[*E ] c:\intel\PROCMON.EXE
     [*E6] c:\program files\winrar\formats\TAR.FMT
     [*E6] c:\program files\winrar\formats\GZ.FMT
     [*E6] c:\program files\winrar\formats\ARJ.FMT
     [*E ] c:\windows\microsoft.net\framework\v4.0.30319\MSCOREEI.DLL
          [*E ] c:\windows\syswow64\ADVAPI32.DLL
               [*E ] c:\windows\syswow64\ADVAPI32.DLL
[*E ]  c:\windows\microsoft.net\framework\v4.0.30319\MSCOREEI.DLL                                                                   02.03.2016 21:10  03.03.2016  5:20     497 824  A      0x0007B319     0x0007B319     x86  GUI        CV,Unknown  0x--------10000000  0x--------72790000  0x00079000    63          4.6.1076.0          4.0.30319.0       10.0         12.10       6.0     6.0
[*E6]  c:\program files\winrar\formats\ARJ.FMT                                                                                      22.08.2013 18:01  22.08.2013 16:00      87 128  A      0x000158BA     0x000158BA     x64  GUI        CV          0x0000000180000000  Unknown             0x0001E000    Not Loaded  5.0.0.0             5.0.0.0           0.0          9.0         5.2     5.2
[*E6]  c:\program files\winrar\formats\GZ.FMT                                                                                       22.08.2013 18:01  22.08.2013 16:00      89 688  A      0x00023A2F     0x00023A2F     x64  GUI        CV          0x0000000180000000  Unknown             0x00028000    Not Loaded  5.0.0.0             5.0.0.0           0.0          9.0         5.2     5.2
[*E6]  c:\program files\winrar\formats\TAR.FMT                                                                                      22.08.2013 18:01  22.08.2013 16:00      75 352  A      0x0001440D     0x0001440D     x64  GUI        CV          0x0000000180000000  Unknown             0x0001A000    Not Loaded  5.0.0.0             5.0.0.0           0.0          9.0         5.2     5.2