At first thank you very much for help.
My Avast is working now, I can even start the Windows Defender.
I did all that you've said.
Here are reports from kaspersky and from FRST:
kaspersky.txt 157.25KB
520 downloads
Fixlog.txt 2.2KB
524 downloads
KASPERSKY
19:58:00.0703 0x0b4c TDSS rootkit removing tool 3.1.0.5 Jul 24 2015 12:29:57
19:58:00.0952 0x0b4c ============================================================
19:58:00.0952 0x0b4c Current date / time: 2015/09/02 19:58:00.0952
19:58:00.0952 0x0b4c SystemInfo:
19:58:00.0952 0x0b4c
19:58:00.0952 0x0b4c OS Version: 6.1.7601 ServicePack: 1.0
19:58:00.0952 0x0b4c Product type: Workstation
19:58:00.0952 0x0b4c ComputerName: BLADOWO_KOM
19:58:00.0968 0x0b4c UserName: Bladowo
19:58:00.0968 0x0b4c Windows directory: C:\Windows
19:58:00.0968 0x0b4c System windows directory: C:\Windows
19:58:00.0968 0x0b4c Running under WOW64
19:58:00.0968 0x0b4c Processor architecture: Intel x64
19:58:00.0968 0x0b4c Number of processors: 4
19:58:00.0968 0x0b4c Page size: 0x1000
19:58:00.0968 0x0b4c Boot type: Normal boot
19:58:00.0968 0x0b4c ============================================================
19:58:00.0968 0x0b4c BG loaded
19:58:03.0639 0x0b4c System UUID: {09C73EF1-FDCD-21B7-F930-7EB6CF310D2F}
19:58:06.0089 0x0b4c Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 ( 465.76 Gb ), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
19:58:06.0099 0x0b4c ============================================================
19:58:06.0099 0x0b4c \Device\Harddisk0\DR0:
19:58:06.0099 0x0b4c MBR partitions:
19:58:06.0099 0x0b4c \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0xC8800, BlocksNum 0x1D14D000
19:58:06.0099 0x0b4c \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1D215800, BlocksNum 0x1D170030
19:58:06.0099 0x0b4c ============================================================
19:58:06.0159 0x0b4c C: <-> \Device\Harddisk0\DR0\Partition1
19:58:06.0889 0x0b4c D: <-> \Device\Harddisk0\DR0\Partition2
19:58:06.0889 0x0b4c ============================================================
19:58:06.0889 0x0b4c Initialize success
19:58:06.0889 0x0b4c ============================================================
19:59:39.0356 0x0f80 ============================================================
19:59:39.0356 0x0f80 Scan started
19:59:39.0356 0x0f80 Mode: Manual; SigCheck; TDLFS;
19:59:39.0356 0x0f80 ============================================================
19:59:39.0356 0x0f80 KSN ping started
19:59:42.0117 0x0f80 KSN ping finished: true
19:59:50.0864 0x0f80 ================ Scan system memory ========================
19:59:50.0864 0x0f80 System memory - ok
19:59:50.0865 0x0f80 ================ Scan services =============================
19:59:51.0730 0x0f80 [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
19:59:52.0031 0x0f80 1394ohci - ok
19:59:52.0040 0x0f80 Suspicious service (NoAccess): a14f089ffbafdf69
19:59:52.0132 0x0f80 [ FFF37EAFA2C55044BBC2D4CAE5F223FC, 793652E6BBB54D221ADE9DFBE5EDA007F6E7B01465FE91FC5B58D40908271D79 ] a14f089ffbafdf69 C:\Windows\System32\Drivers\a14f089ffbafdf69.sys
19:59:52.0132 0x0f80 Suspicious file ( NoAccess ): C:\Windows\System32\Drivers\a14f089ffbafdf69.sys. md5: FFF37EAFA2C55044BBC2D4CAE5F223FC, sha256: 793652E6BBB54D221ADE9DFBE5EDA007F6E7B01465FE91FC5B58D40908271D79
19:59:52.0197 0x0f80 a14f089ffbafdf69 - detected Rootkit.Win32.Necurs.gen ( 0 )
19:59:55.0182 0x0f80 a14f089ffbafdf69 ( Rootkit.Win32.Necurs.gen ) - infected
19:59:55.0182 0x0f80 Force sending object to P2P due to detect: a14f089ffbafdf69
19:59:58.0006 0x0f80 Object send P2P result: true
20:00:00.0800 0x0f80 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI C:\Windows\system32\drivers\ACPI.sys
20:00:00.0827 0x0f80 ACPI - ok
20:00:00.0903 0x0f80 [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
20:00:01.0104 0x0f80 AcpiPmi - ok
20:00:01.0210 0x0f80 [ 013697369EAFFA675D0671607F036020, 65611C775AC4681E46A6565E5A7A4FF3363C66EBDC98C4C58AFB365D40BE23B6 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
20:00:01.0231 0x0f80 AdobeARMservice - ok
20:00:02.0523 0x0f80 [ 368290D0A612D62DA6F3D798B1BB8FE7, D573BF8543F37BC51B88A2473EDFD28AFBCCC446E8CADD54A90FA48D8739D222 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
20:00:02.0550 0x0f80 AdobeFlashPlayerUpdateSvc - ok
20:00:02.0671 0x0f80 [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys
20:00:02.0717 0x0f80 adp94xx - ok
20:00:02.0779 0x0f80 [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys
20:00:02.0807 0x0f80 adpahci - ok
20:00:02.0841 0x0f80 [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys
20:00:02.0856 0x0f80 adpu320 - ok
20:00:02.0894 0x0f80 [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
20:00:03.0641 0x0f80 AeLookupSvc - ok
20:00:03.0742 0x0f80 [ 79059559E89D06E8B80CE2944BE20228, 6E041D2FED2D0C3D8E16E56CB61D3245F9144EA92F5BDC9A4AA30598D1C8E6EE ] AFD C:\Windows\system32\drivers\afd.sys
20:00:03.0870 0x0f80 AFD - ok
20:00:03.0898 0x0f80 [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440 C:\Windows\system32\drivers\agp440.sys
20:00:03.0918 0x0f80 agp440 - ok
20:00:03.0963 0x0f80 [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG C:\Windows\System32\alg.exe
20:00:04.0091 0x0f80 ALG - ok
20:00:04.0142 0x0f80 [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide C:\Windows\system32\drivers\aliide.sys
20:00:04.0164 0x0f80 aliide - ok
20:00:04.0240 0x0f80 [ 61A18BCAF557CD6614309E4978B81056, 4481B4276E7F6790D7BF4D9DC3C172BCA037BF6A30D5CE4E0190585F669FA4EC ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
20:00:04.0437 0x0f80 AMD External Events Utility - ok
20:00:04.0502 0x0f80 [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide C:\Windows\system32\drivers\amdide.sys
20:00:04.0525 0x0f80 amdide - ok
20:00:04.0632 0x0f80 [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
20:00:04.0702 0x0f80 AmdK8 - ok
20:00:05.0336 0x0f80 [ F05B22CE901FC26AE55A1A27AA674D96, 1D1F8D6076BC3608C11F343F4597B599BA602B3FB1064CC1EAFB08FD667D0D6E ] amdkmdag C:\Windows\system32\DRIVERS\atikmdag.sys
20:00:05.0553 0x0f80 amdkmdag - ok
20:00:05.0629 0x0f80 [ ED25D58581B5A28593C277F482FCCD62, EC20DF155BA3814A052DD4DB1B5C220A75E68B9D88518ED676A12CF70AF619F5 ] amdkmdap C:\Windows\system32\DRIVERS\atikmpag.sys
20:00:05.0693 0x0f80 amdkmdap - ok
20:00:05.0753 0x0f80 [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
20:00:05.0849 0x0f80 AmdPPM - ok
20:00:05.0887 0x0f80 [ 6EC6D772EAE38DC17C14AED9B178D24B, B4FB936B31B1265B8CC6B426C64965C34D0CCF1638E645ACD65E88F4AFFC57A6 ] amdsata C:\Windows\system32\drivers\amdsata.sys
20:00:05.0909 0x0f80 amdsata - ok
20:00:05.0964 0x0f80 [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys
20:00:05.0993 0x0f80 amdsbs - ok
20:00:06.0019 0x0f80 [ 1142A21DB581A84EA5597B03A26EBAA0, F94EB140D0CD068760D7EB081FF75154C75DAC75E5E24B6DE4E4F9CE65A70343 ] amdxata C:\Windows\system32\drivers\amdxata.sys
20:00:06.0039 0x0f80 amdxata - ok
20:00:06.0128 0x0f80 [ 89A69C3F2F319B43379399547526D952, 8ABDB4B8E106F96EBBA0D4D04C4F432296516E107E7BA5644ED2E50CF9BB491A ] AppID C:\Windows\system32\drivers\appid.sys
20:00:06.0960 0x0f80 AppID - ok
20:00:06.0997 0x0f80 [ 0BC381A15355A3982216F7172F545DE1, C33AF13CB218F7BF52E967452573DF2ADD20A95C6BF99229794FEF07C4BBE725 ] AppIDSvc C:\Windows\System32\appidsvc.dll
20:00:07.0098 0x0f80 AppIDSvc - ok
20:00:07.0170 0x0f80 [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo C:\Windows\System32\appinfo.dll
20:00:07.0264 0x0f80 Appinfo - ok
20:00:07.0304 0x0f80 [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc C:\Windows\system32\DRIVERS\arc.sys
20:00:07.0329 0x0f80 arc - ok
20:00:07.0353 0x0f80 [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys
20:00:07.0371 0x0f80 arcsas - ok
20:00:07.0449 0x0f80 [ 525F5989C095F5757414E1F4B39175B2, 0CA28553AE4BF07C3952A6E2355FAB2B0CB862CFD88DEFD7232FD48ABA99CFCB ] aswHwid C:\Windows\system32\drivers\aswHwid.sys
20:00:07.0467 0x0f80 aswHwid - ok
20:00:07.0488 0x0f80 [ 76D585093398DB973470BB83FCF0CE52, F7135232E7F50270A253C9F04574F22B827A42B2BE42DE6E391CE3A56B2EA51F ] aswMonFlt C:\Windows\system32\drivers\aswMonFlt.sys
20:00:07.0498 0x0f80 aswMonFlt - ok
20:00:07.0543 0x0f80 [ 719FF5568B5E71832541636E2A7DFE27, C49ADB31B5DE6FCFB252290D5B831A90E555F86058500538BBD288B10CDCC46F ] aswRdr C:\Windows\system32\drivers\aswRdr2.sys
20:00:07.0563 0x0f80 aswRdr - ok
20:00:07.0593 0x0f80 [ 21C13E3C9B801C8AE172FABBD235221E, 0AE02CB0F4A87C6065159B68545DD536C4E98C8C23E954ED3392A7CE5F28868C ] aswRvrt C:\Windows\system32\drivers\aswRvrt.sys
20:00:07.0616 0x0f80 aswRvrt - ok
20:00:07.0852 0x0f80 [ E0F47617EB31CD205BF68B55CE88862D, EE3ED93E51E310E1D713F8692CF2A61147C0EFCFA465969C04B85DA2E271F3E6 ] aswSnx C:\Windows\system32\drivers\aswSnx.sys
20:00:07.0893 0x0f80 aswSnx - ok
20:00:08.0035 0x0f80 [ C43A0929DE32035499D6BB39A7F44439, 6269380D25D6BFFB7C234758114B700A75BD55D654B6D93ED44D50660A86FCA7 ] aswSP C:\Windows\system32\drivers\aswSP.sys
20:00:08.0060 0x0f80 aswSP - ok
20:00:08.0152 0x0f80 [ 763C27EA21875F54615A0174EEC78FC4, 4EE48D475B183DD2066781137F46A4BEE2E510B3A085B9B1385F8C0043A5BE08 ] aswStm C:\Windows\system32\drivers\aswStm.sys
20:00:08.0173 0x0f80 aswStm - ok
20:00:08.0200 0x0f80 [ C85B35201A253B99199C0A9F5B98FC18, 18FF49D52035C79AD70A96FBD4663C41A58830D432DD4B9EDA6E7FCDFD12C18F ] aswVmm C:\Windows\system32\drivers\aswVmm.sys
20:00:08.0227 0x0f80 aswVmm - ok
20:00:08.0281 0x0f80 [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
20:00:08.0385 0x0f80 AsyncMac - ok
20:00:08.0452 0x0f80 [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi C:\Windows\system32\drivers\atapi.sys
20:00:08.0479 0x0f80 atapi - ok
20:00:08.0650 0x0f80 [ E857EEE6B92AAA473EBB3465ADD8F7E7, 1C7E4737E649A025B3C4974A4F7D1353EAB85561FC8ED54E5C22A777E1A189B3 ] athr C:\Windows\system32\DRIVERS\athrx.sys
20:00:08.0970 0x0f80 athr - ok
20:00:09.0122 0x0f80 [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
20:00:09.0230 0x0f80 AudioEndpointBuilder - ok
20:00:09.0324 0x0f80 [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioSrv C:\Windows\System32\Audiosrv.dll
20:00:09.0377 0x0f80 AudioSrv - ok
20:00:09.0586 0x0f80 [ 4956380A54B1C9E6BFDF3D80DACB9698, 0B0F9807EEF0F3BFE4F862876633D241DBA8F72A1373445976FF388678C4734C ] avast! Antivirus C:\Program Files\AVAST Software\Avast\AvastSvc.exe
20:00:09.0609 0x0f80 avast! Antivirus - ok
20:00:09.0671 0x0f80 [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV C:\Windows\System32\AxInstSV.dll
20:00:10.0015 0x0f80 AxInstSV - ok
20:00:10.0131 0x0f80 [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys
20:00:10.0223 0x0f80 b06bdrv - ok
20:00:10.0286 0x0f80 [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
20:00:10.0344 0x0f80 b57nd60a - ok
20:00:10.0443 0x0f80 [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC C:\Windows\System32\bdesvc.dll
20:00:10.0553 0x0f80 BDESVC - ok
20:00:10.0605 0x0f80 [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep C:\Windows\system32\drivers\Beep.sys
20:00:10.0670 0x0f80 Beep - ok
20:00:10.0850 0x0f80 [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE C:\Windows\System32\bfe.dll
20:00:10.0918 0x0f80 BFE - ok
20:00:11.0168 0x0f80 [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS C:\Windows\System32\qmgr.dll
20:00:11.0266 0x0f80 BITS - ok
20:00:11.0360 0x0f80 [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
20:00:11.0394 0x0f80 blbdrive - ok
20:00:11.0476 0x0f80 [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
20:00:11.0509 0x0f80 bowser - ok
20:00:11.0586 0x0f80 [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys
20:00:11.0676 0x0f80 BrFiltLo - ok
20:00:11.0686 0x0f80 [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys
20:00:11.0709 0x0f80 BrFiltUp - ok
20:00:11.0745 0x0f80 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser C:\Windows\System32\browser.dll
20:00:11.0784 0x0f80 Browser - ok
20:00:11.0826 0x0f80 [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid C:\Windows\System32\Drivers\Brserid.sys
20:00:11.0951 0x0f80 Brserid - ok
20:00:12.0017 0x0f80 [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
20:00:12.0045 0x0f80 BrSerWdm - ok
20:00:12.0071 0x0f80 [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
20:00:12.0178 0x0f80 BrUsbMdm - ok
20:00:12.0222 0x0f80 [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
20:00:12.0255 0x0f80 BrUsbSer - ok
20:00:12.0275 0x0f80 [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys
20:00:12.0321 0x0f80 BTHMODEM - ok
20:00:12.0387 0x0f80 [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv C:\Windows\system32\bthserv.dll
20:00:12.0464 0x0f80 bthserv - ok
20:00:12.0489 0x0f80 [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
20:00:12.0539 0x0f80 cdfs - ok
20:00:12.0591 0x0f80 [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
20:00:12.0627 0x0f80 cdrom - ok
20:00:12.0719 0x0f80 [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc C:\Windows\System32\certprop.dll
20:00:12.0791 0x0f80 CertPropSvc - ok
20:00:12.0830 0x0f80 [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass C:\Windows\system32\DRIVERS\circlass.sys
20:00:12.0856 0x0f80 circlass - ok
20:00:12.0937 0x0f80 [ FE1EC06F2253F691FE36217C592A0206, B9F122DB5E665ECDF29A5CB8BB6B531236F31A54A95769D6C5C1924C87FE70CE ] CLFS C:\Windows\system32\CLFS.sys
20:00:13.0012 0x0f80 CLFS - ok
20:00:13.0086 0x0f80 [ D88040F816FDA31C3B466F0FA0918F29, 39D3630E623DA25B8444B6D3AAAB16B98E7E289C5619E19A85D47B74C71449F3 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:00:13.0115 0x0f80 clr_optimization_v2.0.50727_32 - ok
20:00:13.0205 0x0f80 [ D1CEEA2B47CB998321C579651CE3E4F8, 654013B8FD229A50017B08DEC6CA19C7DDA8CE0771260E057A92625201D539B1 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
20:00:13.0227 0x0f80 clr_optimization_v2.0.50727_64 - ok
20:00:13.0305 0x0f80 [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
20:00:13.0341 0x0f80 CmBatt - ok
20:00:13.0404 0x0f80 [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide C:\Windows\system32\drivers\cmdide.sys
20:00:13.0429 0x0f80 cmdide - ok
20:00:13.0558 0x0f80 [ EBF28856F69CF094A902F884CF989706, AD6C9F0BC20AA49EEE5478DA0F856F0EA2B414B63208C5FFB03C9D7F5B59765F ] CNG C:\Windows\system32\Drivers\cng.sys
20:00:13.0614 0x0f80 CNG - ok
20:00:13.0709 0x0f80 [ 25C58EE97BE0416A373E3E4F855206B5, 3AE7CA1E1ED56C2CE4BD11F2F89060DEF480009E4AA2128897C70E9E679E44BB ] CnxtHdAudService C:\Windows\system32\drivers\CHDRT64.sys
20:00:13.0735 0x0f80 CnxtHdAudService - ok
20:00:13.0825 0x0f80 [ 89C99AB4AE9535F727791592D84D4821, 4DE537467CC39BF3532EDDA3FE0F054654B369D8BBA8B3356FA7D2E8CB374493 ] CnxtHdmiAudService C:\Windows\system32\drivers\CHDMI64.sys
20:00:13.0852 0x0f80 CnxtHdmiAudService - ok
20:00:13.0934 0x0f80 [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
20:00:13.0958 0x0f80 Compbatt - ok
20:00:14.0042 0x0f80 [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys
20:00:14.0110 0x0f80 CompositeBus - ok
20:00:14.0144 0x0f80 COMSysApp - ok
20:00:14.0190 0x0f80 [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys
20:00:14.0203 0x0f80 crcdisk - ok
20:00:14.0244 0x0f80 [ 6B400F211BEE880A37A1ED0368776BF4, 2F27C6FA96A1C8CBDA467846DA57E63949A7EA37DB094B13397DDD30114295BD ] CryptSvc C:\Windows\system32\cryptsvc.dll
20:00:14.0312 0x0f80 CryptSvc - ok
20:00:14.0539 0x0f80 [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch C:\Windows\system32\rpcss.dll
20:00:14.0628 0x0f80 DcomLaunch - ok
20:00:14.0701 0x0f80 [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc C:\Windows\System32\defragsvc.dll
20:00:14.0802 0x0f80 defragsvc - ok
20:00:14.0830 0x0f80 [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC C:\Windows\system32\Drivers\dfsc.sys
20:00:14.0934 0x0f80 DfsC - ok
20:00:15.0028 0x0f80 [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp C:\Windows\system32\dhcpcore.dll
20:00:15.0103 0x0f80 Dhcp - ok
20:00:15.0144 0x0f80 [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache C:\Windows\system32\drivers\discache.sys
20:00:15.0195 0x0f80 discache - ok
20:00:15.0242 0x0f80 [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk C:\Windows\system32\DRIVERS\disk.sys
20:00:15.0271 0x0f80 Disk - ok
20:00:15.0352 0x0f80 dnahlxbg - ok
20:00:15.0397 0x0f80 [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache C:\Windows\System32\dnsrslvr.dll
20:00:15.0487 0x0f80 Dnscache - ok
20:00:15.0529 0x0f80 [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc C:\Windows\System32\dot3svc.dll
20:00:15.0616 0x0f80 dot3svc - ok
20:00:15.0637 0x0f80 [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS C:\Windows\system32\dps.dll
20:00:15.0679 0x0f80 DPS - ok
20:00:15.0748 0x0f80 [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
20:00:15.0819 0x0f80 drmkaud - ok
20:00:15.0963 0x0f80 [ 88612F1CE3BF42256913BF6E61C70D52, 7CF190F83FA8F15C33008EB381D3E345CEF37CBC046227DED26B36799EF4D9A7 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
20:00:15.0997 0x0f80 DXGKrnl - ok
20:00:16.0057 0x0f80 [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost C:\Windows\System32\eapsvc.dll
20:00:16.0121 0x0f80 EapHost - ok
20:00:16.0549 0x0f80 [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys
20:00:16.0733 0x0f80 ebdrv - ok
20:00:16.0784 0x0f80 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] EFS C:\Windows\System32\lsass.exe
20:00:16.0849 0x0f80 EFS - ok
20:00:17.0054 0x0f80 [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
20:00:17.0266 0x0f80 ehRecvr - ok
20:00:17.0299 0x0f80 [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched C:\Windows\ehome\ehsched.exe
20:00:17.0347 0x0f80 ehSched - ok
20:00:17.0445 0x0f80 [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys
20:00:17.0505 0x0f80 elxstor - ok
20:00:17.0520 0x0f80 [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev C:\Windows\system32\drivers\errdev.sys
20:00:17.0569 0x0f80 ErrDev - ok
20:00:17.0661 0x0f80 [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem C:\Windows\system32\es.dll
20:00:17.0719 0x0f80 EventSystem - ok
20:00:17.0773 0x0f80 [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat C:\Windows\system32\drivers\exfat.sys
20:00:17.0840 0x0f80 exfat - ok
20:00:17.0879 0x0f80 [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat C:\Windows\system32\drivers\fastfat.sys
20:00:17.0928 0x0f80 fastfat - ok
20:00:18.0082 0x0f80 [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax C:\Windows\system32\fxssvc.exe
20:00:18.0250 0x0f80 Fax - ok
20:00:18.0300 0x0f80 [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc C:\Windows\system32\DRIVERS\fdc.sys
20:00:18.0300 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\fdc.sys. md5: D765D19CD8EF61F650C384F62FAC00AB, sha256: 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE
20:00:18.0301 0x0f80 fdc - detected LockedFile.Multi.Generic ( 1 )
20:00:21.0092 0x0f80 Detect skipped due to KSN trusted
20:00:21.0092 0x0f80 fdc - ok
20:00:21.0156 0x0f80 [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost C:\Windows\system32\fdPHost.dll
20:00:21.0224 0x0f80 fdPHost - ok
20:00:21.0273 0x0f80 [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub C:\Windows\system32\fdrespub.dll
20:00:21.0366 0x0f80 FDResPub - ok
20:00:21.0395 0x0f80 [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
20:00:21.0395 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\fileinfo.sys. md5: 655661BE46B5F5F3FD454E2C3095B930, sha256: 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A
20:00:21.0395 0x0f80 FileInfo - detected LockedFile.Multi.Generic ( 1 )
20:00:24.0220 0x0f80 Detect skipped due to KSN trusted
20:00:24.0220 0x0f80 FileInfo - ok
20:00:24.0252 0x0f80 [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
20:00:24.0252 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\filetrace.sys. md5: 5F671AB5BC87EEA04EC38A6CD5962A47, sha256: 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6
20:00:24.0252 0x0f80 Filetrace - detected LockedFile.Multi.Generic ( 1 )
20:00:28.0490 0x0f80 Detect skipped due to KSN trusted
20:00:28.0490 0x0f80 Filetrace - ok
20:00:28.0581 0x0f80 [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
20:00:28.0582 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\flpydisk.sys. md5: C172A0F53008EAEB8EA33FE10E177AF5, sha256: 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B
20:00:28.0582 0x0f80 flpydisk - detected LockedFile.Multi.Generic ( 1 )
20:00:31.0402 0x0f80 Detect skipped due to KSN trusted
20:00:31.0402 0x0f80 flpydisk - ok
20:00:31.0453 0x0f80 [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
20:00:31.0453 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\fltmgr.sys. md5: DA6B67270FD9DB3697B20FCE94950741, sha256: F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331
20:00:31.0453 0x0f80 FltMgr - detected LockedFile.Multi.Generic ( 1 )
20:00:34.0423 0x0f80 Detect skipped due to KSN trusted
20:00:34.0423 0x0f80 FltMgr - ok
20:00:34.0595 0x0f80 [ C4C183E6551084039EC862DA1C945E3D, 0874A2ACDD24D64965AA9A76E9C818E216880AE4C9A2E07ED932EE404585CEE6 ] FontCache C:\Windows\system32\FntCache.dll
20:00:34.0673 0x0f80 FontCache - ok
20:00:34.0775 0x0f80 [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
20:00:34.0797 0x0f80 FontCache3.0.0.0 - ok
20:00:34.0814 0x0f80 [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
20:00:34.0814 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\FsDepends.sys. md5: D43703496149971890703B4B1B723EAC, sha256: F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E
20:00:34.0814 0x0f80 FsDepends - detected LockedFile.Multi.Generic ( 1 )
20:00:37.0607 0x0f80 Detect skipped due to KSN trusted
20:00:37.0607 0x0f80 FsDepends - ok
20:00:37.0664 0x0f80 [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
20:00:37.0664 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\Fs_Rec.sys. md5: 6BD9295CC032DD3077C671FCCF579A7B, sha256: 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33
20:00:37.0664 0x0f80 Fs_Rec - detected LockedFile.Multi.Generic ( 1 )
20:00:40.0486 0x0f80 Detect skipped due to KSN trusted
20:00:40.0486 0x0f80 Fs_Rec - ok
20:00:40.0552 0x0f80 [ 1F7B25B858FA27015169FE95E54108ED, 72DD12E924AA7273B3E4BDD2A2C581DECE304C8EF3D44EA79ABB032F3F95DCE5 ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
20:00:40.0552 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\fvevol.sys. md5: 1F7B25B858FA27015169FE95E54108ED, sha256: 72DD12E924AA7273B3E4BDD2A2C581DECE304C8EF3D44EA79ABB032F3F95DCE5
20:00:40.0553 0x0f80 fvevol - detected LockedFile.Multi.Generic ( 1 )
20:00:43.0543 0x0f80 Detect skipped due to KSN trusted
20:00:43.0543 0x0f80 fvevol - ok
20:00:43.0614 0x0f80 [ 60ACB128E64C35C2B4E4AAB1B0A5C293, 7B476AB5E95529A894F95397C753662F4C58D1FE89F4648271251DA77C5A3FA9 ] FwLnk C:\Windows\system32\DRIVERS\FwLnk.sys
20:00:43.0614 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\FwLnk.sys. md5: 60ACB128E64C35C2B4E4AAB1B0A5C293, sha256: 7B476AB5E95529A894F95397C753662F4C58D1FE89F4648271251DA77C5A3FA9
20:00:43.0614 0x0f80 FwLnk - detected LockedFile.Multi.Generic ( 1 )
20:00:46.0413 0x0f80 Detect skipped due to KSN trusted
20:00:46.0413 0x0f80 FwLnk - ok
20:00:46.0454 0x0f80 [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys
20:00:46.0455 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\gagp30kx.sys. md5: 8C778D335C9D272CFD3298AB02ABE3B6, sha256: 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005
20:00:46.0455 0x0f80 gagp30kx - detected LockedFile.Multi.Generic ( 1 )
20:00:49.0249 0x0f80 Detect skipped due to KSN trusted
20:00:49.0249 0x0f80 gagp30kx - ok
20:00:49.0419 0x0f80 [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc C:\Windows\System32\gpsvc.dll
20:00:49.0502 0x0f80 gpsvc - ok
20:00:49.0567 0x0f80 [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
20:00:49.0567 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\hcw85cir.sys. md5: F2523EF6460FC42405B12248338AB2F0, sha256: B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19
20:00:49.0568 0x0f80 hcw85cir - detected LockedFile.Multi.Generic ( 1 )
20:00:52.0540 0x0f80 Detect skipped due to KSN trusted
20:00:52.0540 0x0f80 hcw85cir - ok
20:00:52.0639 0x0f80 [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
20:00:52.0639 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\HdAudio.sys. md5: 975761C778E33CD22498059B91E7373A, sha256: 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9
20:00:52.0639 0x0f80 HdAudAddService - detected LockedFile.Multi.Generic ( 1 )
20:00:55.0434 0x0f80 Detect skipped due to KSN trusted
20:00:55.0434 0x0f80 HdAudAddService - ok
20:00:55.0496 0x0f80 [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys
20:00:55.0496 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\HDAudBus.sys. md5: 97BFED39B6B79EB12CDDBFEED51F56BB, sha256: 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955
20:00:55.0497 0x0f80 HDAudBus - detected LockedFile.Multi.Generic ( 1 )
20:00:58.0293 0x0f80 Detect skipped due to KSN trusted
20:00:58.0293 0x0f80 HDAudBus - ok
20:00:58.0344 0x0f80 [ B6AC71AAA2B10848F57FC49D55A651AF, 4FAD833654E86F9FAF972AC8AF87FD4A9A765B26B96F096BBD63506B5D521A91 ] HECIx64 C:\Windows\system32\DRIVERS\HECIx64.sys
20:00:58.0345 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\HECIx64.sys. md5: B6AC71AAA2B10848F57FC49D55A651AF, sha256: 4FAD833654E86F9FAF972AC8AF87FD4A9A765B26B96F096BBD63506B5D521A91
20:00:58.0345 0x0f80 HECIx64 - detected LockedFile.Multi.Generic ( 1 )
20:01:01.0139 0x0f80 Detect skipped due to KSN trusted
20:01:01.0139 0x0f80 HECIx64 - ok
20:01:01.0179 0x0f80 [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys
20:01:01.0179 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\HidBatt.sys. md5: 78E86380454A7B10A5EB255DC44A355F, sha256: 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64
20:01:01.0180 0x0f80 HidBatt - detected LockedFile.Multi.Generic ( 1 )
20:01:04.0004 0x0f80 Detect skipped due to KSN trusted
20:01:04.0004 0x0f80 HidBatt - ok
20:01:04.0054 0x0f80 [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys
20:01:04.0054 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\hidbth.sys. md5: 7FD2A313F7AFE5C4DAB14798C48DD104, sha256: 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4
20:01:04.0054 0x0f80 HidBth - detected LockedFile.Multi.Generic ( 1 )
20:01:06.0851 0x0f80 Detect skipped due to KSN trusted
20:01:06.0851 0x0f80 HidBth - ok
20:01:06.0885 0x0f80 [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
20:01:06.0885 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\hidir.sys. md5: 0A77D29F311B88CFAE3B13F9C1A73825, sha256: 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D
20:01:06.0885 0x0f80 HidIr - detected LockedFile.Multi.Generic ( 1 )
20:01:09.0711 0x0f80 Detect skipped due to KSN trusted
20:01:09.0711 0x0f80 HidIr - ok
20:01:09.0761 0x0f80 [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv C:\Windows\system32\hidserv.dll
20:01:09.0830 0x0f80 hidserv - ok
20:01:09.0875 0x0f80 [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
20:01:09.0876 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\hidusb.sys. md5: 9592090A7E2B61CD582B612B6DF70536, sha256: FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F
20:01:09.0876 0x0f80 HidUsb - detected LockedFile.Multi.Generic ( 1 )
20:01:12.0863 0x0f80 Detect skipped due to KSN trusted
20:01:12.0863 0x0f80 HidUsb - ok
20:01:12.0915 0x0f80 [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc C:\Windows\system32\kmsvc.dll
20:01:12.0978 0x0f80 hkmsvc - ok
20:01:13.0009 0x0f80 [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
20:01:13.0056 0x0f80 HomeGroupListener - ok
20:01:13.0085 0x0f80 [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
20:01:13.0132 0x0f80 HomeGroupProvider - ok
20:01:13.0157 0x0f80 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
20:01:13.0157 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\HpSAMD.sys. md5: 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, sha256: E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205
20:01:13.0158 0x0f80 HpSAMD - detected LockedFile.Multi.Generic ( 1 )
20:01:16.0129 0x0f80 Detect skipped due to KSN trusted
20:01:16.0129 0x0f80 HpSAMD - ok
20:01:16.0246 0x0f80 [ 0EA7DE1ACB728DD5A369FD742D6EEE28, 21C489412EB33A12B22290EB701C19BA57006E8702E76F730954F0784DDE9779 ] HTTP C:\Windows\system32\drivers\HTTP.sys
20:01:16.0246 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\HTTP.sys. md5: 0EA7DE1ACB728DD5A369FD742D6EEE28, sha256: 21C489412EB33A12B22290EB701C19BA57006E8702E76F730954F0784DDE9779
20:01:16.0247 0x0f80 HTTP - detected LockedFile.Multi.Generic ( 1 )
20:01:19.0243 0x0f80 Detect skipped due to KSN trusted
20:01:19.0243 0x0f80 HTTP - ok
20:01:19.0264 0x0f80 [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
20:01:19.0264 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\hwpolicy.sys. md5: A5462BD6884960C9DC85ED49D34FF392, sha256: 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53
20:01:19.0265 0x0f80 hwpolicy - detected LockedFile.Multi.Generic ( 1 )
20:01:22.0091 0x0f80 Detect skipped due to KSN trusted
20:01:22.0091 0x0f80 hwpolicy - ok
20:01:22.0129 0x0f80 [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt C:\Windows\system32\drivers\i8042prt.sys
20:01:22.0129 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\i8042prt.sys. md5: FA55C73D4AFFA7EE23AC4BE53B4592D3, sha256: 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD
20:01:22.0130 0x0f80 i8042prt - detected LockedFile.Multi.Generic ( 1 )
20:01:25.0100 0x0f80 Detect skipped due to KSN trusted
20:01:25.0100 0x0f80 i8042prt - ok
20:01:25.0173 0x0f80 [ 85977CD13FC16069CE0AF7943A811775, 421AFFF08D14C2F55CFEF05E4A5A8B086F80BE69A927F84052A502EC5B222990 ] iaStor C:\Windows\system32\DRIVERS\iaStor.sys
20:01:25.0173 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\iaStor.sys. md5: 85977CD13FC16069CE0AF7943A811775, sha256: 421AFFF08D14C2F55CFEF05E4A5A8B086F80BE69A927F84052A502EC5B222990
20:01:25.0182 0x0f80 iaStor - detected LockedFile.Multi.Generic ( 1 )
20:01:28.0153 0x0f80 Detect skipped due to KSN trusted
20:01:28.0153 0x0f80 iaStor - ok
20:01:28.0243 0x0f80 [ 3DF4395A7CF8B7A72A5F4606366B8C2D, 483588B8FC6E05488ED631C4E1CFC398553FEBFA2CD2BB527B4DF12D19774F80 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
20:01:28.0243 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\iaStorV.sys. md5: 3DF4395A7CF8B7A72A5F4606366B8C2D, sha256: 483588B8FC6E05488ED631C4E1CFC398553FEBFA2CD2BB527B4DF12D19774F80
20:01:28.0244 0x0f80 iaStorV - detected LockedFile.Multi.Generic ( 1 )
20:01:31.0070 0x0f80 Detect skipped due to KSN trusted
20:01:31.0071 0x0f80 iaStorV - ok
20:01:31.0198 0x0f80 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD, 2B9512324DBA4A97F6AC34E8067EE08E3B6874CD60F6CB4209AFC22A34D2BE99 ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
20:01:31.0249 0x0f80 idsvc - ok
20:01:31.0269 0x0f80 IEEtwCollectorService - ok
20:01:31.0300 0x0f80 [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys
20:01:31.0300 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\iirsp.sys. md5: 5C18831C61933628F5BB0EA2675B9D21, sha256: 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4
20:01:31.0300 0x0f80 iirsp - detected LockedFile.Multi.Generic ( 1 )
20:01:34.0279 0x0f80 Detect skipped due to KSN trusted
20:01:34.0279 0x0f80 iirsp - ok
20:01:34.0366 0x0f80 [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT C:\Windows\System32\ikeext.dll
20:01:34.0418 0x0f80 IKEEXT - ok
20:01:34.0472 0x0f80 [ 4B6363CD4610BB848531BB260B15DFCC, 13A8AA9571497086341AC00797EFF212FF76EE62F9CFF758D3C08B377EC7BF04 ] Impcd C:\Windows\system32\DRIVERS\Impcd.sys
20:01:34.0472 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\Impcd.sys. md5: 4B6363CD4610BB848531BB260B15DFCC, sha256: 13A8AA9571497086341AC00797EFF212FF76EE62F9CFF758D3C08B377EC7BF04
20:01:34.0473 0x0f80 Impcd - detected LockedFile.Multi.Generic ( 1 )
20:01:37.0446 0x0f80 Detect skipped due to KSN trusted
20:01:37.0446 0x0f80 Impcd - ok
20:01:37.0533 0x0f80 [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide C:\Windows\system32\drivers\intelide.sys
20:01:37.0533 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\intelide.sys. md5: F00F20E70C6EC3AA366910083A0518AA, sha256: E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22
20:01:37.0534 0x0f80 intelide - detected LockedFile.Multi.Generic ( 1 )
20:01:40.0362 0x0f80 Detect skipped due to KSN trusted
20:01:40.0362 0x0f80 intelide - ok
20:01:40.0443 0x0f80 [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
20:01:40.0444 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\intelppm.sys. md5: ADA036632C664CAA754079041CF1F8C1, sha256: F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610
20:01:40.0454 0x0f80 intelppm - detected LockedFile.Multi.Generic ( 1 )
20:01:43.0282 0x0f80 Detect skipped due to KSN trusted
20:01:43.0282 0x0f80 intelppm - ok
20:01:43.0375 0x0f80 [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum C:\Windows\system32\ipbusenum.dll
20:01:43.0453 0x0f80 IPBusEnum - ok
20:01:43.0483 0x0f80 [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:01:43.0483 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\ipfltdrv.sys. md5: C9F0E1BD74365A8771590E9008D22AB6, sha256: 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51
20:01:43.0484 0x0f80 IpFilterDriver - detected LockedFile.Multi.Generic ( 1 )
20:01:46.0474 0x0f80 Detect skipped due to KSN trusted
20:01:46.0474 0x0f80 IpFilterDriver - ok
20:01:46.0587 0x0f80 [ A34A587FFFD45FA649FBA6D03784D257, C9A2BCD4E2A5EB6E320092A3AFD5737ECDCDA0B83EE42314A23C4978F2974767 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
20:01:46.0668 0x0f80 iphlpsvc - ok
20:01:46.0722 0x0f80 [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
20:01:46.0722 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\IPMIDrv.sys. md5: 0FC1AEA580957AA8817B8F305D18CA3A, sha256: 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9
20:01:46.0723 0x0f80 IPMIDRV - detected LockedFile.Multi.Generic ( 1 )
20:01:49.0510 0x0f80 Detect skipped due to KSN trusted
20:01:49.0510 0x0f80 IPMIDRV - ok
20:01:49.0595 0x0f80 [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT C:\Windows\system32\drivers\ipnat.sys
20:01:49.0595 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\ipnat.sys. md5: AF9B39A7E7B6CAA203B3862582E9F2D0, sha256: 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E
20:01:49.0596 0x0f80 IPNAT - detected LockedFile.Multi.Generic ( 1 )
20:01:52.0573 0x0f80 Detect skipped due to KSN trusted
20:01:52.0573 0x0f80 IPNAT - ok
20:01:52.0635 0x0f80 [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM C:\Windows\system32\drivers\irenum.sys
20:01:52.0636 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\irenum.sys. md5: 3ABF5E7213EB28966D55D58B515D5CE9, sha256: A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE
20:01:52.0636 0x0f80 IRENUM - detected LockedFile.Multi.Generic ( 1 )
20:01:55.0628 0x0f80 Detect skipped due to KSN trusted
20:01:55.0628 0x0f80 IRENUM - ok
20:01:55.0714 0x0f80 [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp C:\Windows\system32\drivers\isapnp.sys
20:01:55.0715 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\isapnp.sys. md5: 2F7B28DC3E1183E5EB418DF55C204F38, sha256: D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548
20:01:55.0715 0x0f80 isapnp - detected LockedFile.Multi.Generic ( 1 )
20:01:58.0513 0x0f80 Detect skipped due to KSN trusted
20:01:58.0513 0x0f80 isapnp - ok
20:01:58.0561 0x0f80 [ D931D7309DEB2317035B07C9F9E6B0BD, 13AD84172ED8C6153F8A98499C01733B74E48464CE07D099508E38D409913ED3 ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
20:01:58.0561 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\msiscsi.sys. md5: D931D7309DEB2317035B07C9F9E6B0BD, sha256: 13AD84172ED8C6153F8A98499C01733B74E48464CE07D099508E38D409913ED3
20:01:58.0562 0x0f80 iScsiPrt - detected LockedFile.Multi.Generic ( 1 )
20:02:01.0363 0x0f80 Detect skipped due to KSN trusted
20:02:01.0363 0x0f80 iScsiPrt - ok
20:02:01.0432 0x0f80 [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
20:02:01.0433 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\kbdclass.sys. md5: BC02336F1CBA7DCC7D1213BB588A68A5, sha256: 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93
20:02:01.0433 0x0f80 kbdclass - detected LockedFile.Multi.Generic ( 1 )
20:02:04.0415 0x0f80 Detect skipped due to KSN trusted
20:02:04.0415 0x0f80 kbdclass - ok
20:02:04.0484 0x0f80 [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
20:02:04.0484 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\kbdhid.sys. md5: 0705EFF5B42A9DB58548EEC3B26BB484, sha256: 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99
20:02:04.0484 0x0f80 kbdhid - detected LockedFile.Multi.Generic ( 1 )
20:02:07.0279 0x0f80 Detect skipped due to KSN trusted
20:02:07.0279 0x0f80 kbdhid - ok
20:02:07.0348 0x0f80 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] KeyIso C:\Windows\system32\lsass.exe
20:02:07.0369 0x0f80 KeyIso - ok
20:02:07.0398 0x0f80 [ 353009DEDF918B2A51414F330CF72DEC, BF157D6E329F26E02FA16271B751B421396040DBB1D7BF9B2E0A21BC569672E2 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
20:02:07.0398 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\Drivers\ksecdd.sys. md5: 353009DEDF918B2A51414F330CF72DEC, sha256: BF157D6E329F26E02FA16271B751B421396040DBB1D7BF9B2E0A21BC569672E2
20:02:07.0399 0x0f80 KSecDD - detected LockedFile.Multi.Generic ( 1 )
20:02:10.0225 0x0f80 Detect skipped due to KSN trusted
20:02:10.0225 0x0f80 KSecDD - ok
20:02:10.0307 0x0f80 [ 1C2D8E18AA8FD50CD04C15CC27F7F5AB, 4BA3B0F9F01BD47D66091D3AD86B69A523981D61DFB4D677F2CD39405B2DA989 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
20:02:10.0307 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\Drivers\ksecpkg.sys. md5: 1C2D8E18AA8FD50CD04C15CC27F7F5AB, sha256: 4BA3B0F9F01BD47D66091D3AD86B69A523981D61DFB4D677F2CD39405B2DA989
20:02:10.0307 0x0f80 KSecPkg - detected LockedFile.Multi.Generic ( 1 )
20:02:13.0104 0x0f80 Detect skipped due to KSN trusted
20:02:13.0104 0x0f80 KSecPkg - ok
20:02:13.0181 0x0f80 [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
20:02:13.0182 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\ksthunk.sys. md5: 6869281E78CB31A43E969F06B57347C4, sha256: 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B
20:02:13.0182 0x0f80 ksthunk - detected LockedFile.Multi.Generic ( 1 )
20:02:16.0245 0x0f80 Detect skipped due to KSN trusted
20:02:16.0245 0x0f80 ksthunk - ok
20:02:16.0343 0x0f80 [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm C:\Windows\system32\msdtckrm.dll
20:02:16.0443 0x0f80 KtmRm - ok
20:02:16.0482 0x0f80 [ 55480B9C63F3F91A8EBBADCBF28FE581, 5B4BC3F0307B0697DD08DD8AAD4B9EAE99EDD3B33B85D9293D183684D5057293 ] L1C C:\Windows\system32\DRIVERS\L1C62x64.sys
20:02:16.0482 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\L1C62x64.sys. md5: 55480B9C63F3F91A8EBBADCBF28FE581, sha256: 5B4BC3F0307B0697DD08DD8AAD4B9EAE99EDD3B33B85D9293D183684D5057293
20:02:16.0483 0x0f80 L1C - detected LockedFile.Multi.Generic ( 1 )
20:02:19.0465 0x0f80 Detect skipped due to KSN trusted
20:02:19.0466 0x0f80 L1C - ok
20:02:19.0573 0x0f80 [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer C:\Windows\system32\srvsvc.dll
20:02:19.0661 0x0f80 LanmanServer - ok
20:02:19.0685 0x0f80 [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
20:02:19.0725 0x0f80 LanmanWorkstation - ok
20:02:19.0773 0x0f80 [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
20:02:19.0773 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\lltdio.sys. md5: 1538831CF8AD2979A04C423779465827, sha256: E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C
20:02:19.0773 0x0f80 lltdio - detected LockedFile.Multi.Generic ( 1 )
20:02:22.0598 0x0f80 Detect skipped due to KSN trusted
20:02:22.0598 0x0f80 lltdio - ok
20:02:22.0688 0x0f80 [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc C:\Windows\System32\lltdsvc.dll
20:02:22.0802 0x0f80 lltdsvc - ok
20:02:22.0827 0x0f80 [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts C:\Windows\System32\lmhsvc.dll
20:02:22.0860 0x0f80 lmhosts - ok
20:02:22.0944 0x0f80 [ 23DE5B62B0445A6F874BE633C95B483E, 39A8E5BD057F5EE049FA48848C5881DCD2CFB16CD9E2A03CC9DDF35F116FEE0B ] LMS C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
20:02:22.0975 0x0f80 LMS - ok
20:02:23.0002 0x0f80 [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys
20:02:23.0003 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\lsi_fc.sys. md5: 1A93E54EB0ECE102495A51266DCDB6A6, sha256: DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B
20:02:23.0003 0x0f80 LSI_FC - detected LockedFile.Multi.Generic ( 1 )
20:02:27.0212 0x0f80 Detect skipped due to KSN trusted
20:02:27.0212 0x0f80 LSI_FC - ok
20:02:27.0298 0x0f80 [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys
20:02:27.0298 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\lsi_sas.sys. md5: 1047184A9FDC8BDBFF857175875EE810, sha256: F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B
20:02:27.0299 0x0f80 LSI_SAS - detected LockedFile.Multi.Generic ( 1 )
20:02:30.0122 0x0f80 Detect skipped due to KSN trusted
20:02:30.0122 0x0f80 LSI_SAS - ok
20:02:30.0192 0x0f80 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys
20:02:30.0192 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\lsi_sas2.sys. md5: 30F5C0DE1EE8B5BC9306C1F0E4A75F93, sha256: 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06
20:02:30.0193 0x0f80 LSI_SAS2 - detected LockedFile.Multi.Generic ( 1 )
20:02:33.0020 0x0f80 Detect skipped due to KSN trusted
20:02:33.0020 0x0f80 LSI_SAS2 - ok
20:02:33.0094 0x0f80 [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys
20:02:33.0095 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\lsi_scsi.sys. md5: 0504EACAFF0D3C8AED161C4B0D369D4A, sha256: 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D
20:02:33.0095 0x0f80 LSI_SCSI - detected LockedFile.Multi.Generic ( 1 )
20:02:35.0895 0x0f80 Detect skipped due to KSN trusted
20:02:35.0895 0x0f80 LSI_SCSI - ok
20:02:35.0961 0x0f80 [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv C:\Windows\system32\drivers\luafv.sys
20:02:35.0961 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\luafv.sys. md5: 43D0F98E1D56CCDDB0D5254CFF7B356E, sha256: 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22
20:02:35.0961 0x0f80 luafv - detected LockedFile.Multi.Generic ( 1 )
20:02:38.0757 0x0f80 Detect skipped due to KSN trusted
20:02:38.0757 0x0f80 luafv - ok
20:02:38.0781 0x0f80 [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
20:02:38.0817 0x0f80 Mcx2Svc - ok
20:02:38.0833 0x0f80 [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas C:\Windows\system32\DRIVERS\megasas.sys
20:02:38.0834 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\megasas.sys. md5: A55805F747C6EDB6A9080D7C633BD0F4, sha256: 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728
20:02:38.0834 0x0f80 megasas - detected LockedFile.Multi.Generic ( 1 )
20:02:41.0808 0x0f80 Detect skipped due to KSN trusted
20:02:41.0808 0x0f80 megasas - ok
20:02:41.0998 0x0f80 [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys
20:02:41.0999 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\MegaSR.sys. md5: BAF74CE0072480C3B6B7C13B2A94D6B3, sha256: 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834
20:02:41.0999 0x0f80 MegaSR - detected LockedFile.Multi.Generic ( 1 )
20:02:46.0239 0x0f80 Detect skipped due to KSN trusted
20:02:46.0239 0x0f80 MegaSR - ok
20:02:46.0335 0x0f80 [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS C:\Windows\system32\mmcss.dll
20:02:46.0400 0x0f80 MMCSS - ok
20:02:46.0414 0x0f80 [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem C:\Windows\system32\drivers\modem.sys
20:02:46.0414 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\modem.sys. md5: 800BA92F7010378B09F9ED9270F07137, sha256: 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342
20:02:46.0414 0x0f80 Modem - detected LockedFile.Multi.Generic ( 1 )
20:02:49.0411 0x0f80 Detect skipped due to KSN trusted
20:02:49.0412 0x0f80 Modem - ok
20:02:49.0492 0x0f80 [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
20:02:49.0493 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\monitor.sys. md5: B03D591DC7DA45ECE20B3B467E6AADAA, sha256: 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732
20:02:49.0494 0x0f80 monitor - detected LockedFile.Multi.Generic ( 1 )
20:02:52.0288 0x0f80 Detect skipped due to KSN trusted
20:02:52.0288 0x0f80 monitor - ok
20:02:52.0363 0x0f80 [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
20:02:52.0363 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\mouclass.sys. md5: 7D27EA49F3C1F687D357E77A470AEA99, sha256: 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7
20:02:52.0364 0x0f80 mouclass - detected LockedFile.Multi.Generic ( 1 )
20:02:55.0336 0x0f80 Detect skipped due to KSN trusted
20:02:55.0336 0x0f80 mouclass - ok
20:02:55.0344 0x0f80 [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
20:02:55.0344 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\mouhid.sys. md5: D3BF052C40B0C4166D9FD86A4288C1E6, sha256: 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183
20:02:55.0344 0x0f80 mouhid - detected LockedFile.Multi.Generic ( 1 )
20:02:58.0195 0x0f80 Detect skipped due to KSN trusted
20:02:58.0195 0x0f80 mouhid - ok
20:02:58.0286 0x0f80 [ 32E7A3D591D671A6DF2DB515A5CBE0FA, 47CED0B9067AE8BF5EEF60B17ADEE5906BEDCC56E4CB460B7BFBC12BB9A69E63 ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
20:02:58.0286 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\mountmgr.sys. md5: 32E7A3D591D671A6DF2DB515A5CBE0FA, sha256: 47CED0B9067AE8BF5EEF60B17ADEE5906BEDCC56E4CB460B7BFBC12BB9A69E63
20:02:58.0286 0x0f80 mountmgr - detected LockedFile.Multi.Generic ( 1 )
20:03:01.0113 0x0f80 Detect skipped due to KSN trusted
20:03:01.0113 0x0f80 mountmgr - ok
20:03:01.0239 0x0f80 [ CC11EEB7AF4617D65DF0E9A21FC1ABD0, A683A5FB26E1B9FB4EEB40A9C7186F8433E3FB0A45848DF6102EF07B4DC75AC8 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
20:03:01.0266 0x0f80 MozillaMaintenance - ok
20:03:01.0302 0x0f80 [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio C:\Windows\system32\drivers\mpio.sys
20:03:01.0302 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\mpio.sys. md5: A44B420D30BD56E145D6A2BC8768EC58, sha256: B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8
20:03:01.0302 0x0f80 mpio - detected LockedFile.Multi.Generic ( 1 )
20:03:04.0277 0x0f80 Detect skipped due to KSN trusted
20:03:04.0277 0x0f80 mpio - ok
20:03:04.0362 0x0f80 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
20:03:04.0363 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\mpsdrv.sys. md5: 6C38C9E45AE0EA2FA5E551F2ED5E978F, sha256: 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20
20:03:04.0363 0x0f80 mpsdrv - detected LockedFile.Multi.Generic ( 1 )
20:03:07.0159 0x0f80 Detect skipped due to KSN trusted
20:03:07.0159 0x0f80 mpsdrv - ok
20:03:07.0277 0x0f80 [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc C:\Windows\system32\mpssvc.dll
20:03:07.0349 0x0f80 MpsSvc - ok
20:03:07.0390 0x0f80 [ DC722758B8261E1ABAFD31A3C0A66380, 88BBE073E2CCD1DAB4656DDC53D5161E8A91D035ADAC1465D0CEBA86F1BB6D9A ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
20:03:07.0390 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\mrxdav.sys. md5: DC722758B8261E1ABAFD31A3C0A66380, sha256: 88BBE073E2CCD1DAB4656DDC53D5161E8A91D035ADAC1465D0CEBA86F1BB6D9A
20:03:07.0390 0x0f80 MRxDAV - detected LockedFile.Multi.Generic ( 1 )
20:03:10.0368 0x0f80 Detect skipped due to KSN trusted
20:03:10.0368 0x0f80 MRxDAV - ok
20:03:10.0453 0x0f80 [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
20:03:10.0453 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\mrxsmb.sys. md5: A5D9106A73DC88564C825D317CAC68AC, sha256: 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4
20:03:10.0453 0x0f80 mrxsmb - detected LockedFile.Multi.Generic ( 1 )
20:03:13.0249 0x0f80 Detect skipped due to KSN trusted
20:03:13.0249 0x0f80 mrxsmb - ok
20:03:13.0335 0x0f80 [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:03:13.0335 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\mrxsmb10.sys. md5: D711B3C1D5F42C0C2415687BE09FC163, sha256: 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF
20:03:13.0335 0x0f80 mrxsmb10 - detected LockedFile.Multi.Generic ( 1 )
20:03:16.0132 0x0f80 Detect skipped due to KSN trusted
20:03:16.0132 0x0f80 mrxsmb10 - ok
20:03:16.0201 0x0f80 [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:03:16.0201 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\mrxsmb20.sys. md5: 9423E9D355C8D303E76B8CFBD8A5C30C, sha256: 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC
20:03:16.0201 0x0f80 mrxsmb20 - detected LockedFile.Multi.Generic ( 1 )
20:03:19.0021 0x0f80 Detect skipped due to KSN trusted
20:03:19.0021 0x0f80 mrxsmb20 - ok
20:03:19.0099 0x0f80 [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci C:\Windows\system32\drivers\msahci.sys
20:03:19.0099 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\msahci.sys. md5: C25F0BAFA182CBCA2DD3C851C2E75796, sha256: 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8
20:03:19.0100 0x0f80 msahci - detected LockedFile.Multi.Generic ( 1 )
20:03:21.0897 0x0f80 Detect skipped due to KSN trusted
20:03:21.0897 0x0f80 msahci - ok
20:03:21.0973 0x0f80 [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm C:\Windows\system32\drivers\msdsm.sys
20:03:21.0973 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\msdsm.sys. md5: DB801A638D011B9633829EB6F663C900, sha256: B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74
20:03:21.0974 0x0f80 msdsm - detected LockedFile.Multi.Generic ( 1 )
20:03:24.0951 0x0f80 Detect skipped due to KSN trusted
20:03:24.0951 0x0f80 msdsm - ok
20:03:25.0030 0x0f80 [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC C:\Windows\System32\msdtc.exe
20:03:25.0073 0x0f80 MSDTC - ok
20:03:25.0107 0x0f80 [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs C:\Windows\system32\drivers\Msfs.sys
20:03:25.0107 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\Msfs.sys. md5: AA3FB40E17CE1388FA1BEDAB50EA8F96, sha256: 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99
20:03:25.0107 0x0f80 Msfs - detected LockedFile.Multi.Generic ( 1 )
20:03:27.0904 0x0f80 Detect skipped due to KSN trusted
20:03:27.0904 0x0f80 Msfs - ok
20:03:27.0943 0x0f80 [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
20:03:27.0943 0x0f80 Suspicious file ( NoAccess ): C:\Windows\System32\drivers\mshidkmdf.sys. md5: F9D215A46A8B9753F61767FA72A20326, sha256: 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141
20:03:27.0943 0x0f80 mshidkmdf - detected LockedFile.Multi.Generic ( 1 )
20:03:30.0746 0x0f80 Detect skipped due to KSN trusted
20:03:30.0746 0x0f80 mshidkmdf - ok
20:03:30.0813 0x0f80 [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
20:03:30.0814 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\msisadrv.sys. md5: D916874BBD4F8B07BFB7FA9B3CCAE29D, sha256: B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1
20:03:30.0814 0x0f80 msisadrv - detected LockedFile.Multi.Generic ( 1 )
20:03:33.0611 0x0f80 Detect skipped due to KSN trusted
20:03:33.0611 0x0f80 msisadrv - ok
20:03:33.0701 0x0f80 [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
20:03:33.0767 0x0f80 MSiSCSI - ok
20:03:33.0771 0x0f80 msiserver - ok
20:03:33.0808 0x0f80 [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
20:03:33.0808 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\MSKSSRV.sys. md5: 49CCF2C4FEA34FFAD8B1B59D49439366, sha256: E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7
20:03:33.0808 0x0f80 MSKSSRV - detected LockedFile.Multi.Generic ( 1 )
20:03:36.0605 0x0f80 Detect skipped due to KSN trusted
20:03:36.0605 0x0f80 MSKSSRV - ok
20:03:36.0664 0x0f80 [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
20:03:36.0665 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\MSPCLOCK.sys. md5: BDD71ACE35A232104DDD349EE70E1AB3, sha256: 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB
20:03:36.0665 0x0f80 MSPCLOCK - detected LockedFile.Multi.Generic ( 1 )
20:03:39.0494 0x0f80 Detect skipped due to KSN trusted
20:03:39.0494 0x0f80 MSPCLOCK - ok
20:03:39.0554 0x0f80 [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
20:03:39.0555 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\MSPQM.sys. md5: 4ED981241DB27C3383D72092B618A1D0, sha256: E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC
20:03:39.0555 0x0f80 MSPQM - detected LockedFile.Multi.Generic ( 1 )
20:03:42.0528 0x0f80 Detect skipped due to KSN trusted
20:03:42.0528 0x0f80 MSPQM - ok
20:03:42.0627 0x0f80 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
20:03:42.0627 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\MsRPC.sys. md5: 759A9EEB0FA9ED79DA1FB7D4EF78866D, sha256: 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133
20:03:42.0628 0x0f80 MsRPC - detected LockedFile.Multi.Generic ( 1 )
20:03:45.0468 0x0f80 Detect skipped due to KSN trusted
20:03:45.0469 0x0f80 MsRPC - ok
20:03:45.0550 0x0f80 [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys
20:03:45.0550 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\mssmbios.sys. md5: 0EED230E37515A0EAEE3C2E1BC97B288, sha256: B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42
20:03:45.0550 0x0f80 mssmbios - detected LockedFile.Multi.Generic ( 1 )
20:03:48.0531 0x0f80 Detect skipped due to KSN trusted
20:03:48.0531 0x0f80 mssmbios - ok
20:03:48.0574 0x0f80 [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
20:03:48.0574 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\MSTEE.sys. md5: 2E66F9ECB30B4221A318C92AC2250779, sha256: DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD
20:03:48.0575 0x0f80 MSTEE - detected LockedFile.Multi.Generic ( 1 )
20:03:51.0718 0x0f80 Detect skipped due to KSN trusted
20:03:51.0718 0x0f80 MSTEE - ok
20:03:51.0724 0x0f80 [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys
20:03:51.0725 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\MTConfig.sys. md5: 7EA404308934E675BFFDE8EDF0757BCD, sha256: 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232
20:03:51.0725 0x0f80 MTConfig - detected LockedFile.Multi.Generic ( 1 )
20:03:54.0528 0x0f80 Detect skipped due to KSN trusted
20:03:54.0528 0x0f80 MTConfig - ok
20:03:54.0603 0x0f80 [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup C:\Windows\system32\Drivers\mup.sys
20:03:54.0603 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\Drivers\mup.sys. md5: F9A18612FD3526FE473C1BDA678D61C8, sha256: 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A
20:03:54.0604 0x0f80 Mup - detected LockedFile.Multi.Generic ( 1 )
20:03:57.0670 0x0f80 Detect skipped due to KSN trusted
20:03:57.0670 0x0f80 Mup - ok
20:03:57.0777 0x0f80 [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent C:\Windows\system32\qagentRT.dll
20:03:57.0843 0x0f80 napagent - ok
20:03:57.0887 0x0f80 [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
20:03:57.0887 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\nwifi.sys. md5: 1EA3749C4114DB3E3161156FFFFA6B33, sha256: 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7
20:03:57.0894 0x0f80 NativeWifiP - detected LockedFile.Multi.Generic ( 1 )
20:04:00.0872 0x0f80 Detect skipped due to KSN trusted
20:04:00.0872 0x0f80 NativeWifiP - ok
20:04:01.0000 0x0f80 [ 79B47FD40D9A817E932F9D26FAC0A81C, 53E260B8BFC50BA45FA73BFCF4E58C233890D0EAA9DEFDCCBB55FD3EB992FF2D ] NDIS C:\Windows\system32\drivers\ndis.sys
20:04:01.0000 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\ndis.sys. md5: 79B47FD40D9A817E932F9D26FAC0A81C, sha256: 53E260B8BFC50BA45FA73BFCF4E58C233890D0EAA9DEFDCCBB55FD3EB992FF2D
20:04:01.0001 0x0f80 NDIS - detected LockedFile.Multi.Generic ( 1 )
20:04:05.0626 0x0f80 Detect skipped due to KSN trusted
20:04:05.0626 0x0f80 NDIS - ok
20:04:05.0714 0x0f80 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
20:04:05.0715 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\ndiscap.sys. md5: 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, sha256: D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC
20:04:05.0715 0x0f80 NdisCap - detected LockedFile.Multi.Generic ( 1 )
20:04:08.0701 0x0f80 Detect skipped due to KSN trusted
20:04:08.0702 0x0f80 NdisCap - ok
20:04:08.0775 0x0f80 [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
20:04:08.0776 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\ndistapi.sys. md5: 30639C932D9FEF22B31268FE25A1B6E5, sha256: 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6
20:04:08.0776 0x0f80 NdisTapi - detected LockedFile.Multi.Generic ( 1 )
20:04:11.0575 0x0f80 Detect skipped due to KSN trusted
20:04:11.0575 0x0f80 NdisTapi - ok
20:04:11.0659 0x0f80 [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
20:04:11.0659 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\ndisuio.sys. md5: 136185F9FB2CC61E573E676AA5402356, sha256: BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683
20:04:11.0660 0x0f80 Ndisuio - detected LockedFile.Multi.Generic ( 1 )
20:04:14.0635 0x0f80 Detect skipped due to KSN trusted
20:04:14.0635 0x0f80 Ndisuio - ok
20:04:14.0727 0x0f80 [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
20:04:14.0727 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\ndiswan.sys. md5: 53F7305169863F0A2BDDC49E116C2E11, sha256: 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77
20:04:14.0729 0x0f80 NdisWan - detected LockedFile.Multi.Generic ( 1 )
20:04:17.0532 0x0f80 Detect skipped due to KSN trusted
20:04:17.0532 0x0f80 NdisWan - ok
20:04:17.0626 0x0f80 [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
20:04:17.0626 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\NDProxy.sys. md5: 015C0D8E0E0421B4CFD48CFFE2825879, sha256: 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023
20:04:17.0627 0x0f80 NDProxy - detected LockedFile.Multi.Generic ( 1 )
20:04:20.0424 0x0f80 Detect skipped due to KSN trusted
20:04:20.0424 0x0f80 NDProxy - ok
20:04:20.0523 0x0f80 [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
20:04:20.0523 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\netbios.sys. md5: 86743D9F5D2B1048062B14B1D84501C4, sha256: DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062
20:04:20.0523 0x0f80 NetBIOS - detected LockedFile.Multi.Generic ( 1 )
20:04:23.0315 0x0f80 Detect skipped due to KSN trusted
20:04:23.0316 0x0f80 NetBIOS - ok
20:04:23.0404 0x0f80 [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
20:04:23.0404 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\netbt.sys. md5: 09594D1089C523423B32A4229263F068, sha256: 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37
20:04:23.0419 0x0f80 NetBT - detected LockedFile.Multi.Generic ( 1 )
20:04:26.0229 0x0f80 Detect skipped due to KSN trusted
20:04:26.0229 0x0f80 NetBT - ok
20:04:26.0298 0x0f80 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] Netlogon C:\Windows\system32\lsass.exe
20:04:26.0320 0x0f80 Netlogon - ok
20:04:26.0363 0x0f80 [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman C:\Windows\System32\netman.dll
20:04:26.0437 0x0f80 Netman - ok
20:04:26.0452 0x0f80 [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm C:\Windows\System32\netprofm.dll
20:04:26.0501 0x0f80 netprofm - ok
20:04:26.0525 0x0f80 [ 3E5A36127E201DDF663176B66828FAFE, 5A08BA9EFB1A72DF1DD839BA5FA2B8994012BA62A515588FF62333B33B60045B ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:04:26.0536 0x0f80 NetTcpPortSharing - ok
20:04:26.0572 0x0f80 [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys
20:04:26.0572 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\nfrd960.sys. md5: 77889813BE4D166CDAB78DDBA990DA92, sha256: 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3
20:04:26.0573 0x0f80 nfrd960 - detected LockedFile.Multi.Generic ( 1 )
20:04:29.0563 0x0f80 Detect skipped due to KSN trusted
20:04:29.0563 0x0f80 nfrd960 - ok
20:04:29.0669 0x0f80 [ 1EE99A89CC788ADA662441D1E9830529, 6B4FDD74BB81E12BD4B25A3E8AECB0FA77FA0075D454DD1D6DC1790ADF1F2AA8 ] NlaSvc C:\Windows\System32\nlasvc.dll
20:04:29.0746 0x0f80 NlaSvc - ok
20:04:29.0758 0x0f80 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs C:\Windows\system32\drivers\Npfs.sys
20:04:29.0759 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\Npfs.sys. md5: 1E4C4AB5C9B8DD13179BBDC75A2A01F7, sha256: D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F
20:04:29.0759 0x0f80 Npfs - detected LockedFile.Multi.Generic ( 1 )
20:04:32.0602 0x0f80 Detect skipped due to KSN trusted
20:04:32.0602 0x0f80 Npfs - ok
20:04:32.0677 0x0f80 [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi C:\Windows\system32\nsisvc.dll
20:04:32.0751 0x0f80 nsi - ok
20:04:32.0777 0x0f80 [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
20:04:32.0777 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\nsiproxy.sys. md5: E7F5AE18AF4168178A642A9247C63001, sha256: 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76
20:04:32.0777 0x0f80 nsiproxy - detected LockedFile.Multi.Generic ( 1 )
20:04:35.0752 0x0f80 Detect skipped due to KSN trusted
20:04:35.0752 0x0f80 nsiproxy - ok
20:04:35.0899 0x0f80 [ B98F8C6E31CD07B2E6F71F7F648E38C0, 2FEA100B80680FBBF644CB6763738804155DF1E94A6542CAE2B2786D770D554E ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
20:04:35.0899 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\Ntfs.sys. md5: B98F8C6E31CD07B2E6F71F7F648E38C0, sha256: 2FEA100B80680FBBF644CB6763738804155DF1E94A6542CAE2B2786D770D554E
20:04:35.0901 0x0f80 Ntfs - detected LockedFile.Multi.Generic ( 1 )
20:04:38.0697 0x0f80 Detect skipped due to KSN trusted
20:04:38.0697 0x0f80 Ntfs - ok
20:04:38.0766 0x0f80 [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null C:\Windows\system32\drivers\Null.sys
20:04:38.0767 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\Null.sys. md5: 9899284589F75FA8724FF3D16AED75C1, sha256: 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6
20:04:38.0767 0x0f80 Null - detected LockedFile.Multi.Generic ( 1 )
20:04:41.0565 0x0f80 Detect skipped due to KSN trusted
20:04:41.0565 0x0f80 Null - ok
20:04:41.0654 0x0f80 [ 5D9FD91F3D38DC9DA01E3CB5FA89CD48, 7738785DE8B50D69993F4408498B812D0283FEE5C04FF5B89C20F149B44E9737 ] nvraid C:\Windows\system32\drivers\nvraid.sys
20:04:41.0655 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\nvraid.sys. md5: 5D9FD91F3D38DC9DA01E3CB5FA89CD48, sha256: 7738785DE8B50D69993F4408498B812D0283FEE5C04FF5B89C20F149B44E9737
20:04:41.0655 0x0f80 nvraid - detected LockedFile.Multi.Generic ( 1 )
20:04:44.0481 0x0f80 Detect skipped due to KSN trusted
20:04:44.0481 0x0f80 nvraid - ok
20:04:44.0559 0x0f80 [ F7CD50FE7139F07E77DA8AC8033D1832, DA96F4B15C8165E6AE1D00E03A062C66CA3A3089E4FF0E9E11CE00B154DD12EC ] nvstor C:\Windows\system32\drivers\nvstor.sys
20:04:44.0559 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\nvstor.sys. md5: F7CD50FE7139F07E77DA8AC8033D1832, sha256: DA96F4B15C8165E6AE1D00E03A062C66CA3A3089E4FF0E9E11CE00B154DD12EC
20:04:44.0560 0x0f80 nvstor - detected LockedFile.Multi.Generic ( 1 )
20:04:47.0536 0x0f80 Detect skipped due to KSN trusted
20:04:47.0536 0x0f80 nvstor - ok
20:04:47.0598 0x0f80 [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
20:04:47.0598 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\nv_agp.sys. md5: 270D7CD42D6E3979F6DD0146650F0E05, sha256: 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F
20:04:47.0599 0x0f80 nv_agp - detected LockedFile.Multi.Generic ( 1 )
20:04:50.0583 0x0f80 Detect skipped due to KSN trusted
20:04:50.0583 0x0f80 nv_agp - ok
20:04:50.0739 0x0f80 [ 785F487A64950F3CB8E9F16253BA3B7B, 02445344BD214370A6D48B1CA04921D8EFCB13E676B5648266DD0E076C0822B6 ] odserv C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
20:04:50.0789 0x0f80 odserv - ok
20:04:50.0823 0x0f80 [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
20:04:50.0823 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\ohci1394.sys. md5: 3589478E4B22CE21B41FA1BFC0B8B8A0, sha256: AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203
20:04:50.0823 0x0f80 ohci1394 - detected LockedFile.Multi.Generic ( 1 )
20:04:53.0637 0x0f80 Detect skipped due to KSN trusted
20:04:53.0637 0x0f80 ohci1394 - ok
20:04:53.0725 0x0f80 [ 5A432A042DAE460ABE7199B758E8606C, 6E5D1F477D290905BE27CEBF9572BAC6B05FFEF2FAD901D3C8E11F665F8B9A71 ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
20:04:53.0749 0x0f80 ose - ok
20:04:53.0796 0x0f80 [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
20:04:53.0843 0x0f80 p2pimsvc - ok
20:04:53.0902 0x0f80 [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc C:\Windows\system32\p2psvc.dll
20:04:53.0932 0x0f80 p2psvc - ok
20:04:53.0955 0x0f80 [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport C:\Windows\system32\DRIVERS\parport.sys
20:04:53.0955 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\parport.sys. md5: 0086431C29C35BE1DBC43F52CC273887, sha256: 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80
20:04:53.0956 0x0f80 Parport - detected LockedFile.Multi.Generic ( 1 )
20:04:56.0931 0x0f80 Detect skipped due to KSN trusted
20:04:56.0931 0x0f80 Parport - ok
20:04:57.0020 0x0f80 [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr C:\Windows\system32\drivers\partmgr.sys
20:04:57.0020 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\partmgr.sys. md5: E9766131EEADE40A27DC27D2D68FBA9C, sha256: 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6
20:04:57.0021 0x0f80 partmgr - detected LockedFile.Multi.Generic ( 1 )
20:04:59.0816 0x0f80 Detect skipped due to KSN trusted
20:04:59.0816 0x0f80 partmgr - ok
20:04:59.0917 0x0f80 [ 3AEAA8B561E63452C655DC0584922257, 04C072969B58657602EB0C21CEDF24FCEE14E61B90A0F758F93925EF2C9FC32D ] PcaSvc C:\Windows\System32\pcasvc.dll
20:05:00.0006 0x0f80 PcaSvc - ok
20:05:00.0037 0x0f80 [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci C:\Windows\system32\drivers\pci.sys
20:05:00.0037 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\pci.sys. md5: 94575C0571D1462A0F70BDE6BD6EE6B3, sha256: 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9
20:05:00.0038 0x0f80 pci - detected LockedFile.Multi.Generic ( 1 )
20:05:02.0864 0x0f80 Detect skipped due to KSN trusted
20:05:02.0865 0x0f80 pci - ok
20:05:02.0941 0x0f80 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide C:\Windows\system32\drivers\pciide.sys
20:05:02.0941 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\pciide.sys. md5: B5B8B5EF2E5CB34DF8DCF8831E3534FA, sha256: F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480
20:05:02.0941 0x0f80 pciide - detected LockedFile.Multi.Generic ( 1 )
20:05:05.0763 0x0f80 Detect skipped due to KSN trusted
20:05:05.0763 0x0f80 pciide - ok
20:05:05.0808 0x0f80 [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
20:05:05.0808 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\pcmcia.sys. md5: B2E81D4E87CE48589F98CB8C05B01F2F, sha256: 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14
20:05:05.0809 0x0f80 pcmcia - detected LockedFile.Multi.Generic ( 1 )
20:05:08.0603 0x0f80 Detect skipped due to KSN trusted
20:05:08.0603 0x0f80 pcmcia - ok
20:05:08.0662 0x0f80 [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw C:\Windows\system32\drivers\pcw.sys
20:05:08.0663 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\pcw.sys. md5: D6B9C2E1A11A3A4B26A182FFEF18F603, sha256: BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36
20:05:08.0663 0x0f80 pcw - detected LockedFile.Multi.Generic ( 1 )
20:05:11.0460 0x0f80 Detect skipped due to KSN trusted
20:05:11.0460 0x0f80 pcw - ok
20:05:11.0565 0x0f80 [ 68769C3356B3BE5D1C732C97B9A80D6E, FB2D61145980A2899D1B7729184C54070315B0E63C9A22400A76CCD39E00029C ] PEAUTH C:\Windows\system32\drivers\peauth.sys
20:05:11.0565 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\peauth.sys. md5: 68769C3356B3BE5D1C732C97B9A80D6E, sha256: FB2D61145980A2899D1B7729184C54070315B0E63C9A22400A76CCD39E00029C
20:05:11.0575 0x0f80 PEAUTH - detected LockedFile.Multi.Generic ( 1 )
20:05:14.0403 0x0f80 Detect skipped due to KSN trusted
20:05:14.0403 0x0f80 PEAUTH - ok
20:05:14.0533 0x0f80 [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost C:\Windows\SysWow64\perfhost.exe
20:05:14.0569 0x0f80 PerfHost - ok
20:05:14.0627 0x0f80 [ 663962900E7FEA522126BA287715BB4A, 95CE12CA11E705C293BE4E18845581037D819A7EC812349BCAF4EABC8E7087B1 ] PGEffect C:\Windows\system32\DRIVERS\pgeffect.sys
20:05:14.0627 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\pgeffect.sys. md5: 663962900E7FEA522126BA287715BB4A, sha256: 95CE12CA11E705C293BE4E18845581037D819A7EC812349BCAF4EABC8E7087B1
20:05:14.0627 0x0f80 PGEffect - detected LockedFile.Multi.Generic ( 1 )
20:05:17.0428 0x0f80 Detect skipped due to KSN trusted
20:05:17.0429 0x0f80 PGEffect - ok
20:05:17.0568 0x0f80 [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla C:\Windows\system32\pla.dll
20:05:17.0678 0x0f80 pla - ok
20:05:17.0717 0x0f80 [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
20:05:17.0762 0x0f80 PlugPlay - ok
20:05:17.0790 0x0f80 [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
20:05:17.0827 0x0f80 PNRPAutoReg - ok
20:05:17.0861 0x0f80 [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
20:05:17.0893 0x0f80 PNRPsvc - ok
20:05:17.0948 0x0f80 [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
20:05:18.0017 0x0f80 PolicyAgent - ok
20:05:18.0047 0x0f80 [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power C:\Windows\system32\umpo.dll
20:05:18.0090 0x0f80 Power - ok
20:05:18.0129 0x0f80 [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
20:05:18.0129 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\raspptp.sys. md5: F92A2C41117A11A00BE01CA01A7FCDE9, sha256: 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763
20:05:18.0130 0x0f80 PptpMiniport - detected LockedFile.Multi.Generic ( 1 )
20:05:20.0944 0x0f80 Detect skipped due to KSN trusted
20:05:20.0944 0x0f80 PptpMiniport - ok
20:05:21.0019 0x0f80 [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor C:\Windows\system32\DRIVERS\processr.sys
20:05:21.0020 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\processr.sys. md5: 0D922E23C041EFB1C3FAC2A6F943C9BF, sha256: 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5
20:05:21.0020 0x0f80 Processor - detected LockedFile.Multi.Generic ( 1 )
20:05:24.0001 0x0f80 Detect skipped due to KSN trusted
20:05:24.0001 0x0f80 Processor - ok
20:05:24.0106 0x0f80 [ 5C78838B4D166D1A27DB3A8A820C799A, BBF7E1D0B6754CF06BF3936671FDF5BF6E845CA5678D0940EA54E9212B539B7F ] ProfSvc C:\Windows\system32\profsvc.dll
20:05:24.0169 0x0f80 ProfSvc - ok
20:05:24.0187 0x0f80 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] ProtectedStorage C:\Windows\system32\lsass.exe
20:05:24.0198 0x0f80 ProtectedStorage - ok
20:05:24.0231 0x0f80 [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched C:\Windows\system32\DRIVERS\pacer.sys
20:05:24.0232 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\pacer.sys. md5: 0557CF5A2556BD58E26384169D72438D, sha256: F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4
20:05:24.0233 0x0f80 Psched - detected LockedFile.Multi.Generic ( 1 )
20:05:27.0207 0x0f80 Detect skipped due to KSN trusted
20:05:27.0207 0x0f80 Psched - ok
20:05:27.0341 0x0f80 [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys
20:05:27.0341 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\ql2300.sys. md5: A53A15A11EBFD21077463EE2C7AFEEF0, sha256: 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489
20:05:27.0342 0x0f80 ql2300 - detected LockedFile.Multi.Generic ( 1 )
20:05:30.0137 0x0f80 Detect skipped due to KSN trusted
20:05:30.0138 0x0f80 ql2300 - ok
20:05:30.0225 0x0f80 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys
20:05:30.0226 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\ql40xx.sys. md5: 4F6D12B51DE1AAEFF7DC58C4D75423C8, sha256: FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE
20:05:30.0226 0x0f80 ql40xx - detected LockedFile.Multi.Generic ( 1 )
20:05:33.0206 0x0f80 Detect skipped due to KSN trusted
20:05:33.0206 0x0f80 ql40xx - ok
20:05:33.0298 0x0f80 [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE C:\Windows\system32\qwave.dll
20:05:33.0350 0x0f80 QWAVE - ok
20:05:33.0382 0x0f80 [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
20:05:33.0382 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\qwavedrv.sys. md5: 76707BB36430888D9CE9D705398ADB6C, sha256: 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535
20:05:33.0382 0x0f80 QWAVEdrv - detected LockedFile.Multi.Generic ( 1 )
20:05:36.0355 0x0f80 Detect skipped due to KSN trusted
20:05:36.0355 0x0f80 QWAVEdrv - ok
20:05:36.0421 0x0f80 [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
20:05:36.0421 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\rasacd.sys. md5: 5A0DA8AD5762FA2D91678A8A01311704, sha256: 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF
20:05:36.0421 0x0f80 RasAcd - detected LockedFile.Multi.Generic ( 1 )
20:05:39.0229 0x0f80 Detect skipped due to KSN trusted
20:05:39.0229 0x0f80 RasAcd - ok
20:05:39.0301 0x0f80 [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
20:05:39.0302 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\AgileVpn.sys. md5: 7ECFF9B22276B73F43A99A15A6094E90, sha256: 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1
20:05:39.0302 0x0f80 RasAgileVpn - detected LockedFile.Multi.Generic ( 1 )
20:05:42.0100 0x0f80 Detect skipped due to KSN trusted
20:05:42.0100 0x0f80 RasAgileVpn - ok
20:05:42.0177 0x0f80 [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto C:\Windows\System32\rasauto.dll
20:05:42.0254 0x0f80 RasAuto - ok
20:05:42.0285 0x0f80 [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
20:05:42.0285 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\rasl2tp.sys. md5: 471815800AE33E6F1C32FB1B97C490CA, sha256: 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698
20:05:42.0285 0x0f80 Rasl2tp - detected LockedFile.Multi.Generic ( 1 )
20:05:45.0082 0x0f80 Detect skipped due to KSN trusted
20:05:45.0082 0x0f80 Rasl2tp - ok
20:05:45.0179 0x0f80 [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan C:\Windows\System32\rasmans.dll
20:05:45.0282 0x0f80 RasMan - ok
20:05:45.0309 0x0f80 [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
20:05:45.0309 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\raspppoe.sys. md5: 855C9B1CD4756C5E9A2AA58A15F58C25, sha256: A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72
20:05:45.0309 0x0f80 RasPppoe - detected LockedFile.Multi.Generic ( 1 )
20:05:48.0101 0x0f80 Detect skipped due to KSN trusted
20:05:48.0102 0x0f80 RasPppoe - ok
20:05:48.0181 0x0f80 [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
20:05:48.0181 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\rassstp.sys. md5: E8B1E447B008D07FF47D016C2B0EEECB, sha256: FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C
20:05:48.0182 0x0f80 RasSstp - detected LockedFile.Multi.Generic ( 1 )
20:05:51.0006 0x0f80 Detect skipped due to KSN trusted
20:05:51.0006 0x0f80 RasSstp - ok
20:05:51.0089 0x0f80 [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
20:05:51.0089 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\rdbss.sys. md5: 77F665941019A1594D887A74F301FA2F, sha256: 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA
20:05:51.0090 0x0f80 rdbss - detected LockedFile.Multi.Generic ( 1 )
20:05:53.0906 0x0f80 Detect skipped due to KSN trusted
20:05:53.0906 0x0f80 rdbss - ok
20:05:53.0975 0x0f80 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
20:05:53.0975 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\rdpbus.sys. md5: 302DA2A0539F2CF54D7C6CC30C1F2D8D, sha256: 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17
20:05:53.0975 0x0f80 rdpbus - detected LockedFile.Multi.Generic ( 1 )
20:05:56.0948 0x0f80 Detect skipped due to KSN trusted
20:05:56.0948 0x0f80 rdpbus - ok
20:05:57.0033 0x0f80 [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
20:05:57.0033 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\RDPCDD.sys. md5: CEA6CC257FC9B7715F1C2B4849286D24, sha256: A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804
20:05:57.0034 0x0f80 RDPCDD - detected LockedFile.Multi.Generic ( 1 )
20:05:59.0842 0x0f80 Detect skipped due to KSN trusted
20:05:59.0842 0x0f80 RDPCDD - ok
20:05:59.0851 0x0f80 [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
20:05:59.0851 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\rdpencdd.sys. md5: BB5971A4F00659529A5C44831AF22365, sha256: 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F
20:05:59.0852 0x0f80 RDPENCDD - detected LockedFile.Multi.Generic ( 1 )
20:06:02.0678 0x0f80 Detect skipped due to KSN trusted
20:06:02.0678 0x0f80 RDPENCDD - ok
20:06:02.0748 0x0f80 [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
20:06:02.0748 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\rdprefmp.sys. md5: 216F3FA57533D98E1F74DED70113177A, sha256: 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4
20:06:02.0749 0x0f80 RDPREFMP - detected LockedFile.Multi.Generic ( 1 )
20:06:06.0445 0x0f80 Detect skipped due to KSN trusted
20:06:06.0445 0x0f80 RDPREFMP - ok
20:06:06.0532 0x0f80 [ E61608AA35E98999AF9AAEEEA6114B0A, F754CDE89DC96786D2A3C4D19EE2AEF1008E634E4DE3C0CBF927436DE90C04A6 ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
20:06:06.0532 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\RDPWD.sys. md5: E61608AA35E98999AF9AAEEEA6114B0A, sha256: F754CDE89DC96786D2A3C4D19EE2AEF1008E634E4DE3C0CBF927436DE90C04A6
20:06:06.0532 0x0f80 RDPWD - detected LockedFile.Multi.Generic ( 1 )
20:06:10.0433 0x0f80 Detect skipped due to KSN trusted
20:06:10.0433 0x0f80 RDPWD - ok
20:06:10.0549 0x0f80 [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
20:06:10.0550 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\rdyboost.sys. md5: 34ED295FA0121C241BFEF24764FC4520, sha256: AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F
20:06:10.0563 0x0f80 rdyboost - detected LockedFile.Multi.Generic ( 1 )
20:06:13.0360 0x0f80 Detect skipped due to KSN trusted
20:06:13.0361 0x0f80 rdyboost - ok
20:06:13.0455 0x0f80 [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess C:\Windows\System32\mprdim.dll
20:06:13.0520 0x0f80 RemoteAccess - ok
20:06:13.0556 0x0f80 [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry C:\Windows\system32\regsvc.dll
20:06:13.0606 0x0f80 RemoteRegistry - ok
20:06:13.0626 0x0f80 [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
20:06:13.0670 0x0f80 RpcEptMapper - ok
20:06:13.0689 0x0f80 [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator C:\Windows\system32\locator.exe
20:06:13.0717 0x0f80 RpcLocator - ok
20:06:13.0745 0x0f80 [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs C:\Windows\system32\rpcss.dll
20:06:13.0790 0x0f80 RpcSs - ok
20:06:13.0818 0x0f80 [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
20:06:13.0819 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\rspndr.sys. md5: DDC86E4F8E7456261E637E3552E804FF, sha256: D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD
20:06:13.0819 0x0f80 rspndr - detected LockedFile.Multi.Generic ( 1 )
20:06:16.0797 0x0f80 Detect skipped due to KSN trusted
20:06:16.0797 0x0f80 rspndr - ok
20:06:16.0858 0x0f80 [ 907C4464381B5EBDFDC60F6C7D0DEDFC, A39EB4C0858A3CA2D8AFE6D52809EC41795FD7A2F3F157D9CBCCB84BE7958A89 ] RSUSBSTOR C:\Windows\system32\Drivers\RtsUStor.sys
20:06:16.0858 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\Drivers\RtsUStor.sys. md5: 907C4464381B5EBDFDC60F6C7D0DEDFC, sha256: A39EB4C0858A3CA2D8AFE6D52809EC41795FD7A2F3F157D9CBCCB84BE7958A89
20:06:16.0859 0x0f80 RSUSBSTOR - detected LockedFile.Multi.Generic ( 1 )
20:06:19.0688 0x0f80 Detect skipped due to KSN trusted
20:06:19.0688 0x0f80 RSUSBSTOR - ok
20:06:19.0838 0x0f80 [ 7475548B0BA58EBA4D12414FC9E9DFE6, 93F5CF9C7F5CE556810A6113014CB17774EA7779BD91D84670FA6653C810361F ] rtl8192se C:\Windows\system32\DRIVERS\rtl8192se.sys
20:06:19.0838 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\rtl8192se.sys. md5: 7475548B0BA58EBA4D12414FC9E9DFE6, sha256: 93F5CF9C7F5CE556810A6113014CB17774EA7779BD91D84670FA6653C810361F
20:06:19.0840 0x0f80 rtl8192se - detected LockedFile.Multi.Generic ( 1 )
20:06:22.0664 0x0f80 Detect skipped due to KSN trusted
20:06:22.0664 0x0f80 rtl8192se - ok
20:06:22.0683 0x0f80 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] SamSs C:\Windows\system32\lsass.exe
20:06:22.0704 0x0f80 SamSs - ok
20:06:22.0739 0x0f80 [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
20:06:22.0739 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\sbp2port.sys. md5: AC03AF3329579FFFB455AA2DAABBE22B, sha256: 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656
20:06:22.0740 0x0f80 sbp2port - detected LockedFile.Multi.Generic ( 1 )
20:06:25.0712 0x0f80 Detect skipped due to KSN trusted
20:06:25.0712 0x0f80 sbp2port - ok
20:06:25.0802 0x0f80 [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr C:\Windows\System32\SCardSvr.dll
20:06:25.0852 0x0f80 SCardSvr - ok
20:06:25.0886 0x0f80 [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
20:06:25.0886 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\scfilter.sys. md5: 253F38D0D7074C02FF8DEB9836C97D2B, sha256: CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116
20:06:25.0886 0x0f80 scfilter - detected LockedFile.Multi.Generic ( 1 )
20:06:28.0712 0x0f80 Detect skipped due to KSN trusted
20:06:28.0712 0x0f80 scfilter - ok
20:06:28.0840 0x0f80 [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule C:\Windows\system32\schedsvc.dll
20:06:28.0922 0x0f80 Schedule - ok
20:06:28.0952 0x0f80 [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc C:\Windows\System32\certprop.dll
20:06:28.0985 0x0f80 SCPolicySvc - ok
20:06:29.0017 0x0f80 [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC C:\Windows\System32\SDRSVC.dll
20:06:29.0062 0x0f80 SDRSVC - ok
20:06:29.0103 0x0f80 [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv C:\Windows\system32\drivers\secdrv.sys
20:06:29.0103 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\secdrv.sys. md5: 3EA8A16169C26AFBEB544E0E48421186, sha256: 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D
20:06:29.0103 0x0f80 secdrv - detected LockedFile.Multi.Generic ( 1 )
20:06:32.0075 0x0f80 Detect skipped due to KSN trusted
20:06:32.0076 0x0f80 secdrv - ok
20:06:32.0142 0x0f80 [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon C:\Windows\system32\seclogon.dll
20:06:32.0228 0x0f80 seclogon - ok
20:06:32.0261 0x0f80 [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS C:\Windows\System32\sens.dll
20:06:32.0330 0x0f80 SENS - ok
20:06:32.0348 0x0f80 [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc C:\Windows\system32\sensrsvc.dll
20:06:32.0393 0x0f80 SensrSvc - ok
20:06:32.0421 0x0f80 [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
20:06:32.0421 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\serenum.sys. md5: CB624C0035412AF0DEBEC78C41F5CA1B, sha256: A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4
20:06:32.0421 0x0f80 Serenum - detected LockedFile.Multi.Generic ( 1 )
20:06:35.0214 0x0f80 Detect skipped due to KSN trusted
20:06:35.0214 0x0f80 Serenum - ok
20:06:35.0288 0x0f80 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial C:\Windows\system32\DRIVERS\serial.sys
20:06:35.0289 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\serial.sys. md5: C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, sha256: 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D
20:06:35.0289 0x0f80 Serial - detected LockedFile.Multi.Generic ( 1 )
20:06:38.0089 0x0f80 Detect skipped due to KSN trusted
20:06:38.0089 0x0f80 Serial - ok
20:06:38.0183 0x0f80 [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys
20:06:38.0183 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\sermouse.sys. md5: 1C545A7D0691CC4A027396535691C3E3, sha256: 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D
20:06:38.0184 0x0f80 sermouse - detected LockedFile.Multi.Generic ( 1 )
20:06:40.0978 0x0f80 Detect skipped due to KSN trusted
20:06:40.0978 0x0f80 sermouse - ok
20:06:41.0067 0x0f80 [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv C:\Windows\system32\sessenv.dll
20:06:41.0140 0x0f80 SessionEnv - ok
20:06:41.0149 0x0f80 [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
20:06:41.0149 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\sffdisk.sys. md5: A554811BCD09279536440C964AE35BBF, sha256: DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55
20:06:41.0149 0x0f80 sffdisk - detected LockedFile.Multi.Generic ( 1 )
20:06:43.0972 0x0f80 Detect skipped due to KSN trusted
20:06:43.0972 0x0f80 sffdisk - ok
20:06:44.0042 0x0f80 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
20:06:44.0043 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\sffp_mmc.sys. md5: FF414F0BAEFEBA59BC6C04B3DB0B87BF, sha256: B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042
20:06:44.0043 0x0f80 sffp_mmc - detected LockedFile.Multi.Generic ( 1 )
20:06:46.0838 0x0f80 Detect skipped due to KSN trusted
20:06:46.0839 0x0f80 sffp_mmc - ok
20:06:46.0982 0x0f80 [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
20:06:46.0982 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\sffp_sd.sys. md5: DD85B78243A19B59F0637DCF284DA63C, sha256: 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197
20:06:46.0982 0x0f80 sffp_sd - detected LockedFile.Multi.Generic ( 1 )
20:06:49.0806 0x0f80 Detect skipped due to KSN trusted
20:06:49.0806 0x0f80 sffp_sd - ok
20:06:49.0884 0x0f80 [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys
20:06:49.0885 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\sfloppy.sys. md5: A9D601643A1647211A1EE2EC4E433FF4, sha256: 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9
20:06:49.0885 0x0f80 sfloppy - detected LockedFile.Multi.Generic ( 1 )
20:06:52.0680 0x0f80 Detect skipped due to KSN trusted
20:06:52.0680 0x0f80 sfloppy - ok
20:06:52.0720 0x0f80 [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess C:\Windows\System32\ipnathlp.dll
20:06:52.0807 0x0f80 SharedAccess - ok
20:06:52.0850 0x0f80 [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
20:06:52.0910 0x0f80 ShellHWDetection - ok
20:06:52.0927 0x0f80 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys
20:06:52.0927 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\SiSRaid2.sys. md5: 843CAF1E5FDE1FFD5FF768F23A51E2E1, sha256: 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820
20:06:52.0927 0x0f80 SiSRaid2 - detected LockedFile.Multi.Generic ( 1 )
20:06:55.0732 0x0f80 Detect skipped due to KSN trusted
20:06:55.0732 0x0f80 SiSRaid2 - ok
20:06:55.0796 0x0f80 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys
20:06:55.0797 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\sisraid4.sys. md5: 6A6C106D42E9FFFF8B9FCB4F754F6DA4, sha256: 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E
20:06:55.0797 0x0f80 SiSRaid4 - detected LockedFile.Multi.Generic ( 1 )
20:06:58.0589 0x0f80 Detect skipped due to KSN trusted
20:06:58.0590 0x0f80 SiSRaid4 - ok
20:06:58.0668 0x0f80 [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb C:\Windows\system32\DRIVERS\smb.sys
20:06:58.0669 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\smb.sys. md5: 548260A7B8654E024DC30BF8A7C5BAA4, sha256: 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740
20:06:58.0670 0x0f80 Smb - detected LockedFile.Multi.Generic ( 1 )
20:07:01.0467 0x0f80 Detect skipped due to KSN trusted
20:07:01.0467 0x0f80 Smb - ok
20:07:01.0553 0x0f80 [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
20:07:01.0587 0x0f80 SNMPTRAP - ok
20:07:01.0600 0x0f80 [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr C:\Windows\system32\drivers\spldr.sys
20:07:01.0601 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\spldr.sys. md5: B9E31E5CACDFE584F34F730A677803F9, sha256: 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063
20:07:01.0601 0x0f80 spldr - detected LockedFile.Multi.Generic ( 1 )
20:07:04.0572 0x0f80 Detect skipped due to KSN trusted
20:07:04.0572 0x0f80 spldr - ok
20:07:04.0753 0x0f80 [ B96C17B5DC1424D56EEA3A99E97428CD, AF0A85066A7983878DC1C663811CE61C6CA1912DC956184F878B7B82DB93C651 ] Spooler C:\Windows\System32\spoolsv.exe
20:07:04.0812 0x0f80 Spooler - ok
20:07:04.0947 0x0f80 [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc C:\Windows\system32\sppsvc.exe
20:07:05.0067 0x0f80 sppsvc - ok
20:07:05.0097 0x0f80 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify C:\Windows\system32\sppuinotify.dll
20:07:05.0142 0x0f80 sppuinotify - ok
20:07:05.0180 0x0f80 [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv C:\Windows\system32\DRIVERS\srv.sys
20:07:05.0180 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\srv.sys. md5: 441FBA48BFF01FDB9D5969EBC1838F0B, sha256: 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0
20:07:05.0180 0x0f80 srv - detected LockedFile.Multi.Generic ( 1 )
20:07:07.0996 0x0f80 Detect skipped due to KSN trusted
20:07:07.0996 0x0f80 srv - ok
20:07:08.0089 0x0f80 [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
20:07:08.0089 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\srv2.sys. md5: B4ADEBBF5E3677CCE9651E0F01F7CC28, sha256: 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7
20:07:08.0090 0x0f80 srv2 - detected LockedFile.Multi.Generic ( 1 )
20:07:10.0927 0x0f80 Detect skipped due to KSN trusted
20:07:10.0927 0x0f80 srv2 - ok
20:07:11.0003 0x0f80 [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
20:07:11.0004 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\srvnet.sys. md5: 27E461F0BE5BFF5FC737328F749538C3, sha256: AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6
20:07:11.0004 0x0f80 srvnet - detected LockedFile.Multi.Generic ( 1 )
20:07:15.0212 0x0f80 Detect skipped due to KSN trusted
20:07:15.0212 0x0f80 srvnet - ok
20:07:15.0290 0x0f80 [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
20:07:15.0365 0x0f80 SSDPSRV - ok
20:07:15.0388 0x0f80 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc C:\Windows\system32\sstpsvc.dll
20:07:15.0432 0x0f80 SstpSvc - ok
20:07:15.0454 0x0f80 [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys
20:07:15.0454 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\stexstor.sys. md5: F3817967ED533D08327DC73BC4D5542A, sha256: 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5
20:07:15.0454 0x0f80 stexstor - detected LockedFile.Multi.Generic ( 1 )
20:07:18.0249 0x0f80 Detect skipped due to KSN trusted
20:07:18.0249 0x0f80 stexstor - ok
20:07:18.0363 0x0f80 [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc C:\Windows\System32\wiaservc.dll
20:07:18.0399 0x0f80 stisvc - ok
20:07:18.0422 0x0f80 [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum C:\Windows\system32\drivers\swenum.sys
20:07:18.0422 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\swenum.sys. md5: D01EC09B6711A5F8E7E6564A4D0FBC90, sha256: 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969
20:07:18.0427 0x0f80 swenum - detected LockedFile.Multi.Generic ( 1 )
20:07:21.0262 0x0f80 Detect skipped due to KSN trusted
20:07:21.0262 0x0f80 swenum - ok
20:07:21.0371 0x0f80 [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv C:\Windows\System32\swprv.dll
20:07:21.0489 0x0f80 swprv - ok
20:07:21.0544 0x0f80 [ 470C47DABA9CA3966F0AB3F835D7D135, BF98E48B05F37F8ABE264BF77355391A08955057E24AE456A5637D56BDFD40A5 ] SynTP C:\Windows\system32\DRIVERS\SynTP.sys
20:07:21.0545 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\SynTP.sys. md5: 470C47DABA9CA3966F0AB3F835D7D135, sha256: BF98E48B05F37F8ABE264BF77355391A08955057E24AE456A5637D56BDFD40A5
20:07:21.0545 0x0f80 SynTP - detected LockedFile.Multi.Generic ( 1 )
20:07:24.0517 0x0f80 Detect skipped due to KSN trusted
20:07:24.0518 0x0f80 SynTP - ok
20:07:24.0674 0x0f80 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain C:\Windows\system32\sysmain.dll
20:07:24.0740 0x0f80 SysMain - ok
20:07:24.0764 0x0f80 [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
20:07:24.0795 0x0f80 TabletInputService - ok
20:07:24.0817 0x0f80 [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv C:\Windows\System32\tapisrv.dll
20:07:24.0871 0x0f80 TapiSrv - ok
20:07:24.0891 0x0f80 [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS C:\Windows\System32\tbssvc.dll
20:07:24.0925 0x0f80 TBS - ok
20:07:25.0032 0x0f80 [ 40AF23633D197905F03AB5628C558C51, 644656A15236E964E4BE57B42225EAA5643C4CF1FFF6D306813A000716F9D72C ] Tcpip C:\Windows\system32\drivers\tcpip.sys
20:07:25.0033 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\tcpip.sys. md5: 40AF23633D197905F03AB5628C558C51, sha256: 644656A15236E964E4BE57B42225EAA5643C4CF1FFF6D306813A000716F9D72C
20:07:25.0047 0x0f80 Tcpip - detected LockedFile.Multi.Generic ( 1 )
20:07:27.0837 0x0f80 Detect skipped due to KSN trusted
20:07:27.0837 0x0f80 Tcpip - ok
20:07:27.0979 0x0f80 [ 40AF23633D197905F03AB5628C558C51, 644656A15236E964E4BE57B42225EAA5643C4CF1FFF6D306813A000716F9D72C ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
20:07:27.0979 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\tcpip.sys. md5: 40AF23633D197905F03AB5628C558C51, sha256: 644656A15236E964E4BE57B42225EAA5643C4CF1FFF6D306813A000716F9D72C
20:07:27.0996 0x0f80 TCPIP6 - detected LockedFile.Multi.Generic ( 1 )
20:07:27.0996 0x0f80 Detect skipped due to KSN trusted
20:07:27.0996 0x0f80 TCPIP6 - ok
20:07:28.0026 0x0f80 [ DF687E3D8836BFB04FCC0615BF15A519, 7C5B1E72673B4299DFC21E869F0FBB28198CA54DF4F4AF7080005F2D82467784 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
20:07:28.0027 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\tcpipreg.sys. md5: DF687E3D8836BFB04FCC0615BF15A519, sha256: 7C5B1E72673B4299DFC21E869F0FBB28198CA54DF4F4AF7080005F2D82467784
20:07:28.0027 0x0f80 tcpipreg - detected LockedFile.Multi.Generic ( 1 )
20:07:30.0827 0x0f80 Detect skipped due to KSN trusted
20:07:30.0827 0x0f80 tcpipreg - ok
20:07:30.0947 0x0f80 [ FD542B661BD22FA69CA789AD0AC58C29, 75FFAF1834B1E22DF37608ED451F161052FF1FE3C681B4E20A68DCA92CC7FD8C ] tdcmdpst C:\Windows\system32\DRIVERS\tdcmdpst.sys
20:07:30.0947 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\tdcmdpst.sys. md5: FD542B661BD22FA69CA789AD0AC58C29, sha256: 75FFAF1834B1E22DF37608ED451F161052FF1FE3C681B4E20A68DCA92CC7FD8C
20:07:30.0948 0x0f80 tdcmdpst - detected LockedFile.Multi.Generic ( 1 )
20:07:33.0921 0x0f80 Detect skipped due to KSN trusted
20:07:33.0921 0x0f80 tdcmdpst - ok
20:07:34.0005 0x0f80 [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
20:07:34.0006 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\tdpipe.sys. md5: 3371D21011695B16333A3934340C4E7C, sha256: 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D
20:07:34.0006 0x0f80 TDPIPE - detected LockedFile.Multi.Generic ( 1 )
20:07:36.0984 0x0f80 Detect skipped due to KSN trusted
20:07:36.0984 0x0f80 TDPIPE - ok
20:07:37.0060 0x0f80 [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
20:07:37.0060 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\tdtcp.sys. md5: 51C5ECEB1CDEE2468A1748BE550CFBC8, sha256: 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9
20:07:37.0060 0x0f80 TDTCP - detected LockedFile.Multi.Generic ( 1 )
20:07:39.0856 0x0f80 Detect skipped due to KSN trusted
20:07:39.0856 0x0f80 TDTCP - ok
20:07:39.0948 0x0f80 [ DDAD5A7AB24D8B65F8D724F5C20FD806, B71F2967A4EE7395E4416C1526CB85368AEA988BDD1F2C9719C48B08FAFA9661 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
20:07:39.0949 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\tdx.sys. md5: DDAD5A7AB24D8B65F8D724F5C20FD806, sha256: B71F2967A4EE7395E4416C1526CB85368AEA988BDD1F2C9719C48B08FAFA9661
20:07:39.0949 0x0f80 tdx - detected LockedFile.Multi.Generic ( 1 )
20:07:42.0745 0x0f80 Detect skipped due to KSN trusted
20:07:42.0745 0x0f80 tdx - ok
20:07:42.0775 0x0f80 [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD C:\Windows\system32\drivers\termdd.sys
20:07:42.0776 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\termdd.sys. md5: 561E7E1F06895D78DE991E01DD0FB6E5, sha256: 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D
20:07:42.0776 0x0f80 TermDD - detected LockedFile.Multi.Generic ( 1 )
20:07:45.0572 0x0f80 Detect skipped due to KSN trusted
20:07:45.0572 0x0f80 TermDD - ok
20:07:45.0671 0x0f80 [ 2E648163254233755035B46DD7B89123, 6FA0D07CE18A3A69D82EE49D875F141E39406E92C34EAC76AC4EB052E6EBCBCD ] TermService C:\Windows\System32\termsrv.dll
20:07:45.0779 0x0f80 TermService - ok
20:07:45.0812 0x0f80 [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes C:\Windows\system32\themeservice.dll
20:07:45.0856 0x0f80 Themes - ok
20:07:45.0876 0x0f80 [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER C:\Windows\system32\mmcss.dll
20:07:45.0926 0x0f80 THREADORDER - ok
20:07:45.0987 0x0f80 [ 28644B0523D64EFF2FC7312A2EE74B0A, 09A36DE0B2B90842BD5B8353CC34B7C71C0FBBF6DD5862720FCEE760849C4561 ] TMachInfo C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
20:07:46.0002 0x0f80 TMachInfo - ok
20:07:46.0036 0x0f80 [ ED32035BDFECED1AD66D459FD9CC1140, B82A15FAB4CBB5A633B9BF722441D5B20D946B63DD10BBE2A89D3A8BA3BE3339 ] TODDSrv C:\Windows\system32\TODDSrv.exe
20:07:46.0053 0x0f80 TODDSrv - ok
20:07:46.0110 0x0f80 TosCoSrv - ok
20:07:46.0135 0x0f80 TOSHIBA eco Utility Service - ok
20:07:46.0139 0x0f80 TPCHSrv - ok
20:07:46.0184 0x0f80 [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks C:\Windows\System32\trkwks.dll
20:07:46.0267 0x0f80 TrkWks - ok
20:07:46.0332 0x0f80 [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
20:07:46.0393 0x0f80 TrustedInstaller - ok
20:07:46.0423 0x0f80 [ 4CE278FC9671BA81A138D70823FCAA09, CBE501436696E32A3701B9F377B823AC36647B6626595F76CC63E2396AD7D300 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
20:07:46.0424 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\tssecsrv.sys. md5: 4CE278FC9671BA81A138D70823FCAA09, sha256: CBE501436696E32A3701B9F377B823AC36647B6626595F76CC63E2396AD7D300
20:07:46.0424 0x0f80 tssecsrv - detected LockedFile.Multi.Generic ( 1 )
20:07:49.0225 0x0f80 Detect skipped due to KSN trusted
20:07:49.0225 0x0f80 tssecsrv - ok
20:07:49.0316 0x0f80 [ D11C783E3EF9A3C52C0EBE83CC5000E9, A136C355D4C8945729163D15801364A614E23217B15F9313C85BA45BB71A74EB ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
20:07:49.0317 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\tsusbflt.sys. md5: D11C783E3EF9A3C52C0EBE83CC5000E9, sha256: A136C355D4C8945729163D15801364A614E23217B15F9313C85BA45BB71A74EB
20:07:49.0317 0x0f80 TsUsbFlt - detected LockedFile.Multi.Generic ( 1 )
20:07:52.0305 0x0f80 Detect skipped due to KSN trusted
20:07:52.0305 0x0f80 TsUsbFlt - ok
20:07:52.0394 0x0f80 [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
20:07:52.0394 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\tunnel.sys. md5: 3566A8DAAFA27AF944F5D705EAA64894, sha256: AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8
20:07:52.0395 0x0f80 tunnel - detected LockedFile.Multi.Generic ( 1 )
20:07:55.0369 0x0f80 Detect skipped due to KSN trusted
20:07:55.0369 0x0f80 tunnel - ok
20:07:55.0450 0x0f80 [ 550B567F9364D8F7684C3FB3EA665A72, A214BBBBAB9F0DD525FA5A818CEB8E9294B4A96676317255D7ACF6049049C933 ] TVALZ C:\Windows\system32\DRIVERS\TVALZ_O.SYS
20:07:55.0450 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\TVALZ_O.SYS. md5: 550B567F9364D8F7684C3FB3EA665A72, sha256: A214BBBBAB9F0DD525FA5A818CEB8E9294B4A96676317255D7ACF6049049C933
20:07:55.0451 0x0f80 TVALZ - detected LockedFile.Multi.Generic ( 1 )
20:07:58.0297 0x0f80 Detect skipped due to KSN trusted
20:07:58.0297 0x0f80 TVALZ - ok
20:07:58.0369 0x0f80 [ 9C7191F4B2E49BFF47A6C1144B5923FA, DF4E663499946F4E68B7528CA399574D1EB69797FF81F681943B84F3E5E6A40E ] TVALZFL C:\Windows\system32\DRIVERS\TVALZFL.sys
20:07:58.0369 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\TVALZFL.sys. md5: 9C7191F4B2E49BFF47A6C1144B5923FA, sha256: DF4E663499946F4E68B7528CA399574D1EB69797FF81F681943B84F3E5E6A40E
20:07:58.0370 0x0f80 TVALZFL - detected LockedFile.Multi.Generic ( 1 )
20:08:01.0174 0x0f80 Detect skipped due to KSN trusted
20:08:01.0174 0x0f80 TVALZFL - ok
20:08:01.0271 0x0f80 [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys
20:08:01.0272 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\uagp35.sys. md5: B4DD609BD7E282BFC683CEC7EAAAAD67, sha256: EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123
20:08:01.0285 0x0f80 uagp35 - detected LockedFile.Multi.Generic ( 1 )
20:08:04.0078 0x0f80 Detect skipped due to KSN trusted
20:08:04.0078 0x0f80 uagp35 - ok
20:08:04.0168 0x0f80 [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
20:08:04.0169 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\udfs.sys. md5: FF4232A1A64012BAA1FD97C7B67DF593, sha256: D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3
20:08:04.0169 0x0f80 udfs - detected LockedFile.Multi.Generic ( 1 )
20:08:07.0145 0x0f80 Detect skipped due to KSN trusted
20:08:07.0145 0x0f80 udfs - ok
20:08:07.0222 0x0f80 [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect C:\Windows\system32\UI0Detect.exe
20:08:07.0253 0x0f80 UI0Detect - ok
20:08:07.0283 0x0f80 [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
20:08:07.0283 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\uliagpkx.sys. md5: 4BFE1BC28391222894CBF1E7D0E42320, sha256: 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A
20:08:07.0283 0x0f80 uliagpkx - detected LockedFile.Multi.Generic ( 1 )
20:08:10.0255 0x0f80 Detect skipped due to KSN trusted
20:08:10.0255 0x0f80 uliagpkx - ok
20:08:10.0339 0x0f80 [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus C:\Windows\system32\DRIVERS\umbus.sys
20:08:10.0339 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\umbus.sys. md5: DC54A574663A895C8763AF0FA1FF7561, sha256: 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE
20:08:10.0340 0x0f80 umbus - detected LockedFile.Multi.Generic ( 1 )
20:08:13.0195 0x0f80 Detect skipped due to KSN trusted
20:08:13.0195 0x0f80 umbus - ok
20:08:13.0269 0x0f80 [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass C:\Windows\system32\DRIVERS\umpass.sys
20:08:13.0269 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\umpass.sys. md5: B2E8E8CB557B156DA5493BBDDCC1474D, sha256: F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43
20:08:13.0270 0x0f80 UmPass - detected LockedFile.Multi.Generic ( 1 )
20:08:17.0463 0x0f80 Detect skipped due to KSN trusted
20:08:17.0463 0x0f80 UmPass - ok
20:08:17.0629 0x0f80 [ CC3775100ABA633984F73DFAE1F55CAE, 845F129289BB73FD78A6C3B497F17BA973FD691BC9242200F81993417C803FE9 ] UNS C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
20:08:17.0686 0x0f80 UNS - ok
20:08:17.0713 0x0f80 [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost C:\Windows\System32\upnphost.dll
20:08:17.0770 0x0f80 upnphost - ok
20:08:17.0823 0x0f80 [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
20:08:17.0823 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\usbccgp.sys. md5: DCA68B0943D6FA415F0C56C92158A83A, sha256: BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57
20:08:17.0823 0x0f80 usbccgp - detected LockedFile.Multi.Generic ( 1 )
20:08:20.0654 0x0f80 Detect skipped due to KSN trusted
20:08:20.0654 0x0f80 usbccgp - ok
20:08:20.0739 0x0f80 [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir C:\Windows\system32\drivers\usbcir.sys
20:08:20.0740 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\usbcir.sys. md5: 80B0F7D5CCF86CEB5D402EAAF61FEC31, sha256: 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD
20:08:20.0740 0x0f80 usbcir - detected LockedFile.Multi.Generic ( 1 )
20:08:23.0712 0x0f80 Detect skipped due to KSN trusted
20:08:23.0712 0x0f80 usbcir - ok
20:08:23.0782 0x0f80 [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci C:\Windows\system32\drivers\usbehci.sys
20:08:23.0783 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\usbehci.sys. md5: 18A85013A3E0F7E1755365D287443965, sha256: 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33
20:08:23.0783 0x0f80 usbehci - detected LockedFile.Multi.Generic ( 1 )
20:08:26.0761 0x0f80 Detect skipped due to KSN trusted
20:08:26.0761 0x0f80 usbehci - ok
20:08:26.0963 0x0f80 [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
20:08:26.0964 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\usbhub.sys. md5: 8D1196CFBB223621F2C67D45710F25BA, sha256: B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003
20:08:26.0965 0x0f80 usbhub - detected LockedFile.Multi.Generic ( 1 )
20:08:29.0768 0x0f80 Detect skipped due to KSN trusted
20:08:29.0768 0x0f80 usbhub - ok
20:08:29.0836 0x0f80 [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci C:\Windows\system32\drivers\usbohci.sys
20:08:29.0836 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\usbohci.sys. md5: 765A92D428A8DB88B960DA5A8D6089DC, sha256: 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C
20:08:29.0837 0x0f80 usbohci - detected LockedFile.Multi.Generic ( 1 )
20:08:32.0632 0x0f80 Detect skipped due to KSN trusted
20:08:32.0632 0x0f80 usbohci - ok
20:08:32.0707 0x0f80 [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
20:08:32.0708 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\usbprint.sys. md5: 73188F58FB384E75C4063D29413CEE3D, sha256: B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C
20:08:32.0708 0x0f80 usbprint - detected LockedFile.Multi.Generic ( 1 )
20:08:35.0537 0x0f80 Detect skipped due to KSN trusted
20:08:35.0537 0x0f80 usbprint - ok
20:08:35.0608 0x0f80 [ D76510CFA0FC09023077F22C2F979D86, 5662281C6D515423255D3C262EA368DBAFC250235E535FBFA3E59D3487695439 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
20:08:35.0609 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\USBSTOR.SYS. md5: D76510CFA0FC09023077F22C2F979D86, sha256: 5662281C6D515423255D3C262EA368DBAFC250235E535FBFA3E59D3487695439
20:08:35.0609 0x0f80 USBSTOR - detected LockedFile.Multi.Generic ( 1 )
20:08:38.0587 0x0f80 Detect skipped due to KSN trusted
20:08:38.0587 0x0f80 USBSTOR - ok
20:08:38.0678 0x0f80 [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci C:\Windows\system32\drivers\usbuhci.sys
20:08:38.0678 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\usbuhci.sys. md5: DD253AFC3BC6CBA412342DE60C3647F3, sha256: 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7
20:08:38.0679 0x0f80 usbuhci - detected LockedFile.Multi.Generic ( 1 )
20:08:41.0477 0x0f80 Detect skipped due to KSN trusted
20:08:41.0477 0x0f80 usbuhci - ok
20:08:41.0574 0x0f80 [ 1F775DA4CF1A3A1834207E975A72E9D7, 6D3DE5BD3EF3A76E997E5BAF900C51D25308F5A9682D1F62017F577A24095B90 ] usbvideo C:\Windows\System32\Drivers\usbvideo.sys
20:08:41.0574 0x0f80 Suspicious file ( NoAccess ): C:\Windows\System32\Drivers\usbvideo.sys. md5: 1F775DA4CF1A3A1834207E975A72E9D7, sha256: 6D3DE5BD3EF3A76E997E5BAF900C51D25308F5A9682D1F62017F577A24095B90
20:08:41.0575 0x0f80 usbvideo - detected LockedFile.Multi.Generic ( 1 )
20:08:44.0369 0x0f80 Detect skipped due to KSN trusted
20:08:44.0369 0x0f80 usbvideo - ok
20:08:44.0451 0x0f80 [ 7B28E2FBE75115660FAB31079C0A9F29, 81BB5A3E64B652A672A0782A88ABF6DDD729D38712D0706CE0FB9DE6D1EE1515 ] usb_rndisx C:\Windows\system32\DRIVERS\usb8023x.sys
20:08:44.0516 0x0f80 usb_rndisx - ok
20:08:44.0541 0x0f80 [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms C:\Windows\System32\uxsms.dll
20:08:44.0602 0x0f80 UxSms - ok
20:08:44.0636 0x0f80 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] VaultSvc C:\Windows\system32\lsass.exe
20:08:44.0647 0x0f80 VaultSvc - ok
20:08:44.0662 0x0f80 [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
20:08:44.0663 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\vdrvroot.sys. md5: C5C876CCFC083FF3B128F933823E87BD, sha256: 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D
20:08:44.0666 0x0f80 vdrvroot - detected LockedFile.Multi.Generic ( 1 )
20:08:47.0462 0x0f80 Detect skipped due to KSN trusted
20:08:47.0462 0x0f80 vdrvroot - ok
20:08:47.0563 0x0f80 [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds C:\Windows\System32\vds.exe
20:08:47.0651 0x0f80 vds - ok
20:08:47.0694 0x0f80 [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
20:08:47.0695 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\vgapnp.sys. md5: DA4DA3F5E02943C2DC8C6ED875DE68DD, sha256: EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838
20:08:47.0696 0x0f80 vga - detected LockedFile.Multi.Generic ( 1 )
20:08:50.0520 0x0f80 Detect skipped due to KSN trusted
20:08:50.0520 0x0f80 vga - ok
20:08:50.0661 0x0f80 [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave C:\Windows\System32\drivers\vga.sys
20:08:50.0661 0x0f80 Suspicious file ( NoAccess ): C:\Windows\System32\drivers\vga.sys. md5: 53E92A310193CB3C03BEA963DE7D9CFC, sha256: 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125
20:08:50.0661 0x0f80 VgaSave - detected LockedFile.Multi.Generic ( 1 )
20:08:53.0639 0x0f80 Detect skipped due to KSN trusted
20:08:53.0639 0x0f80 VgaSave - ok
20:08:53.0722 0x0f80 [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
20:08:53.0722 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\vhdmp.sys. md5: 2CE2DF28C83AEAF30084E1B1EB253CBB, sha256: D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF
20:08:53.0723 0x0f80 vhdmp - detected LockedFile.Multi.Generic ( 1 )
20:08:56.0613 0x0f80 Detect skipped due to KSN trusted
20:08:56.0613 0x0f80 vhdmp - ok
20:08:56.0722 0x0f80 [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide C:\Windows\system32\drivers\viaide.sys
20:08:56.0723 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\viaide.sys. md5: E5689D93FFE4E5D66C0178761240DD54, sha256: 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27
20:08:56.0723 0x0f80 viaide - detected LockedFile.Multi.Generic ( 1 )
20:08:59.0572 0x0f80 Detect skipped due to KSN trusted
20:08:59.0572 0x0f80 viaide - ok
20:08:59.0650 0x0f80 [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr C:\Windows\system32\drivers\volmgr.sys
20:08:59.0651 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\volmgr.sys. md5: D2AAFD421940F640B407AEFAAEBD91B0, sha256: 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161
20:08:59.0651 0x0f80 volmgr - detected LockedFile.Multi.Generic ( 1 )
20:09:02.0445 0x0f80 Detect skipped due to KSN trusted
20:09:02.0445 0x0f80 volmgr - ok
20:09:02.0551 0x0f80 [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
20:09:02.0551 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\volmgrx.sys. md5: A255814907C89BE58B79EF2F189B843B, sha256: 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F
20:09:02.0552 0x0f80 volmgrx - detected LockedFile.Multi.Generic ( 1 )
20:09:05.0352 0x0f80 Detect skipped due to KSN trusted
20:09:05.0353 0x0f80 volmgrx - ok
20:09:05.0437 0x0f80 [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap C:\Windows\system32\drivers\volsnap.sys
20:09:05.0438 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\volsnap.sys. md5: 0D08D2F3B3FF84E433346669B5E0F639, sha256: 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC
20:09:05.0438 0x0f80 volsnap - detected LockedFile.Multi.Generic ( 1 )
20:09:08.0411 0x0f80 Detect skipped due to KSN trusted
20:09:08.0411 0x0f80 volsnap - ok
20:09:08.0494 0x0f80 [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys
20:09:08.0495 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\vsmraid.sys. md5: 5E2016EA6EBACA03C04FEAC5F330D997, sha256: 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC
20:09:08.0495 0x0f80 vsmraid - detected LockedFile.Multi.Generic ( 1 )
20:09:11.0468 0x0f80 Detect skipped due to KSN trusted
20:09:11.0468 0x0f80 vsmraid - ok
20:09:11.0616 0x0f80 [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS C:\Windows\system32\vssvc.exe
20:09:11.0743 0x0f80 VSS - ok
20:09:11.0758 0x0f80 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys
20:09:11.0758 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\vwifibus.sys. md5: 36D4720B72B5C5D9CB2B9C29E9DF67A1, sha256: 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7
20:09:11.0771 0x0f80 vwifibus - detected LockedFile.Multi.Generic ( 1 )
20:09:14.0569 0x0f80 Detect skipped due to KSN trusted
20:09:14.0569 0x0f80 vwifibus - ok
20:09:14.0598 0x0f80 [ 6A3D66263414FF0D6FA754C646612F3F, 30F6BA594B0D3B94113064015A16D97811CD989DF1715CCE21CEAB9894C1B4FB ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
20:09:14.0599 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\vwififlt.sys. md5: 6A3D66263414FF0D6FA754C646612F3F, sha256: 30F6BA594B0D3B94113064015A16D97811CD989DF1715CCE21CEAB9894C1B4FB
20:09:14.0599 0x0f80 vwififlt - detected LockedFile.Multi.Generic ( 1 )
20:09:17.0426 0x0f80 Detect skipped due to KSN trusted
20:09:17.0426 0x0f80 vwififlt - ok
20:09:17.0523 0x0f80 [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time C:\Windows\system32\w32time.dll
20:09:17.0625 0x0f80 W32Time - ok
20:09:17.0659 0x0f80 [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys
20:09:17.0659 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\wacompen.sys. md5: 4E9440F4F152A7B944CB1663D3935A3E, sha256: 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53
20:09:17.0659 0x0f80 WacomPen - detected LockedFile.Multi.Generic ( 1 )
20:09:20.0630 0x0f80 Detect skipped due to KSN trusted
20:09:20.0630 0x0f80 WacomPen - ok
20:09:20.0727 0x0f80 [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
20:09:20.0727 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\wanarp.sys. md5: 356AFD78A6ED4457169241AC3965230C, sha256: CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399
20:09:20.0728 0x0f80 WANARP - detected LockedFile.Multi.Generic ( 1 )
20:09:23.0535 0x0f80 Detect skipped due to KSN trusted
20:09:23.0535 0x0f80 WANARP - ok
20:09:23.0567 0x0f80 [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
20:09:23.0568 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\wanarp.sys. md5: 356AFD78A6ED4457169241AC3965230C, sha256: CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399
20:09:23.0568 0x0f80 Wanarpv6 - detected LockedFile.Multi.Generic ( 1 )
20:09:23.0568 0x0f80 Detect skipped due to KSN trusted
20:09:23.0568 0x0f80 Wanarpv6 - ok
20:09:23.0744 0x0f80 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C, 4150DAB33E8D61076F1D4767BCAFC9B4ECCCCBD58FD4FB3CFE5B8D27DCDCAB61 ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe
20:09:23.0820 0x0f80 WatAdminSvc - ok
20:09:23.0928 0x0f80 [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine C:\Windows\system32\wbengine.exe
20:09:24.0024 0x0f80 wbengine - ok
20:09:24.0062 0x0f80 [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
20:09:24.0086 0x0f80 WbioSrvc - ok
20:09:24.0149 0x0f80 [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc C:\Windows\System32\wcncsvc.dll
20:09:24.0209 0x0f80 wcncsvc - ok
20:09:24.0223 0x0f80 [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
20:09:24.0261 0x0f80 WcsPlugInService - ok
20:09:24.0289 0x0f80 [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd C:\Windows\system32\DRIVERS\wd.sys
20:09:24.0289 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\wd.sys. md5: 72889E16FF12BA0F235467D6091B17DC, sha256: F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8
20:09:24.0289 0x0f80 Wd - detected LockedFile.Multi.Generic ( 1 )
20:09:27.0183 0x0f80 Detect skipped due to KSN trusted
20:09:27.0183 0x0f80 Wd - ok
20:09:27.0303 0x0f80 [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
20:09:27.0303 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\Wdf01000.sys. md5: E2C933EDBC389386EBE6D2BA953F43D8, sha256: AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07
20:09:27.0305 0x0f80 Wdf01000 - detected LockedFile.Multi.Generic ( 1 )
20:09:30.0100 0x0f80 Detect skipped due to KSN trusted
20:09:30.0100 0x0f80 Wdf01000 - ok
20:09:30.0199 0x0f80 [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiServiceHost C:\Windows\system32\wdi.dll
20:09:30.0317 0x0f80 WdiServiceHost - ok
20:09:30.0342 0x0f80 [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiSystemHost C:\Windows\system32\wdi.dll
20:09:30.0371 0x0f80 WdiSystemHost - ok
20:09:30.0406 0x0f80 [ 3DB6D04E1C64272F8B14EB8BC4616280, 9138642B1C19F895D4ECFD930160C80FBF15813CE63BBF4C899842C300FD3026 ] WebClient C:\Windows\System32\webclnt.dll
20:09:30.0447 0x0f80 WebClient - ok
20:09:30.0471 0x0f80 [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc C:\Windows\system32\wecsvc.dll
20:09:30.0532 0x0f80 Wecsvc - ok
20:09:30.0555 0x0f80 [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport C:\Windows\System32\wercplsupport.dll
20:09:30.0600 0x0f80 wercplsupport - ok
20:09:30.0625 0x0f80 [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc C:\Windows\System32\WerSvc.dll
20:09:30.0675 0x0f80 WerSvc - ok
20:09:30.0705 0x0f80 [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
20:09:30.0705 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\wfplwf.sys. md5: 611B23304BF067451A9FDEE01FBDD725, sha256: 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8
20:09:30.0715 0x0f80 WfpLwf - detected LockedFile.Multi.Generic ( 1 )
20:09:33.0708 0x0f80 Detect skipped due to KSN trusted
20:09:33.0708 0x0f80 WfpLwf - ok
20:09:33.0733 0x0f80 [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount C:\Windows\system32\drivers\wimmount.sys
20:09:33.0733 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\wimmount.sys. md5: 05ECAEC3E4529A7153B3136CEB49F0EC, sha256: 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50
20:09:33.0733 0x0f80 WIMMount - detected LockedFile.Multi.Generic ( 1 )
20:09:36.0551 0x0f80 Detect skipped due to KSN trusted
20:09:36.0551 0x0f80 WIMMount - ok
20:09:36.0592 0x0f80 WinDefend - ok
20:09:36.0603 0x0f80 WinHttpAutoProxySvc - ok
20:09:36.0671 0x0f80 [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
20:09:36.0732 0x0f80 Winmgmt - ok
20:09:36.0833 0x0f80 [ BCB1310604AA415C4508708975B3931E, 9D943F086D454345153A0DD426B4432532A44FD87950386B186E1CAD2AC70565 ] WinRM C:\Windows\system32\WsmSvc.dll
20:09:36.0982 0x0f80 WinRM - ok
20:09:37.0040 0x0f80 [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys
20:09:37.0040 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\WinUsb.sys. md5: FE88B288356E7B47B74B13372ADD906D, sha256: A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03
20:09:37.0040 0x0f80 WinUsb - detected LockedFile.Multi.Generic ( 1 )
20:09:39.0832 0x0f80 Detect skipped due to KSN trusted
20:09:39.0832 0x0f80 WinUsb - ok
20:09:39.0941 0x0f80 [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc C:\Windows\System32\wlansvc.dll
20:09:39.0992 0x0f80 Wlansvc - ok
20:09:40.0156 0x0f80 [ 7E47C328FC4768CB8BEAFBCFAFA70362, C98BD6A0C2F70E069D5FD3BAB31BD028DFEAC0490D180BBC28A14BE375897D8C ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
20:09:40.0210 0x0f80 wlidsvc - ok
20:09:40.0230 0x0f80 [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
20:09:40.0231 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\wmiacpi.sys. md5: F6FF8944478594D0E414D3F048F0D778, sha256: 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9
20:09:40.0231 0x0f80 WmiAcpi - detected LockedFile.Multi.Generic ( 1 )
20:09:43.0025 0x0f80 Detect skipped due to KSN trusted
20:09:43.0025 0x0f80 WmiAcpi - ok
20:09:43.0114 0x0f80 [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
20:09:43.0154 0x0f80 wmiApSrv - ok
20:09:43.0179 0x0f80 WMPNetworkSvc - ok
20:09:43.0208 0x0f80 [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc C:\Windows\System32\wpcsvc.dll
20:09:43.0231 0x0f80 WPCSvc - ok
20:09:43.0263 0x0f80 [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
20:09:43.0286 0x0f80 WPDBusEnum - ok
20:09:43.0309 0x0f80 [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
20:09:43.0310 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\ws2ifsl.sys. md5: 6BCC1D7D2FD2453957C5479A32364E52, sha256: E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090
20:09:43.0310 0x0f80 ws2ifsl - detected LockedFile.Multi.Generic ( 1 )
20:09:46.0281 0x0f80 Detect skipped due to KSN trusted
20:09:46.0281 0x0f80 ws2ifsl - ok
20:09:46.0348 0x0f80 [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc C:\Windows\System32\wscsvc.dll
20:09:46.0389 0x0f80 wscsvc - ok
20:09:46.0435 0x0f80 [ 8D918B1DB190A4D9B1753A66FA8C96E8, DB7D2714DC04D2D6999A207D7399A5647C8653E5A1AD80856A65C5B6065AEDFE ] WSDPrintDevice C:\Windows\system32\DRIVERS\WSDPrint.sys
20:09:46.0436 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\WSDPrint.sys. md5: 8D918B1DB190A4D9B1753A66FA8C96E8, sha256: DB7D2714DC04D2D6999A207D7399A5647C8653E5A1AD80856A65C5B6065AEDFE
20:09:46.0436 0x0f80 WSDPrintDevice - detected LockedFile.Multi.Generic ( 1 )
20:09:49.0231 0x0f80 Detect skipped due to KSN trusted
20:09:49.0231 0x0f80 WSDPrintDevice - ok
20:09:49.0312 0x0f80 [ 4A2A5C50DD1A63577D3ACA94269FBC7F, F75C1906D431CF871AD954218DF32A0F206E45FF49332DEF9F13C0A36A407047 ] WSDScan C:\Windows\system32\DRIVERS\WSDScan.sys
20:09:49.0313 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\WSDScan.sys. md5: 4A2A5C50DD1A63577D3ACA94269FBC7F, sha256: F75C1906D431CF871AD954218DF32A0F206E45FF49332DEF9F13C0A36A407047
20:09:49.0313 0x0f80 WSDScan - detected LockedFile.Multi.Generic ( 1 )
20:09:52.0110 0x0f80 Detect skipped due to KSN trusted
20:09:52.0110 0x0f80 WSDScan - ok
20:09:52.0114 0x0f80 WSearch - ok
20:09:52.0285 0x0f80 [ D9EF901DCA379CFE914E9FA13B73B4C4, 3BE9693B7B2AFEE23D72AF5DA211379724D752F0EC18ACB7D3DE3DDFC5AE0004 ] wuauserv C:\Windows\system32\wuaueng.dll
20:09:52.0384 0x0f80 wuauserv - ok
20:09:52.0410 0x0f80 [ D3381DC54C34D79B22CEE0D65BA91B7C, 70DC4ADCA4C0C28BB133287511E329D1B6B9B97F96CDE5B1D2F1F59FE1A965D9 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
20:09:52.0410 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\drivers\WudfPf.sys. md5: D3381DC54C34D79B22CEE0D65BA91B7C, sha256: 70DC4ADCA4C0C28BB133287511E329D1B6B9B97F96CDE5B1D2F1F59FE1A965D9
20:09:52.0410 0x0f80 WudfPf - detected LockedFile.Multi.Generic ( 1 )
20:09:55.0394 0x0f80 Detect skipped due to KSN trusted
20:09:55.0394 0x0f80 WudfPf - ok
20:09:55.0501 0x0f80 [ CF8D590BE3373029D57AF80914190682, FB9641777E90A58C063FBE95F081DC6D2F4770827DE19108A9DC3E3D6B17B4BF ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
20:09:55.0502 0x0f80 Suspicious file ( NoAccess ): C:\Windows\system32\DRIVERS\WUDFRd.sys. md5: CF8D590BE3373029D57AF80914190682, sha256: FB9641777E90A58C063FBE95F081DC6D2F4770827DE19108A9DC3E3D6B17B4BF
20:09:55.0502 0x0f80 WUDFRd - detected LockedFile.Multi.Generic ( 1 )
20:09:58.0314 0x0f80 Detect skipped due to KSN trusted
20:09:58.0314 0x0f80 WUDFRd - ok
20:09:58.0397 0x0f80 [ 7A95C95B6C4CF292D689106BCAE49543, 9029F489E1E817CE12839B8C6656E46190497D445DC3F43C20CF96E5E6BD0691 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
20:09:58.0450 0x0f80 wudfsvc - ok
20:09:58.0481 0x0f80 [ 9A3452B3C2A46C073166C5CF49FAD1AE, D6F95F51D8E37BA4CF403965EC08CCFEEA9EEFDBFC7752432EAEC19925BDA115 ] WwanSvc C:\Windows\System32\wwansvc.dll
20:09:58.0515 0x0f80 WwanSvc - ok
20:09:58.0531 0x0f80 ================ Scan global ===============================
20:09:58.0557 0x0f80 [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
20:09:58.0591 0x0f80 [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
20:09:58.0623 0x0f80 [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
20:09:58.0658 0x0f80 [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
20:09:58.0687 0x0f80 [ 24ACB7E5BE595468E3B9AA488B9B4FCB, 63541E3432FCE953F266AE553E7A394978D6EE3DB52388D885F668CF42C5E7E2 ] C:\Windows\system32\services.exe
20:09:58.0698 0x0f80 [ Global ] - ok
20:09:58.0699 0x0f80 ================ Scan MBR ==================================
20:09:58.0711 0x0f80 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
20:09:59.0263 0x0f80 \Device\Harddisk0\DR0 - ok
20:09:59.0263 0x0f80 ================ Scan VBR ==================================
20:09:59.0267 0x0f80 [ 24BF7F780D3EE634DAB53EFDC1202BD1 ] \Device\Harddisk0\DR0\Partition1
20:09:59.0301 0x0f80 \Device\Harddisk0\DR0\Partition1 - ok
20:09:59.0328 0x0f80 [ EC6726C4FA42D14EDA4AB29ED4F49905 ] \Device\Harddisk0\DR0\Partition2
20:09:59.0346 0x0f80 \Device\Harddisk0\DR0\Partition2 - ok
20:09:59.0347 0x0f80 ================ Scan generic autorun ======================
20:09:59.0347 0x0f80 TPwrMain - ok
20:09:59.0350 0x0f80 TosWaitSrv - ok
20:09:59.0353 0x0f80 TosVolRegulator - ok
20:09:59.0356 0x0f80 Toshiba Registration - ok
20:09:59.0382 0x0f80 Teco - ok
20:09:59.0383 0x0f80 SynTPEnh - ok
20:09:59.0386 0x0f80 SmoothView - ok
20:09:59.0388 0x0f80 SmartFaceVWatcher - ok
20:09:59.0445 0x0f80 [ 5B3719BDBF1F035558F2D73BA166A99C, AA0A6B2C7B504637A77C31A1680245CEAE993417050B9A0D8595E3424BC2D57A ] C:\Program Files\CONEXANT\SAII\SAIICpl.exe
20:09:59.0470 0x0f80 SmartAudio - ok
20:09:59.0472 0x0f80 HSON - ok
20:09:59.0504 0x0f80 [ 24066DF5E85F6AF4A2013E70BF73423C, 9B4EFBF3FF194244F0D5C9128CF99EC7BCB1D62BE0975DA0F52816FF00EB0DB9 ] C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe
20:09:59.0524 0x0f80 cAudioFilterAgent - ok
20:09:59.0525 0x0f80 00TCrdMain - ok
20:09:59.0657 0x0f80 [ F7E0783DA9043BC131BB37C77EDB04DF, CD24E9B89789BE57230C52B24E63F29C6E650876E5FB0CB1304390B7E698FF93 ] C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe
20:09:59.0712 0x0f80 TWebCamera - ok
20:09:59.0765 0x0f80 [ 541B822882607023E75FFEC0C8F90FAF, 1D734219F99EE4FEDFD8D146DCA4733C8633540CF2613A6002363B0F69859687 ] C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
20:09:59.0795 0x0f80 ToshibaServiceStation - ok
20:09:59.0850 0x0f80 [ 21EE540CC1AC0F16E34BE3D84BF93269, 1A4F67879043DCD622F9280E359D9BB189EF1C2FF23FB101606808740EA25B42 ] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
20:09:59.0871 0x0f80 StartCCC - detected UnsignedFile.Multi.Generic ( 1 )
20:10:02.0682 0x0f80 Detect skipped due to KSN trusted
20:10:02.0683 0x0f80 StartCCC - ok
20:10:02.0979 0x0f80 [ D6FE9E0F705794A86F87A01B222290EF, 92EE74775E39B6CC83C5B8D80239D7C475825057E31CC3A8D85D152FD77F7F8A ] C:\Program Files\AVAST Software\Avast\AvastUI.exe
20:10:03.0115 0x0f80 AvastUI.exe - ok
20:10:03.0218 0x0f80 [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
20:10:03.0334 0x0f80 Sidebar - ok
20:10:03.0361 0x0f80 [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
20:10:03.0396 0x0f80 mctadmin - ok
20:10:03.0443 0x0f80 [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
20:10:03.0485 0x0f80 Sidebar - ok
20:10:03.0493 0x0f80 [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
20:10:03.0509 0x0f80 mctadmin - ok
20:10:03.0510 0x0f80 Waiting for KSN requests completion. In queue: 11
20:10:04.0510 0x0f80 Waiting for KSN requests completion. In queue: 11
20:10:05.0510 0x0f80 Waiting for KSN requests completion. In queue: 11
20:10:06.0510 0x0f80 Waiting for KSN requests completion. In queue: 5
20:10:07.0633 0x0f80 Win FW state via NFP2: enabled ( trusted )
20:10:10.0379 0x0f80 ============================================================
20:10:10.0379 0x0f80 Scan finished
20:10:10.0379 0x0f80 ============================================================
20:10:10.0392 0x07ec Detected object count: 1
20:10:10.0393 0x07ec Actual detected object count: 1
20:10:57.0764 0x07ec C:\Windows\System32\Drivers\a14f089ffbafdf69.sys - copied to quarantine
20:10:57.0772 0x07ec HKLM\SYSTEM\ControlSet001\services\a14f089ffbafdf69 - will be deleted on reboot
20:10:57.0788 0x07ec HKLM\SYSTEM\ControlSet002\services\a14f089ffbafdf69 - will be deleted on reboot
20:10:57.0949 0x07ec C:\Windows\System32\Drivers\a14f089ffbafdf69.sys - will be deleted on reboot
20:10:57.0949 0x07ec a14f089ffbafdf69 ( Rootkit.Win32.Necurs.gen ) - User select action: Delete
20:10:58.0145 0x07ec KLMD registered as C:\Windows\system32\drivers\60661574.sys
FRST FIXLOG
Rezultat naprawy Farbar Recovery Scan Tool (x64) Wersja:31-08-2015
Uruchomiony przez Bladowo (2015-09-02 20:18:16) Run:1
Uruchomiony z C:\Users\Bladowo\Desktop
Załadowane profile: Bladowo (Dostępne profile: Bladowo)
Tryb startu: Normal
==============================================
fixlist - zawartość:
*****************
CreateRestorePoint:
U5 a14f089ffbafdf69; C:\Windows\System32\Drivers\a14f089ffbafdf69.sys [60344 2014-05-25] () <===== UWAGA Necurs Rootkit?
U5 a14f089ffbafdf69; <===== UWAGA: Zablokowana usluga
S1 dnahlxbg; \??\C:\Windows\system32\drivers\dnahlxbg.sys [X]
C:\Windows\system32\drivers\dnahlxbg.sys
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers
*****************
Punkt przywracania został pomyślnie utworzony.
a14f089ffbafdf69 => serwis nie znaleziono.
a14f089ffbafdf69 => serwis nie znaleziono.
dnahlxbg => serwis pomyślnie usunięto
"C:\Windows\system32\drivers\dnahlxbg.sys" => plik/folder nie znaleziono.
========= RemoveProxy: =========
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wartość pomyślnie usunięto
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wartość pomyślnie usunięto
HKU\S-1-5-21-4061940706-3157505194-3058203634-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => Wartość pomyślnie usunięto
HKU\S-1-5-21-4061940706-3157505194-3058203634-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => Wartość pomyślnie usunięto
========= Koniec RemoveProxy: =========
========= bitsadmin /reset /allusers =========
BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
© Copyright 2000-2006 Microsoft Corp.
BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.
0 out of 0 jobs canceled.
========= Koniec CMD: =========
EmptyTemp: => 6.6 GB danych tymczasowych Usunięto.
System wymagał restartu..
==== Koniec Fixlog 20:20:06 ====