 :   Application
:      Microsoft-Windows-CAPI2
:          16.03.2014 2:22:00
 :   4097
 :
:       
 :
:  /
:     -
:
     :: : <CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US>;  SHA1: <E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46>.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-CAPI2" Guid="{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}" EventSourceName="Microsoft-Windows-CAPI2" />
    <EventID Qualifiers="0">4097</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8080000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T18:22:00.125597600Z" />
    <EventRecordID>5327</EventRecordID>
    <Correlation />
    <Execution ProcessID="960" ThreadID="1524" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US</Data>
    <Data>E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          16.03.2014 1:04:14
 :   903
 :
:       
 :
:  /
:     -
:
    .

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">903</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T17:04:14.000000000Z" />
    <EventRecordID>5326</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      SecurityCenter
:          16.03.2014 0:59:15
 :   1
 :
:       
 :
:  /
:     -
:
    Windows .
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="SecurityCenter" />
    <EventID Qualifiers="0">1</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:59:15.000000000Z" />
    <EventRecordID>5325</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          16.03.2014 0:59:14
 :   902
 :
:       
 :
:  /
:     -
:
    .
6.1.7601.17514
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">902</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:59:14.000000000Z" />
    <EventRecordID>5324</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>6.1.7601.17514</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          16.03.2014 0:59:14
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:59:14.000000000Z" />
    <EventRecordID>5323</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          16.03.2014 0:59:14
 :   1066
 :
:       
 :
:  /
:     -
:
   .
C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1066</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:59:14.000000000Z" />
    <EventRecordID>5322</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000
</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          16.03.2014 0:59:14
 :   900
 :
:       
 :
:  /
:     -
:
     .

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">900</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:59:14.000000000Z" />
    <EventRecordID>5321</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      gupdate
:          16.03.2014 0:59:13
 :   0
 :
:       
 :
:  /
:     -
:
       0   gupdate.            .       .

     , ,       .

     : 

Service stopped

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="gupdate" />
    <EventID Qualifiers="0">0</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:59:13.000000000Z" />
    <EventRecordID>5320</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Service stopped</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          16.03.2014 0:57:22
 :   1003
 : 
:       
 :
:  /
:     -
:
 Windows Search .

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:57:22.000000000Z" />
    <EventRecordID>5319</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">
    </Data>
  </EventData>
</Event>

 :   Application
:      ESENT
:          16.03.2014 0:57:22
 :   302
 : /
:       
 :
:  /
:     -
:
Windows (2208) Windows:    .
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="ESENT" />
    <EventID Qualifiers="0">302</EventID>
    <Level>4</Level>
    <Task>3</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:57:22.000000000Z" />
    <EventRecordID>5318</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Windows</Data>
    <Data>2208</Data>
    <Data>Windows: </Data>
  </EventData>
</Event>

 :   Application
:      ESENT
:          16.03.2014 0:57:21
 :   301
 : /
:       
 :
:  /
:     -
:
Windows (2208) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="ESENT" />
    <EventID Qualifiers="0">301</EventID>
    <Level>4</Level>
    <Task>3</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:57:21.000000000Z" />
    <EventRecordID>5317</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Windows</Data>
    <Data>2208</Data>
    <Data>Windows: </Data>
    <Data>C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log</Data>
  </EventData>
</Event>

 :   Application
:      ESENT
:          16.03.2014 0:57:21
 :   301
 : /
:       
 :
:  /
:     -
:
Windows (2208) Windows:      C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0005B.log.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="ESENT" />
    <EventID Qualifiers="0">301</EventID>
    <Level>4</Level>
    <Task>3</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:57:21.000000000Z" />
    <EventRecordID>5316</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Windows</Data>
    <Data>2208</Data>
    <Data>Windows: </Data>
    <Data>C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0005B.log</Data>
  </EventData>
</Event>

 :   Application
:      ESENT
:          16.03.2014 0:57:21
 :   300
 : /
:       
 :
:  /
:     -
:
Windows (2208) Windows:     .
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="ESENT" />
    <EventID Qualifiers="0">300</EventID>
    <Level>4</Level>
    <Task>3</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:57:21.000000000Z" />
    <EventRecordID>5315</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Windows</Data>
    <Data>2208</Data>
    <Data>Windows: </Data>
  </EventData>
</Event>

 :   Application
:      ESENT
:          16.03.2014 0:57:21
 :   102
 :
:       
 :
:  /
:     -
:
Windows (2208) Windows:   (6.01.7601.0000)    (0).
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="ESENT" />
    <EventID Qualifiers="0">102</EventID>
    <Level>4</Level>
    <Task>1</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:57:21.000000000Z" />
    <EventRecordID>5314</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Windows</Data>
    <Data>2208</Data>
    <Data>Windows: </Data>
    <Data>0</Data>
    <Data>6</Data>
    <Data>01</Data>
    <Data>7601</Data>
    <Data>0000</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-WMI
:          16.03.2014 0:57:17
 :   5617
 :
:       
 :
:  /
:     -
:
Windows Management Instrumentation Service subsystems initialized successfully
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />
    <EventID Qualifiers="49152">5617</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:57:17.000000000Z" />
    <EventRecordID>5313</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Winlogon
:          16.03.2014 0:57:12
 :   6000
 :
:       
 :
:  /
:     -
:
    -    winlogon <SessionEnv>.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />
    <EventID Qualifiers="32768">6000</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:57:12.000000000Z" />
    <EventRecordID>5312</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>SessionEnv</Data>
    <Binary>D9060000</Binary>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Winlogon
:          16.03.2014 0:57:12
 :   4101
 :
:       
 :
:  /
:     -
:
 Windows .
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Winlogon" />
    <EventID Qualifiers="16384">4101</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:57:12.000000000Z" />
    <EventRecordID>5311</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0x00000000</Data>
    <Data>0x00000001</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-WMI
:          16.03.2014 0:57:09
 :   5615
 :
:       
 :
:  /
:     -
:
Windows Management Instrumentation Service started sucessfully
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />
    <EventID Qualifiers="49152">5615</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:57:09.000000000Z" />
    <EventRecordID>5310</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      AdobeARMservice
:          16.03.2014 0:57:08
 :   0
 :
:       
 :
:  /
:     -
:
       0   AdobeARMservice.            .       .

     , ,       .

     : 

Service started

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="AdobeARMservice" />
    <EventID Qualifiers="0">0</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:57:08.000000000Z" />
    <EventRecordID>5309</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Service started</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-User Profiles Service
:          16.03.2014 0:57:02
 :   1531
 :
:       
 :
:  
:     -
:
    .  


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
    <EventID>1531</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:57:02.193627600Z" />
    <EventRecordID>5308</EventRecordID>
    <Correlation />
    <Execution ProcessID="876" ThreadID="108" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-EventSystem
:          16.03.2014 0:57:02
 :   4625
 :
:       
 :
:  /
:     -
:
 EventSystem        86400 .      REG_DWORD   SuppressDuplicateDuration    : HKLM\Software\Microsoft\EventSystem\EventLog.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-EventSystem" Guid="{899daace-4868-4295-afcd-9eb8fb497561}" EventSourceName="EventSystem" />
    <EventID Qualifiers="16384">4625</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:57:02.000000000Z" />
    <EventRecordID>5307</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">86400</Data>
    <Data Name="param2">SuppressDuplicateDuration</Data>
    <Data Name="param3">Software\Microsoft\EventSystem\EventLog</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-User Profiles Service
:          16.03.2014 0:56:21
 :   1532
 :
:       
 :
:  
:     -
:
   .  


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
    <EventID>1532</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:56:21.550868800Z" />
    <EventRecordID>5306</EventRecordID>
    <Correlation />
    <Execution ProcessID="792" ThreadID="816" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Winlogon
:          16.03.2014 0:56:21
 :   6000
 :
:       
 :
:  /
:     -
:
    -    winlogon <Wlansvc>.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />
    <EventID Qualifiers="32768">6000</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:56:21.000000000Z" />
    <EventRecordID>5305</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Wlansvc</Data>
    <Binary>D9060000</Binary>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Winlogon
:          16.03.2014 0:56:20
 :   6000
 :
:       
 :
:  /
:     -
:
    -    winlogon <GPClient>.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />
    <EventID Qualifiers="32768">6000</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:56:20.000000000Z" />
    <EventRecordID>5304</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>GPClient</Data>
    <Binary>D9060000</Binary>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Winlogon
:          16.03.2014 0:56:20
 :   6000
 :
:       
 :
:  /
:     -
:
    -    winlogon <SessionEnv>.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />
    <EventID Qualifiers="32768">6000</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:56:20.000000000Z" />
    <EventRecordID>5303</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>SessionEnv</Data>
    <Binary>D9060000</Binary>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Winlogon
:          16.03.2014 0:56:20
 :   6000
 :
:       
 :
:  /
:     -
:
    -    winlogon <Sens>.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />
    <EventID Qualifiers="32768">6000</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:56:20.000000000Z" />
    <EventRecordID>5302</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Sens</Data>
    <Binary>D9060000</Binary>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Winlogon
:          16.03.2014 0:56:20
 :   6000
 :
:       
 :
:  /
:     -
:
    -    winlogon <GPClient>.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />
    <EventID Qualifiers="32768">6000</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:56:20.000000000Z" />
    <EventRecordID>5301</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>GPClient</Data>
    <Binary>D9060000</Binary>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Winlogon
:          16.03.2014 0:53:26
 :   6000
 :
:       
 :
:  /
:     -
:
    -    winlogon <Sens>.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />
    <EventID Qualifiers="32768">6000</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:53:26.000000000Z" />
    <EventRecordID>5300</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Sens</Data>
    <Binary>D9060000</Binary>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Winlogon
:          16.03.2014 0:53:26
 :   6000
 :
:       
 :
:  /
:     -
:
    -    winlogon <GPClient>.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />
    <EventID Qualifiers="32768">6000</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:53:26.000000000Z" />
    <EventRecordID>5299</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>GPClient</Data>
    <Binary>D9060000</Binary>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Winlogon
:          16.03.2014 0:53:26
 :   6000
 :
:       
 :
:  /
:     -
:
    -    winlogon <SessionEnv>.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />
    <EventID Qualifiers="32768">6000</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:53:26.000000000Z" />
    <EventRecordID>5298</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>SessionEnv</Data>
    <Binary>D9060000</Binary>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-WMI
:          16.03.2014 0:53:23
 :   5617
 :
:       
 :
:  /
:     -
:
Windows Management Instrumentation Service subsystems initialized successfully
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />
    <EventID Qualifiers="49152">5617</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:53:23.000000000Z" />
    <EventRecordID>5297</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-User Profiles Service
:          16.03.2014 0:53:22
 :   1531
 :
:       
 :
:  
:     -
:
    .  


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
    <EventID>1531</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:53:22.136855600Z" />
    <EventRecordID>5296</EventRecordID>
    <Correlation />
    <Execution ProcessID="792" ThreadID="816" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      VSS
:          16.03.2014 0:53:22
 :   8211
 :
:       
 :
:  /
:     -
:
   :     WMI Writer   {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}     . 

:
     

:
      : {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
     : WMI Writer
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="VSS" />
    <EventID Qualifiers="0">8211</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:53:22.000000000Z" />
    <EventRecordID>5295</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>WMI Writer</Data>
    <Data>{a6ad56c2-b509-4e6c-bb19-49d8f43532f0}</Data>
    <Data>

:
     

:
      : {a6ad56c2-b509-4e6c-bb19-49d8f43532f0}
     : WMI Writer</Data>
    <Binary>2D20436F64653A20575254575254494330303030303834302D2043616C6C3A20575254575254494330303030303738332D205049443A202030303030303739322D205449443A202030303030303831322D20434D443A2020433A5C57696E646F77735C73797374656D33325C737663686F73742E657865202D6B206E6574737663732020202020202D20557365723A204E616D653A204E5420415554484F524954595C</Binary>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-WMI
:          16.03.2014 0:53:22
 :   5615
 :
:       
 :
:  /
:     -
:
Windows Management Instrumentation Service started sucessfully
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />
    <EventID Qualifiers="49152">5615</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:53:22.000000000Z" />
    <EventRecordID>5294</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-User Profiles Service
:          16.03.2014 0:52:18
 :   1532
 :
:       
 :
:  
:     -
:
   .  


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
    <EventID>1532</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:52:18.486000000Z" />
    <EventRecordID>5293</EventRecordID>
    <Correlation />
    <Execution ProcessID="916" ThreadID="300" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Winlogon
:          16.03.2014 0:52:16
 :   6000
 :
:       
 :
:  /
:     -
:
    -    winlogon <SessionEnv>.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />
    <EventID Qualifiers="32768">6000</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:52:16.000000000Z" />
    <EventRecordID>5292</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>SessionEnv</Data>
    <Binary>D9060000</Binary>
  </EventData>
</Event>

 :   Application
:      Desktop Window Manager
:          16.03.2014 0:52:16
 :   9009
 :
:       
 :
:  /
:     -
:
        (0x40010004)
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Desktop Window Manager" />
    <EventID Qualifiers="16384">9009</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:52:16.000000000Z" />
    <EventRecordID>5291</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0x40010004</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          16.03.2014 0:49:00
 :   902
 :
:       
 :
:  /
:     -
:
    .
6.1.7601.17514
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">902</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:49:00.000000000Z" />
    <EventRecordID>5290</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>6.1.7601.17514</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          16.03.2014 0:49:00
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:49:00.000000000Z" />
    <EventRecordID>5289</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          16.03.2014 0:48:59
 :   1066
 :
:       
 :
:  /
:     -
:
   .
C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1066</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:48:59.000000000Z" />
    <EventRecordID>5288</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000
</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          16.03.2014 0:48:59
 :   900
 :
:       
 :
:  /
:     -
:
     .

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">900</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:48:59.000000000Z" />
    <EventRecordID>5287</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          16.03.2014 0:47:40
 :   903
 :
:       
 :
:  /
:     -
:
    .

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">903</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:47:40.000000000Z" />
    <EventRecordID>5286</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          16.03.2014 0:42:39
 :   902
 :
:       
 :
:  /
:     -
:
    .
6.1.7601.17514
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">902</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:42:39.000000000Z" />
    <EventRecordID>5285</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>6.1.7601.17514</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          16.03.2014 0:42:39
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:42:39.000000000Z" />
    <EventRecordID>5284</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          16.03.2014 0:42:39
 :   1033
 :
:       
 :
:  /
:     -
:
  ,       override-only.
 =(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet-Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicensing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs-clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA) 
 =55c92734-d682-4d71-983e-d6ec3f16059f
 SKU=7cfd4696-69a9-4af7-af36-ff3d12b6b6c8
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1033</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:42:39.000000000Z" />
    <EventRecordID>5283</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet-Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicensing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs-clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA) </Data>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>7cfd4696-69a9-4af7-af36-ff3d12b6b6c8</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          16.03.2014 0:42:37
 :   1066
 :
:       
 :
:  /
:     -
:
   .
C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1066</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:42:37.000000000Z" />
    <EventRecordID>5282</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000
</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          16.03.2014 0:42:36
 :   900
 :
:       
 :
:  /
:     -
:
     .

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">900</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:42:36.000000000Z" />
    <EventRecordID>5281</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      VSS
:          16.03.2014 0:37:45
 :   8224
 :
:       
 :
:  /
:     -
:
 VSS  - - . 
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="VSS" />
    <EventID Qualifiers="0">8224</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:37:45.000000000Z" />
    <EventRecordID>5280</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Binary>2D20436F64653A2020434F525356434330303030303737332D2043616C6C3A2020434F525356434330303030303735352D205049443A202030303030333134342D205449443A202030303030323634342D20434D443A2020433A5C57696E646F77735C73797374656D33325C76737376632E6578652020202D20557365723A204E616D653A204E5420415554484F524954595C</Binary>
  </EventData>
</Event>

 :   Application
:      System Restore
:          16.03.2014 0:34:27
 :   8194
 :
:       
 :
:  /
:     -
:
    ( = C:\Windows\system32\svchost.exe -k netsvcs;  =   Windows).
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="System Restore" />
    <EventID Qualifiers="0">8194</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:34:27.000000000Z" />
    <EventRecordID>5279</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>C:\Windows\system32\svchost.exe -k netsvcs</Data>
    <Data>  Windows</Data>
    <Binary>00000000A1010000970100000000000022CE28677C6DDA79E28C1C000000000000000000</Binary>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Winlogon
:          16.03.2014 0:30:44
 :   6000
 :
:       
 :
:  /
:     -
:
    -    winlogon <SessionEnv>.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />
    <EventID Qualifiers="32768">6000</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:30:44.000000000Z" />
    <EventRecordID>5278</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>SessionEnv</Data>
    <Binary>D9060000</Binary>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Winlogon
:          16.03.2014 0:30:44
 :   4101
 :
:       
 :
:  /
:     -
:
 Windows .
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Winlogon" />
    <EventID Qualifiers="16384">4101</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:30:44.000000000Z" />
    <EventRecordID>5277</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0x00000000</Data>
    <Data>0x00000001</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Winlogon
:          16.03.2014 0:30:39
 :   6000
 :
:       
 :
:  /
:     -
:
    -    winlogon <SessionEnv>.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />
    <EventID Qualifiers="32768">6000</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:30:39.000000000Z" />
    <EventRecordID>5276</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>SessionEnv</Data>
    <Binary>D9060000</Binary>
  </EventData>
</Event>

 :   Application
:      Desktop Window Manager
:          16.03.2014 0:30:39
 :   9009
 :
:       
 :
:  /
:     -
:
        (0x40010004)
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Desktop Window Manager" />
    <EventID Qualifiers="16384">9009</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:30:39.000000000Z" />
    <EventRecordID>5275</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0x40010004</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          16.03.2014 0:16:40
 :   3036
 :  
:       
 :
:  /
:     -
:
    <csc://{S-1-5-21-3368229806-3106785895-14530972-1003}/> .

:  "Windows",  "SystemIndex"

:
	(HRESULT : 0x80004005) (0x80004005)

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="32768">3036</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:16:40.000000000Z" />
    <EventRecordID>5274</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">

:  "Windows",  "SystemIndex"

:
	(HRESULT : 0x80004005) (0x80004005)
</Data>
    <Data Name="URL">csc://{S-1-5-21-3368229806-3106785895-14530972-1003}/</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          16.03.2014 0:16:40
 :   3036
 :  
:       
 :
:  /
:     -
:
    <iehistory://{S-1-5-21-3368229806-3106785895-14530972-1003}/> .

:  "Windows",  "SystemIndex"

:
	(HRESULT : 0x80004005) (0x80004005)

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="32768">3036</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T16:16:40.000000000Z" />
    <EventRecordID>5273</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">

:  "Windows",  "SystemIndex"

:
	(HRESULT : 0x80004005) (0x80004005)
</Data>
    <Data Name="URL">iehistory://{S-1-5-21-3368229806-3106785895-14530972-1003}/</Data>
  </EventData>
</Event>

 :   Application
:      gupdate
:          15.03.2014 23:24:37
 :   0
 :
:       
 :
:  /
:     -
:
       0   gupdate.            .       .

     , ,       .

     : 

Service stopped

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="gupdate" />
    <EventID Qualifiers="0">0</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:24:37.000000000Z" />
    <EventRecordID>5272</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Service stopped</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-RestartManager
:          15.03.2014 23:24:02
 :   10001
 :
:       
 :
:  
:     -
:
  0,  ?2014?-?03?-?15T15:24:01.161240900Z.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-RestartManager" Guid="{0888E5EF-9B98-4695-979D-E92CE4247224}" />
    <EventID>10001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:24:02.730330700Z" />
    <EventRecordID>5271</EventRecordID>
    <Correlation />
    <Execution ProcessID="3444" ThreadID="3756" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <RmSessionEvent xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://www.microsoft.com/2005/08/Windows/Reliability/RestartManager/">
      <RmSessionId>0</RmSessionId>
      <UTCStartTime>2014-03-15T15:24:01.161240900Z</UTCStartTime>
    </RmSessionEvent>
  </UserData>
</Event>

 :   Application
:      MsiInstaller
:          15.03.2014 23:24:02
 :   1042
 :
:       
 :
:  
:     -
:
   Windows: C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleUpdateHelper.msi.   : 3656.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MsiInstaller" />
    <EventID Qualifiers="0">1042</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:24:02.000000000Z" />
    <EventRecordID>5270</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data>C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleUpdateHelper.msi</Data>
    <Data>3656</Data>
    <Data>(NULL)</Data>
    <Data>(NULL)</Data>
    <Data>(NULL)</Data>
    <Data>(NULL)</Data>
    <Data>
    </Data>
  </EventData>
</Event>

 :   Application
:      MsiInstaller
:          15.03.2014 23:24:02
 :   1033
 :
:       
 :
:  
:     -
:
 Windows   . : Google Update Helper. : 1.3.22.5. : 1033. : Google Inc..    : 0.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MsiInstaller" />
    <EventID Qualifiers="0">1033</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:24:02.000000000Z" />
    <EventRecordID>5269</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data>Google Update Helper</Data>
    <Data>1.3.22.5</Data>
    <Data>1033</Data>
    <Data>0</Data>
    <Data>Google Inc.</Data>
    <Data>(NULL)</Data>
    <Data>
    </Data>
    <Binary>7B41393244414233392D344532432D343330342D394142362D4243343445363842353545327D3030303036343132313565646263386566316564343933323239353832366138376662633030303030393034</Binary>
  </EventData>
</Event>

 :   Application
:      MsiInstaller
:          15.03.2014 23:24:02
 :   11707
 :
:       
 :
:  
:     -
:
Product: Google Update Helper -- Installation completed successfully.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MsiInstaller" />
    <EventID Qualifiers="0">11707</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:24:02.000000000Z" />
    <EventRecordID>5268</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data>Product: Google Update Helper -- Installation completed successfully.</Data>
    <Data>(NULL)</Data>
    <Data>(NULL)</Data>
    <Data>(NULL)</Data>
    <Data>(NULL)</Data>
    <Data>(NULL)</Data>
    <Data>
    </Data>
    <Binary>7B41393244414233392D344532432D343330342D394142362D4243343445363842353545327D</Binary>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-RestartManager
:          15.03.2014 23:24:01
 :   10000
 :
:       
 :
:  
:     -
:
  0 - ?2014?-?03?-?15T15:24:01.161240900Z.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-RestartManager" Guid="{0888E5EF-9B98-4695-979D-E92CE4247224}" />
    <EventID>10000</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:24:01.161240900Z" />
    <EventRecordID>5267</EventRecordID>
    <Correlation />
    <Execution ProcessID="3444" ThreadID="3104" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <RmSessionEvent xmlns:auto-ns2="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://www.microsoft.com/2005/08/Windows/Reliability/RestartManager/">
      <RmSessionId>0</RmSessionId>
      <UTCStartTime>2014-03-15T15:24:01.161240900Z</UTCStartTime>
    </RmSessionEvent>
  </UserData>
</Event>

 :   Application
:      MsiInstaller
:          15.03.2014 23:24:00
 :   1040
 :
:       
 :
:  
:     -
:
   Windows: C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleUpdateHelper.msi.   : 3656.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="MsiInstaller" />
    <EventID Qualifiers="0">1040</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:24:00.000000000Z" />
    <EventRecordID>5266</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data>C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleUpdateHelper.msi</Data>
    <Data>3656</Data>
    <Data>(NULL)</Data>
    <Data>(NULL)</Data>
    <Data>(NULL)</Data>
    <Data>(NULL)</Data>
    <Data>
    </Data>
  </EventData>
</Event>

 :   Application
:      gupdate
:          15.03.2014 23:20:53
 :   0
 :
:       
 :
:  /
:     -
:
       0   gupdate.            .       .

     , ,       .

     : 

Service stopped

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="gupdate" />
    <EventID Qualifiers="0">0</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:20:53.000000000Z" />
    <EventRecordID>5265</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Service stopped</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:20:30
 :   903
 :
:       
 :
:  /
:     -
:
    .

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">903</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:20:30.000000000Z" />
    <EventRecordID>5264</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          15.03.2014 23:16:38
 :   3036
 :  
:       
 :
:  /
:     -
:
    <csc://{S-1-5-21-3368229806-3106785895-14530972-1003}/> .

:  "Windows",  "SystemIndex"

:
	(HRESULT : 0x80004005) (0x80004005)

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="32768">3036</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:16:38.000000000Z" />
    <EventRecordID>5263</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">

:  "Windows",  "SystemIndex"

:
	(HRESULT : 0x80004005) (0x80004005)
</Data>
    <Data Name="URL">csc://{S-1-5-21-3368229806-3106785895-14530972-1003}/</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          15.03.2014 23:16:38
 :   3036
 :  
:       
 :
:  /
:     -
:
    <csc://{S-1-5-21-3368229806-3106785895-14530972-1003}/> .

:  "Windows",  "SystemIndex"

:
	(HRESULT : 0x80004005) (0x80004005)

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="32768">3036</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:16:38.000000000Z" />
    <EventRecordID>5262</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">

:  "Windows",  "SystemIndex"

:
	(HRESULT : 0x80004005) (0x80004005)
</Data>
    <Data Name="URL">csc://{S-1-5-21-3368229806-3106785895-14530972-1003}/</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          15.03.2014 23:16:38
 :   3036
 :  
:       
 :
:  /
:     -
:
    <iehistory://{S-1-5-21-3368229806-3106785895-14530972-1003}/> .

:  "Windows",  "SystemIndex"

:
	(HRESULT : 0x80004005) (0x80004005)

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="32768">3036</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:16:38.000000000Z" />
    <EventRecordID>5261</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">

:  "Windows",  "SystemIndex"

:
	(HRESULT : 0x80004005) (0x80004005)
</Data>
    <Data Name="URL">iehistory://{S-1-5-21-3368229806-3106785895-14530972-1003}/</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          15.03.2014 23:16:38
 :   3036
 :  
:       
 :
:  /
:     -
:
    <iehistory://{S-1-5-21-3368229806-3106785895-14530972-1003}/> .

:  "Windows",  "SystemIndex"

:
	(HRESULT : 0x80004005) (0x80004005)

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="32768">3036</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:16:38.000000000Z" />
    <EventRecordID>5260</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">

:  "Windows",  "SystemIndex"

:
	(HRESULT : 0x80004005) (0x80004005)
</Data>
    <Data Name="URL">iehistory://{S-1-5-21-3368229806-3106785895-14530972-1003}/</Data>
  </EventData>
</Event>

 :   Application
:      SecurityCenter
:          15.03.2014 23:14:39
 :   1
 :
:       
 :
:  /
:     -
:
    Windows .
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="SecurityCenter" />
    <EventID Qualifiers="0">1</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:14:39.000000000Z" />
    <EventRecordID>5259</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          15.03.2014 23:13:37
 :   1003
 : 
:       
 :
:  /
:     -
:
 Windows Search .

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:13:37.000000000Z" />
    <EventRecordID>5258</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">
    </Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          15.03.2014 23:13:37
 :   1005
 : 
:       
 :
:  /
:     -
:
 Windows Search     . 

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="16384">1005</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:13:37.000000000Z" />
    <EventRecordID>5257</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">
    </Data>
  </EventData>
</Event>

 :   Application
:      ESENT
:          15.03.2014 23:13:30
 :   102
 :
:       
 :
:  /
:     -
:
Windows (2672) Windows:   (6.01.7601.0000)    (0).
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="ESENT" />
    <EventID Qualifiers="0">102</EventID>
    <Level>4</Level>
    <Task>1</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:13:30.000000000Z" />
    <EventRecordID>5256</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Windows</Data>
    <Data>2672</Data>
    <Data>Windows: </Data>
    <Data>0</Data>
    <Data>6</Data>
    <Data>01</Data>
    <Data>7601</Data>
    <Data>0000</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          15.03.2014 23:13:28
 :   1004
 : 
:       
 :
:  /
:     -
:
 Windows Search     (:  ). 

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="16384">1004</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:13:28.000000000Z" />
    <EventRecordID>5255</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">
    </Data>
    <Data Name="Reason"> </Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          15.03.2014 23:13:28
 :   1010
 : 
:       
 :
:  /
:     -
:
 Windows Search     . 

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="16384">1010</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:13:28.000000000Z" />
    <EventRecordID>5254</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">
    </Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          15.03.2014 23:13:28
 :   1008
 : 
:       
 :
:  /
:     -
:
 Windows Search        (:  ). 

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="32768">1008</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:13:28.000000000Z" />
    <EventRecordID>5253</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">
    </Data>
    <Data Name="Reason"> </Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          15.03.2014 23:12:58
 :   1013
 : 
:       
 :
:  /
:     -
:
 Windows Search  .

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="16384">1013</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:58.000000000Z" />
    <EventRecordID>5252</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">
    </Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          15.03.2014 23:12:58
 :   7010
 :  
:       
 :
:  /
:     -
:
  .

:
	   .  (HRESULT : 0xc0041801) (0xc0041801)

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="49152">7010</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:58.000000000Z" />
    <EventRecordID>5251</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">

:
	   .  (HRESULT : 0xc0041801) (0xc0041801)
</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          15.03.2014 23:12:58
 :   3058
 :  
:       
 :
:  /
:     -
:
   .

:  "Windows"

:
	   .  (HRESULT : 0xc0041801) (0xc0041801)

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="49152">3058</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:58.000000000Z" />
    <EventRecordID>5250</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">

:  "Windows"

:
	   .  (HRESULT : 0xc0041801) (0xc0041801)
</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          15.03.2014 23:12:58
 :   3028
 :  
:       
 :
:  /
:     -
:
      .

:  "Windows",  "SystemIndex"

:
	   .  (HRESULT : 0xc0041801) (0xc0041801)

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="49152">3028</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:58.000000000Z" />
    <EventRecordID>5249</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">

:  "Windows",  "SystemIndex"

:
	   .  (HRESULT : 0xc0041801) (0xc0041801)
</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          15.03.2014 23:12:58
 :   3029
 :  
:       
 :
:  /
:     -
:
      <Search.TripoliIndexer>.

:  "Windows",  "SystemIndex"

:
	  .  (HRESULT : 0x80070490) (0x80070490)

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="49152">3029</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:58.000000000Z" />
    <EventRecordID>5248</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">

:  "Windows",  "SystemIndex"

:
	  .  (HRESULT : 0x80070490) (0x80070490)
</Data>
    <Data Name="Plugin">Search.TripoliIndexer</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          15.03.2014 23:12:57
 :   3029
 :  
:       
 :
:  /
:     -
:
      <Search.JetPropStore>.

:  "Windows",  "SystemIndex"

:
	   .  (HRESULT : 0xc0041801) (0xc0041801)

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="49152">3029</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:57.000000000Z" />
    <EventRecordID>5247</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">

:  "Windows",  "SystemIndex"

:
	   .  (HRESULT : 0xc0041801) (0xc0041801)
</Data>
    <Data Name="Plugin">Search.JetPropStore</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          15.03.2014 23:12:57
 :   9002
 : 
:       
 :
:  /
:     -
:
 Windows Search       .

:  "Windows",  "SystemIndex"

:
	    .  (HRESULT : 0xc0041800) (0xc0041800)

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="49152">9002</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:57.000000000Z" />
    <EventRecordID>5246</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">

:  "Windows",  "SystemIndex"

:
	    .  (HRESULT : 0xc0041800) (0xc0041800)
</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          15.03.2014 23:12:57
 :   7042
 :  
:       
 :
:  /
:     -
:
  Windows Search  -   : The catalog is corrupt.

:
	   .  (HRESULT : 0xc0041801) (0xc0041801)

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="16384">7042</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:57.000000000Z" />
    <EventRecordID>5245</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">

:
	   .  (HRESULT : 0xc0041801) (0xc0041801)
</Data>
    <Data Name="Reason">The catalog is corrupt</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          15.03.2014 23:12:57
 :   7040
 :  
:       
 :
:  /
:     -
:
        {=4700}.          .

:
	   .  (HRESULT : 0xc0041801) (0xc0041801)

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="49152">7040</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:57.000000000Z" />
    <EventRecordID>5244</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">

:
	   .  (HRESULT : 0xc0041801) (0xc0041801)
</Data>
    <Data Name="CorruptionId">4700</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Search
:          15.03.2014 23:12:57
 :   9000
 :  
:       
 :
:  /
:     -
:
 Windows Search      Jet.

:
	0x%08x (0xc0041800 -     .  (HRESULT : 0xc0041800))

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Search" Guid="{CA4E628D-8567-4896-AB6B-835B221F373F}" EventSourceName="Windows Search Service" />
    <EventID Qualifiers="49152">9000</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:57.000000000Z" />
    <EventRecordID>5243</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="ExtraInfo">

:
	0x%08x (0xc0041800 -     .  (HRESULT : 0xc0041800))
</Data>
  </EventData>
</Event>

 :   Application
:      ESENT
:          15.03.2014 23:12:57
 :   455
 : /
:       
 :
:  /
:     -
:
Windows (2128) Windows:  -1811     C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0006F.log.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="ESENT" />
    <EventID Qualifiers="0">455</EventID>
    <Level>2</Level>
    <Task>3</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:57.000000000Z" />
    <EventRecordID>5242</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Windows</Data>
    <Data>2128</Data>
    <Data>Windows: </Data>
    <Data>C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0006F.log</Data>
    <Data>-1811</Data>
  </EventData>
</Event>

 :   Application
:      ESENT
:          15.03.2014 23:12:57
 :   102
 :
:       
 :
:  /
:     -
:
Windows (2128) Windows:   (6.01.7601.0000)    (0).
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="ESENT" />
    <EventID Qualifiers="0">102</EventID>
    <Level>4</Level>
    <Task>1</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:57.000000000Z" />
    <EventRecordID>5241</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Windows</Data>
    <Data>2128</Data>
    <Data>Windows: </Data>
    <Data>0</Data>
    <Data>6</Data>
    <Data>01</Data>
    <Data>7601</Data>
    <Data>0000</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Winlogon
:          15.03.2014 23:12:49
 :   6000
 :
:       
 :
:  /
:     -
:
    -    winlogon <SessionEnv>.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />
    <EventID Qualifiers="32768">6000</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:49.000000000Z" />
    <EventRecordID>5240</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>SessionEnv</Data>
    <Binary>D9060000</Binary>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Winlogon
:          15.03.2014 23:12:49
 :   4101
 :
:       
 :
:  /
:     -
:
 Windows .
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Winlogon" />
    <EventID Qualifiers="16384">4101</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:49.000000000Z" />
    <EventRecordID>5239</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0x00000000</Data>
    <Data>0x00000001</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:12:48
 :   902
 :
:       
 :
:  /
:     -
:
    .
6.1.7601.17514
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">902</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:48.000000000Z" />
    <EventRecordID>5238</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>6.1.7601.17514</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:12:48
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:48.000000000Z" />
    <EventRecordID>5237</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0x00000000, 1, 0], [(?)(?)( 1 0x00000000 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 )]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:12:48
 :   1033
 :
:       
 :
:  /
:     -
:
  ,       override-only.
 =(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet-Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicensing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs-clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA) 
 =55c92734-d682-4d71-983e-d6ec3f16059f
 SKU=7cfd4696-69a9-4af7-af36-ff3d12b6b6c8
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1033</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:48.000000000Z" />
    <EventRecordID>5236</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet-Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicensing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs-clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA) </Data>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>7cfd4696-69a9-4af7-af36-ff3d12b6b6c8</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:12:48
 :   1066
 :
:       
 :
:  /
:     -
:
   .
C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1066</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:48.000000000Z" />
    <EventRecordID>5235</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000
</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:12:47
 :   900
 :
:       
 :
:  /
:     -
:
     .

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">900</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:47.000000000Z" />
    <EventRecordID>5234</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Winlogon
:          15.03.2014 23:12:46
 :   4105
 :
:       
 :
:  /
:     -
:
Windows    .
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Winlogon" />
    <EventID Qualifiers="32768">4105</EventID>
    <Version>0</Version>
    <Level>3</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:46.000000000Z" />
    <EventRecordID>5233</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0x00000000</Data>
    <Data>0x00000000</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-WMI
:          15.03.2014 23:12:38
 :   5617
 :
:       
 :
:  /
:     -
:
Windows Management Instrumentation Service subsystems initialized successfully
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />
    <EventID Qualifiers="49152">5617</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:38.000000000Z" />
    <EventRecordID>5232</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-WMI
:          15.03.2014 23:12:37
 :   5615
 :
:       
 :
:  /
:     -
:
Windows Management Instrumentation Service started sucessfully
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />
    <EventID Qualifiers="49152">5615</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:37.000000000Z" />
    <EventRecordID>5231</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      AdobeARMservice
:          15.03.2014 23:12:35
 :   0
 :
:       
 :
:  /
:     -
:
       0   AdobeARMservice.            .       .

     , ,       .

     : 

Service started

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="AdobeARMservice" />
    <EventID Qualifiers="0">0</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:35.000000000Z" />
    <EventRecordID>5230</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Service started</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-User Profiles Service
:          15.03.2014 23:12:29
 :   1531
 :
:       
 :
:  
:     -
:
    .  


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
    <EventID>1531</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:29.768847900Z" />
    <EventRecordID>5229</EventRecordID>
    <Correlation />
    <Execution ProcessID="916" ThreadID="300" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-User Profiles Service
:          15.03.2014 23:11:34
 :   1532
 :
:       
 :
:  
:     -
:
   .  


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-User Profiles Service" Guid="{89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}" />
    <EventID>1532</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:34.857690600Z" />
    <EventRecordID>5228</EventRecordID>
    <Correlation />
    <Execution ProcessID="888" ThreadID="276" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-EventSystem
:          15.03.2014 23:12:29
 :   4625
 :
:       
 :
:  /
:     -
:
 EventSystem        86400 .      REG_DWORD   SuppressDuplicateDuration    : HKLM\Software\Microsoft\EventSystem\EventLog.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-EventSystem" Guid="{899daace-4868-4295-afcd-9eb8fb497561}" EventSourceName="EventSystem" />
    <EventID Qualifiers="16384">4625</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:12:29.000000000Z" />
    <EventRecordID>5227</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="param1">86400</Data>
    <Data Name="param2">SuppressDuplicateDuration</Data>
    <Data Name="param3">Software\Microsoft\EventSystem\EventLog</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Winlogon
:          15.03.2014 23:11:32
 :   6000
 :
:       
 :
:  /
:     -
:
    -    winlogon <SessionEnv>.
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Winlogon" Guid="{DBE9B383-7CF3-4331-91CC-A3CB16A3B538}" EventSourceName="Wlclntfy" />
    <EventID Qualifiers="32768">6000</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:32.000000000Z" />
    <EventRecordID>5226</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>SessionEnv</Data>
    <Binary>D9060000</Binary>
  </EventData>
</Event>

 :   Application
:      Desktop Window Manager
:          15.03.2014 23:11:32
 :   9009
 :
:       
 :
:  /
:     -
:
        (0x40010004)
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Desktop Window Manager" />
    <EventID Qualifiers="16384">9009</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:32.000000000Z" />
    <EventRecordID>5225</EventRecordID>
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0x40010004</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:19
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 0], [( 5 0xC004F009 30 0)( 5 0xC004F009 30 0)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)( 9 0x00000000 0xC004F057)])]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:19.000000000Z" />
    <EventRecordID>5224</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 0], [( 5 0xC004F009 30 0)( 5 0xC004F009 30 0)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)( 9 0x00000000 0xC004F057)])]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:19
 :   1033
 :
:       
 :
:  /
:     -
:
  ,       override-only.
 =(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet-Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicensing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs-clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA) 
 =55c92734-d682-4d71-983e-d6ec3f16059f
 SKU=7cfd4696-69a9-4af7-af36-ff3d12b6b6c8
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1033</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:19.000000000Z" />
    <EventRecordID>5223</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet-Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicensing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs-clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA) </Data>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>7cfd4696-69a9-4af7-af36-ff3d12b6b6c8</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:18
 :   1004
 :
:       
 :
:  /
:     -
:
      .
 =OEM Certificate
 =ecb4ab2f-58a3-4455-b95a-3b5822561c2a
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1004</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:18.000000000Z" />
    <EventRecordID>5222</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>OEM Certificate</Data>
    <Data>ecb4ab2f-58a3-4455-b95a-3b5822561c2a</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:17
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:17.000000000Z" />
    <EventRecordID>5221</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:17
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:17.000000000Z" />
    <EventRecordID>5220</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:16
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:16.000000000Z" />
    <EventRecordID>5219</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:16
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:16.000000000Z" />
    <EventRecordID>5218</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:16
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 0], [( 5 0xC004F009 30 0)( 5 0xC004F009 30 0)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)( 9 0x00000000 0xC004F057)])]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:16.000000000Z" />
    <EventRecordID>5217</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 0], [( 5 0xC004F009 30 0)( 5 0xC004F009 30 0)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)( 9 0x00000000 0xC004F057)])]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:16
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:16.000000000Z" />
    <EventRecordID>5216</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:15
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:15.000000000Z" />
    <EventRecordID>5215</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:15
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:15.000000000Z" />
    <EventRecordID>5214</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:15
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 0], [( 5 0xC004F009 30 0)( 5 0xC004F009 30 0)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)( 9 0x00000000 0xC004F057)])]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:15.000000000Z" />
    <EventRecordID>5213</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 0], [( 5 0xC004F009 30 0)( 5 0xC004F009 30 0)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)( 9 0x00000000 0xC004F057)])]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:14
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:14.000000000Z" />
    <EventRecordID>5212</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:14
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 0], [( 5 0xC004F009 30 0)( 5 0xC004F009 30 0)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)( 9 0x00000000 0xC004F057)])]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:14.000000000Z" />
    <EventRecordID>5211</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 0], [( 5 0xC004F009 30 0)( 5 0xC004F009 30 0)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)( 9 0x00000000 0xC004F057)])]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:14
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:14.000000000Z" />
    <EventRecordID>5210</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:13
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:13.000000000Z" />
    <EventRecordID>5209</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:13
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 0], [( 5 0xC004F009 30 0)( 5 0xC004F009 30 0)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)( 9 0x00000000 0xC004F057)])]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:13.000000000Z" />
    <EventRecordID>5208</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 0], [( 5 0xC004F009 30 0)( 5 0xC004F009 30 0)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)( 9 0x00000000 0xC004F057)])]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:13
 :   1033
 :
:       
 :
:  /
:     -
:
  ,       override-only.
 =(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet-Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicensing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs-clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA) 
 =55c92734-d682-4d71-983e-d6ec3f16059f
 SKU=7cfd4696-69a9-4af7-af36-ff3d12b6b6c8
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1033</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:13.000000000Z" />
    <EventRecordID>5207</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet-Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicensing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs-clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA) </Data>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>7cfd4696-69a9-4af7-af36-ff3d12b6b6c8</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:13
 :   1004
 :
:       
 :
:  /
:     -
:
      .
 =OEM Certificate
 =ecb4ab2f-58a3-4455-b95a-3b5822561c2a
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1004</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:13.000000000Z" />
    <EventRecordID>5206</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>OEM Certificate</Data>
    <Data>ecb4ab2f-58a3-4455-b95a-3b5822561c2a</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:12
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:12.000000000Z" />
    <EventRecordID>5205</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:12
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:12.000000000Z" />
    <EventRecordID>5204</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:12
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:12.000000000Z" />
    <EventRecordID>5203</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:12
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:12.000000000Z" />
    <EventRecordID>5202</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:11
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 0], [( 5 0xC004F009 30 0)( 5 0xC004F009 30 0)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)( 9 0x00000000 0xC004F057)])]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:11.000000000Z" />
    <EventRecordID>5201</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 0], [( 5 0xC004F009 30 0)( 5 0xC004F009 30 0)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)( 9 0x00000000 0xC004F057)])]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:11
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:11.000000000Z" />
    <EventRecordID>5200</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:11
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:11.000000000Z" />
    <EventRecordID>5199</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:10
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:10.000000000Z" />
    <EventRecordID>5198</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:10
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 0], [( 5 0xC004F009 30 0)( 5 0xC004F009 30 0)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)( 9 0x00000000 0xC004F057)])]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:10.000000000Z" />
    <EventRecordID>5197</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 0], [( 5 0xC004F009 30 0)( 5 0xC004F009 30 0)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)( 9 0x00000000 0xC004F057)])]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:10
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:10.000000000Z" />
    <EventRecordID>5196</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:09
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 0], [( 5 0xC004F009 30 0)( 5 0xC004F009 30 0)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)( 9 0x00000000 0xC004F057)])]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:09.000000000Z" />
    <EventRecordID>5195</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 1 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 0], [( 5 0xC004F009 30 0)( 5 0xC004F009 30 0)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)( 9 0x00000000 0xC004F057)])]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:09
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:09.000000000Z" />
    <EventRecordID>5194</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:09
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:09.000000000Z" />
    <EventRecordID>5193</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:08
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 0], [( 5 0xC004F009 30 0)( 5 0xC004F009 30 0)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)( 9 0x00000000 0xC004F057)])]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:08.000000000Z" />
    <EventRecordID>5192</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 0], [( 5 0xC004F009 30 0)( 5 0xC004F009 30 0)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)( 9 0x00000000 0xC004F057)])]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:08
 :   1033
 :
:       
 :
:  /
:     -
:
  ,       override-only.
 =(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet-Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicensing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs-clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA) 
 =55c92734-d682-4d71-983e-d6ec3f16059f
 SKU=7cfd4696-69a9-4af7-af36-ff3d12b6b6c8
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1033</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:08.000000000Z" />
    <EventRecordID>5191</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet-Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicensing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs-clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA) </Data>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>7cfd4696-69a9-4af7-af36-ff3d12b6b6c8</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:11:08
 :   1016
 :
:       
 :
:  /
:     -
:
     . 
ACID=7cfd4696-69a9-4af7-af36-ff3d12b6b6c8
PKeyId=04178a39-62a0-a1e9-fdf9-2e14e334386e
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1016</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:11:08.000000000Z" />
    <EventRecordID>5190</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>7cfd4696-69a9-4af7-af36-ff3d12b6b6c8</Data>
    <Data>04178a39-62a0-a1e9-fdf9-2e14e334386e</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:10:49
 :   1017
 :
:       
 :
:  /
:     -
:
      . 0xC004F015
 Pkey=H9DH4
ACID=46bbed08-9c7b-48fc-a614-95250573f4ea
  [?]

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="32768">1017</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:10:49.000000000Z" />
    <EventRecordID>5189</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0xC004F015</Data>
    <Data>H9DH4</Data>
    <Data>46bbed08-9c7b-48fc-a614-95250573f4ea</Data>
    <Data>?</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:10:37
 :   1017
 :
:       
 :
:  /
:     -
:
      . 0xC004F015
 Pkey=XCKRJ
ACID=1cb6d605-11b3-4e14-bb30-da91c8e3983a
  [?]

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="32768">1017</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:10:37.000000000Z" />
    <EventRecordID>5188</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0xC004F015</Data>
    <Data>XCKRJ</Data>
    <Data>1cb6d605-11b3-4e14-bb30-da91c8e3983a</Data>
    <Data>?</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:10:24
 :   1017
 :
:       
 :
:  /
:     -
:
      . 0xC004F015
 Pkey=HVTHH
ACID=ae2ee509-1b34-41c0-acb7-6d4650168915
  [?]

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="32768">1017</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:10:24.000000000Z" />
    <EventRecordID>5187</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0xC004F015</Data>
    <Data>HVTHH</Data>
    <Data>ae2ee509-1b34-41c0-acb7-6d4650168915</Data>
    <Data>?</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:10:11
 :   1017
 :
:       
 :
:  /
:     -
:
      . 0xC004F015
 Pkey=QY7MG
ACID=54a09a0d-d57b-4c10-8b69-a842d6590ad5
  [?]

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="32768">1017</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:10:11.000000000Z" />
    <EventRecordID>5186</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0xC004F015</Data>
    <Data>QY7MG</Data>
    <Data>54a09a0d-d57b-4c10-8b69-a842d6590ad5</Data>
    <Data>?</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:09:59
 :   1017
 :
:       
 :
:  /
:     -
:
      . 0xC004F015
 Pkey=GPDD4
ACID=b92e9980-b9d5-4821-9c94-140f632f6312
  [?]

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="32768">1017</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:09:59.000000000Z" />
    <EventRecordID>5185</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>0xC004F015</Data>
    <Data>GPDD4</Data>
    <Data>b92e9980-b9d5-4821-9c94-140f632f6312</Data>
    <Data>?</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:09:15
 :   902
 :
:       
 :
:  /
:     -
:
    .
6.1.7601.17514
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">902</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:09:15.000000000Z" />
    <EventRecordID>5184</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>6.1.7601.17514</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:09:14
 :   1003
 :
:       
 :
:  /
:     -
:
       .
 =55c92734-d682-4d71-983e-d6ec3f16059f
 =
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 0], [( 5 0xC004F009 30 0)( 5 0xC004F009 30 0)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)( 9 0x00000000 0xC004F057)])]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]


Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1003</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:09:14.000000000Z" />
    <EventRecordID>5183</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>
1: 022a1afb-b893-4190-92c3-8f69a49839fb, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
2: 436cef53-8387-4692-bb4a-9492cd82260e, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
3: 57a232fe-0931-48fe-9389-e4586967c661, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
4: 7cfd4696-69a9-4af7-af36-ff3d12b6b6c8, 1, 0 [(0 [0xC004E003, 0, 0], [( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)( 1 0xC004F057 0 0 msft:rm/algorithm/bios/4.0 0x00000000 0)(?)(?)(?)])(1 )(2 [0x00000000, 0, 0], [( 5 0xC004F009 30 0)( 5 0xC004F009 30 0)( 1 0x00000000 0 0 msft:rm/algorithm/flags/1.0 0x00000000 0)(?)(?)( 9 0x00000000 0xC004F057)])]
5: 8ec16e01-e86f-415f-b333-1819f4145294, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
6: a0cde89c-3304-4157-b61c-c8ad785d1fad, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
7: ac96e1a8-6cc4-4310-a4ff-332ce77fb5b8, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
8: b2c4b9f6-3ee6-4a2a-a361-64ad3b61ded5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
9: bba42084-cacd-4ad4-b606-9f3d6c93b2c5, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
10: c619d61c-c2f2-40c3-ab3f-c5924314b0f3, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
11: cfb3e52c-d707-4861-af51-11b27ee6169c, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
12: 4a8149bb-7d61-49f4-8822-82c7bf88d64b, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]
13: afd5f68f-b70f-4000-a21d-28dbc8be8b07, 1, 0 [(0 [0xC004F014, 0, 0], [(?)(?)(?)(?)(?)(?)])(1 )(2 )]

</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:09:14
 :   1033
 :
:       
 :
:  /
:     -
:
  ,       override-only.
 =(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet-Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicensing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs-clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA) 
 =55c92734-d682-4d71-983e-d6ec3f16059f
 SKU=7cfd4696-69a9-4af7-af36-ff3d12b6b6c8
Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1033</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:09:14.000000000Z" />
    <EventRecordID>5182</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>(IIS-W3SVC-MaxConcurrentRequests) (Microsoft.Windows.Smc-Enabled) (Telnet-Client-EnableTelnetClient) (Telnet-Server-EnableTelnetServer) (TiffIFilterLicensing-EnableTiffIFilter) (nfs-admincmdtools-enabled) (nfs-adminmmc-enabled) (nfs-clientcmdtools-enabled) (nfs-clientcore-enabled) (sua-EnableSUA) </Data>
    <Data>55c92734-d682-4d71-983e-d6ec3f16059f</Data>
    <Data>7cfd4696-69a9-4af7-af36-ff3d12b6b6c8</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:09:14
 :   1066
 :
:       
 :
:  /
:     -
:
   .
C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">1066</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:09:14.000000000Z" />
    <EventRecordID>5181</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
    <Data>C:\Windows\system32\sppwinob.dll, msft:spp/windowsfunctionality/agent/7.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/phone/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:rm/algorithm/pkey/2005, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/TaskScheduler/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/1.0, 0x00000000, 0x00000000
C:\Windows\system32\sppobjs.dll, msft:spp/volume/services/kms/licenserenewal/1.0, 0x00000000, 0x00000000
</Data>
  </EventData>
</Event>

 :   Application
:      Microsoft-Windows-Security-SPP
:          15.03.2014 23:09:13
 :   900
 :
:       
 :
:  /
:     -
:
     .

Xml :
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-SPP" Guid="{E23B33B0-C8C9-472C-A5F9-F2BDFEA0F156}" EventSourceName="Software Protection Platform Service" />
    <EventID Qualifiers="16384">900</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2014-03-15T15:09:13.000000000Z" />
    <EventRecordID>5180</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>-</Computer>
    <Security />
  </System>
  <EventData>
  </EventData>
</Event>