The start type of the SNM P Trap service was changed from demand start to disabled. System Information None 2013-08-19 15:16:25 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Desktop Configuration service was changed from demand start to disabled. System Information None 2013-08-19 15:16:25 Vic Tiangco Service Control Manager 7040: The start type of the Ada ptive Brightness service was changed from demand start to disabled. System Information None 2013-08-19 15:16:26 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Backup service was changed from demand start to disabled. System Information None 2013-08-19 15:16:26 Vic Tiangco Service Control Manager 7040: The start type of the Sma rt Card Removal Policy service was changed from demand start to disabled. System Information None 2013-08-19 15:16:27 Vic Tiangco Service Control Manager 7040: The start type of the Sma rt Card service was changed from demand start to disabled. System Information None 2013-08-19 15:16:27 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Procedure Call (RPC) Locator service was changed from demand start to disabl ed. System

Information None 2013-08-19 15:16:27 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Registry service was changed from demand start to disabled. System Information None 2013-08-19 15:16:28 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Access Auto Connection Manager service was changed from demand start to disa bled. System Information None 2013-08-19 15:16:28 Vic Tiangco Service Control Manager 7040: The start type of the Qua lity Windows Audio Video Experience service was changed from demand start to dis abled. System Information None 2013-08-19 15:16:29 Vic Tiangco Service Control Manager 7040: The start type of the Pro tected Storage service was changed from demand start to disabled. System Information None 2013-08-19 15:16:29 Vic Tiangco Service Control Manager 7040: The start type of the IPs ec Policy Agent service was changed from demand start to disabled. System Information None 2013-08-19 15:16:29 Vic Tiangco Service Control Manager 7040: The start type of the Pee r Name Resolution Protocol service was changed from demand start to disabled. System Information None 2013-08-19 15:16:30 Vic Tiangco Service Control Manager 7040: The start type of the PNR P Machine Name Publication Service service was changed from demand start to disa bled. System Information None 2013-08-19 15:16:30 Vic Tiangco Service Control Manager 7040: The start type of the Per formance Logs & Alerts service was changed from demand start to disabled. System Information None 2013-08-19 15:16:31 Vic Tiangco Service Control Manager 7040: The start type of the Bra nchCache service was changed from demand start to disabled. System Information None 2013-08-19 15:16:31 Vic Tiangco Service Control Manager 7040: The start type of the Pee r Networking Grouping service was changed from demand start to disabled. System Information None 2013-08-19 15:16:32 Vic Tiangco Service Control Manager 7040: The start type of the Pee r Networking Identity Manager service was changed from demand start to disabled. Information None 2013-08-19 15:16:32 Vic Tiangco Service Control Manager 7040: The start type of the Net logon service was changed from demand start to disabled. System Information None 2013-08-19 15:16:33 Vic Tiangco Service Control Manager 7040: The start type of the Net work Access Protection Agent service was changed from demand start to disabled. Information None 2013-08-19 15:16:33 Vic Tiangco Service Control Manager 7040: The start type of the Mic rosoft iSCSI Initiator Service service was changed from demand start to disabled . System Information None 2013-08-19 15:16:33 Vic Tiangco Service Control Manager 7040: The start type of the Dis tributed Transaction Coordinator service was changed from demand start to disabl ed. System Information None 2013-08-19 15:16:34 Vic Tiangco Service Control Manager 7040: The start type of the TCP /IP NetBIOS Helper service was changed from auto start to disabled. System Information None 2013-08-19 15:16:34 Vic Tiangco Service Control Manager 7040: The start type of the Lin k-Layer Topology Discovery Mapper service was changed from demand start to disab led. System Information None 2013-08-19 15:16:35 Vic Tiangco System System

System

Service Control Manager 7040: The start type of the Ktm Rm for Distributed Transaction Coordinator service was changed from demand start to disabled. System Information None 2013-08-19 15:16:35 Vic Tiangco Service Control Manager 7040: The start type of the IP Helper service was changed from auto start to disabled. System Information None 2013-08-19 15:16:36 Vic Tiangco Service Control Manager 7040: The start type of the PnP -X IP Bus Enumerator service was changed from demand start to disabled. System Information None 2013-08-19 15:16:36 Vic Tiangco Service Control Manager 7040: The start type of the IKE and AuthIP IPsec Keying Modules service was changed from demand start to disabl ed. System Information None 2013-08-19 15:16:36 Vic Tiangco Service Control Manager 7040: The start type of the Win dows CardSpace service was changed from demand start to disabled. System Information None 2013-08-19 15:16:37 Vic Tiangco Service Control Manager 7040: The start type of the Hom eGroup Provider service was changed from demand start to disabled. System Information None 2013-08-19 15:16:37 Vic Tiangco Service Control Manager 7040: The start type of the Hom eGroup Listener service was changed from demand start to disabled. System Information None 2013-08-19 15:16:38 Vic Tiangco Service Control Manager 7040: The start type of the Hea lth Key and Certificate Management service was changed from demand start to disa bled. System Information None 2013-08-19 15:16:38 Vic Tiangco Service Control Manager 7040: The start type of the Hum an Interface Device Access service was changed from demand start to disabled. System Information None 2013-08-19 15:16:38 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Presentation Foundation Font Cache 3.0.0.0 service was changed from demand start to disabled. System Information None 2013-08-19 15:16:39 Vic Tiangco Service Control Manager 7040: The start type of the Fun ction Discovery Resource Publication service was changed from demand start to di sabled. System Information None 2013-08-19 15:16:39 Vic Tiangco Service Control Manager 7040: The start type of the Fun ction Discovery Provider Host service was changed from demand start to disabled. Information None 2013-08-19 15:16:40 Vic Tiangco Service Control Manager 7040: The start type of the Fax service was changed from demand start to disabled. System Information None 2013-08-19 15:16:40 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Media Center Scheduler Service service was changed from demand start to dis abled. System Information None 2013-08-19 15:16:40 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Media Center Receiver Service service was changed from demand start to disa bled. System Information None 2013-08-19 15:16:41 Vic Tiangco Service Control Manager 7040: The start type of the Enc rypting File System (EFS) service was changed from demand start to disabled. System Information None 2013-08-19 15:16:41 Vic Tiangco Service Control Manager 7040: The start type of the Dia gnostic Policy Service service was changed from auto start to disabled. System Information None 2013-08-19 15:16:42 Vic Tiangco Service Control Manager 7040: The start type of the Wir System

ed AutoConfig service was changed from demand start to disabled. System Information None 2013-08-19 15:16:42 Vic Tiangco Service Control Manager 7040: The start type of the Dis k Defragmenter service was changed from demand start to disabled. System Information None 2013-08-19 15:16:43 Vic Tiangco Service Control Manager 7040: The start type of the Off line Files service was changed from auto start to disabled. System Information None 2013-08-19 15:16:43 Vic Tiangco Service Control Manager 7040: The start type of the COM + System Application service was changed from demand start to disabled. System Information None 2013-08-19 15:16:43 Vic Tiangco Service Control Manager 7040: The start type of the Cer tificate Propagation service was changed from demand start to disabled. System Information None 2013-08-19 15:16:44 Vic Tiangco Service Control Manager 7040: The start type of the Blu etooth Support Service service was changed from demand start to disabled. System Information None 2013-08-19 15:16:44 Vic Tiangco Service Control Manager 7040: The start type of the Com puter Browser service was changed from demand start to disabled. System Information None 2013-08-19 15:16:45 Vic Tiangco Service Control Manager 7040: The start type of the Bac kground Intelligent Transfer Service service was changed from auto start to disa bled. System Information None 2013-08-19 15:16:45 Vic Tiangco Service Control Manager 7040: The start type of the Bit Locker Drive Encryption Service service was changed from demand start to disable d. System Information None 2013-08-19 15:16:46 Vic Tiangco Service Control Manager 7040: The start type of the Act iveX Installer (AxInstSV) service was changed from demand start to disabled. System Information None 2013-08-19 15:16:46 Vic Tiangco Service Control Manager 7040: The start type of the App lication Management service was changed from demand start to disabled. System Information None 2013-08-19 15:16:46 Vic Tiangco Service Control Manager 7040: The start type of the App lication Identity service was changed from demand start to disabled. System Information None 2013-08-19 15:16:47 Vic Tiangco Service Control Manager 7040: The start type of the App lication Layer Gateway Service service was changed from demand start to disabled . System Information None 2013-08-19 15:16:47 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Update service was changed from auto start to disabled. System Information None 2013-08-19 15:16:48 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Search service was changed from auto start to disabled. System Information None 2013-08-19 15:16:48 Vic Tiangco Service Control Manager 7040: The start type of the Sec urity Center service was changed from auto start to disabled. System Information None 2013-08-19 15:16:48 Vic Tiangco Service Control Manager 7040: The start type of the WLA N AutoConfig service was changed from auto start to disabled. System Information None 2013-08-19 15:16:49 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Management Instrumentation service was changed from auto start to disabled. Information None 2013-08-19 15:16:49 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Defender service was changed from auto start to disabled. System Information None 2013-08-19 15:16:50 Vic Tiangco System

Service Control Manager 7040: The start type of the Vol ume Shadow Copy service was changed from demand start to disabled. System Information None 2013-08-19 15:16:50 Vic Tiangco Service Control Manager 7040: The start type of the Tel ephony service was changed from demand start to disabled. System Information None 2013-08-19 15:16:51 Vic Tiangco Service Control Manager 7040: The start type of the Sup erfetch service was changed from auto start to disabled. System Information None 2013-08-19 15:16:51 Vic Tiangco Service Control Manager 7040: The start type of the Mic rosoft Software Shadow Copy Provider service was changed from demand start to di sabled. System Information None 2013-08-19 15:16:51 Vic Tiangco Service Control Manager 7040: The start type of the Sec ure Socket Tunneling Protocol Service service was changed from demand start to d isabled. System Information None 2013-08-19 15:16:52 Vic Tiangco Service Control Manager 7040: The start type of the She ll Hardware Detection service was changed from auto start to disabled. System Information None 2013-08-19 15:16:52 Vic Tiangco Service Control Manager 7040: The start type of the Sys tem Event Notification Service service was changed from auto start to disabled. Information None 2013-08-19 15:16:53 Vic Tiangco Service Control Manager 7040: The start type of the Sec ondary Logon service was changed from demand start to disabled. System Information None 2013-08-19 15:16:53 Vic Tiangco Service Control Manager 7040: The start type of the Sec urity Accounts Manager service was changed from auto start to disabled. System Information None 2013-08-19 15:16:54 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Access Connection Manager service was changed from demand start to disabled. Information None 2013-08-19 15:16:54 Vic Tiangco Service Control Manager 7040: The start type of the Pow er service was changed from auto start to disabled. System Information None 2013-08-19 15:16:54 Vic Tiangco Service Control Manager 7040: The start type of the Pro gram Compatibility Assistant Service service was changed from demand start to di sabled. System Information None 2013-08-19 15:16:55 Vic Tiangco Service Control Manager 7040: The start type of the Net work Store Interface Service service was changed from auto start to disabled. System Information None 2013-08-19 15:16:55 Vic Tiangco Service Control Manager 7040: The start type of the Net work Location Awareness service was changed from auto start to disabled. System Information None 2013-08-19 15:16:56 Vic Tiangco Service Control Manager 7040: The start type of the Net work List Service service was changed from demand start to disabled. System Information None 2013-08-19 15:16:56 Vic Tiangco Service Control Manager 7040: The start type of the Net work Connections service was changed from demand start to disabled. System Information None 2013-08-19 15:16:57 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Installer service was changed from demand start to disabled. System Information None 2013-08-19 15:16:57 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Firewall service was changed from auto start to disabled. System Information None 2013-08-19 15:16:57 Vic Tiangco Service Control Manager 7040: The start type of the Mul System System

timedia Class Scheduler service was changed from auto start to disabled. System Information None 2013-08-19 15:16:58 Vic Tiangco Service Control Manager 7040: The start type of the Wor kstation service was changed from auto start to disabled. System Information None 2013-08-19 15:16:59 Vic Tiangco Service Control Manager 7040: The start type of the Ser ver service was changed from auto start to disabled. System Information None 2013-08-19 15:16:59 Vic Tiangco Service Control Manager 7040: The start type of the CNG Key Isolation service was changed from demand start to disabled. System Information None 2013-08-19 15:16:59 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Font Cache Service service was changed from auto start to disabled. System Information None 2013-08-19 15:17:00 Vic Tiangco Service Control Manager 7040: The start type of the COM + Event System service was changed from auto start to disabled. System Information None 2013-08-19 15:17:00 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Event Log service was changed from auto start to disabled. System Information None 2013-08-19 15:17:01 Vic Tiangco Service Control Manager 7040: The start type of the Ext ensible Authentication Protocol service was changed from demand start to disable d. System Information None 2013-08-19 15:17:01 Vic Tiangco Service Control Manager 7040: The start type of the DNS Client service was changed from auto start to disabled. System Information None 2013-08-19 15:17:01 Vic Tiangco Service Control Manager 7040: The start type of the DHC P Client service was changed from auto start to disabled. System Information None 2013-08-19 15:17:02 Vic Tiangco Service Control Manager 7040: The start type of the Cry ptographic Services service was changed from auto start to disabled. System Information None 2013-08-19 15:17:02 Vic Tiangco Service Control Manager 7040: The start type of the Mic rosoft .NET Framework NGEN v2.0.50727_X86 service was changed from auto start to disabled. System Information None 2013-08-19 15:17:03 Vic Tiangco Service Control Manager 7040: The start type of the Bas e Filtering Engine service was changed from auto start to disabled. System Information None 2013-08-19 15:17:03 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Audio service was changed from auto start to disabled. System Information None 2013-08-19 15:17:04 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Audio Endpoint Builder service was changed from auto start to disabled. System Information None 2013-08-19 15:17:04 Vic Tiangco Service Control Manager 7040: The start type of the App lication Experience service was changed from demand start to disabled. System Information None 2013-08-19 15:17:14 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2013-08-19 15:17:32 Vic Tiangco USER32 1074: The process C:\Windows\sy stem32\msconfig.exe (EMOVHICRN) has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: No title for t his reason could be found Reason Code: 0x40000 Shutdown Type: restart C omment: System Information 1102 2013-08-19 15:17:37 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program

Information None 2013-08-19 15:17:38 Service Control Manager 7036: The Windows Update servic e entered the stopped state. System Information None 2013-08-19 15:17:38 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 15:17:39 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the stopped state. System Information None 2013-08-19 15:17:39 Service Control Manager 7036: The Windows Installer ser vice entered the stopped state. System Information None 2013-08-19 15:17:39 SYSTEM Service Control Manager 7040: The start type of the Mic rosoft .NET Framework NGEN v2.0.50727_X86 service was changed from disabled to a uto start. System Information None 2013-08-19 15:17:40 Service Control Manager 7036: The Power service entered the stopped state. System Information None 2013-08-19 15:17:40 Service Control Manager 7036: The Secure Socket Tunneli ng Protocol Service service entered the stopped state. System Information None 2013-08-19 15:17:40 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the stopped state. System Information None 2013-08-19 15:17:40 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 15:17:40 Service Control Manager 7036: The Remote Access Connect ion Manager service entered the stopped state. System Information None 2013-08-19 15:17:40 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information 4 2013-08-19 15:17:40 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51047: DHCPv6 client service i s stopped. ShutDown Flag value is 1 System Information 4 2013-08-19 15:17:40 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50037: DHCPv4 client service is stopped. ShutDown Flag value is 1 System Information 7010 2013-08-19 15:17:40 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Information None 2013-08-19 15:17:41 Service Control Manager 7036: The DHCP Client service e ntered the stopped state. System Information None 2013-08-19 15:17:41 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the stopped state. System Information None 2013-08-19 15:17:42 Service Control Manager 7036: The Security Center servi ce entered the stopped state. System Information None 2013-08-19 15:17:42 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the stopped state. System Information None 2013-08-19 15:17:42 Service Control Manager 7036: The Windows Management In strumentation service entered the stopped state. System Information None 2013-08-19 15:17:43

System

EventLog stopped. System

6006: The Event log service was

Information None 2013-08-19 15:17:43 Service Control Manager 7036: The Superfetch service en tered the stopped state. System Information None 2013-08-19 15:17:44 Service Control Manager 7036: The Windows Defender serv ice entered the stopped state. System Information None 2013-08-19 15:17:44 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Information None 2013-08-19 15:17:45 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information None 2013-08-19 15:17:45 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the stopped state. System Information 103 2013-08-19 15:17:45 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Warning None 2013-08-19 15:17:45 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4001: WLAN AutoConfig servic e has successfully stopped. System Information None 2013-08-19 15:17:50 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Information None 2013-08-19 15:17:53 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 15:18:10 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 15:18:10 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 86 2013-08-19 15:18:18 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information 4 2013-08-19 15:18:19 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Information None 2013-08-19 15:18:54 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 15:18:54 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 15:18:54 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 15:18:54 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 15:18:54 SYSTEM

Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information 7010 2013-08-19 15:18:54 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Error None 2013-08-19 15:18:55 Service Control Manager 7001: The Task Scheduler servic e depends on the Windows Event Log service which failed to start because of the following error: %%1058 System Information None 2013-08-19 15:18:55 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 15:18:55 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 15:18:55 SYSTEM Microsoft-Windows-GroupPolicy 1502: The Group Policy settings for the computer were processed successfully. New settings from 1 Group Policy objects were detected and applied. System Information 1101 2013-08-19 15:18:55 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Warning None 2013-08-19 15:18:55 SYSTEM Microsoft-Windows-GroupPolicy 1090: Windows failed to record Resultant Set of Policy (RSoP) information, which describes the scope of Group P olicy objects applied to the computer or user. This could be caused by Windows M anagement Instrumentation (WMI) service being disabled, stopped, or other WMI er rors. Group Policy settings successfully applied to the computer or user; howeve r, management tools may not report accurately. System Information None 2013-08-19 15:20:53 Vic Tiangco Service Control Manager 7040: The start type of the Cry ptographic Services service was changed from disabled to demand start. System Information None 2013-08-19 15:20:57 Service Control Manager 7036: The Cryptographic Service s service entered the running state. System Information None 2013-08-19 15:20:57 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the running state. System Information None 2013-08-19 15:20:58 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 15:21:38 Vic Tiangco Service Control Manager 7040: The start type of the Cry ptographic Services service was changed from demand start to disabled. System Information None 2013-08-19 15:21:38 Vic Tiangco Service Control Manager 7040: The start type of the Mic rosoft .NET Framework NGEN v2.0.50727_X86 service was changed from auto start to disabled. System Information None 2013-08-19 15:21:38 Vic Tiangco Service Control Manager 7040: The start type of the Bac kground Intelligent Transfer Service service was changed from disabled to auto s tart. System Information None 2013-08-19 15:21:39 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Audio service was changed from disabled to auto start. System Information None 2013-08-19 15:21:39 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Audio Endpoint Builder service was changed from disabled to auto start.

Information None 2013-08-19 15:25:08 Vic Tiangco Service Control Manager 7040: The start type of the Net work Connections service was changed from disabled to demand start. System Information None 2013-08-19 15:25:14 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 15:25:14 SYSTEM Service Control Manager 7040: The start type of the Mic rosoft .NET Framework NGEN v2.0.50727_X86 service was changed from disabled to a uto start. System Information 1102 2013-08-19 15:25:14 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information None 2013-08-19 15:25:15 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the stopped state. System Information None 2013-08-19 15:25:15 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 15:25:15 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 15:25:15 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 15:25:15 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Information 7010 2013-08-19 15:25:15 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Information 103 2013-08-19 15:25:16 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 15:25:20 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 15:25:38 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 15:25:38 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 86 2013-08-19 15:25:46 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information 4 2013-08-19 15:25:47 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Error None 2013-08-19 15:25:53 Service Control Manager 7001: The Windows Audio service depends on the Multimedia Class Scheduler service which failed to start because of the following error: %%1058

System

Error None 2013-08-19 15:25:53 Service Control Manager 7023: The Windows Audio Endpoin t Builder service terminated with the following error: %%1722 System Information None 2013-08-19 15:25:53 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 15:25:53 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 15:25:53 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 15:25:53 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 15:25:53 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the stopped state. System Information None 2013-08-19 15:25:53 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information 7010 2013-08-19 15:25:53 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Error None 2013-08-19 15:25:54 Service Control Manager 7001: The Task Scheduler servic e depends on the Windows Event Log service which failed to start because of the following error: %%1058 System Information None 2013-08-19 15:25:54 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 15:25:54 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 15:25:58 SYSTEM Microsoft-Windows-GroupPolicy 1502: The Group Policy settings for the computer were processed successfully. New settings from 1 Group Policy objects were detected and applied. System Warning None 2013-08-19 15:25:58 SYSTEM Microsoft-Windows-GroupPolicy 1090: Windows failed to record Resultant Set of Policy (RSoP) information, which describes the scope of Group P olicy objects applied to the computer or user. This could be caused by Windows M anagement Instrumentation (WMI) service being disabled, stopped, or other WMI er rors. Group Policy settings successfully applied to the computer or user; howeve r, management tools may not report accurately. System Information 1101 2013-08-19 15:25:59 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Error None 2013-08-19 15:26:14 Service Control Manager 7001: The Network Connections s ervice depends on the Network Store Interface Service service which failed to st art because of the following error: %%1058 System Information None 2013-08-19 15:27:30 Vic Tiangco Service Control Manager 7040: The start type of the WWA N AutoConfig service was changed from disabled to demand start. System Information None 2013-08-19 15:27:31 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Driver Foundation - User-mode Driver Framework service was changed from dis

System

abled to demand start. System Information None 2013-08-19 15:27:32 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Update service was changed from disabled to auto start. System Information None 2013-08-19 15:27:32 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Search service was changed from disabled to auto start. System Information None 2013-08-19 15:27:32 Vic Tiangco Service Control Manager 7040: The start type of the Sec urity Center service was changed from disabled to auto start. System Information None 2013-08-19 15:27:33 Vic Tiangco Service Control Manager 7040: The start type of the Por table Device Enumerator Service service was changed from disabled to demand star t. System Information None 2013-08-19 15:27:33 Vic Tiangco Service Control Manager 7040: The start type of the Par ental Controls service was changed from disabled to demand start. System Information None 2013-08-19 15:27:34 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Media Player Network Sharing Service service was changed from disabled to d emand start. System Information None 2013-08-19 15:27:34 Vic Tiangco Service Control Manager 7040: The start type of the WMI Performance Adapter service was changed from disabled to demand start. System Information None 2013-08-19 15:27:35 Vic Tiangco Service Control Manager 7040: The start type of the WLA N AutoConfig service was changed from disabled to auto start. System Information None 2013-08-19 15:27:35 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Remote Management (WS-Management) service was changed from disabled to dema nd start. System Information None 2013-08-19 15:27:35 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Management Instrumentation service was changed from disabled to auto start. Information None 2013-08-19 15:27:36 Vic Tiangco Service Control Manager 7040: The start type of the Win HTTP Web Proxy Auto-Discovery Service service was changed from disabled to deman d start. System Information None 2013-08-19 15:27:36 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Defender service was changed from disabled to auto start. System Information None 2013-08-19 15:27:37 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Error Reporting Service service was changed from disabled to demand start. Information None 2013-08-19 15:27:37 Vic Tiangco Service Control Manager 7040: The start type of the Pro blem Reports and Solutions Control Panel Support service was changed from disabl ed to demand start. System Information None 2013-08-19 15:27:38 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Event Collector service was changed from disabled to demand start. System Information None 2013-08-19 15:27:38 Vic Tiangco Service Control Manager 7040: The start type of the Web Client service was changed from disabled to demand start. System Information None 2013-08-19 15:27:38 Vic Tiangco Service Control Manager 7040: The start type of the Dia gnostic System Host service was changed from disabled to demand start. System Information None 2013-08-19 15:27:39 Vic Tiangco System System

Service Control Manager 7040: The start type of the Dia gnostic Service Host service was changed from disabled to demand start. System Information None 2013-08-19 15:27:39 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Color System service was changed from disabled to demand start. System Information None 2013-08-19 15:27:40 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Connect Now - Config Registrar service was changed from disabled to demand start. System Information None 2013-08-19 15:27:40 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Biometric Service service was changed from disabled to demand start. System Information None 2013-08-19 15:27:41 Vic Tiangco Service Control Manager 7040: The start type of the Blo ck Level Backup Engine Service service was changed from disabled to demand start . System Information None 2013-08-19 15:27:41 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Time service was changed from disabled to demand start. System Information None 2013-08-19 15:27:41 Vic Tiangco Service Control Manager 7040: The start type of the Vol ume Shadow Copy service was changed from disabled to demand start. System Information None 2013-08-19 15:27:42 Vic Tiangco Service Control Manager 7040: The start type of the Vir tual Disk service was changed from disabled to demand start. System Information None 2013-08-19 15:27:42 Vic Tiangco Service Control Manager 7040: The start type of the Cre dential Manager service was changed from disabled to demand start. System Information None 2013-08-19 15:27:43 Vic Tiangco Service Control Manager 7040: The start type of the Des ktop Window Manager Session Manager service was changed from disabled to auto st art. System Information None 2013-08-19 15:27:43 Vic Tiangco Service Control Manager 7040: The start type of the UPn P Device Host service was changed from disabled to demand start. System Information None 2013-08-19 15:27:44 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Desktop Services UserMode Port Redirector service was changed from disabled to demand start. System Information None 2013-08-19 15:27:44 Vic Tiangco Service Control Manager 7040: The start type of the Int eractive Services Detection service was changed from disabled to demand start. System Information None 2013-08-19 15:27:44 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Modules Installer service was changed from disabled to demand start. System Information None 2013-08-19 15:27:45 Vic Tiangco Service Control Manager 7040: The start type of the Dis tributed Link Tracking Client service was changed from disabled to auto start. System Information None 2013-08-19 15:27:45 Vic Tiangco Service Control Manager 7040: The start type of the Thr ead Ordering Server service was changed from disabled to demand start. System Information None 2013-08-19 15:27:46 Vic Tiangco Service Control Manager 7040: The start type of the The mes service was changed from disabled to auto start. System Information None 2013-08-19 15:27:46 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Desktop Services service was changed from disabled to demand start. System Information None 2013-08-19 15:27:46 Vic Tiangco Service Control Manager 7040: The start type of the TPM Base Services service was changed from disabled to demand start.

Information None 2013-08-19 15:27:47 Vic Tiangco Service Control Manager 7040: The start type of the Tel ephony service was changed from disabled to demand start. System Information None 2013-08-19 15:27:47 Vic Tiangco Service Control Manager 7040: The start type of the Tab let PC Input Service service was changed from disabled to demand start. System Information None 2013-08-19 15:27:48 Vic Tiangco Service Control Manager 7040: The start type of the Sup erfetch service was changed from disabled to auto start. System Information None 2013-08-19 15:27:48 Vic Tiangco Service Control Manager 7040: The start type of the Mic rosoft Software Shadow Copy Provider service was changed from disabled to demand start. System Information None 2013-08-19 15:27:49 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Image Acquisition (WIA) service was changed from disabled to demand start. Information None 2013-08-19 15:27:49 Vic Tiangco Service Control Manager 7040: The start type of the Sec ure Socket Tunneling Protocol Service service was changed from disabled to deman d start. System Information None 2013-08-19 15:27:50 Vic Tiangco Service Control Manager 7040: The start type of the SSD P Discovery service was changed from disabled to demand start. System Information None 2013-08-19 15:27:50 Vic Tiangco Service Control Manager 7040: The start type of the SPP Notification Service service was changed from disabled to demand start. System Information None 2013-08-19 15:27:51 Vic Tiangco Service Control Manager 7040: The start type of the Pri nt Spooler service was changed from disabled to auto start. System Information None 2013-08-19 15:27:51 Vic Tiangco Service Control Manager 7040: The start type of the SNM P Trap service was changed from disabled to demand start. System Information None 2013-08-19 15:27:51 Vic Tiangco Service Control Manager 7040: The start type of the She ll Hardware Detection service was changed from disabled to auto start. System Information None 2013-08-19 15:27:52 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Desktop Configuration service was changed from disabled to demand start. System Information None 2013-08-19 15:27:52 Vic Tiangco Service Control Manager 7040: The start type of the Ada ptive Brightness service was changed from disabled to demand start. System Information None 2013-08-19 15:27:53 Vic Tiangco Service Control Manager 7040: The start type of the Sys tem Event Notification Service service was changed from disabled to auto start. Information None 2013-08-19 15:27:53 Vic Tiangco Service Control Manager 7040: The start type of the Sec ondary Logon service was changed from disabled to demand start. System Information None 2013-08-19 15:27:54 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Backup service was changed from disabled to demand start. System Information None 2013-08-19 15:27:54 Vic Tiangco Service Control Manager 7040: The start type of the Sma rt Card Removal Policy service was changed from disabled to demand start. System Error None 2013-08-19 15:27:55 Service Control Manager 7001: The Background Intelligen t Transfer Service service depends on the COM+ Event System service which failed to start because of the following error: %%1058 System Information None 2013-08-19 15:27:55 Vic Tiangco System System

System

Service Control Manager 7040: The start type of the Sma rt Card service was changed from disabled to demand start. System Information None 2013-08-19 15:27:55 Vic Tiangco Service Control Manager 7040: The start type of the Sec urity Accounts Manager service was changed from disabled to auto start. System Information None 2013-08-19 15:27:56 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the running state. System Information None 2013-08-19 15:27:56 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Procedure Call (RPC) Locator service was changed from disabled to demand sta rt. System Information None 2013-08-19 15:27:57 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 15:27:57 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Registry service was changed from disabled to demand start. System Information None 2013-08-19 15:27:57 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Access Connection Manager service was changed from disabled to demand start. Information None 2013-08-19 15:27:57 Vic Tiangco Service Control Manager 7040: The start type of the Rem ote Access Auto Connection Manager service was changed from disabled to demand s tart. System Information None 2013-08-19 15:27:58 Vic Tiangco Service Control Manager 7040: The start type of the Qua lity Windows Audio Video Experience service was changed from disabled to demand start. System Information None 2013-08-19 15:27:58 Vic Tiangco Service Control Manager 7040: The start type of the Pro tected Storage service was changed from disabled to demand start. System Information None 2013-08-19 15:27:59 Vic Tiangco Service Control Manager 7040: The start type of the Pow er service was changed from disabled to auto start. System Information None 2013-08-19 15:27:59 Vic Tiangco Service Control Manager 7040: The start type of the IPs ec Policy Agent service was changed from disabled to demand start. System Information None 2013-08-19 15:28:00 Vic Tiangco Service Control Manager 7040: The start type of the Pee r Name Resolution Protocol service was changed from disabled to demand start. System Information None 2013-08-19 15:28:00 Vic Tiangco Service Control Manager 7040: The start type of the PNR P Machine Name Publication Service service was changed from disabled to demand s tart. System Information None 2013-08-19 15:28:01 Vic Tiangco Service Control Manager 7040: The start type of the Per formance Logs & Alerts service was changed from disabled to demand start. System Information None 2013-08-19 15:28:01 Vic Tiangco Service Control Manager 7040: The start type of the Bra nchCache service was changed from disabled to demand start. System Information None 2013-08-19 15:28:01 Vic Tiangco Service Control Manager 7040: The start type of the Pro gram Compatibility Assistant Service service was changed from disabled to demand start. System Information None 2013-08-19 15:28:02 Vic Tiangco Service Control Manager 7040: The start type of the Pee r Networking Grouping service was changed from disabled to demand start. System Information None 2013-08-19 15:28:02 Vic Tiangco System

Service Control Manager 7040: The start type of the Pee r Networking Identity Manager service was changed from disabled to demand start. Information None 2013-08-19 15:28:03 Vic Tiangco Service Control Manager 7040: The start type of the Net work Store Interface Service service was changed from disabled to auto start. System Information None 2013-08-19 15:28:03 Vic Tiangco Service Control Manager 7040: The start type of the Net work Location Awareness service was changed from disabled to auto start. System Information None 2013-08-19 15:28:04 Vic Tiangco Service Control Manager 7040: The start type of the Net work List Service service was changed from disabled to demand start. System Information None 2013-08-19 15:28:04 Vic Tiangco Service Control Manager 7040: The start type of the Net logon service was changed from disabled to demand start. System Information None 2013-08-19 15:28:04 Vic Tiangco Service Control Manager 7040: The start type of the Net work Access Protection Agent service was changed from disabled to demand start. Information None 2013-08-19 15:28:05 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Installer service was changed from disabled to demand start. System Information None 2013-08-19 15:28:05 Vic Tiangco Service Control Manager 7040: The start type of the Mic rosoft iSCSI Initiator Service service was changed from disabled to demand start . System Information None 2013-08-19 15:28:06 Vic Tiangco Service Control Manager 7040: The start type of the Dis tributed Transaction Coordinator service was changed from disabled to demand sta rt. System Information None 2013-08-19 15:28:06 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Firewall service was changed from disabled to auto start. System Information None 2013-08-19 15:28:07 Vic Tiangco Service Control Manager 7040: The start type of the Mul timedia Class Scheduler service was changed from disabled to auto start. System Information None 2013-08-19 15:28:07 Vic Tiangco Service Control Manager 7040: The start type of the TCP /IP NetBIOS Helper service was changed from disabled to auto start. System Information None 2013-08-19 15:28:07 Vic Tiangco Service Control Manager 7040: The start type of the Lin k-Layer Topology Discovery Mapper service was changed from disabled to demand st art. System Information None 2013-08-19 15:28:08 Vic Tiangco Service Control Manager 7040: The start type of the Wor kstation service was changed from disabled to auto start. System Information None 2013-08-19 15:28:08 Vic Tiangco Service Control Manager 7040: The start type of the Ser ver service was changed from disabled to auto start. System Information None 2013-08-19 15:28:09 Vic Tiangco Service Control Manager 7040: The start type of the Ktm Rm for Distributed Transaction Coordinator service was changed from disabled to demand start. System Information None 2013-08-19 15:28:09 Vic Tiangco Service Control Manager 7040: The start type of the CNG Key Isolation service was changed from disabled to demand start. System Information None 2013-08-19 15:28:09 Vic Tiangco Service Control Manager 7040: The start type of the IP Helper service was changed from disabled to auto start. System Information None 2013-08-19 15:28:10 Vic Tiangco System System

Service Control Manager 7040: The start type of the PnP -X IP Bus Enumerator service was changed from disabled to demand start. System Information None 2013-08-19 15:28:10 Vic Tiangco Service Control Manager 7040: The start type of the IKE and AuthIP IPsec Keying Modules service was changed from disabled to demand sta rt. System Information None 2013-08-19 15:28:11 Vic Tiangco Service Control Manager 7040: The start type of the Can on Inkjet Printer/Scanner/Fax Extended Survey Program service was changed from d isabled to auto start. System Information None 2013-08-19 15:28:11 Vic Tiangco Service Control Manager 7040: The start type of the Win dows CardSpace service was changed from disabled to demand start. System Information None 2013-08-19 15:28:12 Vic Tiangco Service Control Manager 7040: The start type of the Hom eGroup Provider service was changed from disabled to demand start. System Information None 2013-08-19 15:28:12 Vic Tiangco Service Control Manager 7040: The start type of the Hom eGroup Listener service was changed from disabled to demand start. System Information None 2013-08-19 15:28:12 Vic Tiangco Service Control Manager 7040: The start type of the Hea lth Key and Certificate Management service was changed from disabled to demand s tart. System Information None 2013-08-19 15:28:13 Vic Tiangco Service Control Manager 7040: The start type of the Hum an Interface Device Access service was changed from disabled to demand start. System Information None 2013-08-19 15:28:13 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Presentation Foundation Font Cache 3.0.0.0 service was changed from disable d to demand start. System Information None 2013-08-19 15:28:14 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Font Cache Service service was changed from disabled to auto start. System Information None 2013-08-19 15:28:14 Vic Tiangco Service Control Manager 7040: The start type of the Fun ction Discovery Resource Publication service was changed from disabled to demand start. System Information None 2013-08-19 15:28:15 Vic Tiangco Service Control Manager 7040: The start type of the Fun ction Discovery Provider Host service was changed from disabled to demand start. Information None 2013-08-19 15:28:15 Vic Tiangco Service Control Manager 7040: The start type of the Fax service was changed from disabled to demand start. System Information None 2013-08-19 15:28:16 Vic Tiangco Service Control Manager 7040: The start type of the COM + Event System service was changed from disabled to auto start. System Information None 2013-08-19 15:28:16 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Event Log service was changed from disabled to auto start. System Information None 2013-08-19 15:28:16 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Media Center Scheduler Service service was changed from disabled to demand start. System Information None 2013-08-19 15:28:17 Vic Tiangco Service Control Manager 7040: The start type of the Win dows Media Center Receiver Service service was changed from disabled to demand s tart. System Information None 2013-08-19 15:28:17 Vic Tiangco Service Control Manager 7040: The start type of the Enc System

rypting File System (EFS) service was changed from disabled to demand start. System Information None 2013-08-19 15:28:18 Vic Tiangco Service Control Manager 7040: The start type of the Ext ensible Authentication Protocol service was changed from disabled to demand star t. System Information None 2013-08-19 15:28:18 Vic Tiangco Service Control Manager 7040: The start type of the Dia gnostic Policy Service service was changed from disabled to auto start. System Information None 2013-08-19 15:28:19 Vic Tiangco Service Control Manager 7040: The start type of the Wir ed AutoConfig service was changed from disabled to demand start. System Information None 2013-08-19 15:28:19 Vic Tiangco Service Control Manager 7040: The start type of the DNS Client service was changed from disabled to auto start. System Information None 2013-08-19 15:28:19 Vic Tiangco Service Control Manager 7040: The start type of the DHC P Client service was changed from disabled to auto start. System Information None 2013-08-19 15:28:20 Vic Tiangco Service Control Manager 7040: The start type of the Dis k Defragmenter service was changed from disabled to demand start. System Information None 2013-08-19 15:28:20 Vic Tiangco Service Control Manager 7040: The start type of the Off line Files service was changed from disabled to auto start. System Information None 2013-08-19 15:28:21 Vic Tiangco Service Control Manager 7040: The start type of the Cry ptographic Services service was changed from disabled to demand start. System Information None 2013-08-19 15:28:21 Vic Tiangco Service Control Manager 7040: The start type of the COM + System Application service was changed from disabled to demand start. System Information None 2013-08-19 15:28:21 Vic Tiangco Service Control Manager 7040: The start type of the Cer tificate Propagation service was changed from disabled to demand start. System Information None 2013-08-19 15:28:22 Vic Tiangco Service Control Manager 7040: The start type of the Blu etooth Support Service service was changed from disabled to demand start. System Information None 2013-08-19 15:28:22 Vic Tiangco Service Control Manager 7040: The start type of the Com puter Browser service was changed from disabled to demand start. System Information None 2013-08-19 15:28:23 Vic Tiangco Service Control Manager 7040: The start type of the Bas e Filtering Engine service was changed from disabled to auto start. System Information None 2013-08-19 15:28:23 Vic Tiangco Service Control Manager 7040: The start type of the Bit Locker Drive Encryption Service service was changed from disabled to demand star t. System Information None 2013-08-19 15:28:24 Vic Tiangco Service Control Manager 7040: The start type of the Act iveX Installer (AxInstSV) service was changed from disabled to demand start. System Information None 2013-08-19 15:28:24 Vic Tiangco Service Control Manager 7040: The start type of the App lication Management service was changed from disabled to demand start. System Information None 2013-08-19 15:28:24 Vic Tiangco Service Control Manager 7040: The start type of the App lication Identity service was changed from disabled to demand start. System Information None 2013-08-19 15:28:25 Vic Tiangco Service Control Manager 7040: The start type of the App lication Layer Gateway Service service was changed from disabled to demand start . System Information None 2013-08-19 15:28:25 Vic Tiangco Service Control Manager 7040: The start type of the App

lication Experience service was changed from disabled to demand start. System Information None 2013-08-19 15:28:42 Vic Tiangco Service Control Manager 7040: The start type of the Can on Inkjet Printer/Scanner/Fax Extended Survey Program service was changed from a uto start to disabled. System Information None 2013-08-19 15:28:46 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information 1102 2013-08-19 15:28:47 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information None 2013-08-19 15:28:48 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 15:28:48 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v2.0.50727_X86 service entered the stopped state. System Information None 2013-08-19 15:28:48 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 15:28:48 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 15:28:48 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information 7010 2013-08-19 15:28:48 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Information 103 2013-08-19 15:28:49 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 15:28:53 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 15:29:12 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 15:29:12 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 86 2013-08-19 15:29:19 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information 4 2013-08-19 15:29:21 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Information None 2013-08-19 15:29:27 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 15:29:27 EventLog 6005: The Event log service was started.

System econds. System

Information EventLog

None

2013-08-19 15:29:27 6013: The system uptime is 15 s

Information None 2013-08-19 15:29:27 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 15:29:27 Service Control Manager 7036: The Power service entered the running state. System Information None 2013-08-19 15:29:27 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 15:29:27 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 15:29:27 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 15:29:27 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 15:29:27 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 15:29:27 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information 7010 2013-08-19 15:29:27 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Warning None 2013-08-19 15:29:27 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 15:29:28

Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The Security Accounts Man ager service entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The CNG Key Isolation ser vice entered the running state. System Information None 2013-08-19 15:29:28 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the running state. System Information None 2013-08-19 15:29:29 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information None 2013-08-19 15:29:29 Service Control Manager 7036: The DNS Client service en tered the running state. System Information None 2013-08-19 15:29:29 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information 4 2013-08-19 15:29:29 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started System Information 4 2013-08-19 15:29:29 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i s started System Information None 2013-08-19 15:29:30 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the running state. System Information None 2013-08-19 15:29:30 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information None 2013-08-19 15:29:30 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4000: WLAN AutoConfig servic e has successfully started. System Information None 2013-08-19 15:29:31 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 15:29:32 Service Control Manager 7036: The Print Spooler service entered the running state. System Information None 2013-08-19 15:29:32 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information None 2013-08-19 15:29:33 Service Control Manager 7036: The Windows Firewall serv ice entered the running state. System Information None 2013-08-19 15:29:33 Service Control Manager 7036: The Workstation service e ntered the running state. System Information None 2013-08-19 15:29:34 Service Control Manager 7036: The Network Location Awar eness service entered the running state. System Information None 2013-08-19 15:29:34 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the running state. System Information None 2013-08-19 15:29:34

Service Control Manager 7036: The Superfetch service en tered the running state. System Information None 2013-08-19 15:29:34 Service Control Manager 7036: The Distributed Link Trac king Client service entered the running state. System Information None 2013-08-19 15:29:35 Service Control Manager 7036: The Windows Management In strumentation service entered the running state. System Information None 2013-08-19 15:29:35 Service Control Manager 7036: The IP Helper service ent ered the running state. System Information 1101 2013-08-19 15:29:36 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information None 2013-08-19 15:29:38 Service Control Manager 7036: The Server service entere d the running state. System Information None 2013-08-19 15:29:38 Service Control Manager 7036: The Diagnostic Service Ho st service entered the running state. System Information None 2013-08-19 15:29:38 Service Control Manager 7036: The Network List Service service entered the running state. System Information None 2013-08-19 15:29:38 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 15:29:38 Service Control Manager 7036: The Diagnostic System Hos t service entered the running state. System Information None 2013-08-19 15:29:53 Service Control Manager 7036: The Network Connections s ervice entered the running state. System Information None 2013-08-19 15:30:01 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 15:30:02 Service Control Manager 7036: The Windows Defender serv ice entered the running state. System Information None 2013-08-19 15:30:02 Service Control Manager 7036: The Cryptographic Service s service entered the running state. System Information None 2013-08-19 15:30:03 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 15:30:39 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 15:30:39 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Information None 2013-08-19 15:31:30 Service Control Manager 7036: The Windows Update servic e entered the running state. System Information None 2013-08-19 15:31:33 Service Control Manager 7036: The Windows Installer ser vice entered the running state. System Information 1 2013-08-19 15:31:37 SYSTEM Microsoft-Windows-WindowsUpdateClient 27: Automatic Updates is now paused. System Information None 2013-08-19 15:31:41 Vic Tiangco

Service Control Manager 7040: The start type of the Mic rosoft .NET Framework NGEN v2.0.50727_X86 service was changed from auto start to disabled. System Information None 2013-08-19 15:31:43 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the running state. System Information None 2013-08-19 15:31:43 SYSTEM Microsoft-Windows-Application-Experience 206: The Program Comp atibility Assistant service successfully performed phase two initialization. System Information None 2013-08-19 15:31:50 Service Control Manager 7036: The SSDP Discovery servic e entered the running state. System Information None 2013-08-19 15:31:56 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 15:32:02 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 15:32:03 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 15:32:11 Service Control Manager 7036: The Security Center servi ce entered the running state. System Information None 2013-08-19 15:33:03 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Net.Tcp Listener Adapter Service File Name: C: \Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe Service Type: user m ode service Service Start Type: disabled Service Account: NT AUTHORITY\Local Service System Information None 2013-08-19 15:33:54 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Net.Pipe Listener Adapter Service File Name: C :\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe Service Type: user mode service Service Start Type: disabled Service Account: NT AUTHORITY\Loca lService System Information None 2013-08-19 15:34:13 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Net.Msmq Listener Adapter Service File Name: " C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe" -NetMsmqActivator Service Type: user mode service Service Start Type: disabled Service Account : NT AUTHORITY\NetworkService System Information None 2013-08-19 15:34:33 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Microsoft .NET Framework NGEN v4.0.30319_X86 Se rvice File Name: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe Se rvice Type: user mode service Service Start Type: auto start Service Account : LocalSystem System Information None 2013-08-19 15:34:41 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: ASP.NET State Service Service File Name: %Syst emRoot%\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe Service Type: user mode service Service Start Type: disabled Service Account: LocalSystem System Information None 2013-08-19 15:35:08 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v4.0.30319_X86 service entered the running state. System Information None 2013-08-19 15:35:48 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the running state. System Information None 2013-08-19 15:35:49

Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the running state. System Information 7005 2013-08-19 15:36:26 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\volsnap.inf_x86_neutral_42f862e 05fcb0306\volsnap.inf for Device Instance ID STORAGE\VOLUMESNAPSHOT\HARDDISKVOLU MESNAPSHOT5 with the following status: 0x0. System Information None 2013-08-19 15:37:21 Service Control Manager 7036: The Windows Installer ser vice entered the stopped state. System Information 1 2013-08-19 15:37:26 SYSTEM Microsoft-Windows-WindowsUpdateClient 28: Automatic Updates is now resumed. System Information None 2013-08-19 15:39:42 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 15:39:46 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2013-08-19 15:40:16 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: TeamViewer 8 Service File Name: "C:\Program Fi les\TeamViewer\Version8\TeamViewer_Service.exe" Service Type: user mode servic e Service Start Type: auto start Service Account: LocalSystem System Information None 2013-08-19 15:40:49 Service Control Manager 7036: The TeamViewer 8 service entered the running state. System Information None 2013-08-19 15:40:51 Service Control Manager 7036: The WinHTTP Web Proxy Aut o-Discovery Service service entered the running state. System Error None 2013-08-19 15:41:04 Service Control Manager 7031: The TeamViewer 8 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 2000 milliseconds: Restart the service. System Information None 2013-08-19 15:41:06 Service Control Manager 7036: The TeamViewer 8 service entered the running state. System Information None 2013-08-19 15:42:34 volsnap 33: The oldest shadow copy of v olume C: was deleted to keep disk space usage for shadow copies of volume C: bel ow the user defined limit. System Information None 2013-08-19 15:42:46 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the stopped state. System Information None 2013-08-19 15:45:04 Vic Tiangco USER32 1074: The process Explorer.EXE has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: Other (Unplanned) Reason Code: 0x0 Shutd own Type: restart Comment: System Information None 2013-08-19 15:45:08 Vic Tiangco USER32 1074: The process C:\Windows\sy stem32\winlogon.exe (EMOVHICRN) has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: No title for t his reason could be found Reason Code: 0x500ff Shutdown Type: restart C omment: System Information 1102 2013-08-19 15:45:08 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information None 2013-08-19 15:45:09 Service Control Manager 7036: The Windows Update servic

e entered the stopped state. System Information None 2013-08-19 15:45:09 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 15:45:09 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v4.0.30319_X86 service entered the stopped state. System Information None 2013-08-19 15:45:10 EventLog 6006: The Event log service was stopped. System Information None 2013-08-19 15:45:10 Service Control Manager 7036: The Power service entered the stopped state. System Information None 2013-08-19 15:45:10 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 15:45:10 Service Control Manager 7036: The DHCP Client service e ntered the stopped state. System Information None 2013-08-19 15:45:10 Service Control Manager 7036: The Distributed Link Trac king Client service entered the stopped state. System Information None 2013-08-19 15:45:10 Service Control Manager 7036: The Diagnostic Service Ho st service entered the stopped state. System Information None 2013-08-19 15:45:10 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the stopped state. System Information None 2013-08-19 15:45:10 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 15:45:10 Service Control Manager 7036: The TeamViewer 8 service entered the stopped state. System Information None 2013-08-19 15:45:10 Service Control Manager 7036: The SSDP Discovery servic e entered the stopped state. System Information None 2013-08-19 15:45:10 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information 4 2013-08-19 15:45:10 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51047: DHCPv6 client service i s stopped. ShutDown Flag value is 1 System Information 4 2013-08-19 15:45:10 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50037: DHCPv4 client service is stopped. ShutDown Flag value is 1 System Information 7010 2013-08-19 15:45:10 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Information None 2013-08-19 15:45:11 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the stopped state. System Information None 2013-08-19 15:45:12 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the stopped state. System Information None 2013-08-19 15:45:12 Service Control Manager 7036: The Security Center servi ce entered the stopped state. System Information None 2013-08-19 15:45:12

Service Control Manager 7036: The Windows Management In strumentation service entered the stopped state. System Information None 2013-08-19 15:45:12 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the stopped state. System Information None 2013-08-19 15:45:13 Service Control Manager 7036: The Windows Defender serv ice entered the stopped state. System Information None 2013-08-19 15:45:13 Service Control Manager 7036: The Superfetch service en tered the stopped state. System Information None 2013-08-19 15:45:14 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the stopped state. System Information None 2013-08-19 15:45:14 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Warning None 2013-08-19 15:45:14 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4001: WLAN AutoConfig servic e has successfully stopped. System Information None 2013-08-19 15:45:15 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information 103 2013-08-19 15:45:15 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 15:45:19 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Information None 2013-08-19 15:45:21 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 15:45:40 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 15:45:40 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 86 2013-08-19 15:45:49 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information 4 2013-08-19 15:45:51 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Warning None 2013-08-19 15:45:56 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 15:46:21 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 15:46:21 Service Control Manager 7036: The Power service entered the running state. System Information None 2013-08-19 15:46:21

Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 15:46:21 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 15:46:21 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 15:46:21 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information 7010 2013-08-19 15:46:21 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Information None 2013-08-19 15:46:22 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 15:46:22 EventLog 6005: The Event log service was started. System Information None 2013-08-19 15:46:22 EventLog 6013: The system uptime is 41 s econds. System Information None 2013-08-19 15:46:22 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 15:46:22 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 15:46:23 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 15:46:23 Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 15:46:23 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 15:46:23 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 15:46:23 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 15:46:23 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 15:46:23 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 15:46:24 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 15:46:24 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 15:46:24 Service Control Manager 7036: The Security Accounts Man

ager service entered the running state. System Information None 2013-08-19 15:46:24 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information None 2013-08-19 15:46:24 Service Control Manager 7036: The CNG Key Isolation ser vice entered the running state. System Information None 2013-08-19 15:46:24 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 15:46:24 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information None 2013-08-19 15:46:24 Service Control Manager 7036: The DNS Client service en tered the running state. System Information 1101 2013-08-19 15:46:24 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information 4 2013-08-19 15:46:24 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started System Information 4 2013-08-19 15:46:24 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i s started System Information None 2013-08-19 15:46:25 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the running state. System Information None 2013-08-19 15:46:25 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the running state. System Information None 2013-08-19 15:46:25 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information None 2013-08-19 15:46:25 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 15:46:25 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4000: WLAN AutoConfig servic e has successfully started. System Information None 2013-08-19 15:46:26 Service Control Manager 7036: The Print Spooler service entered the running state. System Information None 2013-08-19 15:46:26 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information None 2013-08-19 15:46:26 Service Control Manager 7036: The Windows Firewall serv ice entered the running state. System Information None 2013-08-19 15:46:26 Service Control Manager 7036: The Workstation service e ntered the running state. System Information None 2013-08-19 15:46:26 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the running state. System Information None 2013-08-19 15:46:27 Service Control Manager 7036: The Superfetch service en tered the running state. System Information None 2013-08-19 15:46:27 Service Control Manager 7036: The Network Location Awar

eness service entered the running state. System Information None 2013-08-19 15:46:31 Service Control Manager 7036: The Distributed Link Trac king Client service entered the running state. System Information None 2013-08-19 15:46:31 Service Control Manager 7036: The Windows Management In strumentation service entered the running state. System Information None 2013-08-19 15:46:31 Service Control Manager 7036: The IP Helper service ent ered the running state. System Information None 2013-08-19 15:46:31 Service Control Manager 7036: The Server service entere d the running state. System Information None 2013-08-19 15:46:43 Service Control Manager 7036: The TeamViewer 8 service entered the running state. System Information None 2013-08-19 15:46:43 Service Control Manager 7036: The Diagnostic Service Ho st service entered the running state. System Information None 2013-08-19 15:46:43 Service Control Manager 7036: The Network List Service service entered the running state. System Information None 2013-08-19 15:46:43 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 15:46:43 Service Control Manager 7036: The Diagnostic System Hos t service entered the running state. System Information None 2013-08-19 15:46:43 Service Control Manager 7036: The Windows Defender serv ice entered the running state. System Information None 2013-08-19 15:46:44 Service Control Manager 7036: The Cryptographic Service s service entered the running state. System Information None 2013-08-19 15:46:44 Service Control Manager 7036: The Network Connections s ervice entered the running state. System Information None 2013-08-19 15:46:48 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 15:47:23 Service Control Manager 7036: The Application Managemen t service entered the running state. System Information None 2013-08-19 15:47:33 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 15:47:33 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Information None 2013-08-19 15:47:49 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 15:48:17 SYSTEM Microsoft-Windows-Application-Experience 206: The Program Comp atibility Assistant service successfully performed phase two initialization. System Information None 2013-08-19 15:48:25 Service Control Manager 7036: The Windows Installer ser vice entered the running state. System Information None 2013-08-19 15:48:42 Service Control Manager 7036: The Windows Update servic

e entered the running state. System Information None 2013-08-19 15:48:43 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 15:48:49 Service Control Manager 7036: The WinHTTP Web Proxy Aut o-Discovery Service service entered the running state. System Information None 2013-08-19 15:48:50 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the running state. System Information None 2013-08-19 15:48:52 Service Control Manager 7036: The SSDP Discovery servic e entered the running state. System Information None 2013-08-19 15:48:56 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v4.0.30319_X86 service entered the running state. System Information None 2013-08-19 15:48:57 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 15:48:57 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 15:48:58 Service Control Manager 7036: The Security Center servi ce entered the running state. System Information None 2013-08-19 15:49:32 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the running state. System Information None 2013-08-19 15:49:32 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the running state. System Information None 2013-08-19 15:49:50 volsnap 33: The oldest shadow copy of v olume C: was deleted to keep disk space usage for shadow copies of volume C: bel ow the user defined limit. System Information None 2013-08-19 15:49:57 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Skype Updater Service File Name: "C:\Program F iles\Skype\Updater\Updater.exe" Service Type: user mode service Service Start Type: auto start Service Account: LocalSystem System Information None 2013-08-19 15:50:11 Service Control Manager 7036: The Skype Updater service entered the running state. System Information None 2013-08-19 15:51:12 Service Control Manager 7036: The Skype Updater service entered the stopped state. System Information 7005 2013-08-19 15:52:32 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service USBSTOR for Device Instance ID USB\VID_1058&P ID_1023\575844314132313233303135 with the following status: 0. System Information 7005 2013-08-19 15:52:33 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\usbstor.inf_x86_neutral_c77d41a 490bdc63d\usbstor.inf for Device Instance ID USB\VID_1058&PID_1023\5758443141323 13233303135 with the following status: 0x0. System Information 7005 2013-08-19 15:52:39 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service disk for Device Instance ID USBSTOR\DISK&VEN_ WD&PROD_ELEMENTS_1023&REV_2005\575844314132313233303135&0 with the following sta tus: 0.

Information 7005 2013-08-19 15:52:40 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\disk.inf_x86_neutral_b431b61a11 f8df6c\disk.inf for Device Instance ID USBSTOR\DISK&VEN_WD&PROD_ELEMENTS_1023&RE V_2005\575844314132313233303135&0 with the following status: 0x0. System Information None 2013-08-19 15:52:42 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information 7005 2013-08-19 15:52:46 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service volsnap for Device Instance ID STORAGE\VOLUME \{586D5B16-08A3-11E3-8D6F-0016D4BCCE11}#0000007186900000 with the following stat us: 0. System Information 7005 2013-08-19 15:52:46 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\volume.inf_x86_neutral_6dee0205 881d1a1d\volume.inf for Device Instance ID STORAGE\VOLUME\{586D5B16-08A3-11E3-8D 6F-0016D4BCCE11}#0000007186900000 with the following status: 0x0. System Information 7005 2013-08-19 15:52:52 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service volsnap for Device Instance ID STORAGE\VOLUME \{586D5B16-08A3-11E3-8D6F-0016D4BCCE11}#0000000000100000 with the following stat us: 0. System Information 7005 2013-08-19 15:52:52 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\volume.inf_x86_neutral_6dee0205 881d1a1d\volume.inf for Device Instance ID STORAGE\VOLUME\{586D5B16-08A3-11E3-8D 6F-0016D4BCCE11}#0000000000100000 with the following status: 0x0. System Information None 2013-08-19 15:53:00 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2013-08-19 15:54:27 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 15:54:42 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 15:54:56 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the running state. System Information None 2013-08-19 15:56:00 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the stopped state. System Information None 2013-08-19 15:56:33 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the running state. System Information None 2013-08-19 15:56:33 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the running state. System Information None 2013-08-19 15:56:48 volsnap 33: The oldest shadow copy of v olume C: was deleted to keep disk space usage for shadow copies of volume C: bel ow the user defined limit. System Information None 2013-08-19 15:56:56 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the stopped state. System Information None 2013-08-19 15:57:17 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Office Source Engine Service File Name: "C:\P rogram Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE" Service Type:

System

user mode service Service Start Type: demand start Service Account: LocalS ystem System Information None 2013-08-19 16:00:08 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2013-08-19 16:01:36 SYSTEM Service Control Manager 7045: A service was installed i n the system. Service Name: Office Software Protection Platform Service Fil e Name: "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectio nPlatform\OSPPSVC.EXE" Service Type: user mode service Service Start Type: d emand start Service Account: NT AUTHORITY\NetworkService System Information None 2013-08-19 16:01:39 Service Control Manager 7036: The Office Software Prote ction Platform service entered the running state. System Information None 2013-08-19 16:01:57 Service Control Manager 7036: The Windows Modules Insta ller service entered the running state. System Information None 2013-08-19 16:02:10 Service Control Manager 7036: The Multimedia Class Sche duler service entered the stopped state. System Information None 2013-08-19 16:02:51 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Information None 2013-08-19 16:02:53 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 16:03:08 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the stopped state. System Information None 2013-08-19 16:08:07 Service Control Manager 7036: The Windows Image Acquisi tion (WIA) service entered the running state. System Information None 2013-08-19 16:08:25 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 16:08:38 Service Control Manager 7036: The Windows Image Acquisi tion (WIA) service entered the stopped state. System Information None 2013-08-19 16:09:21 volsnap 33: The oldest shadow copy of v olume C: was deleted to keep disk space usage for shadow copies of volume C: bel ow the user defined limit. System Information None 2013-08-19 16:10:05 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the running state. System Information None 2013-08-19 16:10:05 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the running state. System Information 1 2013-08-19 16:10:08 SYSTEM Microsoft-Windows-WindowsUpdateClient 27: Automatic Updates is now paused. System Information 1 2013-08-19 16:10:53 SYSTEM Microsoft-Windows-WindowsUpdateClient 27: Automatic Updates is now paused. System Information 1 2013-08-19 16:10:53 SYSTEM Microsoft-Windows-WindowsUpdateClient 27: Automatic Updates is now paused. System Information 1 2013-08-19 16:10:53 SYSTEM Microsoft-Windows-WindowsUpdateClient 28: Automatic Updates is now resumed.

Information None 2013-08-19 16:10:56 Vic Tiangco USER32 1074: The process setup.exe has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tia ngco for the following reason: No title for this reason could be found Reason Code: 0xffff Shutdown Type: restart Comment: System Information None 2013-08-19 16:11:05 Vic Tiangco USER32 1074: The process C:\Windows\sy stem32\winlogon.exe (EMOVHICRN) has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: No title for t his reason could be found Reason Code: 0x500ff Shutdown Type: restart C omment: System Information 1102 2013-08-19 16:11:05 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information None 2013-08-19 16:11:06 Service Control Manager 7036: The Windows Update servic e entered the stopped state. System Information None 2013-08-19 16:11:06 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 16:11:06 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v4.0.30319_X86 service entered the stopped state. System Information None 2013-08-19 16:11:06 Service Control Manager 7036: The Windows Installer ser vice entered the stopped state. System Information None 2013-08-19 16:11:08 Service Control Manager 7036: The Power service entered the stopped state. System Information None 2013-08-19 16:11:08 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the stopped state. System Information None 2013-08-19 16:11:08 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 16:11:08 Service Control Manager 7036: The DHCP Client service e ntered the stopped state. System Information None 2013-08-19 16:11:08 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 16:11:08 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the stopped state. System Information None 2013-08-19 16:11:08 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the stopped state. System Information 4 2013-08-19 16:11:08 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51047: DHCPv6 client service i s stopped. ShutDown Flag value is 1 System Information 4 2013-08-19 16:11:08 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50037: DHCPv4 client service is stopped. ShutDown Flag value is 1 System Information 7010 2013-08-19 16:11:08 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Information None 2013-08-19 16:11:09 EventLog 6006: The Event log service was stopped.

System

Information None 2013-08-19 16:11:09 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the stopped state. System Information None 2013-08-19 16:11:09 Service Control Manager 7036: The Distributed Link Trac king Client service entered the stopped state. System Information None 2013-08-19 16:11:09 Service Control Manager 7036: The SSDP Discovery servic e entered the stopped state. System Information None 2013-08-19 16:11:09 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 16:11:10 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2013-08-19 16:11:10 Service Control Manager 7036: The Office Software Prote ction Platform service entered the stopped state. System Information None 2013-08-19 16:11:10 Service Control Manager 7036: The Diagnostic Service Ho st service entered the stopped state. System Information None 2013-08-19 16:11:10 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the stopped state. System Information None 2013-08-19 16:11:10 Service Control Manager 7036: The Security Center servi ce entered the stopped state. System Information None 2013-08-19 16:11:11 Service Control Manager 7036: The Windows Management In strumentation service entered the stopped state. System Information None 2013-08-19 16:11:11 Service Control Manager 7036: The Superfetch service en tered the stopped state. System Information None 2013-08-19 16:11:12 Service Control Manager 7036: The Windows Defender serv ice entered the stopped state. System Information None 2013-08-19 16:11:13 Service Control Manager 7036: The TeamViewer 8 service entered the stopped state. System Information 103 2013-08-19 16:11:13 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 16:11:14 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Information None 2013-08-19 16:11:14 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the stopped state. System Warning None 2013-08-19 16:11:14 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4001: WLAN AutoConfig servic e has successfully stopped. System Information None 2013-08-19 16:11:15 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information None 2013-08-19 16:11:15 Service Control Manager 7036: The Windows Modules Insta ller service entered the stopped state. System Information None 2013-08-19 16:11:20 Service Control Manager 7036: The Windows Search servic e entered the stopped state.

System

System System d. System

Information None 2013-08-19 Microsoft-Windows-Kernel-General 13: Information None 2013-08-19 Microsoft-Windows-Kernel-General 12:

16:11:23 The data is invalid. 16:11:42 SYSTEM The access code is invali

Information None 2013-08-19 16:11:42 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 86 2013-08-19 16:11:50 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information 4 2013-08-19 16:11:52 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Warning None 2013-08-19 16:11:58 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 16:12:23 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 16:12:23 Service Control Manager 7036: The Power service entered the running state. System Information 7010 2013-08-19 16:12:23 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Information None 2013-08-19 16:12:24 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 16:12:24 EventLog 6005: The Event log service was started. System Information None 2013-08-19 16:12:24 EventLog 6013: The system uptime is 41 s econds. System Information None 2013-08-19 16:12:24 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 16:12:24 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 16:12:24 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 16:12:24 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 16:12:24 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information None 2013-08-19 16:12:25

Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The Security Accounts Man ager service entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The CNG Key Isolation ser vice entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information None 2013-08-19 16:12:25 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the running state. System Information 4 2013-08-19 16:12:25 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started System Information 4 2013-08-19 16:12:25 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i s started System Information None 2013-08-19 16:12:26 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the running state. System Information None 2013-08-19 16:12:26 Service Control Manager 7036: The DNS Client service en tered the running state. System Information None 2013-08-19 16:12:26

Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information None 2013-08-19 16:12:26 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4000: WLAN AutoConfig servic e has successfully started. System Information None 2013-08-19 16:12:27 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 16:12:27 Service Control Manager 7036: The Print Spooler service entered the running state. System Information None 2013-08-19 16:12:27 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information 1101 2013-08-19 16:12:27 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information None 2013-08-19 16:12:28 Service Control Manager 7036: The Windows Firewall serv ice entered the running state. System Information None 2013-08-19 16:12:28 Service Control Manager 7036: The Workstation service e ntered the running state. System Information None 2013-08-19 16:12:28 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the running state. System Information None 2013-08-19 16:12:28 Service Control Manager 7036: The Network Location Awar eness service entered the running state. System Information None 2013-08-19 16:12:29 Service Control Manager 7036: The Superfetch service en tered the running state. System Information None 2013-08-19 16:12:29 Service Control Manager 7036: The Skype Updater service entered the running state. System Information None 2013-08-19 16:12:34 Service Control Manager 7036: The Distributed Link Trac king Client service entered the running state. System Information None 2013-08-19 16:12:34 Service Control Manager 7036: The Windows Management In strumentation service entered the running state. System Information None 2013-08-19 16:12:34 Service Control Manager 7036: The IP Helper service ent ered the running state. System Information None 2013-08-19 16:12:34 Service Control Manager 7036: The Server service entere d the running state. System Information None 2013-08-19 16:12:53 Service Control Manager 7036: The TeamViewer 8 service entered the running state. System Information None 2013-08-19 16:12:53 Service Control Manager 7036: The Network List Service service entered the running state. System Information None 2013-08-19 16:12:53 Service Control Manager 7036: The Diagnostic Service Ho st service entered the running state. System Information None 2013-08-19 16:12:53 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 16:12:53

Service Control Manager 7036: The Diagnostic System Hos t service entered the running state. System Information None 2013-08-19 16:12:53 Service Control Manager 7036: The Windows Defender serv ice entered the running state. System Information None 2013-08-19 16:12:54 Service Control Manager 7036: The Cryptographic Service s service entered the running state. System Information None 2013-08-19 16:12:55 Service Control Manager 7036: The Network Connections s ervice entered the running state. System Information None 2013-08-19 16:12:57 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 16:13:02 Service Control Manager 7036: The Windows Installer ser vice entered the running state. System Information None 2013-08-19 16:14:09 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the running state. System Information None 2013-08-19 16:14:09 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the running state. System Information None 2013-08-19 16:14:29 volsnap 33: The oldest shadow copy of v olume C: was deleted to keep disk space usage for shadow copies of volume C: bel ow the user defined limit. System Information None 2013-08-19 16:14:30 Service Control Manager 7036: The Skype Updater service entered the stopped state. System Information None 2013-08-19 16:14:37 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 16:14:53 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the running state. System Information None 2013-08-19 16:14:53 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 16:14:54 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v4.0.30319_X86 service entered the running state. System Information None 2013-08-19 16:14:55 Service Control Manager 7036: The SSDP Discovery servic e entered the running state. System Information None 2013-08-19 16:14:55 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 16:14:59 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 16:15:02 Service Control Manager 7036: The Security Center servi ce entered the running state. System Information None 2013-08-19 16:15:14 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 16:15:14 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully.

Information None 2013-08-19 16:16:06 Service Control Manager 7036: The Office Software Prote ction Platform service entered the running state. System Information None 2013-08-19 16:16:29 Service Control Manager 7036: The Windows Update servic e entered the running state. System Information None 2013-08-19 16:16:45 Service Control Manager 7036: The Windows Installer ser vice entered the stopped state. System Information None 2013-08-19 16:16:58 Service Control Manager 7036: The Office Software Prote ction Platform service entered the stopped state. System Information None 2013-08-19 16:17:01 Service Control Manager 7036: The Office Software Prote ction Platform service entered the running state. System Information None 2013-08-19 16:17:35 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2013-08-19 16:17:43 SYSTEM Microsoft-Windows-Application-Experience 206: The Program Comp atibility Assistant service successfully performed phase two initialization. System Information None 2013-08-19 16:20:13 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the running state. System Information None 2013-08-19 16:20:35 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the stopped state. System Information None 2013-08-19 16:21:03 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: ScsiAccess Service File Name: C:\Program Files \Photodex\ProShow Producer\ScsiAccess.exe Service Type: user mode service Ser vice Start Type: auto start Service Account: LocalSystem System Information None 2013-08-19 16:21:34 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 16:22:13 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the stopped state. System Information None 2013-08-19 16:28:01 Service Control Manager 7036: The Multimedia Class Sche duler service entered the stopped state. System Information None 2013-08-19 16:28:03 Service Control Manager 7036: The WinHTTP Web Proxy Aut o-Discovery Service service entered the running state. System Information None 2013-08-19 16:33:26 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 16:35:50 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 16:37:50 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 16:41:02 Vic Tiangco USER32 1074: The process Explorer.EXE has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: Other (Unplanned) Reason Code: 0x0 Shutd own Type: restart Comment: System Information None 2013-08-19 16:41:08 Vic Tiangco USER32 1074: The process C:\Windows\sy

System

stem32\winlogon.exe (EMOVHICRN) has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: No title for t his reason could be found Reason Code: 0x500ff Shutdown Type: restart C omment: System Information 1102 2013-08-19 16:41:08 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information None 2013-08-19 16:41:09 Service Control Manager 7036: The Windows Update servic e entered the stopped state. System Information None 2013-08-19 16:41:09 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 16:41:10 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v4.0.30319_X86 service entered the stopped state. System Information None 2013-08-19 16:41:10 Service Control Manager 7036: The Office Software Prote ction Platform service entered the stopped state. System Information None 2013-08-19 16:41:10 Service Control Manager 7036: The Power service entered the stopped state. System Information 4 2013-08-19 16:41:10 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51047: DHCPv6 client service i s stopped. ShutDown Flag value is 1 System Information 4 2013-08-19 16:41:10 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50037: DHCPv4 client service is stopped. ShutDown Flag value is 1 System Information None 2013-08-19 16:41:11 Service Control Manager 7036: The DHCP Client service e ntered the stopped state. System Information None 2013-08-19 16:41:11 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the stopped state. System Information None 2013-08-19 16:41:11 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 16:41:11 Service Control Manager 7036: The SSDP Discovery servic e entered the stopped state. System Information None 2013-08-19 16:41:11 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 16:41:11 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 16:41:11 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the stopped state. System Information 7010 2013-08-19 16:41:11 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Information None 2013-08-19 16:41:12 EventLog 6006: The Event log service was stopped. System Information None 2013-08-19 16:41:12 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the stopped state. System Information None 2013-08-19 16:41:12

Service Control Manager 7036: The Distributed Link Trac king Client service entered the stopped state. System Information None 2013-08-19 16:41:12 Service Control Manager 7036: The Diagnostic Service Ho st service entered the stopped state. System Information None 2013-08-19 16:41:12 Service Control Manager 7036: The Superfetch service en tered the stopped state. System Information None 2013-08-19 16:41:13 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the stopped state. System Information None 2013-08-19 16:41:13 Service Control Manager 7036: The Security Center servi ce entered the stopped state. System Information None 2013-08-19 16:41:14 Service Control Manager 7036: The Windows Management In strumentation service entered the stopped state. System Information None 2013-08-19 16:41:14 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Information None 2013-08-19 16:41:16 Service Control Manager 7036: The Windows Defender serv ice entered the stopped state. System Information None 2013-08-19 16:41:16 Service Control Manager 7036: The TeamViewer 8 service entered the stopped state. System Information 103 2013-08-19 16:41:16 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 16:41:17 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information None 2013-08-19 16:41:17 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the stopped state. System Warning None 2013-08-19 16:41:17 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4001: WLAN AutoConfig servic e has successfully stopped. System Information None 2013-08-19 16:41:21 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Information None 2013-08-19 16:41:24 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 16:41:41 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 16:41:41 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 86 2013-08-19 16:41:48 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Information 4 2013-08-19 16:41:50 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr

oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Warning None 2013-08-19 16:41:55 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 16:42:16 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 16:42:16 EventLog 6005: The Event log service was started. System Information None 2013-08-19 16:42:16 EventLog 6013: The system uptime is 35 s econds. System Information None 2013-08-19 16:42:16 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 16:42:16 Service Control Manager 7036: The Power service entered the running state. System Information None 2013-08-19 16:42:16 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 16:42:16 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 16:42:16 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 16:42:16 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 16:42:16 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information 7010 2013-08-19 16:42:16 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Information None 2013-08-19 16:42:17 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 16:42:17 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 16:42:17 Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 16:42:17 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 16:42:17 Service Control Manager 7036: The Group Policy Client s ervice entered the running state. System Information None 2013-08-19 16:42:17 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 16:42:17 Service Control Manager 7036: The User Profile Service

service entered the running state. System Information None 2013-08-19 16:42:17 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 16:42:17 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 16:42:18 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 16:42:18 Service Control Manager 7036: The Security Accounts Man ager service entered the running state. System Information None 2013-08-19 16:42:18 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information None 2013-08-19 16:42:18 Service Control Manager 7036: The CNG Key Isolation ser vice entered the running state. System Information None 2013-08-19 16:42:18 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 16:42:18 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the running state. System Information 1101 2013-08-19 16:42:18 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information 4 2013-08-19 16:42:18 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started System Information 4 2013-08-19 16:42:18 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i s started System Information None 2013-08-19 16:42:19 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information None 2013-08-19 16:42:19 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the running state. System Information None 2013-08-19 16:42:19 Service Control Manager 7036: The DNS Client service en tered the running state. System Information None 2013-08-19 16:42:19 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information None 2013-08-19 16:42:19 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 16:42:19 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4000: WLAN AutoConfig servic e has successfully started. System Information None 2013-08-19 16:42:20 Service Control Manager 7036: The Print Spooler service entered the running state. System Information None 2013-08-19 16:42:20 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information None 2013-08-19 16:42:20 Service Control Manager 7036: The Windows Firewall serv

ice entered the running state. System Information None 2013-08-19 Service Control Manager 7036: ntered the running state. System Information None 2013-08-19 Service Control Manager 7036: vice service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: eness service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: tered the running state. System Information None 2013-08-19 Service Control Manager 7036: tered the running state. System Information None 2013-08-19 Service Control Manager 7036: entered the running state. System Information None 2013-08-19 Service Control Manager 7036: king Client service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: strumentation service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: ered the running state. System Information None 2013-08-19 Service Control Manager 7036: d the running state. System Information None 2013-08-19 Service Control Manager 7036: entered the running state. System Information None 2013-08-19 Service Control Manager 7036: st service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: rator Service service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: e service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: ice entered the running state. System Information None 2013-08-19 Service Control Manager 7036: t service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: ction Platform service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: ervice entered the running state. System Information None 2013-08-19 Service Control Manager 7036:

16:42:20 The Workstation service e 16:42:20 The Diagnostic Policy Ser 16:42:20 The Network Location Awar 16:42:21 The ScsiAccess service en 16:42:21 The Superfetch service en 16:42:21 The Skype Updater service 16:42:24 The Distributed Link Trac 16:42:24 The Windows Management In 16:42:24 The IP Helper service ent 16:42:24 The Server service entere 16:42:32 The TeamViewer 8 service 16:42:32 The Diagnostic Service Ho 16:42:32 The Network List Service 16:42:32 The Portable Device Enume 16:42:32 The Application Experienc 16:42:32 The Windows Defender serv 16:42:32 The Diagnostic System Hos 16:42:43 The Office Software Prote 16:42:47 The Software Protection s 16:42:51 The Cryptographic Service

s service entered the running state. System Information None 2013-08-19 16:42:52 Service Control Manager 7036: The Network Connections s ervice entered the running state. System Information None 2013-08-19 16:42:53 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 16:44:22 Service Control Manager 7036: The Skype Updater service entered the stopped state. System Information None 2013-08-19 16:44:32 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the running state. System Information None 2013-08-19 16:44:32 Service Control Manager 7036: The SSDP Discovery servic e entered the running state. System Information None 2013-08-19 16:44:33 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v4.0.30319_X86 service entered the running state. System Information None 2013-08-19 16:44:34 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 16:44:35 Service Control Manager 7036: The Security Center servi ce entered the running state. System Information None 2013-08-19 16:44:39 Service Control Manager 7036: The Windows Update servic e entered the running state. System Information None 2013-08-19 16:44:41 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 16:44:41 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Information None 2013-08-19 16:45:27 Vic Tiangco Service Control Manager 7040: The start type of the Blu etooth Support Service service was changed from demand start to disabled. System Information None 2013-08-19 16:45:47 SYSTEM Microsoft-Windows-Application-Experience 206: The Program Comp atibility Assistant service successfully performed phase two initialization. System Information None 2013-08-19 16:46:10 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information 7005 2013-08-19 16:47:34 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service usbccgp for Device Instance ID USB\VID_1A2C&P ID_0023\5&25117D7C&0&1 with the following status: 0. System Information 7005 2013-08-19 16:47:34 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\usb.inf_x86_neutral_2620fd493ca d7d41\usb.inf for Device Instance ID USB\VID_1A2C&PID_0023\5&25117D7C&0&1 with t he following status: 0x0. System Information 7005 2013-08-19 16:47:35 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service HidUsb for Device Instance ID USB\VID_1A2C&PI D_0023&MI_00\6&7244335&0&0000 with the following status: 0. System Information 7005 2013-08-19 16:47:36 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\input.inf_x86_neutral_9e1eba572 4be176f\input.inf for Device Instance ID USB\VID_1A2C&PID_0023&MI_00\6&7244335&0

&0000 with the following status: 0x0. System Information 7005 2013-08-19 16:47:37 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service HidUsb for Device Instance ID USB\VID_1A2C&PI D_0023&MI_01\6&7244335&0&0001 with the following status: 0. System Information 7005 2013-08-19 16:47:37 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\input.inf_x86_neutral_9e1eba572 4be176f\input.inf for Device Instance ID USB\VID_1A2C&PID_0023&MI_01\6&7244335&0 &0001 with the following status: 0x0. System Information 7005 2013-08-19 16:47:38 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service kbdhid for Device Instance ID HID\VID_1A2C&PI D_0023&MI_00\7&29E72E7&0&0000 with the following status: 0. System Information None 2013-08-19 16:47:39 Service Control Manager 7036: The Human Interface Devic e Access service entered the running state. System Information 7005 2013-08-19 16:47:39 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service kbdclass for Device Instance ID HID\VID_1A2C& PID_0023&MI_00\7&29E72E7&0&0000 with the following status: 0. System Information 7005 2013-08-19 16:47:39 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\keyboard.inf_x86_neutral_50ad65 9974198591\keyboard.inf for Device Instance ID HID\VID_1A2C&PID_0023&MI_00\7&29E 72E7&0&0000 with the following status: 0x0. System Information 7005 2013-08-19 16:47:40 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\input.inf_x86_neutral_9e1eba572 4be176f\input.inf for Device Instance ID HID\VID_1A2C&PID_0023&MI_01&COL02\7&376 112C6&0&0001 with the following status: 0x0. System Information 7005 2013-08-19 16:47:41 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\hidserv.inf_x86_neutral_32c4c73 e5497e483\hidserv.inf for Device Instance ID HID\VID_1A2C&PID_0023&MI_01&COL01\7 &376112C6&0&0000 with the following status: 0x0. System Information None 2013-08-19 16:48:23 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Error None 2013-08-19 16:54:47 Service Control Manager 7030: The DFServ service is mar ked as an interactive service. However, the system is configured to not allow i nteractive services. This service may not function properly. System Information None 2013-08-19 16:54:47 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: DFServ Service File Name: C:\Program Files\Far onics\Deep Freeze\Install C-0\DFServ.exe Service Type: user mode service Serv ice Start Type: auto start Service Account: LocalSystem System Information None 2013-08-19 16:54:48 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: DeepFrz Service File Name: C:\Windows\system32 \drivers\DeepFrz.sys Service Type: kernel mode driver Service Start Type: bo ot start Service Account: System Information None 2013-08-19 16:55:12 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the running state. System Information None 2013-08-19 16:55:12 Vic Tiangco USER32 1074: The process FARONICS_DFS. exe has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\ Vic Tiangco for the following reason: Application: Installation (Planned) Rea

son Code: 0x80040002 Shutdown Type: restart Comment: System Information None 2013-08-19 16:55:15 EventLog 6006: The Event log service was stopped. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Windows Update servic e entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v4.0.30319_X86 service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The DHCP Client service e ntered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Human Interface Devic e Access service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Power service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The TeamViewer 8 service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The SSDP Discovery servic e entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Distributed Link Trac king Client service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Office Software Prote ction Platform service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Diagnostic Service Ho st service entered the stopped state. System Information None 2013-08-19 16:55:15 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the stopped state. System Information None 2013-08-19 16:55:15 Vic Tiangco USER32 1074: The process C:\Windows\sy stem32\winlogon.exe (EMOVHICRN) has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: No title for t his reason could be found Reason Code: 0x500ff Shutdown Type: restart C omment: System Information 1102 2013-08-19 16:55:15 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification

for Customer Experience Improvement Program System Information 4 2013-08-19 16:55:15 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51047: DHCPv6 client service i s stopped. ShutDown Flag value is 1 System Information 4 2013-08-19 16:55:15 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50037: DHCPv4 client service is stopped. ShutDown Flag value is 1 System Information 7010 2013-08-19 16:55:15 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Information None 2013-08-19 16:55:16 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information None 2013-08-19 16:55:16 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the stopped state. System Information None 2013-08-19 16:55:16 Service Control Manager 7036: The Security Center servi ce entered the stopped state. System Information None 2013-08-19 16:55:16 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the stopped state. System Information None 2013-08-19 16:55:16 Service Control Manager 7036: The Windows Management In strumentation service entered the stopped state. System Information None 2013-08-19 16:55:16 Service Control Manager 7036: The Windows Font Cache Se rvice service entered the stopped state. System Information None 2013-08-19 16:55:16 Service Control Manager 7036: The Windows Defender serv ice entered the stopped state. System Information None 2013-08-19 16:55:16 Service Control Manager 7036: The Superfetch service en tered the stopped state. System Information None 2013-08-19 16:55:16 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Information None 2013-08-19 16:55:16 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Warning None 2013-08-19 16:55:16 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4001: WLAN AutoConfig servic e has successfully stopped. System Information 103 2013-08-19 16:55:17 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 16:55:21 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 16:55:39 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 16:55:39 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 4 2013-08-19 16:55:48 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s)

Information 86 2013-08-19 16:55:48 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Warning None 2013-08-19 16:55:54 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 16:56:14 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 16:56:14 Service Control Manager 7036: The Power service entered the running state. System Information 7010 2013-08-19 16:56:14 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Information None 2013-08-19 16:56:15 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 16:56:15 EventLog 6005: The Event log service was started. System Information None 2013-08-19 16:56:15 EventLog 6013: The system uptime is 35 s econds. System Information None 2013-08-19 16:56:15 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 16:56:15 Service Control Manager 7036: The RPC Endpoint Mapper s ervice entered the running state. System Information None 2013-08-19 16:56:15 Service Control Manager 7036: The Remote Procedure Call (RPC) service entered the running state. System Information None 2013-08-19 16:56:15 Service Control Manager 7036: The Windows Event Log ser vice entered the running state. System Information None 2013-08-19 16:56:15 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information None 2013-08-19 16:56:17 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The Windows Audio Endpoin t Builder service entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The Windows Audio service entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The Themes service entere d the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The Group Policy Client s

System

ervice entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The Offline Files service entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The User Profile Service service entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The COM+ Event System ser vice entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The System Event Notifica tion Service service entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The Security Accounts Man ager service entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The CNG Key Isolation ser vice entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The Network Store Interfa ce Service service entered the running state. System Information None 2013-08-19 16:56:18 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the running state. System Information 4 2013-08-19 16:56:18 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started System Information None 2013-08-19 16:56:19 Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information None 2013-08-19 16:56:19 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the running state. System Information None 2013-08-19 16:56:19 Service Control Manager 7036: The DNS Client service en tered the running state. System Information None 2013-08-19 16:56:19 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information None 2013-08-19 16:56:19 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4000: WLAN AutoConfig servic e has successfully started. System Information 4 2013-08-19 16:56:19 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i s started System Information None 2013-08-19 16:56:20 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 16:56:20 Service Control Manager 7036: The Print Spooler service entered the running state. System Information 1101 2013-08-19 16:56:20 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f

or Customer Experience Improvement Program System Information None 2013-08-19 Service Control Manager 7036: service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: ice entered the running state. System Information None 2013-08-19 Service Control Manager 7036: ntered the running state. System Information None 2013-08-19 Service Control Manager 7036: vice service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: eness service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: tered the running state. System Information None 2013-08-19 Service Control Manager 7036: tered the running state. System Information None 2013-08-19 Service Control Manager 7036: entered the running state. System Information None 2013-08-19 Service Control Manager 7036: king Client service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: strumentation service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: ered the running state. System Information None 2013-08-19 Service Control Manager 7036: d the running state. System Information None 2013-08-19 Service Control Manager 7036: entered the running state. System Information None 2013-08-19 Service Control Manager 7036: st service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: rator Service service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: ice entered the running state. System Information None 2013-08-19 Service Control Manager 7036: t service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: s service entered the running state. System Information None 2013-08-19 Service Control Manager 7036:

16:56:21 The Base Filtering Engine 16:56:21 The Windows Firewall serv 16:56:21 The Workstation service e 16:56:21 The Diagnostic Policy Ser 16:56:21 The Network Location Awar 16:56:22 The ScsiAccess service en 16:56:22 The Superfetch service en 16:56:22 The Skype Updater service 16:56:23 The Distributed Link Trac 16:56:23 The Windows Management In 16:56:24 The IP Helper service ent 16:56:24 The Server service entere 16:56:31 The TeamViewer 8 service 16:56:31 The Diagnostic Service Ho 16:56:31 The Network List Service 16:56:31 The Portable Device Enume 16:56:32 The Windows Defender serv 16:56:32 The Diagnostic System Hos 16:56:32 The Cryptographic Service 16:56:35 The Office Software Prote

ction Platform service entered the running state. System Information None 2013-08-19 16:56:37 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the running state. System Information None 2013-08-19 16:56:40 Service Control Manager 7036: The Network Connections s ervice entered the running state. System Information None 2013-08-19 16:56:42 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 16:56:42 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 16:57:27 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 16:57:27 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Error None 2013-08-19 16:57:46 Service Control Manager 7030: The DFServ service is mar ked as an interactive service. However, the system is configured to not allow i nteractive services. This service may not function properly. System Information None 2013-08-19 16:57:46 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: DFServ Service File Name: C:\Program Files\Far onics\Deep Freeze\Install C-0\DFServ.exe Service Type: user mode service Serv ice Start Type: auto start Service Account: LocalSystem System Information None 2013-08-19 16:57:47 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: DeepFrz Service File Name: C:\Windows\system32 \drivers\DeepFrz.sys Service Type: kernel mode driver Service Start Type: bo ot start Service Account: System Information None 2013-08-19 16:58:00 Vic Tiangco USER32 1074: The process FARONICS_DFS. exe has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\ Vic Tiangco for the following reason: Application: Installation (Planned) Rea son Code: 0x80040002 Shutdown Type: restart Comment: System Information None 2013-08-19 16:58:03 Service Control Manager 7036: The Group Policy Client s ervice entered the stopped state. System Information None 2013-08-19 16:58:03 Vic Tiangco USER32 1074: The process C:\Windows\sy stem32\winlogon.exe (EMOVHICRN) has initiated the restart of computer EMOVHICRN on behalf of user emovhicRN\Vic Tiangco for the following reason: No title for t his reason could be found Reason Code: 0x500ff Shutdown Type: restart C omment: System Information 1102 2013-08-19 16:58:03 SYSTEM Microsoft-Windows-Winlogon 7002: User Logoff Notification for Customer Experience Improvement Program System Information None 2013-08-19 16:58:04 EventLog 6006: The Event log service was stopped. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The DHCP Client service e ntered the stopped state. System Information None 2013-08-19 16:58:04

Service Control Manager 7036: The Power service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Plug and Play service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The User Profile Service service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Office Software Prote ction Platform service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The TeamViewer 8 service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Desktop Window Manage r Session Manager service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Windows Defender serv ice entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Extensible Authentica tion Protocol service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Diagnostic Service Ho st service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Distributed Link Trac king Client service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Windows Management In strumentation service entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Windows Event Log ser vice entered the stopped state. System Information None 2013-08-19 16:58:04 Service Control Manager 7036: The Superfetch service en tered the stopped state. System Information 4 2013-08-19 16:58:04 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51047: DHCPv6 client service i s stopped. ShutDown Flag value is 1 System Information 4 2013-08-19 16:58:04 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50037: DHCPv4 client service is stopped. ShutDown Flag value is 1 System Information 7010 2013-08-19 16:58:04 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'false' PlugPlay caching subsystem enabled: 'false' System Warning None 2013-08-19 16:58:04 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4001: WLAN AutoConfig servic e has successfully stopped.

Information None 2013-08-19 16:58:05 Service Control Manager 7036: The Cryptographic Service s service entered the stopped state. System Information None 2013-08-19 16:58:05 Service Control Manager 7036: The Windows Search servic e entered the stopped state. System Information 103 2013-08-19 16:58:05 Microsoft-Windows-Kernel-Power 109: The kernel power manager h as initiated a shutdown transition. System Information None 2013-08-19 16:58:10 Microsoft-Windows-Kernel-General 13: The data is invalid. System Information None 2013-08-19 17:45:22 SYSTEM Microsoft-Windows-Kernel-General 12: The access code is invali d. System Information None 2013-08-19 17:45:22 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'FileInf o' (6.1, 2009-07-14T07:21:51.000000000Z) has successfully loaded and registered with Filter Manager. System Information 4 2013-08-19 17:45:30 SYSTEM Microsoft-Windows-Kernel-Processor-Power 26: Processor 0 in gr oup 0 exposes the following: 3 idle state(s) 6 performance state(s) 8 throt tle state(s) System Information 86 2013-08-19 17:45:36 SYSTEM Microsoft-Windows-Kernel-Power 89: ACPI thermal zone ACPI\Ther malZone\TZ1_ has been enumerated. _PSV = 0K _TC1 = 0 _TC2 = 0 _TSP = 0ms _AC0 = 0K _AC1 = 0K _AC2 = 0K _AC3 = 0K _AC4 = 0K _AC5 = 0K _AC6 = 0K _AC7 = 0K _AC8 = 0K _AC9 = 0K _C RT = 373K _HOT = 0K _PSL - see event data. System Warning None 2013-08-19 17:45:36 E100B 4: There is no connection for t his connection ID System Information None 2013-08-19 17:45:47 Service Control Manager 7036: The Plug and Play service entered the running state. System Information None 2013-08-19 17:45:47 Service Control Manager 7036: The Power service entered the running state. System Information 7010 2013-08-19 17:45:47 SYSTEM Microsoft-Windows-UserPnp 20010: One or more of the Plug and Play service's subsystems has changed state. PlugPlay install subsystem enabled: 'true' PlugPlay caching subsystem enabled: 'true' System Information None 2013-08-19 17:45:52 Service Control Manager 7036: The DFServ service entere d the running state. System Information None 2013-08-19 17:45:52 Service Control Manager 7036: The DCOM Server Process L auncher service entered the running state. System Information None 2013-08-19 17:45:52 SYSTEM Microsoft-Windows-FilterManager 6: File System Filter 'luafv' (6.1, 2009-07-14T07:15:44.000000000Z) has successfully loaded and registered wit h Filter Manager. System Information None 2013-08-19 17:45:53 EventLog 6009: Microsoft (R) Windows (R) 6.01. 7601 Service Pack 1 Multiprocessor Free. System Information None 2013-08-19 17:45:53 EventLog 6005: The Event log service was started. System Information None 2013-08-19 17:45:53

System

EventLog econds. System

6013: The system uptime is 30 s 17:45:53 The RPC Endpoint Mapper s 17:45:53 The Remote Procedure Call 17:45:53 The Windows Event Log ser 17:45:53 The Multimedia Class Sche 17:45:53 The Windows Audio Endpoin 17:45:53 The Windows Audio service 17:45:53 The Themes service entere 17:45:53 The Group Policy Client s 17:45:53 The Offline Files service 17:45:53 The User Profile Service 17:45:53 The COM+ Event System ser 17:45:53 The System Event Notifica 17:45:53 The Desktop Window Manage 17:45:53 The Security Accounts Man 17:45:53 The TCP/IP NetBIOS Helper 17:45:53 The CNG Key Isolation ser 17:45:53 The Network Store Interfa 17:45:53 The Extensible Authentica 17:45:53 The DNS Client service en 17:45:53

Information None 2013-08-19 Service Control Manager 7036: ervice entered the running state. System Information None 2013-08-19 Service Control Manager 7036: (RPC) service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: vice entered the running state. System Information None 2013-08-19 Service Control Manager 7036: duler service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: t Builder service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: entered the running state. System Information None 2013-08-19 Service Control Manager 7036: d the running state. System Information None 2013-08-19 Service Control Manager 7036: ervice entered the running state. System Information None 2013-08-19 Service Control Manager 7036: entered the running state. System Information None 2013-08-19 Service Control Manager 7036: service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: vice entered the running state. System Information None 2013-08-19 Service Control Manager 7036: tion Service service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: r Session Manager service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: ager service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: vice entered the running state. System Information None 2013-08-19 Service Control Manager 7036: ce Service service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: tion Protocol service entered the running state. System Information None 2013-08-19 Service Control Manager 7036: tered the running state. System Information None 2013-08-19

Service Control Manager 7036: The DHCP Client service e ntered the running state. System Information 4 2013-08-19 17:45:53 LOCAL SERVICE Microsoft-Windows-Dhcp-Client 50036: DHCPv4 client service is started System Information 4 2013-08-19 17:45:53 LOCAL SERVICE Microsoft-Windows-DHCPv6-Client 51046: DHCPv6 client service i s started System Error None 2013-08-19 17:45:54 BugCheck System Information 1101 2013-08-19 17:45:56 SYSTEM Microsoft-Windows-Winlogon 7001: User Logon Notification f or Customer Experience Improvement Program System Information None 2013-08-19 17:46:06 Service Control Manager 7036: The WLAN AutoConfig servi ce entered the running state. System Information None 2013-08-19 17:46:06 Service Control Manager 7036: The Shell Hardware Detect ion service entered the running state. System Information None 2013-08-19 17:46:06 SYSTEM Microsoft-Windows-WLAN-AutoConfig 4000: WLAN AutoConfig servic e has successfully started. System Information None 2013-08-19 17:46:08 Service Control Manager 7036: The Task Scheduler servic e entered the running state. System Information None 2013-08-19 17:46:10 Service Control Manager 7036: The Print Spooler service entered the running state. System Information None 2013-08-19 17:46:16 Service Control Manager 7036: The Base Filtering Engine service entered the running state. System Information None 2013-08-19 17:46:16 Service Control Manager 7036: The Windows Firewall serv ice entered the running state. System Information None 2013-08-19 17:46:16 Service Control Manager 7036: The Workstation service e ntered the running state. System Information None 2013-08-19 17:46:17 Service Control Manager 7036: The ScsiAccess service en tered the running state. System Information None 2013-08-19 17:46:17 DeepFrz 1: Read from record ID 23. System Information None 2013-08-19 17:46:17 Service Control Manager 7036: The Skype Updater service entered the running state. System Information None 2013-08-19 17:46:25 Service Control Manager 7036: The TeamViewer 8 service entered the running state. System Information None 2013-08-19 17:46:25 Service Control Manager 7036: The Network Location Awar eness service entered the running state. System Information None 2013-08-19 17:46:27 Service Control Manager 7036: The Diagnostic Policy Ser vice service entered the running state. System Information None 2013-08-19 17:46:29 Service Control Manager 7036: The Superfetch service en tered the running state. System Information None 2013-08-19 17:46:29 Service Control Manager 7036: The Distributed Link Trac king Client service entered the running state.

Information None 2013-08-19 17:46:37 Service Control Manager 7036: The Windows Management In strumentation service entered the running state. System Information None 2013-08-19 17:46:37 Service Control Manager 7036: The IP Helper service ent ered the running state. System Information None 2013-08-19 17:46:42 Service Control Manager 7036: The Server service entere d the running state. System Information None 2013-08-19 17:46:42 Service Control Manager 7036: The Diagnostic Service Ho st service entered the running state. System Information None 2013-08-19 17:46:42 Service Control Manager 7036: The Network Connections s ervice entered the running state. System Information None 2013-08-19 17:46:42 Service Control Manager 7036: The Network List Service service entered the running state. System Information None 2013-08-19 17:46:51 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 17:46:51 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 17:46:51 Service Control Manager 7036: The Diagnostic System Hos t service entered the running state. System Information None 2013-08-19 17:46:51 Service Control Manager 7036: The Office Software Prote ction Platform service entered the running state. System Information None 2013-08-19 17:46:53 Service Control Manager 7036: The Windows Defender serv ice entered the running state. System Information None 2013-08-19 17:46:54 Service Control Manager 7036: The Cryptographic Service s service entered the running state. System Information None 2013-08-19 17:46:54 Service Control Manager 7036: The Windows Search servic e entered the running state. System Information None 2013-08-19 17:46:56 BugCheck System Information None 2013-08-19 17:46:56 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the running state. System Information None 2013-08-19 17:46:59 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 17:48:18 Service Control Manager 7036: The Skype Updater service entered the stopped state. System Information None 2013-08-19 17:48:42 Service Control Manager 7036: The Background Intelligen t Transfer Service service entered the running state. System Information None 2013-08-19 17:48:43 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v4.0.30319_X86 service entered the running state. System Information None 2013-08-19 17:48:43 Service Control Manager 7036: The SSDP Discovery servic e entered the running state. System Information None 2013-08-19 17:48:44

System

Service Control Manager 7036: The Windows Font Cache Se rvice service entered the running state. System Information None 2013-08-19 17:48:44 Service Control Manager 7036: The Security Center servi ce entered the running state. System Information None 2013-08-19 17:48:45 Service Control Manager 7036: The Windows Update servic e entered the running state. System Information None 2013-08-19 17:48:51 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 17:48:56 Service Control Manager 7036: The Windows Error Reporti ng Service service entered the stopped state. System Information None 2013-08-19 17:51:41 Service Control Manager 7036: The Multimedia Class Sche duler service entered the stopped state. System Information None 2013-08-19 17:52:18 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 17:53:29 Service Control Manager 7036: The Multimedia Class Sche duler service entered the running state. System Information 7005 2013-08-19 17:53:33 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service USBSTOR for Device Instance ID USB\VID_14CD&P ID_6116\116AC2101219 with the following status: 0. System Information 7005 2013-08-19 17:53:33 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\usbstor.inf_x86_neutral_c77d41a 490bdc63d\usbstor.inf for Device Instance ID USB\VID_14CD&PID_6116\116AC2101219 with the following status: 0x0. System Information None 2013-08-19 17:53:35 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information 7005 2013-08-19 17:53:35 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service disk for Device Instance ID USBSTOR\DISK&VEN_ ___MASS&PROD_STORAGE_DEVICE&REV_\116AC2101219&0 with the following status: 0. System Information 7005 2013-08-19 17:53:35 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\disk.inf_x86_neutral_b431b61a11 f8df6c\disk.inf for Device Instance ID USBSTOR\DISK&VEN____MASS&PROD_STORAGE_DEV ICE&REV_\116AC2101219&0 with the following status: 0x0. System Information 7005 2013-08-19 17:53:36 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service volsnap for Device Instance ID STORAGE\VOLUME \{113933BC-08B4-11E3-A9A7-0016D4BCCE11}#0000000000007E00 with the following stat us: 0. System Information 7005 2013-08-19 17:53:36 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\volume.inf_x86_neutral_6dee0205 881d1a1d\volume.inf for Device Instance ID STORAGE\VOLUME\{113933BC-08B4-11E3-A9 A7-0016D4BCCE11}#0000000000007E00 with the following status: 0x0. System Information None 2013-08-19 17:54:03 Service Control Manager 7036: The Windows Time service entered the running state. System Warning None 2013-08-19 17:54:03 LOCAL SERVICE Microsoft-Windows-Time-Service 134: NtpClient was unable to se t a manual peer to use as a time source because of DNS resolution error on ''. N

tpClient will try again in 3473457 minutes and double the reattempt interval the reafter. The error was: No such host is known. (0x80072AF9) System Information None 2013-08-19 17:54:04 Service Control Manager 7036: The WinHTTP Web Proxy Aut o-Discovery Service service entered the running state. System Information None 2013-08-19 17:54:07 LOCAL SERVICE Microsoft-Windows-Time-Service 37: The time provider NtpClient is currently receiving valid time data from time.windows.com,0x9 (ntp.m|0x9|0.0 .0.0:123->65.55.56.206:123). System Information 7005 2013-08-19 17:54:08 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service tunnel for Device Instance ID ROOT\*TEREDO\00 00 with the following status: 0. System Information None 2013-08-19 17:54:12 Service Control Manager 7036: The Program Compatibility Assistant Service service entered the running state. System Information None 2013-08-19 17:54:12 SYSTEM Microsoft-Windows-Application-Experience 201: The Program Comp atibility Assistant service started successfully. System Information None 2013-08-19 17:55:35 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 18:02:17 Service Control Manager 7036: The Software Protection s ervice entered the running state. System Information None 2013-08-19 18:06:34 Service Control Manager 7036: The Application Experienc e service entered the stopped state. System Information None 2013-08-19 18:07:18 Service Control Manager 7036: The Software Protection s ervice entered the stopped state. System Information None 2013-08-19 18:08:05 SYSTEM Microsoft-Windows-Application-Experience 206: The Program Comp atibility Assistant service successfully performed phase two initialization. System Information None 2013-08-19 18:18:04 Service Control Manager 7036: The WinHTTP Web Proxy Aut o-Discovery Service service entered the stopped state. System Information None 2013-08-19 18:20:16 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 18:30:16 Service Control Manager 7036: The Application Experienc e service entered the stopped state. System Information None 2013-08-19 18:39:51 Service Control Manager 7036: The Microsoft .NET Framew ork NGEN v4.0.30319_X86 service entered the stopped state. System Information None 2013-08-19 18:41:27 Service Control Manager 7036: The Diagnostic System Hos t service entered the stopped state. System Information None 2013-08-19 18:49:10 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the running state. System Information None 2013-08-19 18:49:11 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the running state. System Information None 2013-08-19 18:49:32 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 18:49:35 volsnap 33: The oldest shadow copy of v

olume C: was deleted to keep disk space usage for shadow copies of volume C: bel ow the user defined limit. System Information None 2013-08-19 18:49:37 volsnap 33: The oldest shadow copy of v olume C: was deleted to keep disk space usage for shadow copies of volume C: bel ow the user defined limit. System Information 1 2013-08-19 18:50:08 SYSTEM Microsoft-Windows-WindowsUpdateClient 19: Installation Success ful: Windows successfully installed the following update: Definition Update for Windows Defender - KB915597 (Definition 1.155.2386.0) System Information None 2013-08-19 18:53:11 Service Control Manager 7036: The Volume Shadow Copy se rvice entered the stopped state. System Information None 2013-08-19 18:56:11 Service Control Manager 7036: The Microsoft Software Sh adow Copy Provider service entered the stopped state. System Information None 2013-08-19 18:59:37 Service Control Manager 7036: The Application Experienc e service entered the stopped state. System Warning None 2013-08-19 20:27:22 NETWORK SERVICE Microsoft-Windows-DNS-Client 1014: Name resolution for the n ame www.youtube.com timed out after none of the configured DNS servers responded . System Information None 2013-08-19 20:39:03 SYSTEM Service Control Manager 7042: The TCP/IP NetBIOS Helper service was successfully sent a stop control. The reason specified was: 0x4 0030011 [Operating System: Network Connectivity (Planned)] Comment: None System Information None 2013-08-19 20:39:04 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the stopped state. System Information None 2013-08-19 20:40:26 Service Control Manager 7036: The TCP/IP NetBIOS Helper service entered the running state. System Information 7005 2013-08-19 20:48:44 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service usbhub for Device Instance ID USB\VID_1A40&PI D_0101\5&25117D7C&0&2 with the following status: 0. System Information 7005 2013-08-19 20:48:45 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\usb.inf_x86_neutral_2620fd493ca d7d41\usb.inf for Device Instance ID USB\VID_1A40&PID_0101\5&25117D7C&0&2 with t he following status: 0x0. System Information 7005 2013-08-19 20:48:48 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service usbhub for Device Instance ID USB\VID_1A40&PI D_0101\6&138F37A&0&1 with the following status: 0. System Information 7005 2013-08-19 20:48:49 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\usb.inf_x86_neutral_2620fd493ca d7d41\usb.inf for Device Instance ID USB\VID_1A40&PID_0101\6&138F37A&0&1 with th e following status: 0x0. System Information 7005 2013-08-19 20:48:50 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service HidUsb for Device Instance ID USB\VID_1D57&PI D_0016\6&138F37A&0&4 with the following status: 0. System Information 7005 2013-08-19 20:48:50 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\input.inf_x86_neutral_9e1eba572 4be176f\input.inf for Device Instance ID USB\VID_1D57&PID_0016\6&138F37A&0&4 wit h the following status: 0x0.

Information 7005 2013-08-19 20:48:53 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service mouhid for Device Instance ID HID\VID_1D57&PI D_0016\7&39712D09&0&0000 with the following status: 0. System Information 7005 2013-08-19 20:48:53 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service mouclass for Device Instance ID HID\VID_1D57& PID_0016\7&39712D09&0&0000 with the following status: 0. System Information 7005 2013-08-19 20:48:54 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\msmouse.inf_x86_neutral_7a9084e 0177406eb\msmouse.inf for Device Instance ID HID\VID_1D57&PID_0016\7&39712D09&0& 0000 with the following status: 0x0. System Warning None 2013-08-19 20:49:30 Tcpip 4228: TCP/IP has chosen to rest rict the scale factor due to a network condition. This could be related to a p roblem in a network device and will cause degraded throughput. System Information 7005 2013-08-19 20:50:35 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\usb.inf_x86_neutral_2620fd493ca d7d41\usb.inf for Device Instance ID USB\VID_0000&PID_0000\6&138F37A&0&2 with th e following status: 0x0. System Warning None 2013-08-19 20:56:32 NETWORK SERVICE Microsoft-Windows-DNS-Client 1014: Name resolution for the n ame safebrowsing-cache.google.com timed out after none of the configured DNS ser vers responded. System Information None 2013-08-19 22:22:03 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 22:32:03 Service Control Manager 7036: The Application Experienc e service entered the stopped state. System Information 7005 2013-08-19 23:22:23 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service USBSTOR for Device Instance ID USB\VID_14CD&P ID_6116\M6116A016V20 with the following status: 0. System Information 7005 2013-08-19 23:22:24 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\usbstor.inf_x86_neutral_c77d41a 490bdc63d\usbstor.inf for Device Instance ID USB\VID_14CD&PID_6116\M6116A016V20 with the following status: 0x0. System Information 7005 2013-08-19 23:22:28 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service disk for Device Instance ID USBSTOR\DISK&VEN_ ST950032&PROD_5AS&REV_\M6116A016V20&0 with the following status: 0. System Information 7005 2013-08-19 23:22:29 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\disk.inf_x86_neutral_b431b61a11 f8df6c\disk.inf for Device Instance ID USBSTOR\DISK&VEN_ST950032&PROD_5AS&REV_\M 6116A016V20&0 with the following status: 0x0. System Information 7005 2013-08-19 23:22:32 SYSTEM Microsoft-Windows-UserPnp 20003: Driver Management has co ncluded the process to add Service volsnap for Device Instance ID STORAGE\VOLUME \{113933DF-08B4-11E3-A9A7-0016D4BCCE11}#0000000000100000 with the following stat us: 0. System Information 7005 2013-08-19 23:22:33 SYSTEM Microsoft-Windows-UserPnp 20001: Driver Management conclu ded the process to install driver FileRepository\volume.inf_x86_neutral_6dee0205 881d1a1d\volume.inf for Device Instance ID STORAGE\VOLUME\{113933DF-08B4-11E3-A9 A7-0016D4BCCE11}#0000000000100000 with the following status: 0x0.

System

Information None 2013-08-19 23:22:34 Service Control Manager 7036: The Portable Device Enume rator Service service entered the running state. System Information None 2013-08-19 23:22:57 Service Control Manager 7036: The Application Experienc e service entered the running state. System Information None 2013-08-19 23:23:29 Vic Tiangco Service Control Manager 7045: A service was installed i n the system. Service Name: Lavalys EVEREST Kernel Driver Service File Name : C:\Program Files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt Service Type: kernel mode driver Service Start Type: demand start Service Account: System Information None 2013-08-19 23:24:34 Service Control Manager 7036: The Portable Device Enume rator Service service entered the stopped state. System Information None 2013-08-19 23:24:41 Service Control Manager 7036: The Software Protection s ervice entered the running state. --------[ Database Software ]-----------------------------------------------------------------------------------------Database Drivers: Borland Database Engine Borland InterBase Client Easysoft ODBC-InterBase 6 Easysoft ODBC-InterBase 7 Firebird Client Jet Engine MDAC rtm.101119-1850) ODBC rtm.101119-1850) MySQL Connector/ODBC Oracle Client PsqlODBC Sybase ASE ODBC Database Servers: Borland InterBase Server Firebird Server Microsoft SQL Server Microsoft SQL Server Compact Edition Microsoft SQL Server Express Edition MySQL Server Oracle Server PostgreSQL Server Sybase SQL Server 4.00.9756.0 6.1.7601.17514 (win7sp1_ 6.1.7601.17514 (win7sp1_ -

System

--------[ ODBC Drivers ]----------------------------------------------------------------------------------------------Driver da Microsoft para arquivos texto (*.txt; *.csv) *.,*.asc,*.csv,*.tab,*.txt,*.csv Driver do Microsoft Access (*.mdb) *.mdb Driver do Microsoft dBase (*.dbf) *.dbf,*.ndx,*.mdx Driver do Microsoft Excel(*.xls) odbcjt32.dll odbcjt32.dll odbcjt32.dll odbcjt32.dll

*.xls Driver do Microsoft Paradox (*.db ) *.db Driver para o Microsoft Visual FoxPro *.dbf,*.cdx,*.idx,*.fpt Microsoft Access dBASE Driver (*.dbf, *.ndx, *.mdx) 14.0.4732.1000 *.dbf, *.ndx, *.mdx Microsoft Access Driver (*.mdb) *.mdb Microsoft Access Driver (*.mdb, *.accdb) 14.0.4732.1000 *.mdb,*.accdb Microsoft Access Text Driver (*.txt, *.csv) 14.0.4732.1000 *.txt, *.csv Microsoft Access-Treiber (*.mdb) *.mdb Microsoft dBase Driver (*.dbf) *.dbf,*.ndx,*.mdx Microsoft dBase VFP Driver (*.dbf) *.dbf,*.cdx,*.idx,*.fpt Microsoft dBase-Treiber (*.dbf) *.dbf,*.ndx,*.mdx Microsoft Excel Driver (*.xls) *.xls Microsoft Excel Driver (*.xls, *.xlsx, *.xlsm, *.xlsb) 14.0.4732.1000 *.xls,*.xlsx, *.xlsb Microsoft Excel-Treiber (*.xls) *.xls Microsoft FoxPro VFP Driver (*.dbf) *.dbf,*.cdx,*.idx,*.fpt Microsoft ODBC for Oracle Microsoft Paradox Driver (*.db ) *.db Microsoft Paradox-Treiber (*.db ) *.db Microsoft Text Driver (*.txt; *.csv) *.,*.asc,*.csv,*.tab,*.txt,*.csv Microsoft Text-Treiber (*.txt; *.csv) *.,*.asc,*.csv,*.tab,*.txt,*.csv Microsoft Visual FoxPro Driver *.dbf,*.cdx,*.idx,*.fpt Microsoft Visual FoxPro-Treiber *.dbf,*.cdx,*.idx,*.fpt SQL Server

odbcjt32.dll vfpodbc.dll aceodbc.dll odbcjt32.dll aceodbc.dll aceodbc.dll odbcjt32.dll odbcjt32.dll vfpodbc.dll odbcjt32.dll odbcjt32.dll aceodbc.dll odbcjt32.dll vfpodbc.dll msorcl32.dll odbcjt32.dll odbcjt32.dll odbcjt32.dll odbcjt32.dll vfpodbc.dll vfpodbc.dll sqlsrv32.dll

--------[ ODBC Data Sources ]-----------------------------------------------------------------------------------------dBASE Files .mdx) User Excel Files *.xlsb) User MS Access Database User Microsoft Access dBASE Driver (*.dbf, *.ndx, * aceodbc.dll Microsoft Excel Driver (*.xls, *.xlsx, *.xlsm, aceodbc.dll Microsoft Access Driver (*.mdb, *.accdb) aceodbc.dll

--------[ Memory Read ]------------------------------------------------------------------------------------------------

Core i7 Extreme 965 24 CR1 14045 MB/s Athlon64 X2 Black 6400+ -4-11 CR1 Pentium EE 955

3333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800

9-9-9-

4-4 8889 MB/s 3466 MHz Intel D955XBK i955X Dual DDR2-667 4-4-411 8025 MB/s P4EE 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667 5-5-515 7895 MB/s Phenom II X4 Black 940 3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5-55-18 CR2 7667 MB/s Core 2 Extreme QX9650 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066 8-8-8 -20 CR2 7174 MB/s Core 2 Duo E6700 2666 MHz Abit AB9 P965 Dual DDR2-800 5-5-518 CR2 6924 MB/s Core 2 Extreme QX6700 2666 MHz Intel D975XBX2 i975X Dual DDR2-667 5-5-5 -15 6717 MB/s Athlon64 X2 4000+ 2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 5-5-518 CR2 6264 MB/s Athlon64 3200+ 2000 MHz ASRock 939S56-M SiS756 Dual DDR400 2.5-33-8 CR2 5987 MB/s Core 2 Duo P8400 2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 5-5-515 5850 MB/s Opteron 2378 2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 5029 MB/s Phenom X4 9500 2200 MHz Asus M3A AMD770 Ganged Dual DDR2-800 5-5-518 CR2 5019 MB/s Celeron 420 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 5-5-515 4960 MB/s Core 2 Duo T5600 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 5-5-515 4594 MB/s Xeon 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 2.5-33-7 4585 MB/s P4EE 3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 3-3-38 CR2 4352 MB/s Celeron D 326 2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 4-4-411 4012 MB/s Core Duo T2500 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 5-5-515 3976 MB/s Opteron 248 2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 2-3-3-

6 CR1 Xeon 5 Pentium M 730 12 Atom 230 12 Xeon E5462 15 Opteron 240 8 CR1 Nano L2200 12 CR2 P4 Xeon 5140 15

3938 MB/s 3066 MHz Asus PCH-DL i875P + PAT 3806 MB/s 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 3654 MB/s 1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 3540 MB/s 2800 MHz Intel S5400SF i5400 Quad DDR2-640FB 3540 MB/s 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 3529 MB/s 1600 MHz VIA VB8001 CN896 Int. 3515 MB/s 2400 MHz Abit SI7 SiSR658 3408 MB/s 2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 3348 MB/s 5-5-5Dual PC1066 RDRAM DDR2-667 SDRAM 5-5-53-4-45-5-54-4-44-4-4Dual DDR333 2-2-2-

Pentium M 770 2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A A#ABU) i915GM Int. DDR2-533 SDRAM 4-4-412 3165 MB/s Xeon L5320 1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 4-4-412 3155 MB/s P4 2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM 2.5-33-8 2983 MB/s Sempron 2600+ 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 2.5-33-8 CR2 2832 MB/s Celeron 2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 2-2-46 CR1 2769 MB/s P4 1600 MHz Abit TH7II i850 Dual PC800 RDRAM 2754 MB/s Opteron HE 2344 1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 2737 MB/s Celeron 215 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 5-4-412 2693 MB/s Celeron M 320 1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 2.5-33-7 2435 MB/s Duron 1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 2.5-22-6 CR2 1601 MB/s Efficeon 8600 1000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM 1540 MB/s Athlon 1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 2-3-3-

7 Duron 5 C7 12 CR2 Celeron 6 PIII-E 6 PIII-S

1302 MB/s 600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 1134 MB/s 1500 MHz VIA EPIA EN CN700 Int. 1061 MB/s 1700 MHz Asus P4B i845 1051 MB/s 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 1046 MB/s 1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 2-3-33-3-33-3-3PC133 SDRAM 3-3-3DDR2-533 SDRAM 4-4-42-2-2-

6 CR2 1041 MB/s AthlonXP 1600+ 1400 MHz Acorp 7KMM1 KM133A Int. PC133 SDRAM 6 954 MB/s Crusoe 5800 1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 841 MB/s Athlon 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 6 767 MB/s C3 1333 MHz VIA EPIA SP CN400 Int. DDR400 SDRAM 8 CR2 690 MB/s C3 800 MHz VIA EPIA PLE133 Int. PC133 SDRAM 6 635 MB/s PIII 500 MHz Epox KP6-BS i440BX PC100R SDRAM ? 620 MB/s PIII 450 MHz Asus P3C-S i820 PC600 RDRAM 524 MB/s PII 333 MHz Intel DK440LX i440LX PC66 SDRAM ? 371 MB/s Celeron 266 MHz Epox P2-100B ApolloPro PC66 SDRAM 5 360 MB/s K6-III 400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 5 262 MB/s PentiumPro 200 MHz Compaq ProLiant 800 i440FX Dual EDO 258 MB/s Pentium 166 MHz Asus TX97-X i430TX PC66 SDRAM 4 228 MB/s MediaGXm 233 MHz ALD NPC6836 Cx5520 PC60 SDRAM 6 222 MB/s PentiumMMX 200 MHz Gigabyte GA-586DX i430HX Dual EDO 188 MB/s K5 PR166 116 MHz Asus P5A ALADDiN5 PC66 SDRAM

3-3-33-3-33-3-33-3-33-2-23-2-22-2-22-2-33-3-32-2-2-

6 K6-2 6 Celeron 6

167 MB/s 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM 150 MB/s 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 117 MB/s 3-3-33-3-3-

--------[ Memory Write ]----------------------------------------------------------------------------------------------Core i7 Extreme 965 24 CR1 12038 MB/s Athlon64 X2 Black 6400+ 3333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800 9-9-9-

4-4 -4-11 CR1 8814 MB/s Core 2 Extreme QX9650 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066 8-8-8 -20 CR2 7086 MB/s Xeon E5462 2800 MHz Intel S5400SF i5400 Quad DDR2-640FB 5-5-515 6712 MB/s Phenom II X4 Black 940 3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5-55-18 CR2 5915 MB/s Pentium EE 955 3466 MHz Intel D955XBK i955X Dual DDR2-667 4-4-411 5636 MB/s P4EE 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667 5-5-515 5618 MB/s Core 2 Duo P8400 2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 5-5-515 5522 MB/s Athlon64 X2 4000+ 2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 5-5-518 CR2 5484 MB/s P4EE 3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 3-3-38 CR2 5378 MB/s Core 2 Extreme QX6700 2666 MHz Intel D975XBX2 i975X Dual DDR2-667 5-5-5 -15 4853 MB/s Core 2 Duo E6700 2666 MHz Abit AB9 P965 Dual DDR2-800 5-5-518 CR2 4842 MB/s Xeon 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 2.5-33-7 4199 MB/s Athlon64 3200+ 2000 MHz ASRock 939S56-M SiS756 Dual DDR400 2.5-33-8 CR2 4083 MB/s Opteron 2378 2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 3940 MB/s Phenom X4 9500 2200 MHz Asus M3A AMD770 Ganged Dual DDR2-800 5-5-518 CR2 3861 MB/s

Opteron 248 6 CR1 Celeron 420 15 Core Duo T2500 15 Nano L2200 12 CR2 P4 3-8 3160 MB/s 3410 MB/s 3824 MB/s

2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 3584 MB/s 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 1600 MHz VIA VB8001 CN896 Int. DDR2-667 SDRAM

2-3-35-5-55-5-55-5-5-

2.5-33112 MB/s Core 2 Duo T5600 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 5-5-515 3007 MB/s Xeon 3066 MHz Asus PCH-DL i875P + PAT Dual DDR333 2-2-25 2840 MB/s P4 2400 MHz Abit SI7 SiSR658 Dual PC1066 RDRAM 2838 MB/s Pentium M 730 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 4-4-412 2834 MB/s Atom 230 1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 4-4-412 2832 MB/s Celeron D 326 2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 4-4-411 2785 MB/s Pentium M 770 2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A A#ABU) i915GM Int. DDR2-533 SDRAM 4-4-412 2763 MB/s Xeon 5140 2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 5-5-515 2487 MB/s Xeon L5320 1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 4-4-412 2315 MB/s Opteron 240 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 3-4-48 CR1 2287 MB/s Sempron 2600+ 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 2.5-33-8 CR2 2267 MB/s Opteron HE 2344 1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 2208 MB/s Celeron 2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 2-2-46 CR1 2148 MB/s Celeron M 320 1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 2.5-33-7 2128 MB/s P4 1600 MHz Abit TH7II i850 Dual PC800 RDRAM 2127 MB/s

2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM

C7 12 CR2 Celeron 215 12 Duron 2067 MB/s

1500 MHz VIA EPIA EN CN700 Int.

DDR2-533 SDRAM

4-4-45-4-42.5-22-3-32-2-23-3-32-3-33-3-33-3-33-3-33-3-33-3-32-2-33-3-3-

1333 MHz Intel D201GLY SiS662 Int. DDR2-533 1876 MB/s

1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 2-6 CR2 1571 MB/s Athlon 1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 7 1332 MB/s Duron 600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 5 1204 MB/s C3 1333 MHz VIA EPIA SP CN400 Int. DDR400 SDRAM 8 CR2 1057 MB/s PIII-S 1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 6 CR2 1054 MB/s Celeron 1700 MHz Asus P4B i845 PC133 SDRAM 6 1049 MB/s Athlon 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 6 1034 MB/s AthlonXP 1600+ 1400 MHz Acorp 7KMM1 KM133A Int. PC133 SDRAM 6 952 MB/s PIII-E 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 6 848 MB/s PIII 500 MHz Epox KP6-BS i440BX PC100R SDRAM ? 781 MB/s PIII 450 MHz Asus P3C-S i820 PC600 RDRAM 761 MB/s Pentium 166 MHz Asus TX97-X i430TX PC66 SDRAM 4 692 MB/s PentiumMMX 200 MHz Gigabyte GA-586DX i430HX Dual EDO 690 MB/s MediaGXm 233 MHz ALD NPC6836 Cx5520 PC60 SDRAM 6 588 MB/s Efficeon 8600 1000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM 549 MB/s K5 PR166 116 MHz Asus P5A ALADDiN5 PC66 SDRAM 6 500 MB/s Crusoe 5800 1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 355 MB/s C3 800 MHz VIA EPIA PLE133 Int. PC133 SDRAM 6 250 MB/s

2-2-2-

3-3-3-

PII ? Celeron 6 Celeron 5 K6-III 5 PentiumPro 87 MB/s K6-2 6 77 MB/s 128 MB/s 139 MB/s 171 MB/s 177 MB/s

333 MHz Intel DK440LX i440LX PC66 SDRAM 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 266 MHz Epox P2-100B ApolloPro PC66 SDRAM 400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 200 MHz Compaq ProLiant 800 i440FX Dual EDO 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM

3-2-23-3-33-2-22-2-23-3-3-

--------[ Memory Copy ]-----------------------------------------------------------------------------------------------Core i7 Extreme 965 9-9-924 CR1 14153 MB/s Phenom II X4 Black 940 3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5-55-18 CR2 8444 MB/s Athlon64 X2 Black 6400+ 3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800 4-4 -4-11 CR1 7241 MB/s Opteron 2378 2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 6833 MB/s Athlon64 X2 4000+ 2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 5-5-518 CR2 6567 MB/s Core 2 Extreme QX9650 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066 8-8-8 -20 CR2 6225 MB/s Pentium EE 955 3466 MHz Intel D955XBK i955X Dual DDR2-667 4-4-411 6206 MB/s P4EE 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667 5-5-515 6135 MB/s Xeon E5462 2800 MHz Intel S5400SF i5400 Quad DDR2-640FB 5-5-515 5470 MB/s Phenom X4 9500 2200 MHz Asus M3A AMD770 Ganged Dual DDR2-800 5-5-518 CR2 5429 MB/s Core 2 Duo E6700 2666 MHz Abit AB9 P965 Dual DDR2-800 5-5-518 CR2 5362 MB/s Core 2 Duo P8400 2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 5-5-515 5146 MB/s Athlon64 3200+ 2000 MHz ASRock 939S56-M 3333 MHz Asus P6T Deluxe X58 Triple DDR3-1333

SiS756 Dual DDR400 2.5-33-8 CR2 4653 MB/s Core 2 Extreme QX6700 2666 MHz Intel D975XBX2 i975X Dual DDR2-667 5-5-5 -15 4627 MB/s Xeon 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 2.5-33-7 4149 MB/s Celeron 420 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 5-5-515 4018 MB/s Opteron 248 2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 2-3-36 CR1 3714 MB/s Opteron HE 2344 1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 3373 MB/s P4EE 3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 3-3-38 CR2 3179 MB/s Core 2 Duo T5600 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 5-5-515 3172 MB/s Xeon 3066 MHz Asus PCH-DL i875P + PAT Dual DDR333 2-2-25 3161 MB/s Celeron D 326 2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 4-4-411 3144 MB/s Core Duo T2500 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 5-5-515 3103 MB/s Xeon 5140 2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 5-5-515 3000 MB/s Xeon L5320 1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 4-4-412 2905 MB/s Nano L2200 1600 MHz VIA VB8001 CN896 Int. DDR2-667 SDRAM 5-5-512 CR2 2850 MB/s P4 2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM 2.5-33-8 2645 MB/s P4 2400 MHz Abit SI7 SiSR658 Dual PC1066 RDRAM 2542 MB/s Sempron 2600+ 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 2.5-33-8 CR2 2511 MB/s Pentium M 730 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 4-4-412 2459 MB/s Atom 230 1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 4-4-412 2397 MB/s Opteron 240 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 3-4-48 CR1 2386 MB/s Pentium M 770 2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A

A#ABU) 12 P4 Celeron 6 CR1 Celeron 215 12 Celeron M 320 3-7 Duron

i915GM Int. 2311 MB/s 1600 MHz Abit TH7II i850 2211 MB/s

DDR2-533 SDRAM Dual PC800 RDRAM

4-4-42-2-45-4-42.5-32.5-24-4-42-3-32-2-23-3-32-3-33-3-33-3-33-3-3-

2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 2023 MB/s 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 1963 MB/s 1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 1729 MB/s

1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 2-6 CR2 1571 MB/s C7 1500 MHz VIA EPIA EN CN700 Int. DDR2-533 SDRAM 12 CR2 1394 MB/s Athlon 1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 7 1255 MB/s Duron 600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 5 1184 MB/s AthlonXP 1600+ 1400 MHz Acorp 7KMM1 KM133A Int. PC133 SDRAM 6 950 MB/s PIII-S 1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 6 CR2 907 MB/s Celeron 1700 MHz Asus P4B i845 PC133 SDRAM 6 886 MB/s PIII-E 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 6 865 MB/s C3 1333 MHz VIA EPIA SP CN400 Int. DDR400 SDRAM 8 CR2 784 MB/s Efficeon 8600 1000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM 623 MB/s Athlon 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 6 574 MB/s PIII 500 MHz Epox KP6-BS i440BX PC100R SDRAM ? 526 MB/s PIII 450 MHz Asus P3C-S i820 PC600 RDRAM 504 MB/s Crusoe 5800 1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 476 MB/s C3 800 MHz VIA EPIA PLE133 Int. PC133 SDRAM 6 311 MB/s PII 333 MHz Intel DK440LX

3-3-33-3-3-

3-3-3-

i440LX ? Pentium 4 PentiumMMX 181 MB/s K6-III 5 Celeron 5 Celeron 6 PentiumPro 111 MB/s K6-2 6 MediaGXm 6 K5 PR166 6 81 MB/s 83 MB/s 116 MHz Asus P5A ALADDiN5 100 MB/s 233 MHz ALD NPC6836 Cx5520 133 MB/s 142 MB/s 164 MB/s 182 MB/s 245 MB/s 166 MHz Asus TX97-X i430TX

PC66 SDRAM PC66 SDRAM

3-2-22-2-32-2-23-2-23-3-33-3-33-3-32-2-2-

200 MHz Gigabyte GA-586DX i430HX Dual EDO 400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 266 MHz Epox P2-100B ApolloPro PC66 SDRAM 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 200 MHz Compaq ProLiant 800 i440FX Dual EDO 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM PC60 SDRAM PC66 SDRAM

--------[ Memory Latency ]--------------------------------------------------------------------------------------------Athlon64 X2 Black 6400+ -4-11 CR1 47.2 ns Athlon64 3200+ 3-8 CR2 55.2 ns Core i7 Extreme 965 24 CR1 59.3 ns Sempron 2600+ 3-8 CR2 59.8 ns Phenom II X4 Black 940 5-18 CR2 61.3 ns Athlon64 X2 4000+ 18 CR2 62.1 ns Core 2 Duo E6700 18 CR2 69.3 ns Core 2 Extreme QX6700 -15 70.9 ns Core 2 Extreme QX9650 3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800 2000 MHz ASRock 939S56-M SiS756 Dual DDR400 3333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 4-4 2.5-39-9-92.5-3-

3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5-52100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 2666 MHz Abit AB9 P965 Dual DDR2-800 5-5-55-5-55-5-5 8-8-8

2666 MHz Intel D975XBX2 i975X Dual DDR2-667 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066

-20 CR2 74.7 ns Pentium EE 955 11 80.3 ns Opteron 248

3466 MHz Intel D955XBK i955X Dual DDR2-667 2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667

4-4-42-3-35-5-55-5-54-4-45-5-5-

6 CR1 80.4 ns Core 2 Duo P8400 15 P4EE 15 12 15 85.3 ns Pentium M 730 90.1 ns Celeron 420 91.8 ns Opteron 2378 85.0 ns

2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 2.5-33-4-45-5-54-4-4-

-5-15 CR1 95.3 ns Celeron M 320 3-7 95.8 ns Opteron 240

8 CR1 97.9 ns Core Duo T2500 15 Atom 230 12 103.5 ns Pentium M 770 A#ABU) 12 104.0 ns Xeon 5 PIII-S 6 CR2 108.1 ns Xeon 5140 15 15 109.0 ns Xeon E5462 110.6 ns Phenom X4 9500 112.6 ns 106.0 ns 99.6 ns

2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A i915GM Int. DDR2-533 SDRAM 4-4-43066 MHz Asus PCH-DL i875P + PAT Dual DDR333 2-2-22-3-35-5-55-5-5-

1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 2800 MHz Intel S5400SF i5400 Quad DDR2-640FB 2200 MHz Asus M3A AMD770

Ganged Dual DDR2-800 5-5-52.5-35-5-55-5-5-

18 CR2 P4 3-8

2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM 1600 MHz VIA VB8001 CN896 Int. DDR2-667 SDRAM

112.8 ns Nano L2200

12 CR2 113.4 ns Core 2 Duo T5600

1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667

15 PIII-E 6 P4EE

113.7 ns 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 117.7 ns 3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 139.2 ns Xeon 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 145.2 ns P4 147.1 ns C7 1500 MHz VIA EPIA EN CN700 Int. DDR2-533 SDRAM 4-4-44-4-43-3-33-3-33-3-32-2-43-3-32400 MHz Abit SI7 SiSR658 Dual PC1066 RDRAM 2.5-34-4-42-2-23-3-33-3-3-

8 CR2 124.8 ns Crusoe 5800 125.5 ns Xeon L5320 12 K6-III 5 3-7 126.1 ns

12 CR2 147.2 ns Celeron D 326 11 C3 6 C3 8 CR2 156.0 ns Celeron 6 Celeron 6 CR1 161.4 ns MediaGXm 6 P4 162.9 ns Efficeon 8600 163.2 ns Duron 2-6 CR2 163.8 ns Celeron 215 12 PIII ? 166.3 ns PentiumMMX 166.2 ns 162.2 ns 159.7 ns 154.8 ns 147.8 ns

2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 800 MHz VIA EPIA PLE133 Int. 1333 MHz VIA EPIA SP CN400 Int. 1700 MHz Asus P4B i845 PC133 SDRAM DDR400 SDRAM PC133 SDRAM

2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 233 MHz ALD NPC6836 Cx5520 1600 MHz Abit TH7II i850 PC60 SDRAM Dual PC800 RDRAM

1000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM 1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 500 MHz Epox KP6-BS i440BX PC100R SDRAM 2.5-25-4-43-3-3-

200 MHz Gigabyte GA-586DX i430HX Dual EDO

167.2 ns AthlonXP 1600+ 6 Athlon 7 Duron 5 K6-2 6 201.8 ns Opteron HE 2344 205.3 ns 183.8 ns 175.7 ns 170.6 ns

1400 MHz Acorp 7KMM1 KM133A Int.

PC133 SDRAM

3-3-32-3-32-2-23-3-3-

1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM

1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 3-3-32-2-33-2-22-2-23-3-33-2-2-

-5-15 CR1 Athlon 6 PIII

207.1 ns 450 MHz Asus P3C-S i820 PC600 RDRAM 215.2 ns PentiumPro 233.6 ns Pentium 166 MHz Asus TX97-X i430TX 234.9 ns PII 333 MHz Intel DK440LX i440LX PC66 SDRAM 248.9 ns K5 PR166 116 MHz Asus P5A ALADDiN5 266.1 ns Celeron 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 275.6 ns Celeron 266 MHz Epox P2-100B ApolloPro PC66 SDRAM 317.4 ns PC66 SDRAM PC66 SDRAM

200 MHz Compaq ProLiant 800 i440FX Dual EDO

4 ? 6 6 5

--------[ CPU Queen ]-------------------------------------------------------------------------------------------------4x Core i7 Extreme 965 HT -9-9-24 CR1 8x Xeon E5462 15 30472 8x Opteron 2378 30786 2800 MHz Intel S5400SF i5400 Quad DDR2-640FB 5-5-53333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 9

2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066 1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 84-4-4-

-5-15 CR1 22769 4x Core 2 Extreme QX9650 8-8-20 CR2 21421 8x Xeon L5320 12 20452

4x Core 2 Extreme QX6700 5-5-15 19166 4x Phenom II X4 Black 940 -5-5-18 CR2 4x Xeon 5140 15 18636

2666 MHz Intel D975XBX2 i975X Dual DDR2-667

5-

3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5 5-5-5-

2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB

16729 8x Opteron HE 2344

1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 2200 MHz Asus M3A AMD770 2666 MHz Abit AB9 P965 Ganged Dual DDR2-800 5-5-5Dual DDR2-800 5-5-5-

-5-15 CR1 16146 4x Phenom X4 9500 18 CR2 13693 2x Core 2 Duo E6700

18 CR2 11406 2x Athlon64 X2 Black 6400+

3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800

4-4-4-11 CR1 11169 2x Core 2 Duo P8400 2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 5-5-515 9578 2x Core Duo T2500 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 5-5-515 7793 2x Core 2 Duo T5600 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 5-5-515 7717 2x Athlon64 X2 4000+ 2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 5-5-518 CR2 7280 2x Pentium EE 955 HT 3466 MHz Intel D955XBK i955X Dual DDR2-667 4-4-411 7098 2x Xeon HT 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 2.5-33-7 6953 2x Xeon 3066 MHz Asus PCH-DL i875P + PAT Dual DDR333 2-2-25 6188 2x Opteron 240 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 3-4-48 CR1 4863 2x PIII-S 1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 2-3-36 CR2 4857 P4EE HT 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667 5-5-515 4210 Pentium M 770 2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A A#ABU) i915GM Int. DDR2-533 SDRAM 4-4-412 3968 Opteron 248 2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 2-3-36 CR1 3851 Atom 230 HT 1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 4-4-412 3779

P4EE 8 CR2 3516 Athlon64 3200+ 3-8 CR2 3497 Celeron 420 15 12 2x PIII-E 6 2811 Sempron 2600+ 2808 3375 Pentium M 730 3124

3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 2000 MHz ASRock 939S56-M SiS756 Dual DDR400 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM 2804 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 2607 1600 MHz VIA VB8001 CN896 Int. DDR2-667 SDRAM

3-3-32.5-35-5-54-4-43-3-32.5-32.5-35-4-45-5-52.5-32.5-22-3-33-3-32-2-43-3-34-4-43-3-34-4-4-

3-8 CR2 P4 3-8 Celeron 215 12 Nano L2200

12 CR2 2583 Celeron M 320 3-7 Duron 2-6 CR2 P4 Athlon 7 6 Celeron 6 CR1 2x PIII ? 11 Celeron 6 P4 1624 C7 12 CR2 1560 1723 2031 2218 AthlonXP 1600+ 2210 2537 2544

1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 2400 MHz Abit SI7 SiSR658 Dual PC1066 RDRAM

2434 1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 1400 MHz Acorp 7KMM1 KM133A Int. PC133 SDRAM

2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 500 MHz Epox KP6-BS i440BX PC100R SDRAM

1927 Celeron D 326 1900

2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 1700 MHz Asus P4B i845 1600 MHz Abit TH7II i850 1500 MHz VIA EPIA EN CN700 Int. PC133 SDRAM Dual PC800 RDRAM DDR2-533 SDRAM

Efficeon 8600 1461 Celeron 6 Athlon 6 2x PII ? C3 8 CR2 Duron 5 Crusoe 5800 885 PIII 873 K6-III 5 K6-2 6 2x PentiumMMX 664 C3 6 2x PentiumPro 534 Celeron 5 Pentium 4 K5 PR166 6 MediaGXm 6 185 200 232 459 575 696 814 1099 1145 1188 1349

1000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 333 MHz Intel DK440LX i440LX PC66 SDRAM 1333 MHz VIA EPIA SP CN400 Int. DDR400 SDRAM 3-3-33-3-33-2-23-3-32-2-2-

600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 953 1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 450 MHz Asus P3C-S i820 PC600 RDRAM

2-2-23-3-33-3-33-2-22-2-32-2-23-3-3-

400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM 200 MHz Gigabyte GA-586DX i430HX Dual EDO 800 MHz VIA EPIA PLE133 Int. PC133 SDRAM

200 MHz Compaq ProLiant 800 i440FX Dual EDO 266 MHz Epox P2-100B ApolloPro PC66 SDRAM 166 MHz Asus TX97-X i430TX 116 MHz Asus P5A ALADDiN5 233 MHz ALD NPC6836 Cx5520 PC66 SDRAM PC66 SDRAM PC60 SDRAM

--------[ CPU PhotoWorxx ]--------------------------------------------------------------------------------------------4x Core i7 Extreme 965 HT -9-9-24 CR1 8x Xeon E5462 3333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 9

35393 2800 MHz Intel S5400SF

i5400 15 25575 4x Phenom II X4 Black 940

Quad DDR2-640FB

5-5-5-

3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5

-5-5-18 CR2 19168 4x Core 2 Extreme QX9650 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066 88-8-20 CR2 17431 8x Opteron 2378 2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 15896 2x Core 2 Duo E6700 2666 MHz Abit AB9 P965 Dual DDR2-800 5-5-518 CR2 11922 4x Core 2 Extreme QX6700 2666 MHz Intel D975XBX2 i975X Dual DDR2-667 55-5-15 11706 8x Xeon L5320 1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 4-4-412 9621 4x Xeon 5140 2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 5-5-515 8626 2x Athlon64 X2 Black 6400+ 3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800 4-4-4-11 CR1 7653 2x Core 2 Duo P8400 2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 5-5-515 7534 8x Opteron HE 2344 1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 6622 4x Phenom X4 9500 2200 MHz Asus M3A AMD770 Ganged Dual DDR2-800 5-5-518 CR2 6532 2x Athlon64 X2 4000+ 2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 5-5-518 CR2 6419 2x Pentium EE 955 HT 3466 MHz Intel D955XBK i955X Dual DDR2-667 4-4-411 6058 2x Opteron 240 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 3-4-48 CR1 5645 2x Core Duo T2500 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 5-5-515 5053 2x Core 2 Duo T5600 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 5-5-515 5027 P4EE HT 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667 5-5-515 4621 2x Xeon HT 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 2.5-33-7 4031 Celeron 420 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 5-5-515 3844 Athlon64 3200+ 2000 MHz ASRock 939S56-M

3-8 CR2 Opteron 248 6 CR1 2x Xeon 5 Pentium M 770 A#ABU) 12 Pentium M 730 12 Sempron 2600+ 3-8 CR2 P4EE 8 CR2 Celeron D 326 11 Celeron 215 12 Atom 230 HT 12 Nano L2200 12 CR2 P4 3-8 P4 Celeron M 320 3-7 Celeron 6 CR1 Duron 2-6 CR2 P4 2x PIII-S 6 CR2 C7 12 CR2 2x PIII-E 6 Efficeon 8600

SiS756 Dual DDR400 2.5-33724 2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 2-3-33406 3066 MHz Asus PCH-DL i875P + PAT Dual DDR333 2-2-23339 2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A i915GM Int. DDR2-533 SDRAM 4-4-42822 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 4-4-42801 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 2.5-32780 3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 3-3-32424 2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 4-4-42262 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 5-4-42198 1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 4-4-42163 1600 MHz VIA VB8001 CN896 Int. DDR2-667 SDRAM 5-5-51975 2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM 2.5-31967 2400 MHz Abit SI7 SiSR658 Dual PC1066 RDRAM 1883 1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 2.5-31854 2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 2-2-41599 1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 2.5-21413 1600 MHz Abit TH7II i850 Dual PC800 RDRAM 1385 1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 2-3-31299 1500 MHz VIA EPIA EN CN700 Int. DDR2-533 SDRAM 4-4-41219 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 3-3-31138 1000 MHz ECS 532 Notebook

Efficeon 1119 Celeron 6 AthlonXP 1600+ 6 Athlon 7 2x PIII ? C3 8 CR2 Duron 5 Athlon 6 Crusoe 5800 536 2x PII ? PIII 530 K6-III 5 C3 6 2x PentiumPro 327 Celeron 5 Celeron 6 K6-2 6 K5 PR166 6 Pentium 4 MediaGXm 6 2x PentiumMMX 147 148 233 MHz ALD NPC6836 Cx5520 173 166 MHz Asus TX97-X i430TX 254 116 MHz Asus P5A ALADDiN5 270 297 353 357 800 MHz VIA EPIA PLE133 Int. 531 450 MHz Asus P3C-S i820 598 670 839 1333 MHz VIA EPIA SP CN400 Int. 853 500 MHz Epox KP6-BS i440BX 959 1070 1400 MHz Acorp 7KMM1 KM133A Int. 1700 MHz Asus P4B i845

DDR266 SDRAM PC133 SDRAM PC133 SDRAM 3-3-33-3-32-3-33-3-33-3-32-2-23-3-3-

1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM PC100R SDRAM DDR400 SDRAM

600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 667 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 333 MHz Intel DK440LX i440LX PC66 SDRAM PC600 RDRAM

3-2-22-2-23-3-33-2-23-3-33-3-32-2-22-2-33-3-3-

400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM PC133 SDRAM

200 MHz Compaq ProLiant 800 i440FX Dual EDO 266 MHz Epox P2-100B ApolloPro PC66 SDRAM 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM PC66 SDRAM PC66 SDRAM PC60 SDRAM

200 MHz Gigabyte GA-586DX

i430HX 142

Dual EDO

--------[ CPU ZLib ]--------------------------------------------------------------------------------------------------8x Xeon E5462 15 2800 MHz Intel S5400SF i5400 Quad DDR2-640FB 3333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 5-5-5-

139481 KB/s 4x Core i7 Extreme 965 HT

9 112330 KB/s 2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 104213 KB/s 8x Xeon L5320 1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 4-4-412 95887 KB/s 8x Opteron HE 2344 1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 -5-15 CR1 88845 KB/s 4x Phenom II X4 Black 940 3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5 -5-5-18 CR2 80081 KB/s 4x Core 2 Extreme QX9650 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066 88-8-20 CR2 77167 KB/s 4x Core 2 Extreme QX6700 2666 MHz Intel D975XBX2 i975X Dual DDR2-667 55-5-15 69756 KB/s 4x Xeon 5140 2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 5-5-515 60995 KB/s 4x Phenom X4 9500 2200 MHz Asus M3A AMD770 Ganged Dual DDR2-800 5-5-518 CR2 58396 KB/s 2x Athlon64 X2 Black 6400+ 3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800 4-4-4-11 CR1 38059 KB/s 2x Core 2 Duo E6700 2666 MHz Abit AB9 P965 Dual DDR2-800 5-5-518 CR2 35355 KB/s 2x Pentium EE 955 HT 3466 MHz Intel D955XBK i955X Dual DDR2-667 4-4-411 29844 KB/s 2x Core 2 Duo P8400 2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 5-5-515 29223 KB/s 2x Xeon HT 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 2.5-33-7 29177 KB/s 2x Xeon 3066 MHz Asus PCH-DL i875P + PAT Dual DDR333 2-2-25 25040 KB/s 2x Core 2 Duo T5600 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 5-5-515 23969 KB/s 2x Athlon64 X2 4000+ 2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 5-5-5-9-9-24 CR1 8x Opteron 2378

18 CR2 23852 KB/s 2x Core Duo T2500 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 5-5-515 23789 KB/s P4EE HT 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667 5-5-515 16146 KB/s 2x Opteron 240 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 3-4-48 CR1 15860 KB/s 2x PIII-S 1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 2-3-36 CR2 14669 KB/s P4EE 3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 3-3-38 CR2 14095 KB/s Opteron 248 2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 2-3-36 CR1 12635 KB/s Pentium M 770 2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A A#ABU) i915GM Int. DDR2-533 SDRAM 4-4-412 12056 KB/s Athlon64 3200+ 2000 MHz ASRock 939S56-M SiS756 Dual DDR400 2.5-33-8 CR2 11824 KB/s P4 2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM 2.5-33-8 11343 KB/s Celeron 420 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 5-5-515 10485 KB/s Pentium M 730 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 4-4-412 9871 KB/s P4 2400 MHz Abit SI7 SiSR658 Dual PC1066 RDRAM 9775 KB/s Celeron D 326 2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 4-4-411 9261 KB/s Atom 230 HT 1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 4-4-412 8404 KB/s Sempron 2600+ 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 2.5-33-8 CR2 8152 KB/s Celeron M 320 1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 2.5-33-7 8110 KB/s Celeron 215 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 5-4-412 7935 KB/s Nano L2200 1600 MHz VIA VB8001 CN896 Int. DDR2-667 SDRAM 5-5-512 CR2 7799 KB/s AthlonXP 1600+ 1400 MHz Acorp 7KMM1 KM133A Int. PC133 SDRAM 3-3-36 7435 KB/s 2x PIII-E 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 3-3-3-

6 Athlon 7 P4

7379 KB/s 1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 7343 KB/s 1600 MHz Abit TH7II i850 6339 KB/s Efficeon 8600 5321 KB/s 2x PIII 500 MHz Epox KP6-BS i440BX 4826 KB/s Celeron 2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 4407 KB/s 1500 MHz VIA EPIA EN CN700 Int. 4140 KB/s 1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 4002 KB/s 2.5-23-3-33-3-33-2-22-2-23-3-32-2-23-3-33-3-33-3-3DDR2-533 SDRAM 4-4-42-2-4PC100R SDRAM 3-3-31000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM Dual PC800 RDRAM 2-3-3-

? 6 CR1 C7 12 CR2 Crusoe 5800 Duron

1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 2-6 CR2 3786 KB/s Athlon 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 6 3586 KB/s Celeron 1700 MHz Asus P4B i845 PC133 SDRAM 6 3484 KB/s 2x PII 333 MHz Intel DK440LX i440LX PC66 SDRAM ? 3070 KB/s Duron 600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 5 2288 KB/s C3 1333 MHz VIA EPIA SP CN400 Int. DDR400 SDRAM 8 CR2 2280 KB/s PIII 450 MHz Asus P3C-S i820 PC600 RDRAM 2195 KB/s 2x PentiumPro 200 MHz Compaq ProLiant 800 i440FX Dual EDO 2102 KB/s K6-III 400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 5 1986 KB/s C3 800 MHz VIA EPIA PLE133 Int. PC133 SDRAM 6 1465 KB/s Celeron 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 6 1299 KB/s 2x PentiumMMX 200 MHz Gigabyte GA-586DX i430HX Dual EDO 1054 KB/s K6-2 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM

6 Celeron 5 Pentium 4 K5 PR166 6 MediaGXm 6

774 KB/s 266 MHz Epox P2-100B ApolloPro PC66 SDRAM 656 KB/s 166 MHz Asus TX97-X i430TX 497 KB/s 116 MHz Asus P5A ALADDiN5 474 KB/s 233 MHz ALD NPC6836 Cx5520 412 KB/s PC60 SDRAM 3-3-3PC66 SDRAM 2-2-2PC66 SDRAM 2-2-33-2-2-

--------[ CPU AES ]---------------------------------------------------------------------------------------------------Nano L2200 12 CR2 42295 8x Xeon E5462 15 41625 8x Opteron 2378 1600 MHz VIA VB8001 CN896 Int. DDR2-667 SDRAM 5-5-55-5-5-

2800 MHz Intel S5400SF i5400 Quad DDR2-640FB

2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 3333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 4-4-49

-5-15 CR1 32424 8x Xeon L5320 12

27698 4x Core i7 Extreme 965 HT

-9-9-24 CR1 26703 8x Opteron HE 2344 -5-15 CR1 22599 4x Core 2 Extreme QX9650

1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066 8-

8-8-20 CR2 22435 4x Phenom II X4 Black 940 -5-5-18 CR2 21658 4x Core 2 Extreme QX6700 5-5-15 C7 19896

3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5 2666 MHz Intel D975XBX2 i975X Dual DDR2-667 54-4-45-5-5-

1500 MHz VIA EPIA EN CN700 Int.

DDR2-533 SDRAM

12 CR2 17358 4x Xeon 5140 15 17320 4x Phenom X4 9500

2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 2200 MHz Asus M3A AMD770 2666 MHz Abit AB9 P965

Ganged Dual DDR2-800 5-5-5Dual DDR2-800 5-5-54-4-4-

18 CR2 14802 2x Core 2 Duo E6700 18 CR2 9969 2x Pentium EE 955 HT 11 8970

3466 MHz Intel D955XBK i955X Dual DDR2-667

2x Xeon HT 3-7 15 8740 2x Core 2 Duo P8400

3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800

2.5-35-5-5-

8443 2x Athlon64 X2 Black 6400+

4-4-4-11 CR1 8339 2x Core Duo T2500 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 5-5-515 7109 2x Core 2 Duo T5600 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 5-5-515 6778 C3 1333 MHz VIA EPIA SP CN400 Int. DDR400 SDRAM 3-3-38 CR2 6771 2x Xeon 3066 MHz Asus PCH-DL i875P + PAT Dual DDR333 2-2-25 6366 2x Athlon64 X2 4000+ 2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 5-5-518 CR2 5444 P4EE HT 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667 5-5-515 4811 2x PIII-S 1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 2-3-36 CR2 3985 2x Opteron 240 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 3-4-48 CR1 3608 P4EE 3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 3-3-38 CR2 3576 Pentium M 770 2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A A#ABU) i915GM Int. DDR2-533 SDRAM 4-4-412 3568 Celeron 420 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 5-5-515 2935 P4 2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM 2.5-33-8 2906 Opteron 248 2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 2-3-36 CR1 2851 Pentium M 730 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 4-4-412 2842 Athlon64 3200+ 2000 MHz ASRock 939S56-M SiS756 Dual DDR400 2.5-33-8 CR2 2603 Celeron 215 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 5-4-412 2378 Celeron M 320 1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 2.5-33-7 2291

P4 2284 Celeron D 326 11 2x PIII-E 6 2105 Sempron 2600+ 2089 2114

2400 MHz Abit SI7 SiSR658

Dual PC1066 RDRAM

4-4-43-3-32.5-32.5-22-2-44-4-43-3-3-

2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM

3-8 CR2 Duron 2-6 CR2 Celeron

2031 2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 1400 MHz Acorp 7KMM1 KM133A Int. PC133 SDRAM

6 CR1 1920 Atom 230 HT 12 6 1845 AthlonXP 1600+ 1770 Efficeon 8600 1762 Celeron 6 Athlon 7 P4 1475 2x PIII ? Crusoe 5800 1177 2x PII ? Celeron 6 Athlon 6 Duron 5 PIII 682 2x PentiumPro 599 727 857 909 984 1466 1539 1579

1000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM 1700 MHz Asus P4B i845 PC133 SDRAM 3-3-32-3-33-3-3-

1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 1600 MHz Abit TH7II i850 500 MHz Epox KP6-BS i440BX Dual PC800 RDRAM PC100R SDRAM

1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 333 MHz Intel DK440LX i440LX PC66 SDRAM 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 450 MHz Asus P3C-S i820 PC600 RDRAM 3-2-23-3-33-3-32-2-2-

200 MHz Compaq ProLiant 800 i440FX Dual EDO

K6-III 5 Celeron 5 C3 6 K6-2 6 2x PentiumMMX 313 K5 PR166 6 MediaGXm 6 Pentium 4 107 112 171 348 393 401 447

400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 266 MHz Epox P2-100B ApolloPro PC66 SDRAM 800 MHz VIA EPIA PLE133 Int. PC133 SDRAM

2-2-23-2-23-3-33-3-32-2-23-3-32-2-3-

333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM 200 MHz Gigabyte GA-586DX i430HX Dual EDO 116 MHz Asus P5A ALADDiN5 233 MHz ALD NPC6836 Cx5520 166 MHz Asus TX97-X i430TX PC66 SDRAM PC60 SDRAM PC66 SDRAM

--------[ FPU Julia ]-------------------------------------------------------------------------------------------------8x Xeon E5462 15 2800 MHz Intel S5400SF i5400 Quad DDR2-640FB 3333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 5-5-59 4-4-4-

19454 4x Core i7 Extreme 965 HT 14403

-9-9-24 CR1 8x Xeon L5320 12 13144 8x Opteron 2378

1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB

2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066 2666 MHz Intel D975XBX2 i975X Dual DDR2-667 2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 855-5-5-

-5-15 CR1 12276 4x Core 2 Extreme QX9650 8-8-20 CR2 10970 4x Core 2 Extreme QX6700 5-5-15 4x Xeon 5140 15 9820

8584 4x Phenom II X4 Black 940

3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5

-5-5-18 CR2 8046 8x Opteron HE 2344 -5-15 CR1 7904 4x Phenom X4 9500 18 CR2 5329 2x Core 2 Duo E6700

1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 2200 MHz Asus M3A AMD770 2666 MHz Abit AB9 Ganged Dual DDR2-800 5-5-5-

P965 18 CR2 5005 2x Core 2 Duo P8400 15 15 11 2x Xeon HT 3-7 4188 2x Core 2 Duo T5600 3403 2x Pentium EE 955 HT 2709

Dual DDR2-800

5-5-55-5-55-5-54-4-42.5-3-

2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 3466 MHz Intel D955XBK i955X Dual DDR2-667 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800 Dual DDR333

2640 2x Athlon64 X2 Black 6400+ 2586

4-4-4-11 CR1 2x Xeon 5

3066 MHz Asus PCH-DL i875P + PAT

2-2-25-5-55-5-55-5-55-5-53-3-33-4-45-5-52.5-32-3-32.5-34-4-4-

2063 2x Athlon64 X2 4000+

2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667

18 CR2 1776 2x Core Duo T2500 15 P4EE HT 15 Celeron 420 15 P4EE 8 CR2 1242 2x Opteron 240 8 CR1 1104 Nano L2200 12 CR2 P4 3-8 Opteron 248 6 CR1 900 Athlon64 3200+ 3-8 CR2 854 Celeron D 326 11 823 Pentium M 770 A#ABU) 12 787 Atom 230 HT 12 P4 785 990 1395 1461 1635

1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 1600 MHz VIA VB8001 CN896 Int. DDR2-667 SDRAM

2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM 922 2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 2000 MHz ASRock 939S56-M SiS756 Dual DDR400 2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM

2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A i915GM Int. DDR2-533 SDRAM 4-4-41600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 2400 MHz Abit SI7 4-4-4-

SiSR658 779 Sempron 2600+ 3-8 CR2 Celeron 683

Dual PC1066 RDRAM

2.5-32-2-44-4-42-3-35-4-42.5-23-3-32.5-33-3-32-3-33-3-3-

1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 534 1600 MHz Abit TH7II i850 514 1700 MHz Asus P4B i845 495 Dual PC800 RDRAM PC133 SDRAM

6 CR1 648 Pentium M 730 12 2x PIII-S 6 CR2 617 Celeron 215 12 Duron 2-6 CR2 P4 Celeron 6 Celeron M 320 3-7 6 Athlon 7 2x PIII-E 6 Efficeon 8600 309 C7 12 CR2 2x PIII ? Athlon 6 Duron 5 C3 8 CR2 PIII Celeron 168 193 227 273 363 398 474 AthlonXP 1600+ 440 538 645

1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 1400 MHz Acorp 7KMM1 KM133A Int. PC133 SDRAM

1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 1000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM 1500 MHz VIA EPIA EN CN700 Int. 500 MHz Epox KP6-BS i440BX 261 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 1333 MHz VIA EPIA SP CN400 Int. 450 MHz Asus P3C-S i820 121 700 MHz PCChips M758LT DDR400 SDRAM PC600 RDRAM DDR2-533 SDRAM PC100R SDRAM

4-4-43-3-33-3-32-2-23-3-3-

SiS630ET Int. 6 2x PII ? C3 6 Crusoe 5800 73 K6-III 5 2x PentiumPro 56 K6-2 6 2x PentiumMMX 39 Celeron 5 Pentium 4 K5 PR166 6 MediaGXm 6 6 11 233 MHz ALD NPC6836 Cx5520 16 116 MHz Asus P5A ALADDiN5 39 166 MHz Asus TX97-X i430TX 47 62 78 100 800 MHz VIA EPIA PLE133 Int. 110

PC100 SDRAM

3-3-33-2-23-3-3-

333 MHz Intel DK440LX i440LX PC66 SDRAM PC133 SDRAM

1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 200 MHz Compaq ProLiant 800 i440FX Dual EDO 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM 200 MHz Gigabyte GA-586DX i430HX Dual EDO 266 MHz Epox P2-100B ApolloPro PC66 SDRAM PC66 SDRAM PC66 SDRAM PC60 SDRAM 2-2-23-3-33-2-22-2-32-2-23-3-3-

--------[ FPU Mandel ]------------------------------------------------------------------------------------------------8x Xeon E5462 15 2800 MHz Intel S5400SF i5400 Quad DDR2-640FB 3333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 5-5-59

9771 4x Core i7 Extreme 965 HT

-9-9-24 CR1 7825 8x Opteron 2378 -5-15 CR1 7655 8x Xeon L5320 12 6449 4x Core 2 Extreme QX9650

2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066 4-4-48-

8-8-20 CR2 5567 8x Opteron HE 2344

1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5

-5-15 CR1 5494 4x Phenom II X4 Black 940

-5-5-18 CR2 5051 4x Core 2 Extreme QX6700 5-5-15 4x Xeon 5140 15 4870

2666 MHz Intel D975XBX2 i975X Dual DDR2-667 2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 2200 MHz Asus M3A AMD770 2666 MHz Abit AB9 P965

55-5-5-

4254 4x Phenom X4 9500

Ganged Dual DDR2-800 5-5-5Dual DDR2-800 5-5-55-5-54-4-42.5-35-5-5-

18 CR2 3749 2x Core 2 Duo E6700 18 CR2 2492 2x Core 2 Duo P8400 15 11 2x Xeon HT 3-7 15 1739 2x Core 2 Duo T5600 2150 2x Pentium EE 955 HT 1771

2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 3466 MHz Intel D955XBK i955X Dual DDR2-667 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800 Dual DDR333

1698 2x Athlon64 X2 Black 6400+ 1544

4-4-4-11 CR1 2x Xeon 5

3066 MHz Asus PCH-DL i875P + PAT

2-2-25-5-55-5-53-3-35-5-55-5-52.5-33-4-44-4-45-5-5-

1489 2x Athlon64 X2 4000+ 1005

2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667

18 CR2 P4EE HT 15 P4EE

970 3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 745 P4 2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 1600 MHz VIA VB8001 CN896 Int. 607 2400 MHz Abit SI7 SiSR658 Dual PC1066 RDRAM DDR2-667 SDRAM 683 2x Opteron 240

8 CR2 847 2x Core Duo T2500 15 Celeron 420 15 3-8 764

8 CR1 674 Celeron D 326 11 Nano L2200 12 CR2 P4 636

590 Opteron 248 6 CR1 Celeron 526 2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 2000 MHz ASRock 939S56-M SiS756 Dual DDR400 1700 MHz Asus P4B i845 412 Sempron 2600+ 3-8 CR2 P4 389 1600 MHz Abit TH7II i850 388 Pentium M 770 A#ABU) 12 374 2x PIII-S 6 CR2 340 Pentium M 730 12 Celeron 215 12 Celeron M 320 3-7 Duron 2-6 CR2 2x PIII-E 6 Efficeon 8600 194 AthlonXP 1600+ 6 Athlon 7 C7 12 CR2 145 Atom 230 HT 12 2x PIII ? Athlon 135 750 MHz Epox EP-7KXA KX133 PC133 SDRAM 3-3-3143 500 MHz Epox KP6-BS i440BX PC100R SDRAM 3-3-3191 1500 MHz VIA EPIA EN CN700 Int. DDR2-533 SDRAM 4-4-44-4-4192 1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 2-3-3222 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 197 1000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM 1400 MHz Acorp 7KMM1 KM133A Int. PC133 SDRAM 3-3-33-3-3252 1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 2.5-2257 1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 2.5-3300 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 5-4-42133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A i915GM Int. DDR2-533 SDRAM 4-4-41266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 2-3-34-4-4Dual PC800 RDRAM 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 2.5-3PC133 SDRAM 2-2-42.5-33-3-32200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 2-3-3-

6 CR1 494 Athlon64 3200+ 3-8 CR2 Celeron 6 486

1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM

6 2x PII ? Celeron 6 Duron 5 C3 8 CR2 Crusoe 5800 PIII

105 333 MHz Intel DK440LX i440LX PC66 SDRAM 91 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 87 600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 85 1333 MHz VIA EPIA SP CN400 Int. 80 1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 71 450 MHz Asus P3C-S i820 61 2x PentiumPro 53 2x PentiumMMX 45 Celeron 266 MHz Epox P2-100B ApolloPro PC66 SDRAM 37 C3 800 MHz VIA EPIA PLE133 Int. 31 K6-III 400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 28 K6-2 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM 23 Pentium 166 MHz Asus TX97-X i430TX 19 K5 PR166 116 MHz Asus P5A ALADDiN5 9 MediaGXm 233 MHz ALD NPC6836 Cx5520 6 PC60 SDRAM 3-3-3PC66 SDRAM 2-2-2PC66 SDRAM 2-2-33-3-32-2-2PC133 SDRAM 3-3-33-2-2200 MHz Gigabyte GA-586DX i430HX Dual EDO 200 MHz Compaq ProLiant 800 i440FX Dual EDO PC600 RDRAM DDR400 SDRAM 3-3-32-2-23-3-33-2-2-

5 6 5 6 4 6 6

--------[ FPU SinJulia ]----------------------------------------------------------------------------------------------4x Core i7 Extreme 965 HT -9-9-24 CR1 8x Xeon E5462 15 5546 8x Opteron 2378 4237 6254 2800 MHz Intel S5400SF i5400 Quad DDR2-640FB 5-5-53333 MHz Asus P6T Deluxe X58 Triple DDR3-1333 9

2400 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5

-5-15 CR1

8x Xeon L5320 12 3484 4x Core 2 Extreme QX9650

1866 MHz Intel S5000VCL i5000V Dual DDR2-533FB 3000 MHz Gigabyte GA-EP35C-DS3R P35 Dual DDR3-1066

4-4-48-

8-8-20 CR2 2981 8x Opteron HE 2344

1700 MHz Tyan Thunder n3600R nForcePro-3600 Unganged Dual DDR2-667R 5-5 3000 MHz Asus M3N78-EM GeForce8300 Int. Ganged Dual DDR2-800 5 2666 MHz Intel D975XBX2 i975X Dual DDR2-667 2333 MHz Intel S5000VSA i5000V Dual DDR2-667FB 2200 MHz Asus M3A AMD770 55-5-5-

-5-15 CR1 2970 4x Phenom II X4 Black 940 -5-5-18 CR2 2619 4x Core 2 Extreme QX6700 5-5-15 4x Xeon 5140 15 2497

2178 4x Phenom X4 9500

Ganged Dual DDR2-800 5-5-5-

18 CR2 1922 2x Athlon64 X2 Black 6400+

3200 MHz MSI K9N SLI Platinum nForce570SLI Dual DDR2-800 4-4-42.5-35-5-55-5-55-5-55-5-52-2-25-5-55-5-53-4-42-3-32-3-3-

4-4-4-11 CR1 1429 2x Pentium EE 955 HT 3466 MHz Intel D955XBK i955X Dual DDR2-667 11 1289 2x Xeon HT 3400 MHz Intel SE7320SP2 iE7320 Dual DDR333R 3-7 1264 2x Core 2 Duo E6700 2666 MHz Abit AB9 P965 Dual DDR2-800 18 CR2 1248 2x Core 2 Duo P8400 2266 MHz MSI MegaBook PR201 GM45 Int. Dual DDR2-667 15 1122 2x Athlon64 X2 4000+ 2100 MHz ASRock ALiveNF7G-HDready nForce7050-630a Int. Dual DDR2-700 18 CR2 934 2x Core Duo T2500 2000 MHz Asus N4L-VM DH i945GT Int. Dual DDR2-667 15 911 2x Xeon 3066 MHz Asus PCH-DL i875P + PAT Dual DDR333 5 867 2x Core 2 Duo T5600 1833 MHz Asus F3000Jc Notebook i945PM Dual DDR2-667 15 848 P4EE HT 3733 MHz Intel SE7230NH1LX iE7230 Dual DDR2-667 15 693 2x Opteron 240 1400 MHz MSI K8D Master3-133 FS AMD8100 Dual DDR400R 8 CR1 623 2x PIII-S 1266 MHz MSI Pro266TD Master-LR ApolloPro266TD DDR266 SDRAM 6 CR2 586 Opteron 248 2200 MHz MSI K8T Master1-FAR K8T800 Dual DDR266R 6 CR1 492

P4EE 8 CR2 487 Pentium M 770 A#ABU) 12 453 Athlon64 3200+ 3-8 CR2 P4 3-8 Celeron 420 15 Pentium M 730 12 Sempron 2600+ 3-8 CR2 Duron 2-6 CR2 P4 2x PIII-E 6 6 Athlon 7 Celeron 215 12 Celeron M 320 3-7 Atom 230 HT 12 Celeron 6 CR1 284 Celeron D 326 11 Celeron 6 P4 231 2x PIII ? 227 247 270 285 297 304 304 325 AthlonXP 1600+ 308 358 362 369 447

3466 MHz ASRock 775Dual-880Pro PT880Pro Dual DDR2-400

3-3-3-

2133 MHz Hewlett-Packard HP 510 Notebook PC (RU964A i915GM Int. DDR2-533 SDRAM 4-4-42000 MHz ASRock 939S56-M SiS756 Dual DDR400 2800 MHz MSI 848P Neo-S i848P DDR400 SDRAM 2.5-32.5-35-5-54-4-42.5-32.5-23-3-33-3-32-3-35-4-42.5-34-4-42-2-44-4-43-3-33-3-3-

394 1600 MHz Intel DQ965CO Q965 Int. Dual DDR2-667 1600 MHz AOpen i915Ga-HFS i915G Int. Dual DDR2-533 1600 MHz ASRock K8NF4G-SATA2 GeForce6100 Int. DDR400 SDRAM 1600 MHz Biostar M7VIQ KM266 Int. DDR266 SDRAM 353 2400 MHz Abit SI7 SiSR658 340 733 MHz Tyan Thunder 2500 ServerSet3HE PC133R SDRAM 1400 MHz Acorp 7KMM1 KM133A Int. PC133 SDRAM Dual PC1066 RDRAM

1400 MHz PCChips M817LMR MAGiK1 DDR266 SDRAM 1333 MHz Intel D201GLY SiS662 Int. DDR2-533 1300 MHz DFI 855GME-MGF i855GME Int. DDR333 SDRAM 1600 MHz Intel D945GCLF i945GC DDR2-533 SDRAM 2000 MHz Gigabyte GA-8TRS350MT RS350 Int. Dual DDR400 2533 MHz ASRock 775Twins-HDTV RC410 Ext. DDR2-533 SDRAM 1700 MHz Asus P4B i845 1600 MHz Abit TH7II i850 500 MHz Epox KP6-BS i440BX PC133 SDRAM Dual PC800 RDRAM PC100R SDRAM

Nano L2200 12 CR2 Athlon 6 Celeron 6 2x PII ? Efficeon 8600 140 Duron 5 PIII 103 2x PentiumPro 91 2x PentiumMMX 90 Crusoe 5800 77 K6-III 5 C7 12 CR2 Celeron 5 K6-2 6 C3 8 CR2 Pentium 4 C3 6 MediaGXm 6 K5 PR166 6 8 24 30 49 56 64 68 131 151 155 185

1600 MHz VIA VB8001 CN896 Int.

DDR2-667 SDRAM

5-5-53-3-33-3-33-2-2-

750 MHz Epox EP-7KXA KX133 PC133 SDRAM 163 700 MHz PCChips M758LT SiS630ET Int. PC100 SDRAM 333 MHz Intel DK440LX i440LX PC66 SDRAM 1000 MHz ECS 532 Notebook Efficeon DDR266 SDRAM 600 MHz Abit KG7-Lite AMD-760 DDR200R SDRAM 450 MHz Asus P3C-S i820 PC600 RDRAM

2-2-2-

200 MHz Compaq ProLiant 800 i440FX Dual EDO 200 MHz Gigabyte GA-586DX i430HX Dual EDO 1000 MHz ECS A530 DeskNote Crusoe DDR266 SDRAM 400 MHz Epox EP-MVP3G-M MVP3 PC100 SDRAM 1500 MHz VIA EPIA EN CN700 Int. DDR2-533 SDRAM

2-2-24-4-43-2-23-3-33-3-32-2-33-3-33-3-32-2-2-

266 MHz Epox P2-100B ApolloPro PC66 SDRAM 61 333 MHz Amptron PM-9100LMR SiS5597 Ext. PC66 SDRAM 1333 MHz VIA EPIA SP CN400 Int. 166 MHz Asus TX97-X i430TX 37 800 MHz VIA EPIA PLE133 Int. 233 MHz ALD NPC6836 Cx5520 116 MHz Asus P5A ALADDiN5 PC133 SDRAM PC60 SDRAM PC66 SDRAM DDR400 SDRAM PC66 SDRAM

--------[ Debug - PCI ]---------------------------------------------------------

---------------------------------------B00 D00 F00: Intel 82915GM Memory Controller Hub [B-1] Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset 000: 010: 020: 030: 040: 050: 060: 070: 080: 090: 0A0: 0B0: 0C0: 0D0: 0E0: 0F0: 86 00 00 00 00 00 01 00 00 10 00 00 00 00 09 00 80 00 00 00 90 00 A0 00 00 11 00 00 00 00 00 00 90 00 00 00 D9 30 D9 00 00 11 00 00 00 00 09 00 25 00 00 00 FE 00 FE 00 00 00 00 00 00 00 21 00 06 00 00 E0 00 19 00 00 00 00 00 00 00 00 02 00 00 00 00 00 40 00 00 00 00 11 00 00 00 00 A2 00 90 00 00 00 D9 00 00 00 00 31 00 00 00 00 8B 00 20 00 00 00 FE B8 00 00 00 00 00 00 00 00 90 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 06 00 00 00 E0 00 00 00 00 00 00 00 00 00 00 00 00 00 3C 00 00 00 00 00 00 40 00 00 00 19 00 10 00 00 10 00 80 00 00 00 00 0A 00 00 00 00 00 00 00 00 C4 00 D9 00 00 00 00 B8 00 00 00 00 00 00 00 00 30 00 FE 00 00 00 00 00 00 00 00 00 00 00

B00 D02 F00: Intel 82915GM Graphics Controller 0 Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset 000: 010: 020: 030: 040: 050: 060: 070: 080: 090: 0A0: 0B0: 0C0: 0D0: 0E0: 0F0: 86 00 00 00 00 0A 00 00 00 00 00 00 00 01 20 11 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 92 60 00 00 00 30 00 00 00 00 00 00 00 22 00 64 25 D0 00 00 00 00 00 00 00 00 00 00 00 00 00 34 07 01 00 D0 E0 19 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 00 00 00 00 00 00 00 00 00 00 03 08 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 00 00 00 05 03 C0 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 3C 10 02 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 A2 00 00 00 00 00 00 00 00 00 00 00 80 68 C4 00 8B 80 00 00 00 00 00 00 00 00 00 00 00 D0 30 00 90 3F 00 00 00 00 00 00 00 00 00 00

B00 D02 F01: Intel 82915GM Graphics Controller 1 Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset 000: 010: 020: 030: 040: 050: 060: 070: 080: 090: 0A0: 0B0: 0C0: 0D0: 0E0: 0F0: 86 00 00 00 00 0A 00 00 00 00 00 00 00 01 20 11 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 92 70 00 00 00 30 00 00 00 00 00 00 00 22 00 64 27 D0 00 00 00 00 00 00 00 00 00 00 00 00 00 34 06 00 00 D0 E0 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 00 00 00 00 00 00 00 00 00 00 03 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 09 00 00 00 00 00 00 00 00 00 00 05 03 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 3C 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 A2 00 00 00 00 00 00 00 00 00 00 00 80 00 C4 00 8B 80 00 00 00 00 00 00 00 00 00 00 00 00 30 00 90 3F 00 00 00 00 00 00 00 00 00 00

B00 D1D F00: Intel 82801FBM ICH6-M - USB Universal Host Controller [B-1]

Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset

000: 010: 020: 030: 040: 050: 060: 070: 080: 090: 0A0: 0B0: 0C0: 0D0: 0E0: 0F0:

86 00 21 00 00 00 10 00 00 00 00 00 00 00 00 00

80 00 30 00 00 00 00 00 00 00 00 00 2F 00 00 00

58 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

26 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0F

03 00 00 00 00 00 00 00 00 00 00 00 01 00 00 04

0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 3C 13 00 00 00 00 00 00 00 00 00 00 00 00

00 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00

80 00 C4 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00

B00 D1D F07: Intel 82801FBM ICH6-M - Enhanced USB2 Controller [B-1] Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset 000: 010: 020: 030: 040: 050: 060: 070: 080: 090: 0A0: 0B0: 0C0: 0D0: 0E0: 0F0: 86 00 00 00 00 01 20 00 00 00 00 00 00 00 00 00 80 00 00 00 00 58 20 00 00 00 00 00 00 00 00 80 5C 78 00 00 00 C2 FF D7 00 00 00 00 00 00 00 00 26 D0 00 00 00 C9 01 3F 00 00 00 00 00 00 00 09 06 00 00 50 00 00 00 00 01 00 00 00 00 00 00 88 00 00 00 00 00 80 00 00 00 00 00 00 00 AA 00 8C 90 00 00 00 00 00 00 00 00 00 00 00 00 FF 00 40 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 00 0A 01 00 00 00 00 00 00 55 00 80 20 00 00 00 00 00 00 00 00 00 00 00 00 55 00 0F 03 00 00 00 00 A0 00 00 00 00 00 00 00 FF 00 04 0C 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 3C 13 00 00 00 00 00 00 00 00 00 20 00 06 00 00 10 04 00 00 00 00 00 00 00 00 00 00 00 17 00 00 C4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 C0 00 00 00 00 00 00 00 00 00

B00 D1E F00: Intel 82801FBM I/O Controller Hub 6 (ICH6-M) [B-1] Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset 000: 010: 020: 030: 040: 050: 060: 070: 080: 090: 0A0: 0B0: 0C0: 0D0: 0E0: 0F0: 86 00 00 00 00 0D 00 00 00 00 00 00 00 00 00 00 80 00 D0 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 24 00 D0 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 F1 50 00 3C 00 00 00 00 00 00 00 00 00 00 01 00 FF 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 01 00 00 C4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 00 00 00 00 00 00 00 D3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 0F 04 03 00 00 00 00 00 00 00 00 00 00 00 00 00 04 06 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 81 80 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00

B00 D1E F02: Intel 82801FBM ICH6-M - AC'97 Audio Controller [B-1] Offset 000: 86 80 6E 26 07 00 90 02 03 00 01 04 00 00 00 00 Offset 010: 01 31 00 00 01 32 00 00 00 10 78 D0 00 20 78 D0

Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset

020: 030: 040: 050: 060: 070: 080: 090: 0A0: 0B0: 0C0: 0D0: 0E0: 0F0:

00 00 09 01 00 00 00 00 00 00 00 00 00 00

00 00 01 00 00 00 00 00 00 00 00 00 00 00

00 00 00 C2 00 00 00 00 00 00 00 00 00 00

00 00 00 C9 00 00 00 00 00 00 00 00 00 00

00 50 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00 00 00 80

00 00 00 00 00 00 00 00 00 00 00 00 00 0F

00 00 00 00 00 00 00 00 00 00 00 00 00 04

00 00 00 00 00 00 00 00 00 00 00 00 00 00

3C 11 00 00 00 00 00 00 00 00 00 00 00 00

10 02 00 00 00 00 00 00 00 00 00 00 00 00

C4 00 00 00 00 00 00 00 00 00 00 00 00 00

30 00 00 00 00 00 00 00 00 00 00 00 00 00

B00 D1E F03: Intel 82801FBM ICH6-M - AC'97 Modem Controller [B-1] Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset 000: 010: 020: 030: 040: 050: 060: 070: 080: 090: 0A0: 0B0: 0C0: 0D0: 0E0: 0F0: 86 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 80 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6D 00 00 00 00 C2 00 00 00 00 00 00 00 00 00 00 26 00 00 00 00 C9 00 00 00 00 00 00 00 00 00 00 00 01 00 50 00 03 00 00 00 00 00 00 00 00 00 00 04 35 00 00 00 80 00 00 00 00 00 00 00 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0F 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00

B00 D1F F00: Intel 82801FBM ICH6-M - LPC Bridge [B-1] Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset 000: 010: 020: 030: 040: 050: 060: 070: 080: 090: 0A0: 0B0: 0C0: 0D0: 0E0: 0F0: 86 00 00 00 01 00 80 00 10 00 A4 00 00 33 00 01 80 00 00 00 10 00 80 00 00 00 06 00 00 22 00 00 41 00 00 00 00 00 80 00 07 00 00 00 00 11 00 D9 26 00 00 00 00 00 80 00 3D 00 00 00 00 00 00 FE 07 00 00 00 80 00 92 00 00 00 E1 00 00 67 00 00 01 00 00 00 00 00 00 00 FF 00 00 00 00 45 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 01 00 80 00 00 00 00 0A 00 00 00 80 00 00 00 00 11 00 80 00 00 00 1C 40 00 C0 00 0F 01 00 00 00 00 00 80 00 00 00 00 4A 00 00 00 04 06 00 00 00 00 00 80 00 00 00 00 96 00 00 00 00 00 00 3C 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 03 00 00 00 00 00 80 00 C4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00

B00 D1F F01: Intel 82801FBM ICH6-M - ATA-100 IDE Controller [B-1] Offset Offset Offset Offset Offset 000: 010: 020: 030: 040: 86 01 81 00 77 80 00 35 00 E3 6F 00 00 00 00 26 00 00 00 00 05 01 00 00 0B 00 00 00 00 00 80 00 00 00 00 02 00 00 00 00 03 01 00 00 01 8A 00 00 00 00 01 00 00 00 01 01 00 00 00 00 00 01 3C 0B 00 00 00 10 01 00 00 00 C4 00 00 00 00 30 00 00

Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset

050: 060: 070: 080: 090: 0A0: 0B0: 0C0: 0D0: 0E0: 0F0:

00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00

11 00 00 00 00 00 00 03 00 00 00

10 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 80

00 00 00 00 00 00 00 00 00 00 0F

00 00 00 00 00 00 00 00 00 00 04

00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00 00 00 00

B00 D1F F03: Intel 82801FBM ICH6-M - SMBus Controller [B-1] Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset 000: 010: 020: 030: 040: 050: 060: 070: 080: 090: 0A0: 0B0: 0C0: 0D0: 0E0: 0F0: 86 00 01 00 05 00 00 00 00 00 00 00 00 00 00 00 80 00 12 00 00 00 00 00 00 00 00 00 00 00 00 00 6A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0F 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 0C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

B02 D04 F00: HP PRO/Wireless 2200BG 3B Network Connection Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset 000: 010: 020: 030: 040: 050: 060: 070: 080: 090: 0A0: 0B0: 0C0: 0D0: 0E0: 0F0: 86 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42 D0 00 00 00 00 00 00 00 00 00 00 00 00 13 00 06 00 00 DC 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 3C 15 00 00 00 00 00 00 00 00 00 01 00 00 40 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F6 03 00 00 00 00 00 00 00 00 00 22 00 00 00 00 12 18 00 00 00 00 00 00 00 00 00 C8 00 00

B02 D06 F00: ENE Tech. CB1410 CardBus Controller Offset Offset Offset Offset Offset Offset Offset Offset 000: 010: 020: 030: 040: 050: 060: 070: 24 00 00 00 3C 00 00 00 15 10 F0 2C 10 00 00 00 10 00 5F 00 C4 00 00 00 14 D0 D0 00 30 00 00 00 07 A0 00 FC 01 00 00 00 00 00 E0 FF 00 00 00 00 10 00 5F FF 00 00 00 00 02 02 D0 FF 00 00 00 00 01 02 00 00 00 00 00 00 00 03 E0 00 00 00 00 00 07 03 5F 00 00 00 00 00 06 00 D0 00 00 00 00 00 10 00 00 12 00 00 00 00 40 F0 2C 01 00 00 00 00 02 5F 00 C4 00 00 00 00 00 D0 00 06 00 00 00 00

Offset Offset Offset Offset Offset Offset Offset Offset

080: 090: 0A0: 0B0: 0C0: 0D0: 0E0: 0F0:

20 80 01 00 00 00 00 00

D0 02 00 00 10 00 00 00

40 44 01 00 00 00 00 00

20 60 FE 00 00 00 00 00

00 00 00 00 80 00 00 00

00 00 00 00 00 00 00 00

00 00 C0 00 80 00 00 00

00 00 00 00 00 00 00 00

00 00 00 00 00 00 00 00

00 00 00 00 04 00 00 00

00 00 00 00 08 00 00 00

00 00 00 00 10 00 00 00

32 00 03 00 00 00 00 00

1B 00 00 00 00 00 00 00

BE 00 00 00 00 00 00 00

01 00 00 00 00 00 00 00

B02 D08 F00: Intel PRO/100 VE Network Connection Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset 000: 010: 020: 030: 040: 050: 060: 070: 080: 090: 0A0: 0B0: 0C0: 0D0: 0E0: 0F0: 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 20 00 00 00 00 00 00 00 00 00 00 00 00 41 00 92 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 D0 00 00 00 00 00 00 00 00 00 00 00 00 3A 00 07 01 00 DC 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 3C 14 00 00 00 00 00 00 00 00 00 01 00 00 40 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C4 08 00 00 00 00 00 00 00 00 00 22 00 00 00 00 30 38 00 00 00 00 00 00 00 00 00 FE 00 00

PCI-8086-2590: Intel i910/915/925/E7221 MCHBAR Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset 100: 110: 120: 130: 140: 150: 160: 170: 180: 190: 1A0: 10 F8 06 C4 00 24 82 00 00 00 00 20 28 4A 06 39 87 00 00 00 00 00 20 78 00 00 2A 2D 00 00 00 00 00 20 B9 40 00 48 5A 00 00 00 00 00 00 22 00 6D 07 36 20 00 00 00 00 00 E9 19 06 24 94 00 00 00 00 00 00 C2 0C 1A 10 63 00 00 00 00 00 00 03 80 87 80 C1 00 00 00 00 00 33 28 FC 01 01 00 15 00 00 00 20 00 02 01 04 01 3D AA 00 00 00 3C 00 00 00 10 02 20 00 00 00 00 2F 00 80 0C 00 06 80 02 00 00 00 43 03 0A 00 00 03 00 54 00 00 00 4F 00 01 00 00 0C 03 44 00 00 00 4C 05 0A 00 00 00 00 02 00 00 00 32 00 01 00 00 00 00 E0 00 00 00 3E

PCI-8086-2590: Intel i910/915/925/E7221 MCHBAR Offset 200: 00 04 0F 00 00 00 00 00 08 01 02 04 00 00 00 00 Offset 210: 04 08 01 02 C8 E4 42 00 38 08 E8 04 00 00 00 00 PCI-8086-2590: Intel i910/915/925/E7221 MCHBAR Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset Offset C00: C10: C20: C30: C40: C50: C60: C70: C80: C90: CA0: 31 00 00 BC 00 00 00 00 00 00 00 04 00 00 40 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 08 00 00 00 00 00 00 00 99 00 01 00 00 00 00 00 00 00 7C 00 00 01 80 00 00 00 00 00 00 00 03 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B2 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 7B 00 00 00 06 00 00 00 00 00 00 1F 00 00 00 80 00 00 00 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Offset Offset Offset Offset Offset

CB0: CC0: CD0: CE0: CF0:

00 00 00 00 00

00 00 00 00 00

00 00 00 00 00

00 00 00 00 00

00 00 00 99 00

00 00 26 00 00

00 00 00 06 00

00 00 00 00 00

00 00 B2 00 00

00 00 02 00 00

00 00 10 00 00

00 00 76 00 00

00 00 26 00 00

00 00 38 00 00

00 00 00 00 00

00 00 00 00 00

--------[ Debug - Video BIOS ]----------------------------------------------------------------------------------------C000:0000 C000:0040 C000:0080 C000:00C0 C000:0100 C000:0140 C000:0180 C000:01C0 C000:0200 C000:0240 C000:0280 C000:02C0 C000:0300 C000:0340 C000:0380 C000:03C0 U.....000000000000.!.. z@...00IBM VGA Compatible BIOS. .[.k.y... PCIR...%.................................u.............]........ ....................................d......d......d.....0d...... d......d......d......d.....0d......d.....0d......d......d......d ......d.....0d......d......d.....0$......$......d.......... .... `".......N... ....@............ ...88.......... .1X. (.........V . .1X. .P.......... .0X. @........d..@A.&0..6.......... A. 0.`. ........$.`A.(00`........0*..Q.*@0p.........4..Q.*@...........=. .Q.0@@.........H?@0b.2@@..........O@0b.2@@..........Y@0b.2@@.... .....h[..r.<P...........t..r.<P..........0.7..2.m..4....8....:.. ..<.E..A.7..C.m..E....I....K....M.E..P 7..R m..T ...X ...Z ...\ E..`.k..a.k..b k..c....d....e ...f....g....h ...i....j....k ...l ....m....n ...o....p....q ...................................... .........................................................For Eva luation Use Only....(........c-'(.+............................. ....................(........c-'(.+.............................

--------[ Debug - Unknown ]-------------------------------------------------------------------------------------------Optical DTSOFT Virtual CdRom Device

----------------------------------------------------------------------------------------------------------------------The names of actual companies and products mentioned herein may be the trademark s of their respective owners.