Not sure if I'm infected, but it can't hurt to check ...

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • Fla_Panther
    PCHF Member
    • Sep 2016
    • 38

    #1

    Not sure if I'm infected, but it can't hurt to check ...

    Firefox started acting strange 2-3 days ago. Some HTTPS sites load fine, others won’t. Some load but the HTML doesn’t load properly. I’ve installed some recent MS updates but I can’t remember if this started just before or just after. Anyway, here are my prework logs. Thanks in advance.

    Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-07-2019 01
    Ran by ******** (administrator) on ********-PC (Dell Inc. Latitude E6430) (14-07-2019 21:35:49)
    Running from C:\Users********\Desktop\Virus Removal
    Loaded Profiles: ******** (Available Profiles: ********)
    Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
    Internet Explorer Version 11 (Default browser: FF)
    Boot Mode: Normal
    Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic...ery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

    (Alps Electric Co., LTD. → Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
    (Alps Electric Co., LTD. → Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
    (Alps Electric Co., LTD. → Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
    (Alps Electric Co., LTD. → Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
    (Dell Inc → Dell Inc.) C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe
    (Dell Inc → Dell Inc.) C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe
    (Dell Inc → Dell Inc.) C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe
    (Dell Inc. → Dell Inc.) C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAge nt.exe
    (GEAR Software) [File not signed] C:\Windows\SysWOW64\gearsec.exe
    (Google LLC → Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC → Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC → Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC → Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC → Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC → Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Google LLC → Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    (Intel Corporation - Intel® Management Engine Firmware → Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
    (Intel Corporation - Software and Firmware Products → Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    (Intel Corporation-Mobile Wireless Group → Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
    (Intel Corporation-Mobile Wireless Group → Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
    (Intel Corporation-Mobile Wireless Group → Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    (Intel Corporation-Mobile Wireless Group → Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
    (Intel(R) Corporation) [File not signed] C:\Program Files\Intel\iCLS Client\HeciServer.exe
    (Intel(R) pGFX → Intel Corporation) C:\Windows\System32\igfxCUIService.exe
    (Intel(R) pGFX → Intel Corporation) C:\Windows\System32\igfxEM.exe
    (Intel(R) pGFX → Intel Corporation) C:\Windows\System32\igfxHK.exe
    (Intel(R) pGFX → Intel Corporation) C:\Windows\System32\igfxTray.exe
    (Microsoft Corporation → Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\Pres entationFontCache.exe
    (Microsoft Windows → Microsoft Corporation) C:\Windows\System32\wlanext.exe
    (Microsoft Windows Hardware Compatibility Publisher → IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
    (Microsoft Windows Hardware Compatibility Publisher → IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
    (Microsoft Windows Hardware Compatibility Publisher → Visioneer Inc.) C:\Program Files\Visioneer\RWAR3\RWAR3HV_0001_0.EXE
    (Notepad++ → Don HO don.h@free.fr) C:\Program Files (x86)\Notepad++\notepad++.exe
    (PC-Doctor, Inc. → PC-Doctor, Inc.) C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6 .0.7033.2285\DSAPI.exe
    (PC-Doctor, Inc. → PC-Doctor, Inc.) C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6 .0.7033.2285\pcdrwi.exe
    (Visioneer Inc.) [File not signed] C:\Program Files\Visioneer\RWAR3\RWAR3Monitor.exe

    ==================== Registry (Whitelisted) ===========================

    (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

    HKLM...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-08-16] (Microsoft Windows Hardware Compatibility Publisher → IDT, Inc.)
    HKLM...\Run: [IntelPROSet] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [4791024 2013-07-17] (Intel Corporation-Mobile Wireless Group → Intel(R) Corporation)
    HKLM...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [708952 2013-07-08] (Alps Electric Co., LTD. → Alps Electric Co., Ltd.)
    HKLM-x32...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-11-13] (Intel Corporation - Software and Firmware Products → Intel Corporation)
    HKLM-x32...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [3255888 2018-05-12] (Open Source Developer, Dominik Reichl → Dominik Reichl)
    HKU\S-1-5-21-3206243102-205974907-2145499838-1000...\MountPoints2: {a08823cb-795d-11e8-b725-e41f28566541} - E:\RTK_NIC_DRIVER_INSTALLER.sfx.exe
    HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] → C:\Program Files (x86)\Google\Chrome\Application\75.0.3770.142\Inst aller\chrmstp.exe [2019-07-12] (Google LLC → Google LLC)

    ==================== Scheduled Tasks (Whitelisted) =============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    Task: {28DC2AF6-1D16-4C75-B4DB-CE4C2D0241ED} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [154920 2019-07-12] (Google Inc → Google LLC)
    Task: {D67DBDCB-4494-4132-A263-D7274A930236} - System32\Tasks{EE1BEB1A-D10C-43A0-9D62-B7BBC4690C0E} => C:\Windows\system32\pcalua.exe -a C:\Users*\Desktop\out_lame.binf_v164.exe -d C:\Users*\Desktop
    Task: {EB9DB395-1B49-4B4D-B3E1-B5F4BF91DDE5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [154920 2019-07-12] (Google Inc → Google LLC)
    Task: {F3CA5017-53C0-47CD-A21A-E197090FB41D} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistIns taller.exe [1512920 2019-05-24] (Dell Inc. → Dell Inc.)

    (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

    ==================== Internet (Whitelisted) ====================

    (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

    Tcpip\Parameters: [DhcpNameServer] 209.18.47.62 209.18.47.61
    Tcpip..\Interfaces{F1ABA7E1-57DC-49E4-8FA4-8A72EEFAFE0B}: [DhcpNameServer] 209.18.47.62 209.18.47.61
    HKLM\System...\Parameters\PersistentRoutes: [0.0.0.0,0.0.0.0,192.168.0.201,-1]
    [HEADING=1]Internet Explorer:[/HEADING]
    HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.dell.com/
    HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
    SearchScopes: HKU\S-1-5-21-3206243102-205974907-2145499838-1000 → DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?pc=COSP&ptag=D031719-N0400A915F698E57&form=CONBDF&conlogo=CT3335818&q={ searchTerms}
    SearchScopes: HKU\S-1-5-21-3206243102-205974907-2145499838-1000 → {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?pc=COSP&ptag=D031719-N0400A915F698E57&form=CONBDF&conlogo=CT3335818&q={ searchTerms}
    BHO: Office Document Cache Handler → {B4F3A835-0E21-4959-BA22-42B3008E02FF} → C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation → Microsoft Corporation)
    BHO-x32: Office Document Cache Handler → {B4F3A835-0E21-4959-BA22-42B3008E02FF} → C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation → Microsoft Corporation)
    [HEADING=1]FireFox:[/HEADING]
    FF DefaultProfile: 54mhv969.default-1563029380061
    FF ProfilePath: C:\Users********\AppData\Roaming\Mozilla\Firefox\P rofiles\54mhv969.default-1563029380061 [2019-07-14]
    FF Plugin: @adobe.com/FlashPlayer → C:\Windows\system32\Macromed\Flash\NPSWF64_29_0_0_ 171.dll [2018-06-26] (Adobe Systems Incorporated → )
    FF Plugin: @microsoft.com/GENUINE → disabled [No File]
    FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 → C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation → Microsoft Corporation)
    FF Plugin: @videolan.org/vlc,version=3.0.6 → C:\Program Files\VideoLAN\VLC\npvlc.dll [2019-01-10] (VideoLAN → VideoLAN)
    FF Plugin-x32: @adobe.com/FlashPlayer → C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_29_0_0_ 171.dll [2018-06-26] (Adobe Systems Incorporated → )
    FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf → C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2019-01-17] (Foxit Software Incorporated → Foxit Corporation)
    FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf → C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2019-01-17] (Foxit Software Incorporated → Foxit Corporation)
    FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp → C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2019-01-17] (Foxit Software Incorporated → Foxit Corporation)
    FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf → C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2019-01-17] (Foxit Software Incorporated → Foxit Corporation)
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 → C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-11-13] (Intel® Identity Protection Technology Software → Intel Corporation)
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater → C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-11-13] (Intel® Identity Protection Technology Software → Intel Corporation)
    FF Plugin-x32: @microsoft.com/GENUINE → disabled [No File]
    FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 → C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation → Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 → C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation → Microsoft Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 → C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-07-12] (Google Inc → Google LLC)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 → C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-07-12] (Google Inc → Google LLC)
    [HEADING=1]Chrome:[/HEADING]
    CHR Profile: C:\Users*\AppData\Local\Google\Chrome\User Data\Default [2019-07-14]
    CHR Extension: (Slides) - C:\Users*
    \AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhon fmgoek [2019-07-12]
    CHR Extension: (Docs) - C:\Users*\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfi lokake [2019-07-12]
    CHR Extension: (Google Drive) - C:\Users*
    \AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigk jlhalf [2019-07-12]
    CHR Extension: (YouTube) - C:\Users*\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldk acnbeo [2019-07-12]
    CHR Extension: (Sheets) - C:\Users*
    \AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpeb giejap [2019-07-12]
    CHR Extension: (Google Docs Offline) - C:\Users*\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdl olhkhi [2019-07-13]
    CHR Extension: (Chrome Web Store Payments) - C:\Users*
    \AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccm gmieda [2019-07-12]
    CHR Extension: (Gmail) - C:\Users*\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoe jaedia [2019-07-12]
    CHR Extension: (Chrome Media Router) - C:\Users*
    \AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcj beemfm [2019-07-12]

    ==================== Services (Whitelisted) ====================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R2 DDVCollectorSvcApi; C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe [209392 2019-02-28] (Dell Inc → Dell Inc.)
    R2 DDVDataCollector; C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe [3363824 2019-02-28] (Dell Inc → Dell Inc.)
    R2 DDVRulesProcessor; C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe [218096 2019-02-28] (Dell Inc → Dell Inc.)
    R2 Dell Hardware Support; C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6 .0.7033.2285\DSAPI.exe [1050952 2019-05-30] (PC-Doctor, Inc. → PC-Doctor, Inc.)
    R2 gearsec; C:\Windows\SysWOW64\gearsec.exe [49152 2002-09-02] (GEAR Software) [File not signed]
    R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [329192 2016-06-02] (Intel(R) pGFX → Intel Corporation)
    R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
    S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel® Trusted Connect Service → Intel(R) Corporation)
    R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-11-13] (Intel Corporation - Intel® Management Engine Firmware → Intel Corporation)
    S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-07-17] (Intel Corporation-Mobile Wireless Group → )
    R2 RWAR3HV_0001_0; C:\Program Files\Visioneer\RWAR3\RWAR3HV_0001_0.EXE [463360 2016-04-18] (Microsoft Windows Hardware Compatibility Publisher → Visioneer Inc.)
    R2 RWAR3Monitor; C:\Program Files\Visioneer\RWAR3\RWAR3Monitor.exe [246784 2018-10-29] (Visioneer Inc.) [File not signed]
    R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [339456 2013-08-16] (Microsoft Windows Hardware Compatibility Publisher → IDT, Inc.)
    R2 SupportAssistAgent; C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAge nt.exe [39896 2019-05-24] (Dell Inc. → Dell Inc.)
    R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Windows → Microsoft Corporation)
    R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3377904 2013-07-17] (Intel Corporation-Mobile Wireless Group → Intel® Corporation)

    ===================== Drivers (Whitelisted) ======================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    R3 AKAI_EIE_PRO_MIDI; C:\Windows\System32\drivers\akaieiem.sys [31984 2011-09-22] (Ploytec GmbH → Numark)
    R3 AKAI_EIE_PRO_USB; C:\Windows\System32\Drivers\akaieieu.sys [424176 2011-09-22] (Ploytec GmbH → Ploytec GmbH)
    R3 AKAI_EIE_WDM; C:\Windows\System32\drivers\akaieiea.sys [54000 2011-09-22] (Ploytec GmbH → Numark)
    R3 DDDriver; C:\Windows\System32\drivers\DDDriver64Dcsa.sys [41608 2018-05-08] (Techporch Incorporated → Dell Inc.)
    R3 DellProf; C:\Windows\System32\drivers\DellProf.sys [41208 2018-05-08] (Techporch Incorporated → Dell Computer Corporation)
    S3 GEARAspiWDM; C:\Windows\SysWOW64\DRIVERS\GEARAspiWDM.sys [9440 2003-03-20] (GEAR Software) [File not signed]
    R3 GMLXD16Fltr; C:\Windows\System32\drivers\GMLXDFltr01.sys [19488 2016-05-27] (Microsoft Windows Hardware Compatibility Publisher → LXD Development, Inc.)
    R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-11-13] (Intel Corporation - Intel® Management Engine Firmware → Intel Corporation)
    S3 nusb3hub; C:\Windows\system32\drivers\nusb3hub.sys [80384 2010-09-30] (Microsoft Windows Hardware Compatibility Publisher → Renesas Electronics Corporation)
    S3 nusb3xhc; C:\Windows\system32\drivers\nusb3xhc.sys [180736 2010-09-30] (Microsoft Windows Hardware Compatibility Publisher → Renesas Electronics Corporation)
    S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [50320 2015-01-29] (Panda Security S.L. → Panda Security, S.L.)
    S3 RTLU3E8023-W7-64; C:\Windows\System32\DRIVERS\rtu30x64w7.sys [83160 2013-10-09] (Realtek Semiconductor Corp → Realtek )
    S3 Ser2pl; C:\Windows\System32\DRIVERS\ser2pl64.sys [238072 2018-07-12] (WDKTestCert charles-yeh,131345514351795974 → Prolific Technology Inc.)
    R3 STHDA; C:\Windows\System32\DRIVERS\stwrt64.sys [551936 2013-08-16] (Microsoft Windows Hardware Compatibility Publisher → IDT, Inc.)

    ==================== NetSvcs (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    ==================== One month (created) ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2019-07-14 21:35 - 2019-07-14 21:35 - 000000000 ____D C:\FRST
    2019-07-14 21:34 - 2019-07-14 21:35 - 000000000 ____D C:\Users*\Desktop\Virus Removal
    2019-07-14 20:29 - 2019-07-11 16:10 - 000397440 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
    2019-07-14 20:29 - 2019-07-11 15:13 - 000348792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
    2019-07-14 20:29 - 2019-07-10 00:08 - 025754624 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2019-07-14 20:29 - 2019-07-09 23:58 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2019-07-14 20:29 - 2019-07-09 23:58 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
    2019-07-14 20:29 - 2019-07-09 23:46 - 002909184 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2019-07-14 20:29 - 2019-07-09 23:45 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2019-07-14 20:29 - 2019-07-09 23:44 - 000578560 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
    2019-07-14 20:29 - 2019-07-09 23:44 - 000417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
    2019-07-14 20:29 - 2019-07-09 23:44 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
    2019-07-14 20:29 - 2019-07-09 23:43 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
    2019-07-14 20:29 - 2019-07-09 23:37 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2019-07-14 20:29 - 2019-07-09 23:36 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2019-07-14 20:29 - 2019-07-09 23:34 - 005775872 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2019-07-14 20:29 - 2019-07-09 23:34 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2019-07-14 20:29 - 2019-07-09 23:33 - 000790528 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
    2019-07-14 20:29 - 2019-07-09 23:33 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
    2019-07-14 20:29 - 2019-07-09 23:33 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
    2019-07-14 20:29 - 2019-07-09 23:32 - 020291072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2019-07-14 20:29 - 2019-07-09 23:32 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
    2019-07-14 20:29 - 2019-07-09 23:26 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2019-07-14 20:29 - 2019-07-09 23:25 - 000969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
    2019-07-14 20:29 - 2019-07-09 23:22 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
    2019-07-14 20:29 - 2019-07-09 23:16 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
    2019-07-14 20:29 - 2019-07-09 23:15 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
    2019-07-14 20:29 - 2019-07-09 23:15 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
    2019-07-14 20:29 - 2019-07-09 23:14 - 000496128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
    2019-07-14 20:29 - 2019-07-09 23:14 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2019-07-14 20:29 - 2019-07-09 23:13 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
    2019-07-14 20:29 - 2019-07-09 23:13 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
    2019-07-14 20:29 - 2019-07-09 23:12 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
    2019-07-14 20:29 - 2019-07-09 23:12 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
    2019-07-14 20:29 - 2019-07-09 23:11 - 002301952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2019-07-14 20:29 - 2019-07-09 23:11 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
    2019-07-14 20:29 - 2019-07-09 23:09 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
    2019-07-14 20:29 - 2019-07-09 23:08 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
    2019-07-14 20:29 - 2019-07-09 23:08 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2019-07-14 20:29 - 2019-07-09 23:07 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2019-07-14 20:29 - 2019-07-09 23:05 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2019-07-14 20:29 - 2019-07-09 23:04 - 000663040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
    2019-07-14 20:29 - 2019-07-09 23:04 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
    2019-07-14 20:29 - 2019-07-09 23:04 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
    2019-07-14 20:29 - 2019-07-09 22:58 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
    2019-07-14 20:29 - 2019-07-09 22:56 - 000809472 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2019-07-14 20:29 - 2019-07-09 22:56 - 000728064 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2019-07-14 20:29 - 2019-07-09 22:56 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
    2019-07-14 20:29 - 2019-07-09 22:54 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
    2019-07-14 20:29 - 2019-07-09 22:53 - 002132480 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
    2019-07-14 20:29 - 2019-07-09 22:52 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
    2019-07-14 20:29 - 2019-07-09 22:51 - 015389696 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2019-07-14 20:29 - 2019-07-09 22:51 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
    2019-07-14 20:29 - 2019-07-09 22:51 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
    2019-07-14 20:29 - 2019-07-09 22:48 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
    2019-07-14 20:29 - 2019-07-09 22:48 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
    2019-07-14 20:29 - 2019-07-09 22:46 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
    2019-07-14 20:29 - 2019-07-09 22:45 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
    2019-07-14 20:29 - 2019-07-09 22:43 - 004858880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2019-07-14 20:29 - 2019-07-09 22:42 - 004494848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2019-07-14 20:29 - 2019-07-09 22:40 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
    2019-07-14 20:29 - 2019-07-09 22:38 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
    2019-07-14 20:29 - 2019-07-09 22:38 - 000696320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2019-07-14 20:29 - 2019-07-09 22:37 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
    2019-07-14 20:29 - 2019-07-09 22:34 - 013791232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2019-07-14 20:29 - 2019-07-09 22:31 - 001566208 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2019-07-14 20:29 - 2019-07-09 22:19 - 004386304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2019-07-14 20:29 - 2019-07-09 22:19 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
    2019-07-14 20:29 - 2019-07-09 22:16 - 001331200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2019-07-14 20:29 - 2019-07-09 22:15 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
    2019-07-14 20:29 - 2019-07-03 21:56 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
    2019-07-14 20:29 - 2019-07-03 21:14 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
    2019-07-13 10:49 - 2019-07-13 10:49 - 000000942 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
    2019-07-13 10:49 - 2019-07-13 10:49 - 000000930 _____ C:\Users\Public\Desktop\Firefox.lnk
    2019-07-13 10:49 - 2019-07-13 10:49 - 000000000 ____D C:\Users*
    \Desktop\Old Firefox Data
    2019-07-13 10:49 - 2019-07-13 10:49 - 000000000 ____D C:\Program Files\Mozilla Firefox
    2019-07-13 10:49 - 2019-07-13 10:49 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
    2019-07-13 10:48 - 2019-07-13 10:49 - 000285408 _____ (Mozilla) C:\Users*\Downloads\Firefox Installer.exe
    2019-07-12 22:58 - 2019-07-12 22:58 - 000387228 _____ C:\Users*
    \Desktop\Rick & Morty - Lambs to the cosmic slaughter.wav
    2019-07-12 20:25 - 2019-02-16 01:32 - 000142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
    2019-07-12 20:25 - 2019-02-16 01:30 - 000123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
    2019-07-12 15:59 - 2019-06-28 01:24 - 000887808 _____ (Microsoft Corporation) C:\Windows\system32\wlansvc.dll
    2019-07-12 15:59 - 2019-06-28 01:24 - 000448512 _____ (Microsoft Corporation) C:\Windows\system32\wlansec.dll
    2019-07-12 15:59 - 2019-06-28 01:24 - 000414208 _____ (Microsoft Corporation) C:\Windows\system32\wlanmsm.dll
    2019-07-12 15:59 - 2019-06-28 01:24 - 000118784 _____ (Microsoft Corporation) C:\Windows\system32\wlanhlp.dll
    2019-07-12 15:59 - 2019-06-28 01:24 - 000113664 _____ (Microsoft Corporation) C:\Windows\system32\wlanapi.dll
    2019-07-12 15:59 - 2019-06-28 01:23 - 000428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanmsm.dll
    2019-07-12 15:59 - 2019-06-28 01:23 - 000392704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlansec.dll
    2019-07-12 15:59 - 2019-06-28 01:23 - 000083968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanhlp.dll
    2019-07-12 15:59 - 2019-06-28 01:23 - 000080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanapi.dll
    2019-07-12 15:59 - 2019-06-20 23:09 - 000806400 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
    2019-07-12 15:59 - 2019-06-20 23:05 - 000628224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
    2019-07-12 15:59 - 2019-06-20 22:44 - 003229696 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
    2019-07-12 15:59 - 2019-06-20 21:41 - 001251840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
    2019-07-12 15:59 - 2019-06-18 23:06 - 006135296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
    2019-07-12 15:59 - 2019-06-18 21:52 - 007081984 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
    2019-07-12 15:59 - 2019-06-18 02:41 - 001649664 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
    2019-07-12 15:59 - 2019-06-12 23:25 - 000160488 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
    2019-07-12 15:59 - 2019-06-12 23:21 - 000732160 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
    2019-07-12 15:59 - 2019-06-12 11:23 - 004057320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
    2019-07-12 15:59 - 2019-06-12 11:23 - 003964136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
    2019-07-12 15:59 - 2019-06-12 11:22 - 001314104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
    2019-07-12 15:59 - 2019-06-12 11:21 - 012574208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
    2019-07-12 15:59 - 2019-06-12 11:21 - 011411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
    2019-07-12 15:59 - 2019-06-12 11:21 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
    2019-07-12 15:59 - 2019-06-12 11:21 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
    2019-07-12 15:59 - 2019-06-12 11:21 - 000617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
    2019-07-12 15:59 - 2019-06-12 11:21 - 000275968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
    2019-07-12 15:59 - 2019-06-12 11:21 - 000179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
    2019-07-12 15:59 - 2019-06-12 11:21 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
    2019-07-12 15:59 - 2019-06-12 11:21 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
    2019-07-12 15:59 - 2019-06-12 11:21 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
    2019-07-12 15:59 - 2019-06-12 11:21 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 003207168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 001329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000555520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000261632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000070144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssign32.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
    2019-07-12 15:59 - 2019-06-12 11:20 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 001177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 001005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000373248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000195072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:15 - 000631680 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
    2019-07-12 15:59 - 2019-06-12 11:11 - 000708328 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
    2019-07-12 15:59 - 2019-06-12 11:11 - 000262376 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
    2019-07-12 15:59 - 2019-06-12 11:11 - 000153832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
    2019-07-12 15:59 - 2019-06-12 11:11 - 000094440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
    2019-07-12 15:59 - 2019-06-12 11:10 - 005550824 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
    2019-07-12 15:59 - 2019-06-12 11:10 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
    2019-07-12 15:59 - 2019-06-12 11:09 - 001664352 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
    2019-07-12 15:59 - 2019-06-12 11:08 - 014637568 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
    2019-07-12 15:59 - 2019-06-12 11:08 - 012574720 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
    2019-07-12 15:59 - 2019-06-12 11:08 - 000782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
    2019-07-12 15:59 - 2019-06-12 11:08 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
    2019-07-12 15:59 - 2019-06-12 11:08 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
    2019-07-12 15:59 - 2019-06-12 11:08 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
    2019-07-12 15:59 - 2019-06-12 11:08 - 000236032 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll
    2019-07-12 15:59 - 2019-06-12 11:08 - 000229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
    2019-07-12 15:59 - 2019-06-12 11:08 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
    2019-07-12 15:59 - 2019-06-12 11:08 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
    2019-07-12 15:59 - 2019-06-12 11:08 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
    2019-07-12 15:59 - 2019-06-12 11:08 - 000094208 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
    2019-07-12 15:59 - 2019-06-12 11:08 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
    2019-07-12 15:59 - 2019-06-12 11:08 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
    2019-07-12 15:59 - 2019-06-12 11:08 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
    2019-07-12 15:59 - 2019-06-12 11:08 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\sscore.dll
    2019-07-12 15:59 - 2019-06-12 11:08 - 000005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
    2019-07-12 15:59 - 2019-06-12 11:08 - 000005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 004120576 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 001574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 001484800 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 001472512 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 001211392 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 001202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 001162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 001068544 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000733184 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000632320 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000499712 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000433152 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000408576 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000317440 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000190976 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000187904 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000141824 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000081920 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\mssign32.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
    2019-07-12 15:59 - 2019-06-12 11:07 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000438784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000295936 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
    2019-07-12 15:59 - 2019-06-12 11:06 - 000004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 11:05 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
    2019-07-12 15:59 - 2019-06-12 11:04 - 000023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
    2019-07-12 15:59 - 2019-06-12 11:01 - 000663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
    2019-07-12 15:59 - 2019-06-12 10:55 - 000009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sscore.dll
    2019-07-12 15:59 - 2019-06-12 10:54 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
    2019-07-12 15:59 - 2019-06-12 10:50 - 000055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
    2019-07-12 15:59 - 2019-06-12 10:49 - 000205312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Dism.exe
    2019-07-12 15:59 - 2019-06-12 10:49 - 000125952 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
    2019-07-12 15:59 - 2019-06-12 10:49 - 000024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
    2019-07-12 15:59 - 2019-06-12 10:48 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
    2019-07-12 15:59 - 2019-06-12 10:48 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
    2019-07-12 15:59 - 2019-06-12 10:48 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
    2019-07-12 15:59 - 2019-06-12 10:48 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
    2019-07-12 15:59 - 2019-06-12 10:47 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
    2019-07-12 15:59 - 2019-06-12 10:46 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 10:46 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 10:46 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 10:46 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
    2019-07-12 15:59 - 2019-06-12 10:42 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
    2019-07-12 15:59 - 2019-06-12 10:42 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
    2019-07-12 15:59 - 2019-06-12 10:42 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
    2019-07-12 15:59 - 2019-06-12 10:42 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
    2019-07-12 15:59 - 2019-06-12 10:39 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
    2019-07-12 15:59 - 2019-06-12 10:39 - 000129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\videoprt.sys
    2019-07-12 15:59 - 2019-06-12 10:38 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
    2019-07-12 15:59 - 2019-06-12 10:37 - 000274944 _____ (Microsoft Corporation) C:\Windows\system32\Dism.exe
    2019-07-12 15:59 - 2019-06-12 10:37 - 000011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
    2019-07-12 15:59 - 2019-06-12 10:37 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
    2019-07-12 15:59 - 2019-06-12 10:36 - 000464384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
    2019-07-12 15:59 - 2019-06-12 10:36 - 000406016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
    2019-07-12 15:59 - 2019-06-12 10:36 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
    2019-07-12 15:59 - 2019-06-12 10:36 - 000169472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
    2019-07-12 15:59 - 2019-06-12 10:36 - 000160768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
    2019-07-12 15:59 - 2019-06-12 10:36 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
    2019-07-12 15:59 - 2019-06-12 10:35 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
    2019-07-12 15:59 - 2019-06-12 10:35 - 000064512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\amdk8.sys
    2019-07-12 15:59 - 2019-06-12 10:35 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\intelppm.sys
    2019-07-12 15:59 - 2019-06-12 10:35 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\processr.sys
    2019-07-12 15:59 - 2019-06-12 10:35 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\amdppm.sys
    2019-07-12 15:59 - 2019-06-12 10:35 - 000044544 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\npfs.sys
    2019-07-12 15:59 - 2019-06-12 10:35 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
    2019-07-12 15:59 - 2019-06-07 11:18 - 001425920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
    2019-07-12 15:59 - 2019-06-07 11:18 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
    2019-07-12 15:59 - 2019-06-07 11:08 - 002072576 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
    2019-07-12 15:59 - 2019-06-07 11:08 - 000516096 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
    2019-07-12 15:59 - 2019-06-07 11:08 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
    2019-07-12 15:59 - 2019-06-07 11:07 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
    2019-07-12 15:59 - 2019-06-07 10:55 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
    2019-07-12 15:59 - 2019-06-01 23:50 - 000216576 _____ (Microsoft Corporation) C:\Windows\system32\rdpclip.exe
    2019-07-12 13:46 - 2019-07-12 13:47 - 000000000 ____D C:\Users*\Desktop\3750
    2019-07-12 13:36 - 2019-07-12 13:48 - 000000000 ____D C:\Users*
    \AppData\Local\Google
    2019-07-12 13:36 - 2019-07-12 13:36 - 001151544 _____ (Google LLC) C:\Users*\Desktop\ChromeSetup.exe
    2019-07-12 13:36 - 2019-07-12 13:36 - 000003332 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineU A
    2019-07-12 13:36 - 2019-07-12 13:36 - 000003204 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineC ore
    2019-07-12 13:36 - 2019-07-12 13:36 - 000002298 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
    2019-07-12 13:36 - 2019-07-12 13:36 - 000002257 _____ C:\Users\Public\Desktop\Google Chrome.lnk
    2019-07-12 13:36 - 2019-07-12 13:36 - 000000000 ____D C:\Program Files (x86)\Google
    2019-07-11 14:55 - 2019-07-11 14:55 - 000012209 _____ C:\Users*
    \Desktop\Scale.xlsx
    2019-07-03 22:16 - 2019-06-10 22:59 - 002863104 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
    2019-07-03 22:16 - 2019-06-10 22:59 - 001712640 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
    2019-07-03 22:16 - 2019-06-10 22:59 - 000801792 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
    2019-07-03 22:16 - 2019-06-10 22:59 - 000634368 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
    2019-07-03 22:16 - 2019-06-10 22:59 - 000501760 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
    2019-07-03 22:16 - 2019-06-10 22:59 - 000456192 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
    2019-07-03 22:16 - 2019-06-10 22:59 - 000315904 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
    2019-07-03 22:16 - 2019-06-10 22:59 - 000257024 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
    2019-07-03 22:16 - 2019-06-03 19:11 - 001110528 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
    2019-07-03 22:16 - 2019-06-03 19:11 - 000474112 _____ (Microsoft Corporation) C:\Windows\system32\taskcomp.dll
    2019-07-03 22:16 - 2019-06-03 19:10 - 000304640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskcomp.dll
    2019-07-03 22:16 - 2019-05-24 20:04 - 014185984 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
    2019-07-03 22:16 - 2019-05-24 20:03 - 001867776 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
    2019-07-03 22:16 - 2019-05-24 19:59 - 012880384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
    2019-07-03 22:16 - 2019-05-24 19:58 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
    2019-07-03 22:16 - 2019-05-22 22:06 - 000405504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
    2019-07-03 22:16 - 2019-05-22 22:06 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\mf3216.dll
    2019-07-03 22:16 - 2019-05-22 22:06 - 000008192 _____ (Microsoft Corporation) C:\Windows\system32\msimg32.dll
    2019-07-03 22:16 - 2019-05-22 21:58 - 000313344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
    2019-07-03 22:16 - 2019-05-22 21:58 - 000046080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf3216.dll
    2019-07-03 22:16 - 2019-05-22 21:58 - 000004608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimg32.dll
    2019-07-03 22:16 - 2019-05-22 20:05 - 001182208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
    2019-07-03 22:16 - 2019-05-17 14:21 - 000372456 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
    2019-07-03 22:16 - 2019-05-13 10:44 - 001311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msjet40.dll
    2019-07-03 22:16 - 2019-05-13 10:44 - 000353280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrd3x40.dll
    2019-07-03 22:16 - 2019-05-13 10:44 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexcl40.dll
    2019-07-03 22:16 - 2019-05-13 10:44 - 000313344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrd2x40.dll
    2019-07-03 22:16 - 2019-05-13 10:44 - 000241152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msltus40.dll
    2019-07-03 22:16 - 2019-05-09 11:18 - 002368000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
    2019-07-03 22:16 - 2019-05-09 11:18 - 000337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
    2019-07-03 22:16 - 2019-05-09 11:18 - 000025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
    2019-07-03 22:16 - 2019-05-09 11:17 - 001806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
    2019-07-03 22:16 - 2019-05-09 11:17 - 000805376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll
    2019-07-03 22:16 - 2019-05-09 11:09 - 000114400 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
    2019-07-03 22:16 - 2019-05-09 11:07 - 003247616 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
    2019-07-03 22:16 - 2019-05-09 11:07 - 000504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
    2019-07-03 22:16 - 2019-05-09 11:07 - 000025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
    2019-07-03 22:16 - 2019-05-09 11:06 - 001942016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
    2019-07-03 22:16 - 2019-05-09 11:06 - 001133568 _____ (Microsoft Corporation) C:\Windows\system32\cdosys.dll
    2019-07-03 22:16 - 2019-05-09 11:06 - 000070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
    2019-07-03 22:16 - 2019-05-09 10:51 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
    2019-07-03 22:16 - 2019-05-09 10:40 - 000128512 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
    2019-07-03 22:16 - 2019-04-25 11:18 - 000083968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\userenv.dll
    2019-07-03 22:16 - 2019-04-25 11:06 - 000110592 _____ (Microsoft Corporation) C:\Windows\system32\userenv.dll
    2019-07-03 22:16 - 2019-04-24 11:11 - 001893096 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
    2019-07-03 22:16 - 2019-04-24 11:09 - 000377064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
    2019-07-03 22:16 - 2019-04-24 11:09 - 000287976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
    2019-07-03 22:16 - 2019-04-18 22:44 - 000185064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
    2019-07-03 22:16 - 2019-04-18 22:43 - 000064232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ULIAGPKX.SYS
    2019-07-03 22:16 - 2019-04-18 22:43 - 000063208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\termdd.sys
    2019-07-03 22:16 - 2019-04-18 22:43 - 000060648 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\AGP440.sys
    2019-07-03 22:16 - 2019-04-18 22:43 - 000031976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mssmbios.sys
    2019-07-03 22:16 - 2019-04-18 22:43 - 000023784 _____ (Microsoft Corporation) C:\Windows\system32\streamci.dll
    2019-07-03 22:16 - 2019-04-18 22:43 - 000020200 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\isapnp.sys
    2019-07-03 22:16 - 2019-04-18 22:42 - 000122600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\NV_AGP.SYS
    2019-07-03 22:16 - 2019-04-18 22:42 - 000068328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgr.sys
    2019-07-03 22:16 - 2019-04-18 22:42 - 000036064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vdrvroot.sys
    2019-07-03 22:16 - 2019-04-18 22:42 - 000015080 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msisadrv.sys
    2019-07-03 22:16 - 2019-04-18 22:42 - 000012136 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\swenum.sys
    2019-07-03 22:16 - 2019-04-16 11:17 - 000583680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
    2019-07-03 22:16 - 2019-04-16 11:05 - 000878080 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
    2019-07-03 22:16 - 2019-04-16 09:15 - 000419648 _____ C:\Windows\SysWOW64\locale.nls
    2019-07-03 22:16 - 2019-04-16 09:15 - 000419648 _____ C:\Windows\system32\locale.nls
    2019-07-03 22:16 - 2019-04-14 01:42 - 000309480 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
    2019-07-03 22:16 - 2019-04-14 01:40 - 000111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll
    2019-07-03 22:16 - 2019-04-14 01:40 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
    2019-07-03 22:16 - 2019-04-14 01:39 - 000071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
    2019-07-03 22:16 - 2019-04-14 01:39 - 000010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
    2019-07-03 22:16 - 2019-04-14 01:28 - 000383720 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
    2019-07-03 22:16 - 2019-04-14 01:26 - 000151552 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll
    2019-07-03 22:16 - 2019-04-14 01:26 - 000101376 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
    2019-07-03 22:16 - 2019-04-14 01:26 - 000046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
    2019-07-03 22:16 - 2019-04-14 01:26 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
    2019-07-03 22:16 - 2019-04-14 01:26 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
    2019-07-03 22:16 - 2019-04-14 01:12 - 000034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000994384 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000064248 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000020944 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000019408 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000017656 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000017656 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000016120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000015608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000014288 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000014072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000013560 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000012752 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000012536 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000012240 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000012024 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000012024 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000012024 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000012024 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000012024 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000011512 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000011512 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000011512 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:05 - 000011504 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000914584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000065784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000021752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000018680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000017352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000017144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000015608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000015096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000013560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000013560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000013048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000012024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000012024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000011728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000011512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000011512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000011512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000011512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000011512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000011000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000011000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000011000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
    2019-07-03 22:16 - 2019-04-12 09:04 - 000011000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
    2019-07-03 22:16 - 2019-04-09 11:17 - 000174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
    2019-07-03 22:16 - 2019-04-09 11:05 - 003165184 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
    2019-07-03 22:16 - 2019-04-09 11:05 - 000573440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
    2019-07-03 22:16 - 2019-04-09 11:05 - 000192512 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
    2019-07-03 22:16 - 2019-04-09 11:05 - 000098816 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
    2019-07-03 22:16 - 2019-04-09 11:05 - 000093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
    2019-07-03 22:16 - 2019-04-09 11:05 - 000035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
    2019-07-03 22:16 - 2019-04-09 11:05 - 000030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
    2019-07-03 22:16 - 2019-04-09 11:03 - 000091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
    2019-07-03 22:16 - 2019-04-09 10:53 - 002651136 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
    2019-07-03 22:16 - 2019-04-09 10:52 - 000709120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
    2019-07-03 22:16 - 2019-04-09 10:52 - 000140288 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
    2019-07-03 22:16 - 2019-04-09 10:52 - 000037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
    2019-07-03 22:16 - 2019-04-09 10:52 - 000037888 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
    2019-07-03 22:16 - 2019-04-09 10:52 - 000036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
    2019-07-03 22:16 - 2019-04-09 10:52 - 000012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
    2019-07-03 22:16 - 2019-04-07 11:17 - 000382976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
    2019-07-03 22:16 - 2019-04-07 11:17 - 000160256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werui.dll
    2019-07-03 22:16 - 2019-04-07 11:03 - 001281536 _____ (Microsoft Corporation) C:\Windows\system32\werconcpl.dll
    2019-07-03 22:16 - 2019-04-07 11:03 - 000486400 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
    2019-07-03 22:16 - 2019-04-07 11:03 - 000174080 _____ (Microsoft Corporation) C:\Windows\system32\werui.dll
    2019-07-03 22:16 - 2019-04-07 11:03 - 000086016 _____ (Microsoft Corporation) C:\Windows\system32\wercplsupport.dll
    2019-07-03 22:16 - 2019-04-07 11:03 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
    2019-07-03 22:16 - 2019-04-07 10:49 - 000054272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe
    2019-07-03 22:16 - 2019-04-07 10:48 - 000028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werdiagcontroller.dll
    2019-07-03 22:16 - 2019-04-07 10:42 - 000475648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxbde40.dll
    2019-07-03 22:16 - 2019-04-07 10:42 - 000376320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mspbde40.dll
    2019-07-03 22:16 - 2019-04-07 10:38 - 000407040 _____ (Microsoft Corporation) C:\Windows\system32\nltest.exe
    2019-07-03 22:16 - 2019-04-07 10:35 - 000050688 _____ (Microsoft Corporation) C:\Windows\system32\wermgr.exe
    2019-07-03 22:16 - 2019-04-07 09:05 - 000634312 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
    2019-07-03 22:16 - 2019-04-04 20:34 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\cryptdll.dll
    2019-07-03 22:16 - 2019-04-04 20:23 - 000057856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdll.dll
    2019-07-03 22:16 - 2019-03-28 21:36 - 000114688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\luafv.sys
    2019-07-03 22:16 - 2019-03-26 20:40 - 003181568 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
    2019-07-03 22:16 - 2019-03-20 22:10 - 000032768 _____ (Microsoft Corporation) C:\Windows\system32\sxssrv.dll
    2019-07-03 22:16 - 2019-03-11 17:41 - 002009600 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
    2019-07-03 22:16 - 2019-03-11 17:41 - 001894912 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
    2019-07-03 22:16 - 2019-03-11 17:41 - 001032192 _____ (Microsoft Corporation) C:\Windows\system32\rdpcore.dll
    2019-07-03 22:16 - 2019-03-11 17:41 - 000688128 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
    2019-07-03 22:16 - 2019-03-11 17:41 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\oleprn.dll
    2019-07-03 22:16 - 2019-03-11 17:41 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
    2019-07-03 22:16 - 2019-03-11 17:41 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
    2019-07-03 22:16 - 2019-03-11 17:33 - 001391616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
    2019-07-03 22:16 - 2019-03-11 17:33 - 001241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
    2019-07-03 22:16 - 2019-03-11 17:33 - 000827904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpcore.dll
    2019-07-03 22:16 - 2019-03-11 17:33 - 000107520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleprn.dll
    2019-07-03 22:16 - 2019-03-11 17:33 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
    2019-07-03 22:16 - 2019-03-11 17:33 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
    2019-07-03 22:16 - 2019-03-04 22:44 - 000076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
    2019-07-03 22:16 - 2019-03-04 22:44 - 000033280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
    2019-07-03 22:16 - 2019-03-04 22:44 - 000030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidusb.sys
    2019-07-03 22:16 - 2019-02-21 11:48 - 000025088 _____ (Microsoft Corporation) C:\Windows\system32\netbtugc.exe
    2019-07-03 22:16 - 2019-02-21 11:43 - 000026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe
    2019-07-03 22:16 - 2019-02-21 11:37 - 000262656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
    2019-07-03 22:16 - 2019-02-16 02:02 - 000972288 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
    2019-07-03 22:16 - 2019-02-16 02:02 - 000443904 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv
    2019-07-03 22:16 - 2019-02-16 01:50 - 000321536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winspool.drv
    2019-07-03 22:16 - 2019-02-15 12:09 - 000355328 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
    2019-07-03 22:16 - 2019-02-15 11:58 - 000320512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll
    2019-07-03 22:16 - 2019-02-15 11:40 - 000415744 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
    2019-07-03 22:16 - 2019-02-15 11:40 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
    2019-07-03 22:16 - 2019-02-15 11:38 - 000360960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
    2019-07-03 22:16 - 2019-02-15 11:38 - 000028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe
    2019-07-03 22:16 - 2019-02-10 12:10 - 001680104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
    2019-07-03 22:16 - 2019-02-10 11:36 - 000328192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
    2019-07-03 22:16 - 2019-02-10 11:36 - 000205312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys
    2019-07-03 22:16 - 2019-02-10 11:36 - 000195584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\exfat.sys
    2019-07-03 22:16 - 2019-02-10 11:35 - 000092672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cdfs.sys
    2019-07-03 22:16 - 2019-02-07 12:06 - 000027648 _____ (Microsoft Corporation) C:\Windows\system32\brdgcfg.dll
    2019-07-03 22:16 - 2019-02-07 12:06 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\bridgeres.dll
    2019-07-03 22:16 - 2019-02-07 12:01 - 000095232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bridge.sys
    2019-07-03 22:16 - 2019-02-07 11:46 - 000020992 _____ (Microsoft Corporation) C:\Windows\system32\bridgeunattend.exe
    2019-07-03 22:16 - 2019-02-03 11:36 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msfs.sys
    2019-07-03 22:16 - 2018-12-07 23:08 - 000095744 _____ (Microsoft Corporation) C:\Windows\system32\rascfg.dll
    2019-07-03 22:16 - 2018-12-07 23:08 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\rasdiag.dll
    2019-07-03 22:16 - 2018-12-07 23:08 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\ndptsp.tsp
    2019-07-03 22:16 - 2018-12-07 23:08 - 000047104 _____ (Microsoft Corporation) C:\Windows\system32\kmddsp.tsp
    2019-07-03 22:16 - 2018-12-07 23:08 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\rasmxs.dll
    2019-07-03 22:16 - 2018-12-07 23:08 - 000029696 _____ (Microsoft Corporation) C:\Windows\system32\rasser.dll
    2019-07-03 22:16 - 2018-12-07 22:56 - 000081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rascfg.dll
    2019-07-03 22:16 - 2018-12-07 22:56 - 000061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasdiag.dll
    2019-07-03 22:16 - 2018-12-07 22:56 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ndptsp.tsp
    2019-07-03 22:16 - 2018-12-07 22:47 - 000088576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
    2019-07-03 22:16 - 2018-12-07 22:47 - 000058368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys
    2019-07-03 22:16 - 2018-12-07 22:47 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndistapi.sys
    2019-07-03 22:16 - 2018-12-07 22:41 - 000038912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kmddsp.tsp
    2019-07-03 22:16 - 2018-12-07 22:41 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasmxs.dll
    2019-07-03 22:16 - 2018-12-07 22:41 - 000022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasser.dll
    2019-07-03 22:16 - 2018-12-04 12:07 - 000194048 _____ (Microsoft Corporation) C:\Windows\system32\itircl.dll
    2019-07-03 22:16 - 2018-12-04 12:07 - 000170496 _____ (Microsoft Corporation) C:\Windows\system32\itss.dll
    2019-07-03 22:16 - 2018-12-04 11:55 - 000158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itircl.dll
    2019-07-03 22:16 - 2018-12-04 11:55 - 000142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itss.dll
    2019-07-03 22:16 - 2018-11-11 13:01 - 000366824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msrpc.sys

    ==================== One month (modified) ========

    (If an entry is included in the fixlist, the file/folder will be moved.)

    2019-07-14 21:30 - 2018-08-23 19:50 - 000000000 ____D C:\Users*\AppData\Roaming\KeePass
    2019-07-14 21:30 - 2018-06-26 13:51 - 000000000 ____D C:\Users*
    \AppData\LocalLow\Mozilla
    2019-07-14 20:55 - 2009-07-14 00:45 - 000021504 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2019-07-14 20:55 - 2009-07-14 00:45 - 000021504 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2019-07-14 20:53 - 2009-07-14 01:13 - 000781790 _____ C:\Windows\system32\PerfStringBackup.INI
    2019-07-14 20:53 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\inf
    2019-07-14 20:48 - 2018-06-26 13:44 - 000000000 ___HD C:\Windows\system32\WLANProfiles
    2019-07-14 20:48 - 2018-06-26 10:21 - 000000000 __SHD C:\Users*\IntelGraphicsProfiles
    2019-07-14 20:47 - 2009-07-14 01:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
    2019-07-14 20:43 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\PolicyDefinitions
    2019-07-14 14:44 - 2018-12-14 00:40 - 000000000 ____D C:\Users*
    \Desktop\My WAV Files
    2019-07-13 16:38 - 2018-08-13 21:54 - 000000000 ____D C:\Users*\AppData\Roaming\audacity
    2019-07-12 20:20 - 2018-07-18 16:20 - 000337872 _____ C:\Windows\system32\FNTCACHE.DAT
    2019-07-12 20:19 - 2018-06-26 13:22 - 000000000 ___SD C:\Windows\system32\CompatTel
    2019-07-12 20:19 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\SysWOW64\Dism
    2019-07-12 20:19 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\system32\Dism
    2019-07-12 20:16 - 2018-06-26 11:10 - 000774404 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
    2019-07-12 20:15 - 2018-06-26 11:19 - 000000000 ____D C:\Windows\system32\MRT
    2019-07-12 15:59 - 2018-06-26 11:19 - 136618864 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
    2019-07-12 13:35 - 2018-08-30 08:09 - 000000000 ____D C:\Users*
    \AppData\Local\Deployment
    2019-07-09 16:05 - 2010-11-20 23:27 - 000741432 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
    2019-07-06 19:24 - 2018-11-10 20:53 - 000002625 _____ C:\Users********\Desktop\To Do.txt
    2019-07-05 00:26 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\rescache
    2019-07-04 00:33 - 2018-06-26 13:22 - 000000000 ____D C:\Windows\system32\appraiser

    ==================== Files in the root of some directories ================

    2018-12-07 01:43 - 2018-12-10 22:26 - 000000600 _____ () C:\Users********\AppData\Local\PUTTY.RND

    ==================== SigCheck ===============================

    (There is no automatic fix for files that do not pass verification.)

    LastRegBack: 2019-07-14 20:21
    ==================== End of FRST.txt ============================
    [HEADING=1]Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-07-2019 01
    Ran by ******** (14-07-2019 21:36:21)
    Running from C:\Users********\Desktop\Virus Removal
    Windows 7 Professional Service Pack 1 (X64) (2018-06-26 13:29:10)
    Boot Mode: Normal[/HEADING]
    ==================== Accounts: =============================

    Administrator (S-1-5-21-3206243102-205974907-2145499838-500 - Administrator - Disabled)
    Guest (S-1-5-21-3206243102-205974907-2145499838-501 - Limited - Disabled)
    HomeGroupUser$ (S-1-5-21-3206243102-205974907-2145499838-1002 - Limited - Enabled)
    ******** (S-1-5-21-3206243102-205974907-2145499838-1000 - Administrator - Enabled) => C:\Users********

    ==================== Security Center ========================

    (If an entry is included in the fixlist, it will be removed.)

    AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    ==================== Installed Programs ======================

    (Only the adware programs with “Hidden” flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

    7-Zip 18.05 (x64 edition) (HKLM...{23170F69-40C1-2702-1805-000001000000}) (Version: 18.05.00.0 - Igor Pavlov)
    Adobe Flash Player 29 NPAPI (HKLM-x32...\Adobe Flash Player NPAPI) (Version: 29.0.0.171 - Adobe Systems Incorporated)
    Adobe Flash Player 32 ActiveX (HKLM-x32...\Adobe Flash Player ActiveX) (Version: 32.0.0.142 - Adobe Systems Incorporated)
    Akai EIE Pro USB Audio driver (HKLM...\USB_AUDIO_DEusb-audio.deAkaiEIE) (Version: - )
    Audacity 2.2.2 (HKLM-x32...\Audacity_is1) (Version: 2.2.2 - Audacity Team)
    Authorizer 2.9.5d1 (HKLM...{F6762963-9AE5-4bc6-A70F-2D749F6AC02F}_is1) (Version: 2.9.5d1 - Propellerhead Software AB)
    Dell Custom Help (HKLM...{BE1CF6CA-3182-45D8-9535-A18055B73607}) (Version: 16.01.1000.0235 - Intel Corporation) Hidden
    Dell SupportAssist (HKLM...{806422F1-FC4E-4D7C-8855-05748AEFC031}) (Version: 3.2.2.119 - Dell Inc.)
    Dell Touchpad (HKLM...{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 8.1200.101.134 - ALPS ELECTRIC CO., LTD.)
    Europa by Reason (HKLM-x32...{24D75A2D-A712-42F7-B71B-2FFF95905C97}_is1) (Version: 2.0.0d84 - Propellerhead Software)
    Foxit Reader (HKLM-x32...\Foxit Reader_is1) (Version: 9.4.1.16828 - Foxit Software Inc.)
    Google Chrome (HKLM-x32...\Google Chrome) (Version: 75.0.3770.142 - Google LLC)
    Google Update Helper (HKLM-x32...{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.34.11 - Google LLC) Hidden
    IDT Audio (HKLM-x32...{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6491.0 - IDT)
    Intel(R) Control Center (HKLM-x32...{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)
    Intel(R) Management Engine Components (HKLM-x32...{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
    Intel(R) Network Connections Drivers (HKLM...\PROSet) (Version: 18.1 - Intel)
    Intel(R) Processor Graphics (HKLM-x32...{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4425 - Intel Corporation)
    Intel® PROSet/Wireless Software (HKLM-x32...{b6b417a3-1f40-4618-aadd-49628bda7836}) (Version: 16.1.1 - Intel Corporation)
    IrfanView 4.51 (32-bit) (HKLM-x32...\IrfanView) (Version: 4.51 - Irfan Skiljan)
    KeePass Password Safe 2.39.1 (HKLM-x32...\KeePassPasswordSafe2_is1) (Version: 2.39.1 - Dominik Reichl)
    LAME v3.99.3 (for Windows) (HKLM-x32...\LAME_is1) (Version: - )
    Line 6 Uninstaller (HKLM-x32...\Line 6 Uninstaller) (Version: - Line 6)
    Microsoft .NET Framework 4.7.2 (HKLM...{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.03062 - Microsoft Corporation)
    Microsoft Office 2010 Service Pack 1 (SP1) (HKLM-x32...{90140000-003D-0000-0000-0000000FF1CE}Office14.SingleImage{047B0968-E622-4FAA-9B4B-121FA109EDDE}) (Version: - Microsoft)
    Microsoft Office Home and Business 2010 (HKLM-x32...\Office14.SingleImage) (Version: 14.0.6029.1000 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM...{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32...{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
    Microsoft Visual C++ 2017 Redistributable (x64) - 14.15.26706 (HKLM-x32...{95ac1cfa-f4fb-4d1b-8912-7f9d5fbb140d}) (Version: 14.15.26706.0 - Microsoft Corporation)
    Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (HKLM-x32...{7e9fae12-5bbf-47fb-b944-09c49e75c061}) (Version: 14.15.26706.0 - Microsoft Corporation)
    MixMeister Pro 5 (HKLM-x32...{4920CF11-4A79-4D8D-B643-58E0611FC106}) (Version: 5.1.2.0 - MixMeister Technology LLC)
    Mozilla Firefox 68.0 (x64 en-US) (HKLM...\Mozilla Firefox 68.0 (x64 en-US)) (Version: 68.0 - Mozilla)
    Mozilla Maintenance Service (HKLM...\MozillaMaintenanceService) (Version: 68.0 - Mozilla)
    Neutron 2 Advanced (HKLM-x32...\Neutron 2) (Version: 2.00 - iZotope, Inc.)
    Notepad++ (32-bit x86) (HKLM-x32...\Notepad++) (Version: 7.5.6 - Notepad++ Team)
    Ozone 8 Advanced (HKLM-x32...\Ozone 8) (Version: 8.00 - iZotope, Inc.)
    Panda Cloud Cleaner (HKLM-x32...{92B2B132-C7F0-43DC-921A-4493C04F78A4}_is1) (Version: 1.1.10 - Panda Security)
    PL2303 USB-to-Serial (HKLM-x32...{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}) (Version: 1.20.00 - Prolific Technology INC)
    PuTTY release 0.70 (64-bit) (HKLM...{45B3032F-22CC-40CD-9E97-4DA7095FA5A2}) (Version: 0.70.0.0 - Simon Tatham)
    Reason 10 10.4.0d4 (HKLM...\Reason10.0Stable_64_is1) (Version: 10.4.0d4 - Propellerhead Software AB)
    Reason 8 8.3.2d7 (HKLM...\Reason8.0Stable_64_is1) (Version: 8.3.2d7 - Propellerhead Software AB)
    Skype version 8.29 (HKLM-x32...\Skype_is1) (Version: 8.29 - Skype Technologies S.A.)
    Visioneer Acuity Assets V1 (HKLM-x32...{AAF91E62-A45B-489B-9C98-3E8C06EBB74F}) (Version: 5.1.1516.6024 - Visioneer Inc.)
    Visioneer RoadWarrior 3 Series 5.1.216.4185 & Visioneer Acuity Assets V1 5.1.1516.6024 (HKLM-x32...{e6789094-a487-4886-953d-084857169a2e}) (Version: 5.1.216.6025 - Visioneer Inc.)
    Visioneer RoadWarrior 3 Series Driver (HKLM-x32...{88374377-FCCE-498B-AD19-D72D755F0D46}) (Version: 5.1.216.4185 - Visioneer Inc.)
    VLC media player (HKLM...\VLC media player) (Version: 3.0.6 - VideoLAN)
    Winamp (HKLM-x32...\Winamp) (Version: 5.666 - Nullsoft, Inc)

    ==================== Custom CLSID (Whitelisted): ==========================

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    ContextMenuHandlers1: [7-Zip] → {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2018-04-30] (Igor Pavlov) [File not signed]
    ContextMenuHandlers1: [ANotepad++64] → {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files (x86)\Notepad++\NppShell_06.dll [2018-03-18] (Notepad++ → )
    ContextMenuHandlers1: [Foxit_ConvertToPDF_Reader] → {A94757A0-0226-426F-B4F1-4DF381C630D3} => C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\ConvertToPDFShellExtension_x64.dll [2018-12-25] (Foxit Software Incorporated → Foxit Software Inc.)
    ContextMenuHandlers4: [7-Zip] → {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2018-04-30] (Igor Pavlov) [File not signed]
    ContextMenuHandlers5: [igfxcui] → {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => → No File
    ContextMenuHandlers5: [igfxDTCM] → {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\Windows\system32\igfxDTCM.dll [2016-06-02] (Microsoft Windows Hardware Compatibility Publisher → Intel Corporation)
    ContextMenuHandlers6: [7-Zip] → {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2018-04-30] (Igor Pavlov) [File not signed]
    ContextMenuHandlers6: [Foxit_ConvertToPDF_Reader] → {A94757A0-0226-426F-B4F1-4DF381C630D3} => C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\ConvertToPDFShellExtension_x64.dll [2018-12-25] (Foxit Software Incorporated → Foxit Software Inc.)

    ==================== Shortcuts & WMI ========================

    (The entries could be listed to be restored or removed.)

    WMI:subscription__FilterToConsumerBinding->CommandLineEventConsumer.Name="BVTConsumer"“,Filt er=”__EventFilter.Name="BVTFilter"::
    WMI:subscription__EventFilter->BVTFilter::[Query => SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “Win32_Processor” AND TargetInstance.LoadPercentage > 99]
    WMI:subscription\CommandLineEventConsumer->BVTConsumer::[CommandLineTemplate => cscript KernCap.vbs][WorkingDirectory => C:\tools\kernrate]

    ==================== Loaded Modules (Whitelisted) ==============

    2002-09-02 10:51 - 2002-09-02 10:51 - 000049152 _____ (GEAR Software) [File not signed] C:\Windows\SysWOW64\gearsec.exe
    2018-04-30 17:00 - 2018-04-30 17:00 - 000075776 _____ (Igor Pavlov) [File not signed] C:\Program Files\7-Zip\7-zip.dll
    2013-08-27 14:32 - 2013-08-27 14:32 - 000747520 _____ (Intel(R) Corporation) [File not signed] C:\Program Files\Intel\iCLS Client\HeciServer.exe
    2018-03-26 14:07 - 2018-03-26 14:07 - 000126976 _____ (Microsoft Corporation) [File not signed] C:\Windows\Microsoft.Net\assembly\GAC_64\System.En terpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\Sy stem.EnterpriseServices.Wrapper.dll
    2018-10-29 20:45 - 2018-10-29 20:45 - 000246784 _____ (Visioneer Inc.) [File not signed] C:\Program Files\Visioneer\RWAR3\RWAR3Monitor.exe

    ==================== Alternate Data Streams (Whitelisted) =========

    (If an entry is included in the fixlist, only the ADS will be removed.)

    ==================== Safe Mode (Whitelisted) ===================

    (If an entry is included in the fixlist, it will be removed from the registry. The “AlternateShell” will be restored.)

    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\Wdf01000.sys => “”=“Driver”
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\Wdf01000.sys => “”=“Driver”

    ==================== Association (Whitelisted) ===============

    (If an entry is included in the fixlist, the registry item will be restored to default or removed.)

    ==================== Internet Explorer trusted/restricted ===============

    (If an entry is included in the fixlist, it will be removed from the registry.)

    IE trusted site: HKU.DEFAULT...\dell.com → dell.com
    IE trusted site: HKU.DEFAULT...\localhost → localhost
    IE trusted site: HKU.DEFAULT...\webcompanion.com → hxxp://webcompanion.com
    IE trusted site: HKU\S-1-5-21-3206243102-205974907-2145499838-1000...\localhost → localhost
    IE trusted site: HKU\S-1-5-21-3206243102-205974907-2145499838-1000...\webcompanion.com → hxxp://webcompanion.com

    ==================== Hosts content: ===============================

    (If needed Hosts: directive could be included in the fixlist to reset Hosts.)

    2009-07-13 22:34 - 2009-06-10 17:00 - 000000824 _____ C:\Windows\system32\drivers\etc\hosts

    ==================== Other Areas ============================

    (Currently there is no automatic fix for this section.)

    HKLM\System\CurrentControlSet\Control\Session Manager\Environment\Path → C:\Program Files (x86)\Intel\iCLS Client;C:\Program Files\Intel\iCLS Client;%SystemRoot%\system32;%SystemRoot%;%SystemR oot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPo werShell\v1.0;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files\Intel\WiFi\bin;C:\Program Files\Common Files\Intel\WirelessCommon;C:\Program Files\PuTTY
    HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Control Panel\Desktop\Wallpaper →
    DNS Servers: 209.18.47.62 - 209.18.47.61
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Pol icies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
    Windows Firewall is enabled.

    ==================== MSCONFIG/TASK MANAGER disabled items ==

    If an entry is included in the fixlist, it will be removed.

    ==================== FirewallRules (Whitelisted) ===============

    (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

    FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe (Microsoft Windows → Microsoft Corporation)
    FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe (Microsoft Windows → Microsoft Corporation)
    FirewallRules: [{DA3FC957-B91F-4B12-B5BC-387B37AEA4A6}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe (Intel Corporation-Mobile Wireless Group → )
    FirewallRules: [{1146613B-9846-4149-AAA7-EED5F9DCFA35}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe (Nullsoft Inc. → Nullsoft, Inc.)
    FirewallRules: [{4EB93D04-534E-4F05-A655-E0F1761C493A}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe (Nullsoft Inc. → Nullsoft, Inc.)
    FirewallRules: [{0C0AE79B-9F67-4A86-97AC-E8426F18CF32}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe (Skype Software Sarl → Skype Technologies S.A.)
    FirewallRules: [{DE9D6E7A-D0B8-4848-8BF5-DC7A0C3DD432}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe (Skype Software Sarl → Skype Technologies S.A.)
    FirewallRules: [{DD6A69A7-6F4D-4C94-93A3-EFD897DCD692}] => (Allow) C:\Users*\AppData\Roaming\uTorrent\uTorrent.exe No File
    FirewallRules: [{D0C21295-8A4D-4AAF-867C-F5606173A37E}] => (Allow) C:\Users*
    \AppData\Roaming\uTorrent\uTorrent.exe No File
    FirewallRules: [{43FE1F9D-0162-42B6-B9BC-30E45CEDC654}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC → Google LLC)
    FirewallRules: [{D68D42A9-3E58-4D9B-AE65-CF5B89CA74E3}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation → Mozilla Corporation)
    FirewallRules: [{7E0A3784-7574-4AB4-8A3D-34EFA74CB711}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation → Mozilla Corporation)

    ==================== Restore Points =========================

    12-07-2019 15:59:37 Windows Update
    12-07-2019 20:25:39 Windows Update
    14-07-2019 20:29:27 Windows Update

    ==================== Faulty Device Manager Devices =============

    Name:
    Description:
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click “Update Driver”, which starts the Hardware Update wizard.

    Name: Broadcom USH w/swipe sensor
    Description: Broadcom USH w/swipe sensor
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click “Update Driver”, which starts the Hardware Update wizard.

    Name: Broadcom USH
    Description: Broadcom USH
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click “Update Driver”, which starts the Hardware Update wizard.

    Name: Universal Serial Bus (USB) Controller
    Description: Universal Serial Bus (USB) Controller
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click “Update Driver”, which starts the Hardware Update wizard.

    Name: Visioneer RoadWarrior 3 Series
    Description: Visioneer RoadWarrior 3 Series
    Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
    Manufacturer: Visioneer Incorporated
    Service: StillCam
    Problem: : This device is disabled. (Code 22)
    Resolution: In Device Manager, click “Action”, and then click “Enable Device”. This starts the Enable Device wizard. Follow the instructions.

    ==================== Event log errors: =========================
    [HEADING=1]Application errors:[/HEADING]
    Error: (07/14/2019 08:47:55 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: Event filter with query “SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “Win32_Processor” AND TargetInstance.LoadPercentage > 99” could not be reactivated in namespace “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

    Error: (07/12/2019 01:16:55 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: Event filter with query “SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “Win32_Processor” AND TargetInstance.LoadPercentage > 99” could not be reactivated in namespace “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

    Error: (07/16/2019 01:13:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: Event filter with query “SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “Win32_Processor” AND TargetInstance.LoadPercentage > 99” could not be reactivated in namespace “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

    Error: (07/12/2019 08:20:20 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: Event filter with query “SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “Win32_Processor” AND TargetInstance.LoadPercentage > 99” could not be reactivated in namespace “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

    Error: (07/12/2019 03:53:39 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: Event filter with query “SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “Win32_Processor” AND TargetInstance.LoadPercentage > 99” could not be reactivated in namespace “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

    Error: (07/11/2019 03:33:44 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: Event filter with query “SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “Win32_Processor” AND TargetInstance.LoadPercentage > 99” could not be reactivated in namespace “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

    Error: (07/11/2019 01:13:28 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: Event filter with query “SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “Win32_Processor” AND TargetInstance.LoadPercentage > 99” could not be reactivated in namespace “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

    Error: (07/11/2019 10:20:51 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: Event filter with query “SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA “Win32_Processor” AND TargetInstance.LoadPercentage > 99” could not be reactivated in namespace “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.
    [HEADING=1]System errors:[/HEADING]
    Error: (07/14/2019 08:53:22 PM) (Source: Application Popup) (EventID: 1060) (User: )
    Description: \SystemRoot\System32\DRIVERS\PSKMAD.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

    Error: (07/14/2019 08:47:35 PM) (Source: Application Popup) (EventID: 1060) (User: )
    Description: \SystemRoot\SysWow64\DRIVERS\GEARAspiWDM.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

    Error: (07/14/2019 08:16:52 PM) (Source: Microsoft-Windows-Time-Service) (EventID: 34) (User: NT AUTHORITY)
    Description: The time service has detected that the system time needs to be changed by 431993 seconds. The time service will not change the system time by more than 54000 seconds. Verify that your time and time zone are correct, and that the time source time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->13.65.245.138:123) is working properly.

    Error: (07/12/2019 01:16:57 PM) (Source: Serial) (EventID: 45) (User: )
    Description: The serial driver detected a hardware failure on device \Device\Serial0 and will disable this device.

    Error: (07/12/2019 01:16:49 PM) (Source: Application Popup) (EventID: 1060) (User: )
    Description: \SystemRoot\SysWow64\DRIVERS\GEARAspiWDM.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

    Error: (07/16/2019 01:12:59 PM) (Source: Application Popup) (EventID: 1060) (User: )
    Description: \SystemRoot\SysWow64\DRIVERS\GEARAspiWDM.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

    Error: (07/15/2019 04:09:26 AM) (Source: NetBT) (EventID: 4321) (User: )
    Description: The name “********-PC :0” could not be registered on the interface with IP address 172.27.0.76.
    The computer with the IP address 172.27.0.81 did not allow the name to be claimed by
    this computer.

    Error: (07/15/2019 04:09:26 AM) (Source: NetBT) (EventID: 4321) (User: )
    Description: The name “********-PC :20” could not be registered on the interface with IP address 172.27.0.76.
    The computer with the IP address 172.27.0.81 did not allow the name to be claimed by
    this computer.
    [HEADING=1]Windows Defender:[/HEADING]
    Date: 2018-07-18 15:54:53.741
    Description:
    Windows Defender has encountered an error trying to update signatures.
    New Signature Version:1.271.1054.0
    Previous Signature Version:1.269.1075.0
    Update Source:User
    Signature Type:AntiSpyware
    Update Typeelta
    Current Engine Version:1.1.15000.2
    Previous Engine Version:1.1.14901.4
    Error code:0x80070666
    Error description:Another version of this product is already installed. Installation of this version cannot continue. To configure or remove the existing version of this product, use Add/Remove Programs on the Control Panel.

    Date: 2018-07-18 15:54:53.740
    Description:
    Windows Defender has encountered an error trying to update the engine.
    New Engine Version:1.1.15000.2
    Previous Engine Version:1.1.14901.4
    Update Source:User
    Error Code:0x80070666
    Error description:Another version of this product is already installed. Installation of this version cannot continue. To configure or remove the existing version of this product, use Add/Remove Programs on the Control Panel.

    ==================== Memory info ===========================

    BIOS: Dell Inc. A09 12/13/2012
    Motherboard: Dell Inc. 08KTFF
    Processor: Intel(R) Core™ i7-3520M CPU @ 2.90GHz
    Percentage of memory in use: 31%
    Total physical RAM: 16254.88 MB
    Available physical RAM: 11195.27 MB
    Total Virtual: 32507.9 MB
    Available Virtual: 26815.71 MB

    ==================== Drives ================================

    Drive c: () (Fixed) (Total:200 GB) (Free:14.41 GB) NTFS
    Drive f: (New Volume) (Fixed) (Total:97.99 GB) (Free:31.2 GB) NTFS

    \?\Volume{f4de852a-795c-11e8-9560-806e6f6e6963}\ (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS

    ==================== MBR & Partition Table ==================

    ================================================== ======
    Disk: 0 (MBR Code: Windows 7/8/10) (Size: 476.9 GB) (Disk ID: 523D5AD0)
    Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=200 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=98 GB) - (Type=07 NTFS)

    ==================== End of Addition.txt ============================
    [HEADING=1]aswMBR version 1.0.1.2290 Copyright(c) 2014 AVAST Software
    Run date: 2019-07-14 21:41:38[/HEADING]
    21:41:38.679 OS Version: Windows x64 6.1.7601 Service Pack 1
    21:41:38.679 Number of processors: 4 586 0x3A09
    21:41:38.680 ComputerName: STEVE-PC UserName: Steve
    21:41:39.181 Initialize success
    21:41:39.192 VM: initialized successfully
    21:41:39.192 VM: Intel CPU supported
    21:41:49.027 VM: disk I/O iaStorV.sys
    21:44:58.270 AVAST engine defs: 17030301
    21:46:48.826 Disk 0 (boot) \Device\Harddisk0\DR0 → \Device\Ide\IAAStorageDevice-1
    21:46:48.830 Disk 0 Vendor: SanDisk_ X218 Size: 488386MB BusType: 8
    21:46:48.847 Disk 0 MBR read successfully
    21:46:48.852 Disk 0 MBR scan
    21:46:48.859 Disk 0 Windows 7 default MBR code
    21:46:48.862 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
    21:46:48.865 Disk 0 default boot code
    21:46:48.869 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 204800 MB offset 206848
    21:46:48.873 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 100342 MB offset 419637248
    21:46:48.886 Disk 0 scanning C:\Windows\system32\drivers
    21:46:51.499 Service scanning
    21:46:58.074 Modules scanning
    21:46:58.084 Disk 0 trace - called modules:
    21:46:58.099 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStorV.sys hal.dll
    21:46:58.103 1 nt!IofCallDriver → \Device\Harddisk0\DR0[0xfffffa800db37060]
    21:46:58.106 3 CLASSPNP.SYS[fffff880019cd43f] → nt!IofCallDriver → \Device\Ide\IAAStorageDevice-1[0xfffffa800d545050]
    21:46:58.661 AVAST engine scan C:\Windows
    21:46:59.008 AVAST engine scan C:\Windows\system32
    21:47:58.674 AVAST engine scan C:\Windows\system32\drivers
    21:48:02.043 AVAST engine scan C:\Users\Steve
    21:48:50.602 AVAST engine scan C:\ProgramData
    21:48:54.225 Disk 0 statistics 3842503/0/0 @ 37.44 MB/s
    21:48:54.231 Scan finished successfully
    21:50:11.910 Disk 0 MBR has been saved successfully to “C:\Users\Steve\Desktop\Virus Removal\MBR.dat”
    21:50:11.913 The log file has been saved successfully to “C:\Users\Steve\Desktop\Virus Removal\aswMBR.txt”
  • Malnutrition
    PCHF Moderator
    • Jul 2016
    • 7045

    #2
    Download Quick Diag to your desktop.
    Very Important!! – Make sure program is on your desktop.
    Disable your Antivirus/Antispyware prior to scanning.
    Right Click Run as Administrator.
    Select the Quick Scan.





    Post the log that is generated in your next post.

    Comment

    • Malnutrition
      PCHF Moderator
      • Jul 2016
      • 7045

      #3
      Drive c: () (Fixed) (Total:200 GB) (Free:14.41 GB) NTFS

      Time to free up some space on your HDD, windows needs at least 15% free space…

      It's a bad idea to fill a Windows system drive completely full, and this could cause a variety of problems.

      Comment

      • Fla_Panther
        PCHF Member
        • Sep 2016
        • 38

        #4
        Re: C drive … yes, I know. I just bought a 512GB SSD two weeks ago and cloned my drive over to it. Haven’t had time to extend the partition yet. And I came home last night to find my bathroom sink’s faucet is broken, so that’s taken priority. It’s always something, isn’t it?

        --------------- QuickDiag | g3n-h@ckm@n | V5_27.02.19.1 ---------------

        ----- XP | Vista | 7 | 8 | 8.1 | 10 - 32/64 bits ----- - Start 15/07/2019 10:40:00

        Updated 27/02/2019 | 11:10 (GMT) by g3n-h@ckm@n
        Contact : http://www.sosvirus.net/

        Time Zone : (UTC-05:00) Eastern Time (US & Canada)
        [******** (Administrator)] - [********-PC] (S-1-5-21-3206243102-205974907-2145499838-1000)

        System: Microsoft Windows 7 Professional - Service Pack 1 - (6.1.7601) - BuildType: Multiprocessor Free -

        OSLanguage: 1033 (0409) → ()
        System: AutoReboot: True - DebugFilePath: %SystemRoot%\MEMORY.DMP - KernelDumpOnly: False -

        OverwriteExistingDebugFile: True - WriteDebugInfo: True - WriteToSystemLog: True
        Boot : Microsoft Windows 7 Professional |C:\Windows|\Device\Harddisk0\Partition2
        Boot : Normal boot
        PC: Latitude E6430 - Dell Inc. - IdNumber: JS7MTW1 - UUID: 4C4C4544-0053-3710-804D-CAC04F545731
        Processor : X64 - 2890 Mhz - Intel(R) Core™ i7-3520M CPU @ 2.90GHz
        BIOS Date: 12/13/12 20:36:48 Ver: A09.00 - en|US|iso8859-1 - Dell Inc. - S/N: JS7MTW1 - A09 - DELL - 1072009
        CoreTemp : 63.5 Celsius

        ----------| Quick

        ---------- | SoundDevice

        Akai EIE Pro Audio - WDM 2.9.30 - Status: OK - Manufacturer: Akai Professional - PNPDeviceID: MEDIA

        \AKAI_EIE_AUDIOADAPTER\8&1EF45D8F&0&ID01
        Intel(R) Display Audio - Status: OK - Manufacturer: Intel(R) Corporation - PNPDeviceID: HDAUDIO

        \FUNC_01&VEN_8086&DEV_2806&SUBSYS_80860101&REV_100 0\4&1A5CB910&0&0301
        IDT High Definition Audio CODEC - Status: OK - Manufacturer: IDT - PNPDeviceID: HDAUDIO

        \FUNC_01&VEN_111D&DEV_76DF&SUBSYS_10280534&REV_100 2\4&1A5CB910&0&0001

        ---------- | Video

        Intel(R) HD Graphics 4000 - Resolution: 1280x1024 - Colors: 4294967296 - RefreshRate: 60 - 32 Bits Per Pixel -

        DeviceID: VideoController1 - Drivers:

        igdumdim64.dll,igd10iumd64.dll,igd10iumd64.dll,igd umdim32,igd10iumd32,igd10iumd32 - PNPDeviceID: PCI

        \VEN_8086&DEV_0166&SUBSYS_05341028&REV_09\3&115836 59&0&10 - AdapterCompatibility: Intel Corporation - RAM: -

        2080374784
        Inegrated Video Chipset DeviceName: Intel(R) HD Graphics 4000 - DriverVersion: 10.18.10.4425 -

        SpecificationVersion: 1025

        ---------- | Codecs

        c:\windows\system32\imaadp32.acm - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 22016 -

        Manufacturer: Microsoft Corporation - Status: OK
        c:\windows\system32\msadp32.acm - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 24064 - Manufacturer:

        Microsoft Corporation - Status: OK
        c:\windows\system32\iyuv_32.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 54272 - Manufacturer:

        Microsoft Corporation - Status: OK
        c:\windows\system32\tsbyuv.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 14848 - Manufacturer:

        Microsoft Corporation - Status: OK
        c:\windows\system32\msgsm32.acm - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 29184 - Manufacturer:

        Microsoft Corporation - Status: OK
        c:\windows\system32\l3codeca.acm - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 81408 -

        Manufacturer: Fraunhofer Institut Integrierte Schaltungen IIS - Status: OK
        c:\windows\system32\msrle32.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 16384 - Manufacturer:

        Microsoft Corporation - Status: OK
        c:\windows\system32\msg711.acm - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 14848 - Manufacturer:

        Microsoft Corporation - Status: OK
        c:\windows\system32\msvidc32.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 38912 -

        Manufacturer: Microsoft Corporation - Status: OK
        c:\windows\system32\msyuv.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 25600 - Manufacturer:

        Microsoft Corporation - Status: OK

        ---------- | CPU

        CPU #1 value:6 %
        CPU #2 value:18 %
        CPU #3 value:0 %
        CPU #4 value:6 %
        Total Overall CPU Usage value:7 %

        ---------- | Network

        Intel[R] 82579LM Gigabit Network Connection : SENT:0 bytes/sec / RECVD:0 bytes/sec
        Intel[R] Centrino[R] Advanced-N 6205 : SENT:0 bytes/sec / RECVD:0 bytes/sec
        Microsoft Virtual WiFi Miniport Adapter : SENT:0 bytes/sec / RECVD:0 bytes/sec
        Microsoft Virtual WiFi Miniport Adapter _2 : SENT:0 bytes/sec / RECVD:0 bytes/sec
        isatap.{41B84864-2D3D-4D17-B09E-E347F560F7F7} : SENT:0 bytes/sec / RECVD:0 bytes/sec
        isatap.{3D0D15B6-5A19-4873-88B7-D9B5B9D67406} : SENT:0 bytes/sec / RECVD:0 bytes/sec
        isatap.{AFE20685-E901-42C7-A0EA-94EC69D7938C} : SENT:0 bytes/sec / RECVD:0 bytes/sec
        isatap.mifi.local : SENT:0 bytes/sec / RECVD:0 bytes/sec

        Overall → SEND Maxium:7 bytes/sec, / RECEIVE Maximum:0 bytes/sec

        WAN Miniport (SSTP) - - Microsoft - Status: - PnPID : ROOT\MS_SSTPMINIPORT\0000
        WAN Miniport (IKEv2) - - Microsoft - Status: - PnPID : ROOT\MS_AGILEVPNMINIPORT\0000
        WAN Miniport (L2TP) - - Microsoft - Status: - PnPID : ROOT\MS_L2TPMINIPORT\0000
        WAN Miniport (PPTP) - - Microsoft - Status: - PnPID : ROOT\MS_PPTPMINIPORT\0000
        WAN Miniport (PPPOE) - - Microsoft - Status: - PnPID : ROOT\MS_PPPOEMINIPORT\0000
        WAN Miniport (IPv6) - - Microsoft - Status: - PnPID : ROOT\MS_NDISWANIPV6\0000
        WAN Miniport (Network Monitor) - - Microsoft - Status: - PnPID : ROOT\MS_NDISWANBH\0000
        Realtek USB GBE Family Controller - - - Status: - PnPID :
        WAN Miniport (IP) - - Microsoft - Status: - PnPID : ROOT\MS_NDISWANIP\0000
        Microsoft ISATAP Adapter - Tunnel - Microsoft - Status: - PnPID : ROOT*ISATAP\0000
        RAS Async Adapter - - - Status: - PnPID :
        Microsoft 6to4 Adapter - Tunnel - Microsoft - Status: - PnPID : ROOT*6TO4MP\0000
        Intel(R) 82579LM Gigabit Network Connection - Ethernet 802.3 - Intel - Status: - PnPID : PCI

        \VEN_8086&DEV_1502&SUBSYS_05341028&REV_04\3&115836 59&0&C8
        Microsoft ISATAP Adapter #2 - Tunnel - Microsoft - Status: - PnPID : ROOT*ISATAP\0001
        Intel(R) Centrino(R) Advanced-N 6205 - Ethernet 802.3 - Intel Corporation - Status: - PnPID : PCI

        \VEN_8086&DEV_0082&SUBSYS_13218086&REV_34\4&752EA0 2&0&00E1
        Microsoft ISATAP Adapter #3 - Tunnel - Microsoft - Status: - PnPID : ROOT*ISATAP\0002
        Microsoft Virtual WiFi Miniport Adapter - Ethernet 802.3 - Microsoft - Status: - PnPID : {5D624F94-8850-40C3-

        A3FA-A4FD2080BAF3}\VWIFIMP\5&424B243&0&01
        Microsoft Virtual WiFi Miniport Adapter #2 - Ethernet 802.3 - Microsoft - Status: - PnPID : {5D624F94-8850-

        40C3-A3FA-A4FD2080BAF3}\VWIFIMP\5&424B243&0&02
        Microsoft ISATAP Adapter #5 - Tunnel - Microsoft - Status: - PnPID : ROOT*ISATAP\0004

        ---------- | Memory

        RAM = Total (MB) : 16645 | Free (MB) : 11248
        Pagefile = Total (MB) : 33288 | Free (MB) : 27351
        Virtual = Total (MB) : 4194 | Free (MB) : 3966

        Physical Memory 0 : Capacity: 8589934592 - ChannelA-DIMM0 - Posit.: 1 - Manufacturer: Samsung - PartNumber:

        M471B1G73QH0-YK0 - S/N: 16D8CB97
        Physical Memory 1 : Capacity: 8589934592 - ChannelB-DIMM0 - Posit.: 2 - Manufacturer: Samsung - PartNumber:

        M471B1G73QH0-YK0 - S/N: 16D8CB97

        ---------- | SID Users

        Administrator : [S-1-5-21-3206243102-205974907-2145499838-500]
        Guest : [S-1-5-21-3206243102-205974907-2145499838-501]
        HomeGroupUser$ : [S-1-5-21-3206243102-205974907-2145499838-1002]
        ******** : [S-1-5-21-3206243102-205974907-2145499838-1000]
        Administrators : [S-1-5-32-544]
        Backup Operators : [S-1-5-32-551]
        Cryptographic Operators : [S-1-5-32-569]
        Distributed COM Users : [S-1-5-32-562]
        Event Log Readers : [S-1-5-32-573]
        Guests : [S-1-5-32-546]
        IIS_IUSRS : [S-1-5-32-568]
        Network Configuration Operators : [S-1-5-32-556]
        Performance Log Users : [S-1-5-32-559]
        Performance Monitor Users : [S-1-5-32-558]
        Power Users : [S-1-5-32-547]
        Remote Desktop Users : [S-1-5-32-555]
        Replicator : [S-1-5-32-552]
        Users : [S-1-5-32-545]
        HomeUsers : [S-1-5-21-3206243102-205974907-2145499838-1001]

        ---------- | SystemAccounts

        Name: Everyone - SID: S-1-1-0 - SIDType: 5 - Status: OK
        Name: LOCAL - SID: S-1-2-0 - SIDType: 5 - Status: OK
        Name: CREATOR OWNER - SID: S-1-3-0 - SIDType: 5 - Status: OK
        Name: CREATOR GROUP - SID: S-1-3-1 - SIDType: 5 - Status: OK
        Name: CREATOR OWNER SERVER - SID: S-1-3-2 - SIDType: 5 - Status: OK
        Name: CREATOR GROUP SERVER - SID: S-1-3-3 - SIDType: 5 - Status: OK
        Name: OWNER RIGHTS - SID: S-1-3-4 - SIDType: 5 - Status: OK
        Name: DIALUP - SID: S-1-5-1 - SIDType: 5 - Status: OK
        Name: NETWORK - SID: S-1-5-2 - SIDType: 5 - Status: OK
        Name: BATCH - SID: S-1-5-3 - SIDType: 5 - Status: OK
        Name: INTERACTIVE - SID: S-1-5-4 - SIDType: 5 - Status: OK
        Name: SERVICE - SID: S-1-5-6 - SIDType: 5 - Status: OK
        Name: ANONYMOUS LOGON - SID: S-1-5-7 - SIDType: 5 - Status: OK
        Name: PROXY - SID: S-1-5-8 - SIDType: 5 - Status: OK
        Name: SYSTEM - SID: S-1-5-18 - SIDType: 5 - Status: OK
        Name: ENTERPRISE DOMAIN CONTROLLERS - SID: S-1-5-9 - SIDType: 5 - Status: OK
        Name: SELF - SID: S-1-5-10 - SIDType: 5 - Status: OK
        Name: Authenticated Users - SID: S-1-5-11 - SIDType: 5 - Status: OK
        Name: RESTRICTED - SID: S-1-5-12 - SIDType: 5 - Status: OK
        Name: TERMINAL SERVER USER - SID: S-1-5-13 - SIDType: 5 - Status: OK
        Name: REMOTE INTERACTIVE LOGON - SID: S-1-5-14 - SIDType: 5 - Status: OK
        Name: IUSR - SID: S-1-5-17 - SIDType: 5 - Status: OK
        Name: LOCAL SERVICE - SID: S-1-5-19 - SIDType: 5 - Status: OK
        Name: NETWORK SERVICE - SID: S-1-5-20 - SIDType: 5 - Status: OK
        Name: BUILTIN - SID: S-1-5-32 - SIDType: 3 - Status: OK

        ---------- | Drives

        C:\ → [Fixed] | | Total : 200 Go | Free : 14.19 Go → NTFS (SSD) [RAID]
        F:\ → [Fixed] | [New Volume] | Total : 97.99 Go | Free : 31.2 Go → NTFS (SSD) [RAID]

        Disk Usage Information [1 total Physical Disks]

        Physical Drive #0 [C:, F:] : Read:0 bytes/sec, Written:0 bytes/sec Max Read:0 bytes/sec, Max Write:0 bytes/sec

        Overall - Read Maximum:0 bytes/sec, Write Maximum:0 bytes/sec

        DeviceID: \.\PHYSICALDRIVE0 - Status: OK - SCSI - Fixed hard disk media - 3 Part. - PnPID : IDE

        \DISKSANDISK_SD7SB2Q-512G-1006_______________X2180006\4&241BACD1&0&0.0.0

        ---------- | Windows updates - Activation - License

        W.A.T :

        Last detection : 2019-07-15 00:12:22
        Downloaded last ones : 2019-07-15 00:29:24
        Installed last ones : 2019-07-15 00:30:27
        Next search : 2019-07-15 21:18:22

        Test 1 : Windows Is Activated

        Volume License

        ---------- | Browsers

        IE : 11.0.9600.19404 (© Microsoft Corporation.)
        GC : 75.0.3770.142 (Copyright 2019 Google LLC.)

        Default : “C:\Program Files\Internet Explorer\iexplore.exe”

        ---------- | FlashPlayer

        FlashPlayer ActiveX : 32.0.0.142
        FlashPlayer Plugin : 29.0.0.171

        ---------- | Security

        AV :
        AS : Windows Defender Disabled
        FW : WINDOWS Firewall
        WMI : OK
        WU: Windows Update Service [Auto(2)] = Running
        AS: Windows Defender [Manual(3)] = stopped
        WMI: Windows Management Instrumentation [Auto(2)] = Running

        ---------- | Running processes

        296 | [Owner : SYSTEM | Parent : 4(System) | 1.37 Mo] - (.Microsoft Corporation - Windows Session Manager.) -

        (6.1.7601.24499) = C:\Windows\System32\smss.exe [12/07/2019 15:59:26] CPU Usage:0 %
        404 | [Owner : SYSTEM | Parent : 372() | 5.02 Mo] - (.Microsoft Corporation - Client Server Runtime Process.)
        • (6.1.7600.16385) = C:\Windows\System32\csrss.exe [13/07/2009 19:19:49] CPU Usage:0 %
          448 | [Owner : SYSTEM | Parent : 372() | 4.86 Mo] - (.Microsoft Corporation - Windows Start-Up Application.) -

        (6.1.7600.16385) = C:\Windows\System32\wininit.exe [13/07/2009 19:52:37] CPU Usage:0 %
        464 | [Owner : SYSTEM | Parent : 456() | 56.34 Mo] - (.Microsoft Corporation - Client Server Runtime Process.)
        • (6.1.7600.16385) = C:\Windows\System32\csrss.exe [13/07/2009 19:19:49] CPU Usage:0 %
          512 | [Owner : SYSTEM | Parent : 448(wininit.exe) | 10.82 Mo] - (.Microsoft Corporation - Services and

        Controller app.) - (6.1.7601.18829) = C:\Windows\System32\services.exe [26/06/2018 11:46:30] CPU

        Usage:0 %
        536 | [Owner : SYSTEM | Parent : 448(wininit.exe) | 13.86 Mo] - (.Microsoft Corporation - Local Security

        Authority Process.) - (6.1.7601.24499) = C:\Windows\System32\lsass.exe [12/07/2019 15:59:25] CPU

        Usage:0 %
        544 | [Owner : SYSTEM | Parent : 448(wininit.exe) | 4.8 Mo] - (.Microsoft Corporation - Local Session Manager

        Service.) - (6.1.7601.17514) = C:\Windows\System32\lsm.exe [20/11/2010 23:23:53] CPU Usage:0 %
        592 | [Owner : SYSTEM | Parent : 456() | 8.74 Mo] - (.Microsoft Corporation - Windows Logon Application.) -

        (6.1.7601.24000) = C:\Windows\System32\winlogon.exe [26/06/2018 09:56:04] CPU Usage:0 %
        688 | [Owner : SYSTEM | Parent : 512(services.exe) | 11.06 Mo] - (.Microsoft Corporation - Host Process for

        Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

        Usage:0 %
        768 | [Owner : NETWORK SERVICE | Parent : 512(services.exe) | 9.94 Mo] - (.Microsoft Corporation - Host

        Process for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13]

        CPU Usage:0 %
        864 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 24.56 Mo] - (.Microsoft Corporation - Host Process

        for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

        Usage:0 %
        904 | [Owner : SYSTEM | Parent : 512(services.exe) | 24.12 Mo] - (.Microsoft Corporation - Host Process for

        Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

        Usage:0 %
        944 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 20.06 Mo] - (.Microsoft Corporation - Host Process

        for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

        Usage:0 %
        976 | [Owner : SYSTEM | Parent : 512(services.exe) | 50.88 Mo] - (.Microsoft Corporation - Host Process for

        Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

        Usage:0 %
        116 | [Owner : SYSTEM | Parent : 512(services.exe) | 8.67 Mo] - (.IDT, Inc. - IDT PC Audio.) - (1.0.6491.0) =

        C:\Program Files\IDT\WDM\stacsv64.exe [26/06/2018 13:41:19] CPU Usage:0 %
        972 | [Owner : SYSTEM | Parent : 512(services.exe) | 8.26 Mo] - (.Microsoft Corporation - Host Process for

        Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

        Usage:0 %
        1120 | [Owner : SYSTEM | Parent : 512(services.exe) | 7.54 Mo] - (.Intel Corporation - igfxCUIService Module.)
        • (6.15.10.4425) = C:\Windows\System32\igfxCUIService.exe [02/06/2016 13:40:40] CPU Usage:0 %
          1260 | [Owner : NETWORK SERVICE | Parent : 512(services.exe) | 18.54 Mo] - (.Microsoft Corporation - Host

        Process for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13]

        CPU Usage:0 %
        1348 | [Owner : SYSTEM | Parent : 904(svchost.exe) | 17.05 Mo] - (.Microsoft Corporation - Windows Wireless

        LAN 802.11 Extensibility Framework.) - (6.1.7600.16385) = C:\Windows\System32\wlanext.exe [13/07/2009

        20:07:15] CPU Usage:0 %
        1360 | [Owner : SYSTEM | Parent : 404(csrss.exe) | 3.11 Mo] - (.Microsoft Corporation - Console Window Host.)
        • (6.1.7601.24499) = C:\Windows\System32\conhost.exe [12/07/2019 15:59:25] CPU Usage:0 %
          1448 | [Owner : SYSTEM | Parent : 512(services.exe) | 14.36 Mo] - (.Microsoft Corporation - Spooler SubSystem

        App.) - (6.1.7601.24000) = C:\Windows\System32\spoolsv.exe [26/06/2018 09:55:35] CPU Usage:0 %
        1476 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 16.89 Mo] - (.Microsoft Corporation - Host

        Process for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13]

        CPU Usage:0 %
        1572 | [Owner : SYSTEM | Parent : 512(services.exe) | 7.95 Mo] - (.Microsoft Corporation - Host Process for

        Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

        Usage:0 %
        1616 | [Owner : SYSTEM | Parent : 512(services.exe) | 14.79 Mo] - (.Intel(R) Corporation - Intel(R)

        PROSet/Wireless Event Log Service.) - (16.1.0.0) = C:\Program Files\Intel\WiFi\bin\EvtEng.exe [17/07/2013

        11:50:08] CPU Usage:0 %
        1784 | [Owner : SYSTEM | Parent : 512(services.exe) | 6.14 Mo] - (.Intel(R) Corporation - Intel(R) Capability

        Licensing Service Interface.) - (1.31.8.1) = C:\Program Files\Intel\iCLS Client\HeciServer.exe [27/08/2013

        14:32:14] CPU Usage:0 %
        1856 | [Owner : SYSTEM | Parent : 512(services.exe) | 8.1 Mo] - (.Intel(R) Corporation - Intel(R)

        PROSet/Wireless Registry Service.) - (16.1.0.0) = C:\Program Files\Common Files\Intel\WirelessCommon

        \RegSrvc.exe [17/07/2013 11:49:16] CPU Usage:0 %
        1912 | [Owner : SYSTEM | Parent : 512(services.exe) | 7 Mo] - (.Visioneer Inc. - RoadWarrior 3 Series HAL.) -

        (5.1.216.4184) = C:\Program Files\Visioneer\RWAR3\RWAR3HV_0001_0.EXE [29/10/2018 20:46:48] CPU Usage:0

        %
        1976 | [Owner : SYSTEM | Parent : 512(services.exe) | 6.88 Mo] - (.Visioneer Inc. - RoadWarrior 3 Series

        Monitor.) - (5.1.216.4185) = C:\Program Files\Visioneer\RWAR3\RWAR3Monitor.exe [29/10/2018 20:45:37]

        CPU Usage:0 %
        2004 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 6.51 Mo] - (.Microsoft Corporation - Host Process

        for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

        Usage:0 %
        2028 | [Owner : SYSTEM | Parent : 512(services.exe) | 22.2 Mo] - (.Intel® Corporation - Intel® PROSet/Wireless

        Zero Configure Service.) - (16.1.0.0) = C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [17/07/2013

        11:51:24] CPU Usage:0 %
        1288 | [Owner : SYSTEM | Parent : 688(svchost.exe) | 5.92 Mo] - (.Microsoft Corporation - Sink to receive

        asynchronous callbacks for WMI client application.) - (6.1.7600.16385) = C:\Windows\System32\wbem\unsecapp.exe
        Code:
        [13/07/2009 19:47:12]    CPU Usage:0 %
        384 | [Owner : SYSTEM | Parent : 688(svchost.exe) | 26.62 Mo] - (.Microsoft Corporation - WMI Provider Host.)
        • (6.1.7601.17514) = C:\Windows\System32\wbem\WmiPrvSE.exe [20/11/2010 23:24:15] CPU Usage:0 %
          2304 | [Owner : LOCAL SERVICE | Parent : 904(svchost.exe) | 5.42 Mo] - (.Microsoft Corporation - Windows

        Driver Foundation - User-mode Driver Framework Host Process.) - (6.2.9200.16384) = C:\Windows

        \System32\WUDFHost.exe [26/06/2018 11:04:20] CPU Usage:0 %
        3012 | [Owner : ******** | Parent : 904(svchost.exe) | 33.7 Mo] - (.Microsoft Corporation - Desktop Window

        Manager.) - (6.1.7600.16385) = C:\Windows\System32\dwm.exe [13/07/2009 19:37:38] CPU Usage:2 %
        3020 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 21.48 Mo] - (.Microsoft Corporation -

        PresentationFontCache.exe.) - (3.0.6920.5011) = C:\Windows\Microsoft.NET\Framework64\v3.0\WPF

        \PresentationFontCache.exe [20/11/2010 23:24:52] CPU Usage:0 %
        2232 | [Owner : ******** | Parent : 512(services.exe) | 16.02 Mo] - (.Microsoft Corporation - Host Process for

        Windows Tasks.) - (6.1.7601.18010) = C:\Windows\System32\taskhost.exe [26/06/2018 11:00:30] CPU Usage:0

        %
        2236 | [Owner : ******** | Parent : 2988() | 82.91 Mo] - (.Microsoft Corporation - Windows Explorer.) -

        (6.1.7601.23537) = C:\Windows\explorer.exe [26/06/2018 11:02:30] CPU Usage:0 %
        2784 | [Owner : ******** | Parent : 2752() | 12.94 Mo] - (.Intel Corporation - igfxEM Module.) -

        (6.15.10.4425) = C:\Windows\System32\igfxEM.exe [02/06/2016 13:40:52] CPU Usage:0 %
        2864 | [Owner : ******** | Parent : 2752() | 10.18 Mo] - (.Intel Corporation - igfxHK Module.) -

        (6.15.10.4425) = C:\Windows\System32\igfxHK.exe [02/06/2016 13:40:58] CPU Usage:0 %
        2884 | [Owner : ******** | Parent : 2752() | 12.18 Mo] - (.Intel Corporation - igfxTray Module.) -

        (6.15.10.4425) = C:\Windows\System32\igfxTray.exe [02/06/2016 13:41:06] CPU Usage:0 %
        1188 | [Owner : ******** | Parent : 2236(explorer.exe) | 11.17 Mo] - (.IDT, Inc. - IDT PC Audio.) -

        (1.0.6491.0) = C:\Program Files\IDT\WDM\sttray64.exe [26/06/2018 13:41:19] CPU Usage:0 %
        2744 | [Owner : ******** | Parent : 2236(explorer.exe) | 21.52 Mo] - (.Intel(R) Corporation - Intel(R)

        PROSet/Wireless Framework.) - (16.1.0.0) = C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe

        [17/07/2013 11:48:56] CPU Usage:0 %
        2700 | [Owner : ******** | Parent : 2236(explorer.exe) | 11.07 Mo] - (.Alps Electric Co., Ltd. - Alps

        Pointing-device Driver.) - (8.1.101.178) = C:\Program Files\DellTPad\Apoint.exe [26/06/2018 13:44:55]

        CPU Usage:0 %
        3336 | [Owner : ******** | Parent : 688(svchost.exe) | 6.82 Mo] - (.Microsoft Corporation - Sink to receive

        asynchronous callbacks for WMI client application.) - (6.1.7600.16385) = C:\Windows\System32\wbem\unsecapp.exe
        Code:
        [13/07/2009 19:47:12]    CPU Usage:0 %
        3404 | [Owner : ******** | Parent : 2700(Apoint.exe) | 6.12 Mo] - (.Alps Electric Co., Ltd. - ApMsgFwd.) -

        (8.0.0.39) = C:\Program Files\DellTPad\ApMsgFwd.exe [26/06/2018 13:44:55] CPU Usage:0 %
        3460 | [Owner : ******** | Parent : 2700(Apoint.exe) | 5.04 Mo] - (.Alps Electric Co., Ltd. - Alps Pointing-

        device Driver.) - (7.0.0.30) = C:\Program Files\DellTPad\hidfind.exe [26/06/2018 13:44:55] CPU Usage:0

        %
        3468 | [Owner : ******** | Parent : 3452() | 5.92 Mo] - (.Alps Electric Co., Ltd. - Alps Pointing-device

        Driver for Windows NT/2000/XP/Vista.) - (7.0.1.33) = C:\Program Files\DellTPad\ApntEx.exe [26/06/2018

        13:44:55] CPU Usage:0 %
        3484 | [Owner : ******** | Parent : 464(csrss.exe) | 5.14 Mo] - (.Microsoft Corporation - Console Window

        Host.) - (6.1.7601.24499) = C:\Windows\System32\conhost.exe [12/07/2019 15:59:25] CPU Usage:0 %
        3840 | [Owner : SYSTEM | Parent : 512(services.exe) | 54.46 Mo] - (.Microsoft Corporation - Microsoft Windows

        Search Indexer.) - (7.0.7601.24275) = C:\Windows\System32\SearchIndexer.exe [10/12/2018 23:07:41] CPU

        Usage:0 %
        3932 | [Owner : NETWORK SERVICE | Parent : 512(services.exe) | 11.72 Mo] - (.Microsoft Corporation - Windows

        Media Player Network Sharing Service.) - (12.0.7601.17514) = C:\Program Files\Windows Media Player

        \wmpnetwk.exe [20/11/2010 23:25:05] CPU Usage:0 %
        3212 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 14.23 Mo] - (.Microsoft Corporation - Host

        Process for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13]

        CPU Usage:0 %
        3168 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 16.07 Mo] - (.Microsoft Corporation - Host

        Process for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13]

        CPU Usage:2 %
        3712 | [Owner : NETWORK SERVICE | Parent : 688(svchost.exe) | 19.28 Mo] - (.Microsoft Corporation - WMI

        Provider Host.) - (6.1.7601.17514) = C:\Windows\System32\wbem\WmiPrvSE.exe [20/11/2010 23:24:15] CPU

        Usage:0 %
        4504 | [Owner : ******** | Parent : 2236(explorer.exe) | 197.93 Mo] - (.Google LLC - Google Chrome.) -

        (75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

        Usage:2 %
        5024 | [Owner : ******** | Parent : 4504(chrome.exe) | 6.1 Mo] - (.Google LLC - Google Chrome.) -

        (75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

        Usage:0 %
        4584 | [Owner : ******** | Parent : 4504(chrome.exe) | 6.85 Mo] - (.Google LLC - Google Chrome.) -

        (75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

        Usage:0 %
        5004 | [Owner : ******** | Parent : 4504(chrome.exe) | 675.98 Mo] - (.Google LLC - Google Chrome.) -

        (75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

        Usage:0 %
        1768 | [Owner : ******** | Parent : 4504(chrome.exe) | 48.85 Mo] - (.Google LLC - Google Chrome.) -

        (75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

        Usage:0 %
        5844 | [Owner : SYSTEM | Parent : 512(services.exe) | 11.98 Mo] - (.Dell Inc. - Dell Data Vault Rules

        Processor.) - (5.2.8.103) = C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe [28/02/2019

        11:26:18] CPU Usage:0 %
        5900 | [Owner : SYSTEM | Parent : 512(services.exe) | 63.44 Mo] - (.PC-Doctor, Inc. - PC-Doctor Dell

        SupportAssist API.) - (6.0.7033.2285) = C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist

        \6.0.7033.2285\DSAPI.exe [30/05/2019 09:49:45] CPU Usage:0 %
        5988 | [Owner : SYSTEM | Parent : 5900(DSAPI.exe) | 149.06 Mo] - (.PC-Doctor, Inc. - PC-Doctor Communications

        Manager.) - (6.0.7033.2285) = C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist

        \6.0.7033.2285\pcdrwi.exe [30/05/2019 09:49:49] CPU Usage:0 %
        5996 | [Owner : SYSTEM | Parent : 404(csrss.exe) | 3.15 Mo] - (.Microsoft Corporation - Console Window Host.)
        • (6.1.7601.24499) = C:\Windows\System32\conhost.exe [12/07/2019 15:59:25] CPU Usage:0 %
          2360 | [Owner : SYSTEM | Parent : 512(services.exe) | 4.73 Mo] - (.Intel Corporation - Intel(R) Dynamic

        Application Loader Host Interface.) - (9.5.12.1682) = C:\Program Files (x86)\Intel\Intel(R) Management Engine

        Components\DAL\jhi_service.exe [26/06/2018 13:41:04] CPU Usage:0 %
        5520 | [Owner : SYSTEM | Parent : 512(services.exe) | 11.07 Mo] - (.Intel Corporation - Intel(R) Local

        Management Service.) - (9.5.10.1628) = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS

        \LMS.exe [26/06/2018 13:40:29] CPU Usage:0 %
        5152 | [Owner : SYSTEM | Parent : 512(services.exe) | 95.64 Mo] - (.Dell Inc. - Service.) - (3.2.2.119) = C:

        \Program Files\Dell\SupportAssistAgent\bin\SupportAssistAge nt.exe [24/05/2019 07:01:56] CPU Usage:0 %
        7128 | [Owner : SYSTEM | Parent : 512(services.exe) | 27.77 Mo] - (.Dell Inc. - Dell Data Vault Data Collector

        Service.) - (5.2.8.103) = C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe [28/02/2019 11:28:26]

        CPU Usage:0 %
        2520 | [Owner : SYSTEM | Parent : 512(services.exe) | 5.43 Mo] - (.Dell Inc. - Dell Data Vault Data Collector

        Service API.) - (5.2.8.103) = C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe [28/02/2019

        11:28:48] CPU Usage:0 %
        6816 | [Owner : LOCAL SERVICE | Parent : 688(svchost.exe) | 10.99 Mo] - (.Microsoft Corporation - WMI Provider

        Host.) - (6.1.7601.17514) = C:\Windows\System32\wbem\WmiPrvSE.exe [20/11/2010 23:24:15] CPU Usage:0 %
        4076 | [Owner : ******** | Parent : 4504(chrome.exe) | 1541.13 Mo] - (.Google LLC - Google Chrome.) -

        (75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

        Usage:31 %
        4844 | [Owner : ******** | Parent : 4504(chrome.exe) | 69.72 Mo] - (.Google LLC - Google Chrome.) -

        (75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

        Usage:0 %
        5580 | [Owner : ******** | Parent : 4504(chrome.exe) | 188.56 Mo] - (.Google LLC - Google Chrome.) -

        (75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

        Usage:0 %
        612 | [Owner : ******** | Parent : 4504(chrome.exe) | 87.94 Mo] - (.Google LLC - Google Chrome.) -

        (75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

        Usage:0 %
        5408 | [Owner : ******** | Parent : 4504(chrome.exe) | 208.28 Mo] - (.Google LLC - Google Chrome.) -

        (75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

        Usage:0 %
        4284 | [Owner : ******** | Parent : 4504(chrome.exe) | 59.38 Mo] - (.Google LLC - Google Chrome.) -

        (75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

        Usage:0 %
        2256 | [Owner : ******** | Parent : 4504(chrome.exe) | 83.75 Mo] - (.Google LLC - Google Chrome.) -

        (75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

        Usage:2 %
        5432 | [Owner : ******** | Parent : 4504(chrome.exe) | 129.48 Mo] - (.Google LLC - Google Chrome.) -

        (75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

        Usage:0 %
        6332 | [Owner : LOCAL SERVICE | Parent : 864(svchost.exe) | ???] - (.Microsoft Corporation - Windows Audio

        Device Graph Isolation.) - (6.1.7601.24499) = C:\Windows\System32\audiodg.exe [12/07/2019 15:59:26] CPU

        Usage:0 %
        6304 | [Owner : ******** | Parent : 2236(explorer.exe) | 15.35 Mo] - (.Microsoft Corporation - Windows

        Defender User Interface.) - (6.1.7600.16385) = C:\Program Files\Windows Defender\MSASCui.exe [13/07/2009

        19:53:49] CPU Usage:0 %
        1868 | [Owner : ******** | Parent : 4504(chrome.exe) | 21.53 Mo] - (.Google LLC - Google Chrome.) -

        (75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

        Usage:0 %
        5940 | [Owner : ******** | Parent : 2236(explorer.exe) | 51.28 Mo] - (.SosVirus - QuickDiag.) - (27.2.19.1) =

        C:\Users********\Desktop\quickdiag_V5_27.02.19.1.e xe [15/07/2019 10:23:54] CPU Usage:0 %
        3508 | [Owner : SYSTEM | Parent : 3840(SearchIndexer.exe) | 10.08 Mo] - (.Microsoft Corporation - Microsoft

        Windows Search Protocol Host.) - (7.0.7601.24275) = C:\Windows\System32\SearchProtocolHost.exe [10/12/2018

        23:07:40] CPU Usage:0 %
        4348 | [Owner : SYSTEM | Parent : 3840(SearchIndexer.exe) | 8.21 Mo] - (.Microsoft Corporation - Microsoft

        Windows Search Filter Host.) - (7.0.7601.24275) = C:\Windows\System32\SearchFilterHost.exe [10/12/2018

        23:07:39] CPU Usage:0 %
        3644 | [Owner : NETWORK SERVICE | Parent : 688(svchost.exe) | 7.48 Mo] - (.Microsoft Corporation - WMI

        Provider Host.) - (6.1.7601.17514) = C:\Windows\SysWOW64\wbem\WmiPrvSE.exe [20/11/2010 23:24:27] CPU

        Usage:0 %
        3608 | [Owner : NETWORK SERVICE | Parent : 512(services.exe) | 9.02 Mo] - (.Microsoft Corporation - Microsoft

        Software Protection Platform Service.) - (6.1.7601.17514) = C:\Windows\System32\sppsvc.exe [20/11/2010

        23:23:56] CPU Usage:0 %

        ---------- | Locked Applications

        ---------- | Explorer.exe Modules (Microsoft Files Whitelisted)

        (.Igor Pavlov.-.7-Zip Shell Extension.) - (18.5.0.0) – C:\Program Files\7-Zip\7-zip.dll
        (.Intel Corporation.-.igfxDTCM Module.) - (6.15.10.4425) – C:\Windows\system32\igfxDTCM.dll
        (.Intel Corporation.-.igfxDH Module.) - (6.15.10.4425) – C:\Windows\system32\igfxDH.dll
        (.Intel Corporation.-.igfxLHM Module.) - (6.15.10.4425) – C:\Windows\system32\igfxLHM.dll
        (.Intel Corporation.-.igfxDI Module.) - (6.15.10.4425) – C:\Windows\system32\igfxDI.dll
        (.Foxit Software Inc..-.ConvertToPDFShellExtension.) - (9.4.0.1491) – C:\Program Files (x86)\Foxit Software

        \Foxit Reader\plugins\ConvertToPDFShellExtension_x64.dll
        (..-.ShellHandler for Notepad++ (64 bit).) - (0.1.0.0) – C:\Program Files (x86)\Notepad++\NppShell_06.dll

        ---------- | Winlogon.exe Modules (Microsoft Files Whitelisted)

        ---------- | svchost.exe Modules (Microsoft Files Whitelisted)

        ---------- | ZeroAccess Check

        [HKLM\Software\Classes\CLSID{1108BE51-F58A-4CDA-BB99-7A0227D11D5E}\InProcServer32] : %systemroot%

        \system32\wbem\fastprox.dll
        [HKLM\Software\Classes\CLSID{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] : %SystemRoot%

        \system32\shell32.dll
        [HKLM\Software\Classes\CLSID{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] : %systemroot%

        \system32\wbem\fastprox.dll
        [HKLM\Software\Classes\CLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] : %systemroot%

        \system32\wbem\wbemess.dll
        [HKLM\Software\Classes\CLSID{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] : %SystemRoot%

        \system32\shell32.dll
        [HKLM\Software\WOW6432Node\Classes\CLSID{1108BE51-F58A-4CDA-BB99-7A0227D11D5E}\InProcServer32] : %systemroot

        %\system32\wbem\fastprox.dll
        [HKLM\Software\WOW6432Node\Classes\CLSID{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] : %SystemRoot

        %\system32\shell32.dll
        [HKLM\Software\WOW6432Node\Classes\CLSID{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] : %systemroot

        %\system32\wbem\fastprox.dll
        [HKLM\Software\WOW6432Node\Classes\CLSID{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] : %SystemRoot

        %\system32\shell32.dll

        ---------- | Startings up

        Sidebar - (%ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun [HKU\S-1-5-19\SOFTWARE...\Run]) - User: NT

        AUTHORITY\LOCAL SERVICE
        Sidebar - (%ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun [HKU\S-1-5-20\SOFTWARE...\Run]) - User: NT

        AUTHORITY\NETWORK SERVICE
        SysTrayApp - (C:\Program Files\IDT\WDM\sttray64.exe [HKLM\SOFTWARE...\Run]) - User: Public
        IntelPROSet - (“C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe” /tf Intel PROSet/Wireless

        [HKLM\SOFTWARE...\Run]) - User: Public
        Apoint - (C:\Program Files\DellTPad\Apoint.exe [HKLM\SOFTWARE...\Run]) - User: Public

        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Command Processor]
        “CompletionChar”=9
        “DefaultColor”=0
        “EnableExtensions”=1
        “PathCompletionChar”=9

        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Exp lorer\RunMRU]
        “a”=cmd\1
        “MRUList”=ab
        “b”=regedit\1

        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
        “UserSelectedDefault”=1
        “Device”=Foxit Reader PDF Printer,winspool,Ne02:

        [HKLM\Software\Microsoft\Command Processor]
        “CompletionChar”=64
        “DefaultColor”=0
        “EnableExtensions”=1
        “PathCompletionChar”=64

        [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
        “SysTrayApp”=C:\Program Files\IDT\WDM\sttray64.exe [26/06/2018 13:41:19]
        “IntelPROSet”=“C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe” /tf Intel PROSet/Wireless
        “Apoint”=C:\Program Files\DellTPad\Apoint.exe [26/06/2018 13:44:55]

        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
        “IconServiceLib”=IconCodecService.dll
        “DdeSendTimeout”=0
        “DesktopHeapLogging”=1
        “GDIProcessHandleQuota”=10000
        “ShutdownWarningDialogTimeout”=4294967295
        “USERNestedWindowLimit”=50
        “USERPostMessageLimit”=10000
        “USERProcessHandleQuota”=10000
        “”=mnmsrvc
        “DeviceNotSelectedTimeout”=15
        “Spooler”=yes
        “TransmissionRetryTimeout”=90
        “AppInit_DLLs”=
        “LoadAppInit_DLLs”=0

        [HKLM\Software\WOW6432Node\Microsoft\Command Processor]
        “CompletionChar”=64
        “DefaultColor”=0
        “EnableExtensions”=1
        “PathCompletionChar”=64

        [HKLM\Software\WOW6432Node\Microsoft\Windows\Curren tVersion\Run]
        “IMSS”=“C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe”
        “KeePass 2 PreLoad”=“C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe” --preload

        [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows]
        “IconServiceLib”=IconCodecService.dll
        “DdeSendTimeout”=0
        “DesktopHeapLogging”=1
        “GDIProcessHandleQuota”=10000
        “ShutdownWarningDialogTimeout”=4294967295
        “USERNestedWindowLimit”=50
        “USERPostMessageLimit”=10000
        “USERProcessHandleQuota”=10000
        “”=mnmsrvc
        “DeviceNotSelectedTimeout”=15
        “Spooler”=yes
        “TransmissionRetryTimeout”=90
        “AppInit_DLLs”=
        “LoadAppInit_DLLs”=0

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\ShellServiceObjectDelayLoad]
        “WebCheck”={E6FB5E20-DE35-11CF-9C87-00AA005127ED}

        ---------- | Win.ini :

        ---------- | System.ini :

        ---------- | Tasks List

        Dell SupportAssistAgent AutoUpdate
        GoogleUpdateTaskMachineCore
        GoogleUpdateTaskMachineUA
        {EE1BEB1A-D10C-43A0-9D62-B7BBC4690C0E}

        ---------- | Startings up registry ¦ Folder

        ---------- | Control - lsa - SecurityProviders - Session Manager - Terminal Server

        [HKLM\System\CurrentControlSet\Control]
        “PreshutdownOrder”=wuauserv
        gpsvc
        trustedinstaller
        “WaitToKillServiceTimeout”=2000
        “CurrentUser”=USERNAME
        “BootDriverFlags”=0
        “ServiceControlManagerExtension”=%systemroot%\syst em32\scext.dll
        “SystemStartOptions”= NOEXECUTE=OPTIN
        “SystemBootDevice”=multi(0)disk(0)rdisk(0)partitio n(2)
        “FirmwareBootDevice”=multi(0)disk(0)rdisk(0)partit ion(1)
        “ServicesPipeTimeout”=60000

        [HKLM\System\CurrentControlSet\Control\lsa]
        “auditbaseobjects”=0
        “auditbasedirectories”=0
        “crashonauditfail”=0
        “fullprivilegeauditing”=0x00
        “Bounds”=0x0030000000200000
        “LimitBlankPasswordUse”=1
        “NoLmHash”=1
        “Notification Packages”=scecli
        “Security Packages”=kerberos
        msv1_0
        schannel
        wdigest
        tspkg
        pku2u
        “Authentication Packages”=msv1_0
        “LsaPid”=536
        “SecureBoot”=1
        “ProductType”=6
        “disabledomaincreds”=0
        “everyoneincludesanonymous”=0
        “forceguest”=0
        “restrictanonymous”=1
        “restrictanonymoussam”=1

        [HKLM\System\CurrentControlSet\Control\SecurityProv iders]
        “SecurityProviders”=credssp.dll

        [HKLM\System\CurrentControlSet\Control\Session Manager]
        “CriticalSectionTimeout”=2592000
        “GlobalFlag”=0
        “HeapDeCommitFreeBlockThreshold”=0
        “HeapDeCommitTotalFreeThreshold”=0
        “HeapSegmentCommit”=0
        “HeapSegmentReserve”=0
        “ProcessorControl”=2
        “ResourceTimeoutCount”=648000
        “BootExecute”=autocheck autochk *
        “ExcludeFromKnownDlls”=
        “ObjectDirectories”=\Windows
        \RPC Control
        “ProtectionMode”=1
        “NumberOfInitialSessions”=2
        “SetupExecute”=
        “PendingFileRenameOperations”=??\C:\Windows\system 32\DRIVERS\pfdytcnk.sys

        ??\C:\Users********\AppData\Local

        \Microsoft\Windows\Temporary Internet Files\counters.dat

        ??\C:\Users********\AppData\Local\Mozilla\Firefox

        \Profiles\54mhv969.default-1563029380061\OfflineCache\index.sqlite

        ??\C:\Users********\AppData\Local\Mozilla

        \Firefox\Profiles\54mhv969.default-1563029380061\OfflineCache

        [HKLM\System\CurrentControlSet\Control\Terminal Server]
        “RCDependentServices”=CertPropSvc
        SessionEnv
        “NotificationTimeOut”=0
        “SnapshotMonitors”=1
        “ProductVersion”=5.1
        “AllowRemoteRPC”=0
        “DelayConMgrTimeout”=0
        “fDenyTSConnections”=1
        “StartRCM”=0
        “TSAdvertise”=0
        “DeleteTempDirsOnExit”=1
        “fSingleSessionPerUser”=1
        “PerSessionTempDir”=0
        “TSUserEnabled”=0
        “InstanceID”=92d0cf0d-6ab8-4c98-8a4c-6c2c027
        “fCredentialLessLogonSupportedTSS”=1
        “fCredentialLessLogonSupported”=1
        “fCredentialLessLogonSupportedKMRDP”=1

        ---------- | .LNK with Arguments

        ---------- | AppCertDlls

        ---------- | Dnsapi.dll

        C:\Windows\System32\dnsapi.dll → OK : \drivers\etc\hosts
        C:\Windows\SysWOW64\dnsapi.dll → OK : \drivers\etc\hosts

        ---------- | Policies | Registry

        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Control Panel\Desktop]
        “ScreenSaveActive”=1
        “ActiveWndTrackTimeout”=0
        “BlockSendInputResets”=0
        “CaretWidth”=1
        “ClickLockTime”=1200
        “CoolSwitchColumns”=7
        “CoolSwitchRows”=3
        “CursorBlinkRate”=530
        “DockMoving”=1
        “DragFromMaximize”=1
        “DragFullWindows”=1
        “DragHeight”=4
        “DragWidth”=4
        “FocusBorderHeight”=1
        “FocusBorderWidth”=1
        “FontSmoothing”=2
        “FontSmoothingGamma”=0
        “FontSmoothingOrientation”=1
        “FontSmoothingType”=2
        “ForegroundFlashCount”=7
        “ForegroundLockTimeout”=200000
        “LeftOverlapChars”=3
        “MenuShowDelay”=400
        “PaintDesktopVersion”=0
        “RightOverlapChars”=3
        “SnapSizing”=1
        “TileWallpaper”=0
        “WallpaperOriginX”=0
        “WallpaperOriginY”=0
        “WallpaperStyle”=10
        “WheelScrollChars”=3
        “WheelScrollLines”=3
        “WindowArrangementActive”=1
        “UserPreferencesMask”=0x9E3E078012000000
        “Wallpaper”=
        “Pattern Upgrade”=TRUE
        “WaitToKillAppTimeout”=2000
        “HungAppTimeout”=2000

        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer

        \HideDesktopIcons\NewStartPanel]
        “{20D04FE0-3AEA-1069-A2D8-08002B30309D}”=0

        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer]
        “ExplorerStartupTraceRecorded”=1
        “ShellState”=0x24000000302800000000000000000000000 0000001000000120000000000000022000000
        “CleanShutdown”=0
        “Browse For Folder Width”=318
        “Browse For Folder Height”=288
        “link”=0x1D000000

        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer

        \Advanced]
        “Start_SearchFiles”=2
        “ServerAdminUI”=0
        “Hidden”=2
        “ShowCompColor”=1
        “HideFileExt”=0
        “DontPrettyPath”=0
        “ShowInfoTip”=1
        “HideIcons”=0
        “MapNetDrvBtn”=0
        “WebView”=1
        “Filter”=0
        “SuperHidden”=0
        “SeparateProcess”=0
        “AutoCheckSelect”=0
        “IconsOnly”=0
        “ShowTypeOverlay”=1
        “ListviewAlphaSelect”=1
        “ListviewShadow”=1
        “TaskbarAnimations”=1
        “StartMenuInit”=4
        “Start_ShowMyGames”=0
        “”=0
        “TaskbarSizeMove”=0
        “DisablePreviewDesktop”=0
        “TaskbarSmallIcons”=1
        “TaskbarGlomLevel”=2
        “Start_PowerButtonAction”=16
        “Start_ShowControlPanel”=2
        “Start_ShowMyDocs”=1
        “Start_ShowMyMusic”=1
        “Start_ShowNetPlaces”=1
        “Start_ShowUser”=0
        “Start_ShowMyPics”=1
        “Start_LargeMFUIcons”=0
        “Start_MinMFU”=10
        “Start_JumpListItems”=10
        “Start_AdminToolsRoot”=2
        “StartMenuAdminTools”=1

        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer

        \WordWheelQuery]
        “MRUListEx”=0x080000000700000006000000050000000400 000003000000020000000100000000000000FFFFFFFF
        “0”=0x73006E00690070000000
        “1”=0x7200680065006C000000
        “2”=0x3200350031000000
        “3”=0x6E006F006E0061006D0065000000
        “4”=0x310036000000
        “5”=0x66006900720065002000620075006E000000
        “6”=0x640061006400640079006F000000
        “7”=0x7300690065007200720061000000
        “8”=0x2A002E006D00700033000000

        [HKLM\Software\Policies\Microsoft\Windows\Safer\Cod eIdentifiers]
        “authenticodeenabled”=0

        [HKLM\Software\Microsoft\Windows\CurrentVersion\Pol icies\System]
        “ConsentPromptBehaviorAdmin”=5
        “ConsentPromptBehaviorUser”=3
        “EnableInstallerDetection”=1
        “EnableLUA”=1
        “EnableSecureUIAPaths”=1
        “EnableUIADesktopToggle”=0
        “EnableVirtualization”=1
        “PromptOnSecureDesktop”=1
        “ValidateAdminCodeSignatures”=0
        “dontdisplaylastusername”=0
        “legalnoticecaption”=
        “legalnoticetext”=
        “scforceoption”=0
        “shutdownwithoutlogon”=1
        “undockwithoutlogon”=1
        “FilterAdministratorToken”=0
        “SlowLinkDetectEnabled”=1

        [HKLM\Software\Microsoft\Windows\CurrentVersion\Pol icies\Explorer]
        “NoActiveDesktop”=1
        “NoActiveDesktopChanges”=1
        “ForceActiveDesktopOn”=0

        [HKLM\Software\Microsoft\Windows\CurrentVersion\Pol icies\ActiveDesktop]
        “NoAddingComponents”=1
        “NoComponents”=1

        [HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\HideDesktopIcons\NewStartPanel]
        “{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}”=1
        “{20D04FE0-3AEA-1069-A2D8-08002B30309D}”=1
        “{208D2C60-3AEA-1069-A2D7-08002B30309D}”=1
        “{871C5380-42A0-1069-A2EA-08002B30309D}”=1
        “{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}”=1
        “{59031a47-3f72-44a7-89c5-5595fe6b30ee}”=1
        “{031E4825-7B94-4dc3-B131-E946B44C8DD5}”=1
        “{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}”=1
        “{9343812e-1c37-4a49-a12e-4b2d810d956b}”=1

        [HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\HideDesktopIcons\ClassicStartMenu]
        “{871C5380-42A0-1069-A2EA-08002B30309D}.default”=0
        “{9343812e-1c37-4a49-a12e-4b2d810d956b}”=1

        [HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Advanced\Folder\Hidden\SHOWALL]
        “RegPath”=Software\Microsoft\Windows\CurrentVersio n\Explorer\Advanced
        “Text”=@shell32.dll,-30500
        “Type”=radio
        “CheckedValue”=1
        “ValueName”=Hidden
        “DefaultValue”=2
        “HKeyRoot”=2147483649
        “HelpID”=shell.hlp#51105

        [HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer]
        “ListViewPopupControl”={8be9f5ea-e746-4e47-ad57-3fb191ca1eed}
        “BrowserCFCreator”={57f8510b-a5e2-41da-a8f0-8a5ae85dfffd}
        “GlobalFolderSettings”={EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}
        “LVPopupSearchControl”={fccf70c8-f4d7-4d8b-8c17-cd6715e37fff}
        “FileOpenDialog”={DC1C5A9C-E88A-4dde-A5A1-60F82A20AEF7}
        “IconUnderline”=2
        “GlobalAssocChangedCounter”=24

        [HKLM\Software\Microsoft\Windows\CurrentVersion\Exp lorer\Advanced]
        “TaskbarSizeMove”=0

        [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Exp lorer\Associations]
        “Application”= open %s file - Search

        [HKLM\Software\WOW6432Node\Policies\Microsoft\Windo ws\Safer\CodeIdentifiers]
        “authenticodeenabled”=0

        [HKLM\Software\WOW6432Node\Microsoft\Windows\Curren tVersion\Policies\System]
        “ConsentPromptBehaviorAdmin”=5
        “ConsentPromptBehaviorUser”=3
        “EnableInstallerDetection”=1
        “EnableLUA”=1
        “EnableSecureUIAPaths”=1
        “EnableUIADesktopToggle”=0
        “EnableVirtualization”=1
        “PromptOnSecureDesktop”=1
        “ValidateAdminCodeSignatures”=0
        “dontdisplaylastusername”=0
        “legalnoticecaption”=
        “legalnoticetext”=
        “scforceoption”=0
        “shutdownwithoutlogon”=1
        “undockwithoutlogon”=1
        “FilterAdministratorToken”=0
        “SlowLinkDetectEnabled”=1

        [HKLM\Software\WOW6432Node\Microsoft\Windows\Curren tVersion\Policies\Explorer]
        “NoActiveDesktop”=1
        “NoActiveDesktopChanges”=1
        “ForceActiveDesktopOn”=0

        [HKLM\Software\WOW6432Node\Microsoft\Windows\Curren tVersion\Policies\ActiveDesktop]
        “NoAddingComponents”=1
        “NoComponents”=1

        [HKLM\Software\WOW6432Node\Microsoft\Windows\Curren tVersion\Explorer\HideDesktopIcons\NewStartPanel]
        “{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}”=1
        “{20D04FE0-3AEA-1069-A2D8-08002B30309D}”=1
        “{208D2C60-3AEA-1069-A2D7-08002B30309D}”=1
        “{871C5380-42A0-1069-A2EA-08002B30309D}”=1
        “{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}”=1
        “{59031a47-3f72-44a7-89c5-5595fe6b30ee}”=1
        “{031E4825-7B94-4dc3-B131-E946B44C8DD5}”=1
        “{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}”=1
        “{9343812e-1c37-4a49-a12e-4b2d810d956b}”=1

        [HKLM\Software\WOW6432Node\Microsoft\Windows\Curren tVersion\Explorer\HideDesktopIcons\ClassicStartMen u]
        “{871C5380-42A0-1069-A2EA-08002B30309D}.default”=0
        “{9343812e-1c37-4a49-a12e-4b2d810d956b}”=1

        [HKLM\Software\WOW6432Node\Microsoft\Windows\Curren tVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
        “RegPath”=Software\Microsoft\Windows\CurrentVersio n\Explorer\Advanced
        “Text”=@shell32.dll,-30500
        “Type”=radio
        “CheckedValue”=1
        “ValueName”=Hidden
        “DefaultValue”=2
        “HKeyRoot”=2147483649
        “HelpID”=shell.hlp#51105

        [HKLM\Software\WOW6432Node\Microsoft\Windows\Curren tVersion\Explorer]
        “ListViewPopupControl”={8be9f5ea-e746-4e47-ad57-3fb191ca1eed}
        “BrowserCFCreator”={57f8510b-a5e2-41da-a8f0-8a5ae85dfffd}
        “GlobalFolderSettings”={EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}
        “LVPopupSearchControl”={fccf70c8-f4d7-4d8b-8c17-cd6715e37fff}
        “FileOpenDialog”={DC1C5A9C-E88A-4dde-A5A1-60F82A20AEF7}
        “IconUnderline”=2
        “GlobalAssocChangedCounter”=32

        [HKLM\Software\WOW6432Node\Microsoft\Windows\Curren tVersion\Explorer\Advanced]
        “TaskbarSizeMove”=0

        [HKLM\Software\WOW6432Node\Microsoft\Windows\Curren tVersion\Explorer\Associations]
        “Application”= open %s file - Search

        ---------- | Winlogon

        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
        “ExcludeProfileDirs”=AppData\Local;AppData\LocalLo w;$Recycle.Bin
        “BuildNumber”=7601
        “FirstLogon”=0
        “ParseAutoexec”=1

        [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
        “ReportBootOk”=1
        “Shell”=explorer.exe
        “PreCreateKnownFolders”={A520A1A4-1780-4FF6-BD18-167343C5AF16}
        “Userinit”=C:\Windows\system32\userinit.exe,
        “VMApplet”=SystemPropertiesPerformance.exe /pagefile
        “AutoRestartShell”=1
        “Background”=0 0 0
        “CachedLogonsCount”=10
        “DebugServerCommand”=no
        “ForceUnlockLogon”=0
        “LegalNoticeCaption”=
        “LegalNoticeText”=
        “PasswordExpiryWarning”=5
        “PowerdownAfterShutdown”=0
        “ShutdownWithoutLogon”=0
        “WinStationsDisabled”=0
        “DisableCAD”=1
        “scremoveoption”=0
        “ShutdownFlags”=39
        “AutoAdminLogon”=0
        “DefaultUserName”=********

        [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon]
        “ReportBootOk”=1
        “Shell”=explorer.exe
        “PreCreateKnownFolders”={A520A1A4-1780-4FF6-BD18-167343C5AF16}
        “DefaultDomainName”=
        “DefaultUserName”=
        “Userinit”=userinit.exe
        “VMApplet”=SystemPropertiesPerformance.exe /pagefile

        ---------- | Associations

        [HKLM\Software\Classes.exe]
        “”=exefile
        “Content Type”=application/x-msdownload

        [HKLM\Software\Classes\exefile\Shell\Open\Command]
        “”=“%1” %*
        “IsolatedCommand”=“%1” %*

        [HKLM\Software\Classes.com]
        “”=comfile

        [HKLM\Software\Classes\comfile\Shell\Open\Command]
        “”=“%1” %*

        [HKLM\Software\Classes.reg]
        “”=regfile

        [HKLM\Software\Classes\regfile\Shell\Open\Command]
        “”=regedit.exe “%1”

        [HKLM\Software\Classes.scr]
        “”=scrfile

        [HKLM\Software\Classes\scrfile\Shell\Open\Command]
        “”=“%1” /S

        [HKLM\Software\Classes.bat]
        “”=batfile

        [HKLM\Software\Classes\batfile\Shell\Open\Command]
        “”=“%1” %*

        [HKLM\Software\Classes.cmd]
        “”=cmdfile

        [HKLM\Software\Classes\cmdfile\Shell\Open\Command]
        “”=“%1” %*

        [HKLM\Software\Classes.pif]
        “”=piffile

        [HKLM\Software\Classes\piffile\Shell\Open\Command]
        “”=“%1” %*

        [HKLM\Software\Classes.inf]
        “”=inffile

        [HKLM\Software\Classes\inffile\Shell\Open\Command]
        “”=%SystemRoot%\system32\NOTEPAD.EXE %1

        [HKLM\Software\Classes.url]
        “”=InternetShortcut

        [HKLM\Software\Classes.lnk]
        “”=lnkfile

        [HKLM\Software\Classes.hta]
        “PerceivedType”=text
        “”=htafile
        “Content Type”=application/hta

        [HKLM\Software\Classes\htafile\Shell\Open\Command]
        “”=C:\Windows\SysWOW64\mshta.exe “%1” %*

        [HKLM\Software\Classes\InternetShortcut]
        “NeverShowExt”=
        “InfoTip”=prop:System.Link.TargetUrl;System.Rating ;System.Link.Description;System.Link.Comment
        “EditFlags”=2
        “FullDetails”=prop:System.Link.TargetUrl;System.Ra ting;System.Link.Description;System.Link.Comment
        “IsShortcut”=
        “FriendlyTypeName”=@C:\Windows\System32\ieframe.dl l,-10046
        “PreviewDetails”=prop:System.Link.TargetUrl;System .Rating;System.History.VisitCount;System.History.D ateChanged

        ;System.Link.DateVisited;System.Link.Description;S ystem.Link.Comment

        [HKLM\Software\Classes\Application.Manifest]
        “”=Application Manifest
        “EditFlags”=65536
        “BrowserFlags”=4096
        “FriendlyTypeName”=@dfshim.dll,-200

        [HKLM\Software\Classes\Application.Reference]
        “NeverShowExt”=
        “”=Application Reference
        “IsShortcut”=
        “EditFlags”=131072
        “FriendlyTypeName”=@dfshim.dll,-201

        [HKLM\Software\Classes\Folder]
        “ContentViewModeLayoutPatternForBrowse”=delta
        “ContentViewModeForBrowse”=prop:~System.ItemNameDi splay;~System.LayoutPattern.PlaceHolder;~System.La youtPatter

        n.PlaceHolder;~System.LayoutPattern.PlaceHolder;Sy stem.DateModified
        “ContentViewModeLayoutPatternForSearch”=alpha
        “ContentViewModeForSearch”=prop:~System.ItemNameDi splay;System.DateModified;~System.ItemFolderPathDi splay
        “”=Folder
        “EditFlags”=0xD2030000
        “FullDetails”=prop:System.PropGroup.Description;Sy stem.ItemNameDisplay;System.ItemTypeText;System.Si ze
        “NoRecentDocs”=
        “ThumbnailCutoff”=0
        “TileInfo”=prop:System.Title;System.ItemTypeText

        [HKLM\Software\WOW6432Node\Classes.exe]
        “”=exefile
        “Content Type”=application/x-msdownload

        [HKLM\Software\WOW6432Node\Classes\exefile\Shell\Op en\Command]
        “”=“%1” %*
        “IsolatedCommand”=“%1” %*

        [HKLM\Software\WOW6432Node\Classes.com]
        “”=comfile

        [HKLM\Software\WOW6432Node\Classes\comfile\Shell\Op en\Command]
        “”=“%1” %*

        [HKLM\Software\WOW6432Node\Classes.reg]
        “”=regfile

        [HKLM\Software\WOW6432Node\Classes\regfile\Shell\Op en\Command]
        “”=regedit.exe “%1”

        [HKLM\Software\WOW6432Node\Classes.scr]
        “”=scrfile

        [HKLM\Software\WOW6432Node\Classes\scrfile\Shell\Op en\Command]
        “”=“%1” /S

        [HKLM\Software\WOW6432Node\Classes.bat]
        “”=batfile

        [HKLM\Software\WOW6432Node\Classes\batfile\Shell\Op en\Command]
        “”=“%1” %*

        [HKLM\Software\WOW6432Node\Classes.cmd]
        “”=cmdfile

        [HKLM\Software\WOW6432Node\Classes\cmdfile\Shell\Op en\Command]
        “”=“%1” %*

        [HKLM\Software\WOW6432Node\Classes.pif]
        “”=piffile

        [HKLM\Software\WOW6432Node\Classes\piffile\Shell\Op en\Command]
        “”=“%1” %*

        [HKLM\Software\WOW6432Node\Classes.inf]
        “”=inffile

        [HKLM\Software\WOW6432Node\Classes\inffile\Shell\Op en\Command]
        “”=%SystemRoot%\system32\NOTEPAD.EXE %1

        [HKLM\Software\WOW6432Node\Classes.url]
        “”=InternetShortcut

        [HKLM\Software\WOW6432Node\Classes.lnk]
        “”=lnkfile

        [HKLM\Software\WOW6432Node\Classes.hta]
        “PerceivedType”=text
        “”=htafile
        “Content Type”=application/hta

        [HKLM\Software\WOW6432Node\Classes\htafile\Shell\Op en\Command]
        “”=C:\Windows\SysWOW64\mshta.exe “%1” %*

        [HKLM\Software\WOW6432Node\Classes\InternetShortcut]
        “NeverShowExt”=
        “InfoTip”=prop:System.Link.TargetUrl;System.Rating ;System.Link.Description;System.Link.Comment
        “EditFlags”=2
        “FullDetails”=prop:System.Link.TargetUrl;System.Ra ting;System.Link.Description;System.Link.Comment
        “IsShortcut”=
        “FriendlyTypeName”=@C:\Windows\System32\ieframe.dl l,-10046
        “PreviewDetails”=prop:System.Link.TargetUrl;System .Rating;System.History.VisitCount;System.History.D ateChanged

        ;System.Link.DateVisited;System.Link.Description;S ystem.Link.Comment

        [HKLM\Software\WOW6432Node\Classes\Application.Mani fest]
        “”=Application Manifest
        “EditFlags”=65536
        “BrowserFlags”=4096
        “FriendlyTypeName”=@dfshim.dll,-200

        [HKLM\Software\WOW6432Node\Classes\Application.Refe rence]
        “NeverShowExt”=
        “”=Application Reference
        “IsShortcut”=
        “EditFlags”=131072
        “FriendlyTypeName”=@dfshim.dll,-201

        [HKLM\Software\WOW6432Node\Classes\Folder]
        “ContentViewModeLayoutPatternForBrowse”=delta
        “ContentViewModeForBrowse”=prop:~System.ItemNameDi splay;~System.LayoutPattern.PlaceHolder;~System.La youtPatter

        n.PlaceHolder;~System.LayoutPattern.PlaceHolder;Sy stem.DateModified
        “ContentViewModeLayoutPatternForSearch”=alpha
        “ContentViewModeForSearch”=prop:~System.ItemNameDi splay;System.DateModified;~System.ItemFolderPathDi splay
        “”=Folder
        “EditFlags”=0xD2030000
        “FullDetails”=prop:System.PropGroup.Description;Sy stem.ItemNameDisplay;System.ItemTypeText;System.Si ze
        “NoRecentDocs”=
        “ThumbnailCutoff”=0
        “TileInfo”=prop:System.Title;System.ItemTypeText

        [HKLM\Software\Clients\StartMenuInternet\Firefox-308046B0AF4A39CB\Shell\open\Command]
        “”=“C:\Program Files\Mozilla Firefox\firefox.exe”
        [HKLM\Software\Clients\StartMenuInternet\Firefox-308046B0AF4A39CB\InstallInfo]
        “ReinstallCommand”=“C:\Program Files\Mozilla Firefox\uninstall\helper.exe” /SetAsDefaultAppGlobal

        [HKLM\Software\Clients\StartMenuInternet\Google Chrome\Shell\open\Command]
        “”=“C:\Program Files (x86)\Google\Chrome\Application\chrome.exe”
        [HKLM\Software\Clients\StartMenuInternet\Google Chrome\InstallInfo]
        “ReinstallCommand”=“C:\Program Files (x86)\Google\Chrome\Application\chrome.exe” --make-default-browser

        [HKLM\Software\Clients\StartMenuInternet\IEXPLORE.E XE\Shell\open\Command]
        “”=C:\Program Files\Internet Explorer\iexplore.exe [14/07/2019 20:29:18]
        [HKLM\Software\Clients\StartMenuInternet\IEXPLORE.E XE\InstallInfo]
        “ReinstallCommand”=“C:\Windows\System32\ie4uinit.e xe” -reinstall

        [HKLM\Software\WOW6432Node\Clients\StartMenuInterne t\Firefox-308046B0AF4A39CB\Shell\open\Command]
        “”=“C:\Program Files\Mozilla Firefox\firefox.exe”
        [HKLM\Software\WOW6432Node\Clients\StartMenuInterne t\Firefox-308046B0AF4A39CB\InstallInfo]
        “ReinstallCommand”=“C:\Program Files\Mozilla Firefox\uninstall\helper.exe” /SetAsDefaultAppGlobal

        [HKLM\Software\WOW6432Node\Clients\StartMenuInterne t\Google Chrome\Shell\open\Command]
        “”=“C:\Program Files (x86)\Google\Chrome\Application\chrome.exe”
        [HKLM\Software\WOW6432Node\Clients\StartMenuInterne t\Google Chrome\InstallInfo]
        “ReinstallCommand”=“C:\Program Files (x86)\Google\Chrome\Application\chrome.exe” --make-default-browser

        [HKLM\Software\WOW6432Node\Clients\StartMenuInterne t\IEXPLORE.EXE\Shell\open\Command]
        “”=C:\Program Files\Internet Explorer\iexplore.exe [14/07/2019 20:29:18]
        [HKLM\Software\WOW6432Node\Clients\StartMenuInterne t\IEXPLORE.EXE\InstallInfo]
        “ReinstallCommand”=“C:\Windows\System32\ie4uinit.e xe” -reinstall

        ---------- | AppcompatFlags

        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion

        \AppCompatFlags\Compatibility Assistant\Persisted]
        "C:\Users********\AppData\Local\Microsoft\Windows\ Temporary Internet Files\Content.IE5\FCXADT0B

        \SupportAssistLauncher.exe"=1
        “SIGN.MEDIA=71426 SETUP.EXE”=1
        “C:\Users*\Desktop\Reason\Install Reason 8.exe"=1
        "C:\Users*
        \Desktop\audacity-win-2.2.2.exe”=1
        “C:\Users*\Desktop\KeePass-2.39.1-Setup.exe"=1
        "C:\Users*
        \Desktop\vs_community.exe”=1
        “C:\Users*\Desktop\Skype-8.29.0.50.exe"=1
        "C:\Users*
        \Desktop\out_lame.binf_v164.exe”=1
        “C:\Users*\Desktop\Lame_v3.99.3_for_Windows.exe"=1
        "C:\Users*
        \Desktop\RW3_5.1.216.4185.XX_.exe”=1
        “C:\Users*\Desktop\temp\PL2303-Prolific_DriverInstaller_v1200.exe"=1
        "C:\Users*
        \Desktop\EuropaSetup.exe”=1
        “C:\Users*\Desktop\MixMeister Pro 5.1.2.0 + Serial\mmp5all.exe"=1
        "C:\Users*
        \AppData\Local\Temp\is-45LNO.tmp\CountInstallation.exe”=1
        "C:\Users*\Desktop\FoxitReader941_enu_Setup_Prom.exe"=1
        "C:\Users*
        \AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FCXADT0B

        \flashplayer32ax_ra_install.exe"=1
        “C:\Users*\AppData\Roaming\Foxit Software\Addon\Foxit Reader\FoxitReaderUpdater.exe"=1
        "C:\Users*
        \Desktop\New folder\Install Reason 10.exe”=1
        "C:\Users*\Desktop\uTorrent.exe"=1
        "C:\Users*
        \Downloads\iZotope Ozone 8 and Neutron 2 Advanced WIN x64x86\iZotope Ozone Advanced v8

        00\iZotope_Ozone_Advanced_v8_00.exe"=1
        "C:\Users********\Downloads\iZotope Ozone 8 and Neutron 2 Advanced WIN x64x86\iZotope Neutron Advanced v2

        00\iZotope_Neutron_Advanced_v2_00.exe"=1
        “C:\Users*\Desktop\vlc-3.0.6-win64.exe"=1
        "C:\Users*
        \Desktop\PandaCloudCleaner.exe”=1
        “C:\Users*\Desktop\ChromeSetup.exe"=1
        "C:\Users*
        \Downloads\Firefox Installer.exe”=1

        ---------- | IFEO

        ---------- | Mountpoints2

        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion\Exp lorer

        \Mountpoints2{a08823cb-795d-11e8-b725-e41f28566541}] : E:\RTK_NIC_DRIVER_INSTALLER.sfx.exe (AutoRun)

        ---------- | Windows

        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini\Windows]
        “MouseSpeed”=#USR:Control Panel\Mouse
        “MouseThreshold1”=#USR:Control Panel\Mouse
        “MouseThreshold2”=#USR:Control Panel\Mouse
        “SwapMouseButtons”=#USR:Control Panel\Mouse
        “Beep”=#USR:Control Panel\Sound
        “DoubleClickSpeed”=#USR:Control Panel\Mouse
        “CoolSwitch”=USR:Control Panel\Desktop
        “DoubleClickHeight”=#USR:Control Panel\Mouse
        “DoubleClickWidth”=#USR:Control Panel\Mouse
        “DragFullWindows”=USR:Control Panel\Desktop
        “InitialKeyboardIndicators”=USR:Control Panel\Keyboard
        “LowPowerActive”=#USR:Control Panel\Desktop
        “LowPowerTimeOut”=#USR:Control Panel\Desktop
        “PowerOffActive”=#USR:Control Panel\Desktop
        “PowerOffTimeOut”=#USR:Control Panel\Desktop
        “ScreenSaveActive”=#USR:Control Panel\Desktop
        “ScreenSaveTimeOut”=#USR:Control Panel\Desktop
        “SnapToDefaultButton”=#USR:Control Panel\Mouse
        “”=USR:Software\Microsoft\Windows NT\CurrentVersion\Windows
        “Spooler”=#SYS:Microsoft\Windows NT\CurrentVersion\Windows
        “TRANSMISSIONRETRYTIMEOUT”=#SYS:MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
        “DEFAULTSEPARATEVDM”=\REGISTRY\MACHINE\SYSTEM\CURR ENTCONTROLSET\CONTROL\WOW
        “APPINIT_DLLS”=SYS:MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
        “DEVICENOTSELECTEDTIMEOUT”=#SYS:MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
        “SWAPDISK”=SYS:MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS

        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\Boot]
        “”=SYS:Microsoft\Windows NT\CurrentVersion\WOW\boot
        “ScreenSaverActive”=USR:Control Panel\Desktop
        “ScreenSaverIsSecure”=USR:Control Panel\Desktop
        “SCRNSAVE.EXE”=USR:Control Panel\Desktop
        “Shell”=SYS:Microsoft\Windows NT\CurrentVersion\Winlogon

        [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini\Windows]
        “MouseSpeed”=#USR:Control Panel\Mouse
        “MouseThreshold1”=#USR:Control Panel\Mouse
        “MouseThreshold2”=#USR:Control Panel\Mouse
        “SwapMouseButtons”=#USR:Control Panel\Mouse
        “Beep”=#USR:Control Panel\Sound
        “DoubleClickSpeed”=#USR:Control Panel\Mouse
        “CoolSwitch”=USR:Control Panel\Desktop
        “DoubleClickHeight”=#USR:Control Panel\Mouse
        “DoubleClickWidth”=#USR:Control Panel\Mouse
        “DragFullWindows”=USR:Control Panel\Desktop
        “InitialKeyboardIndicators”=USR:Control Panel\Keyboard
        “LowPowerActive”=#USR:Control Panel\Desktop
        “LowPowerTimeOut”=#USR:Control Panel\Desktop
        “PowerOffActive”=#USR:Control Panel\Desktop
        “PowerOffTimeOut”=#USR:Control Panel\Desktop
        “ScreenSaveActive”=#USR:Control Panel\Desktop
        “ScreenSaveTimeOut”=#USR:Control Panel\Desktop
        “SnapToDefaultButton”=#USR:Control Panel\Mouse
        “TRANSMISSIONRETRYTIMEOUT”=#SYS:MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
        “DEFAULTSEPARATEVDM”=\REGISTRY\MACHINE\SYSTEM\CURR ENTCONTROLSET\CONTROL\WOW
        “APPINIT_DLLS”=SYS:MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
        “DEVICENOTSELECTEDTIMEOUT”=#SYS:MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
        “SWAPDISK”=SYS:MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS

        [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\Boot]
        “”=SYS:Microsoft\Windows NT\CurrentVersion\WOW\boot
        “ScreenSaverActive”=USR:Control Panel\Desktop
        “ScreenSaverIsSecure”=USR:Control Panel\Desktop
        “SCRNSAVE.EXE”=USR:Control Panel\Desktop
        “Shell”=SYS:Microsoft\Windows NT\CurrentVersion\Winlogon

        [HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems]
        “windows”=%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On

        SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3

        ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

        ---------- | Security center

        [HKLM\SOFTWARE\Microsoft\Security Center]
        “cval”=1

        [HKLM\SOFTWARE\Microsoft\Security Center\svc]
        “VistaSp1”=128920218544262440
        “AntiVirusOverride”=0
        “AntiSpywareOverride”=0
        “FirewallOverride”=0

        [HKLM\SOFTWARE\Microsoft\Windows Defender]
        “DisableAntiSpyware”=1
        “DisableRoutinelyTakingAction”=1
        “ProductStatus”=0
        “InstallTime”=0x00FA25256A0DD401

        [HKLM\Software\WOW6432Node\Microsoft\Windows Defender]
        “DisableAntiSpyware”=0
        “DisableRoutinelyTakingAction”=1

        [HKLM\SYSTEM\CurrentControlSet\services\SharedAcces s\Parameters\FirewallPolicy\DomainProfile]
        “EnableFirewall”=1

        [HKLM\SYSTEM\CurrentControlSet\services\SharedAcces s\Parameters\FirewallPolicy\StandardProfile]
        “EnableFirewall”=1

        [HKLM\SYSTEM\CurrentControlSet\services\SharedAcces s\Parameters\FirewallPolicy\PublicProfile]
        “EnableFirewall”=1

        ---------- | Safeboot

        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\AppInfo]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\AppMgmt]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\Base]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\Boot Bus Extender]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\Boot file system]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\CryptSvc]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\DcomLaunch]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\EFS]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\EventLog]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\File system]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\Filter]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\HelpSvc]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\KeyIso]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\Netlogon]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\NTDS]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\PCI Configuration]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\PlugPlay]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\PNP Filter]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\Power]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\Primary disk]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\ProfSvc]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\RpcEptMapper]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\RpcSs]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\sacsvr]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\SCSI Class]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\sermouse.sys]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\SWPRV]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\System Bus Extender]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\TabletInputService]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\TBS]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\TrustedInstaller]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\VDS]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\vga.sys]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\vgasave.sys]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\vmms]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\volmgr.sys]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\volmgrx.sys]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\Wdf01000.sys]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\WinDefend]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\WinMgmt]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\WudfPf]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\WudfRd]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal\WudfSvc]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal{36FC9E60-C465-11CF-8056-444553540000}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal{4D36E965-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal{4D36E967-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal{4D36E969-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal{4D36E96A-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal{4D36E96B-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal{4D36E96F-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal{4D36E977-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal{4D36E97B-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal{4D36E97D-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal{4D36E980-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Min imal{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\AFD]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\AppInfo]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\AppMgmt]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\Base]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\BFE]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\Boot Bus Extender]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\Boot file system]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\bowser]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\Browser]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\CryptSvc]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\DcomLaunch]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\dfsc]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\Dhcp]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\DnsCache]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\Dot3Svc]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\Eaphost]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\EFS]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\EventLog]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\File system]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\Filter]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\HelpSvc]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\IKEEXT]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\ipnat.sys]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\KeyIso]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\LanmanServer]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\LanmanWorkstation]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\LmHosts]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\Messenger]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\MPSDrv]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\MPSSvc]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\mrxsmb]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\mrxsmb10]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\mrxsmb20]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\NativeWifiP]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\NDIS]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\NDIS Wrapper]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\ndiscap]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\Ndisuio]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\NetBIOS]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\NetBIOSGroup]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\NetBT]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\NetDDEGroup]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\Netlogon]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\NetMan]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\netprofm]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\Network]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\NetworkProvider]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\NlaSvc]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\Nsi]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\nsiproxy.sys]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\NTDS]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\PCI Configuration]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\PlugPlay]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\PNP Filter]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\PNP_TDI]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\PolicyAgent]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\Power]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\Primary disk]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\ProfSvc]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\rdbss]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\rdpencdd.sys]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\rdsessmgr]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\RpcEptMapper]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\RpcSs]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\sacsvr]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\SCardSvr]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\SCSI Class]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\sermouse.sys]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\SharedAccess]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\Streams Drivers]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\SWPRV]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\System Bus Extender]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\TabletInputService]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\TBS]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\Tcpip]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\TDI]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\TrustedInstaller]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\VaultSvc]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\VDS]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\vga.sys]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\vgasave.sys]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\vmms]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\volmgr.sys]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\volmgrx.sys]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\Wdf01000.sys]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\WinDefend]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\WinMgmt]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\Wlansvc]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\WudfPf]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\WudfRd]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\WudfSvc]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work\WudfUsbccidDriver]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{36FC9E60-C465-11CF-8056-444553540000}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{4D36E965-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{4D36E967-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{4D36E969-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{4D36E96A-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{4D36E96B-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{4D36E96F-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{4D36E972-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{4D36E973-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{4D36E974-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{4D36E975-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{4D36E977-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{4D36E97B-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{4D36E97D-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{4D36E980-E325-11CE-BFC1-08002BE10318}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{50DD5230-BA8A-11D1-BF5D-0000F805F530}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
        [HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Net work{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

        ---------- | Winsock (Whitelist)

        ---------- | Hosts

        ---------- | Ping

        Pinging google.com [172.217.3.238] with 32 bytes of data:
        Reply from 172.217.3.238: bytes=32 time=31ms TTL=51
        Reply from 172.217.3.238: bytes=32 time=142ms TTL=51
        Reply from 172.217.3.238: bytes=32 time=60ms TTL=51
        Reply from 172.217.3.238: bytes=32 time=94ms TTL=51

        Ping statistics for 172.217.3.238:
        Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
        Approximate round trip times in milli-seconds:
        Minimum = 31ms, Maximum = 142ms, Average = 81ms

        ---------- | @

        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Internet Explorer\Main]
        “Disable Script Debugger”=yes
        “Anchor Underline”=yes
        “Cache_Update_Frequency”=Once_Per_Session
        “Display Inline Images”=yes
        “Do404Search”=0x01000000
        “Local Page”=C:\Windows\system32\blank.htm
        “Save_Session_History_On_Exit”=no
        “Show_FullURL”=no
        “Show_StatusBar”=yes
        “Show_ToolBar”=yes
        “Show_URLinStatusBar”=yes
        “Show_URLToolBar”=yes
        “Use_DlgBox_Colors”=yes
        “Search Page”= Search - Microsoft Bing
        “XMLHTTP”=1
        “NoUpdateCheck”=1
        “UseClearType”=no
        “Enable Browser Extensions”=yes
        “Play_Background_Sounds”=yes
        “Play_Animations”=yes
        “Start Page”= http://www.dell.com/
        “Default_Page_URL”= http://www.dell.com
        “DisableFirstRunCustomize”=1
        “DisableScriptDebuggerIE”=yes
        “OperationalData”=5
        “CompatibilityFlags”=0
        “SearchBandRestoreBarCount”=0
        “SearchBandMigrationVersion”=1
        “FullScreen”=no
        “Window_Placement”=0x2C0000000200000003000000FFFFF FFFFFFFFFFFFFFFFFFFFFFFFFFF23000000230000007803000 07B020000
        “ImageStoreRandomFolder”=xs9y7oq
        “DownloadWindowPlacement”=0x0000000000000000000000 00000000000000000000000000000000000000000000000000 0000000000

        000000
        “Use FormSuggest”=yes
        “Start Page_TIMESTAMP”=0x659D410ED838D501
        “SyncHomePage Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy”=
        “Check_Associations”=no
        “IE11DefaultsFREGPOFileOptions”=0
        “IE11DefaultsFREGPOFileCheck”=1
        “IE11DefaultsFREGPOCheckTimestamp”=0x533DF504D838D 501

        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion\Int ernet

        settings]
        “IE5_UA_Backup_Flag”=5.0
        “User Agent”=Mozilla/4.0 (compatible; MSIE 8.0; Win32)
        “EmailName”=User@
        “PrivDiscUiShown”=1
        “EnableHttp1_1”=1
        “WarnOnIntranet”=1
        “MimeExclusionListForCache”=multipart/mixed multipart/x-mixed-replace multipart/x-byteranges
        “AutoConfigProxy”=wininet.dll
        “UseSchannelDirectly”=0x01000000
        “WarnOnPost”=0x01000000
        “UrlEncoding”=0
        “SecureProtocols”=2688
        “PrivacyAdvanced”=0
        “ZonesSecurityUpgrade”=0xFC39CC526C0DD401
        “DisableCachingOfSSLPages”=0
        “WarnonZoneCrossing”=0
        “CertificateRevocation”=1
        “EnableNegotiate”=1
        “MigrateProxy”=1
        “ProxyEnable”=0

        [HKLM\Software\Microsoft\Internet Explorer\Main]
        “AutoHide”=yes
        “Security Risk Page”=about:SecurityRisk
        “Extensions Off Page”=about:NoAdd-ons
        “Default_Search_URL”= Search - Microsoft Bing
        “Default_Page_URL”= MSN
        “Anchor_Visitation_Horizon”=0x01000000
        “Cache_Percent_of_Disk”=0x0A000000
        “Placeholder_Width”=0x1A000000
        “Placeholder_Height”=0x1A000000
        “Default_Secondary_Page_URL”=
        “Use_Async_DNS”=yes
        “Start Page”= MSN
        “Local Page”=C:\Windows\System32\blank.htm
        “Search Page”= Search - Microsoft Bing
        “Delete_Temp_Files_On_Exit”=yes
        “Enable_Disk_Cache”=yes
        “ApplicationTileImmersiveActivation”=1
        “AssociationActivationMode”=0
        “x86AppPath”=C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

        [HKLM\Software\Microsoft\Internet Explorer\AboutURLs]
        “blank”=res://mshtml.dll/blank.htm
        “NoAdd-onsInfo”=res://ieframe.dll/noaddoninfo.htm
        “InPrivate”=res://ieframe.dll/inprivate_win7.htm
        “NavigationFailure”=res://ieframe.dll/navcancl.htm
        “NoAdd-ons”=res://ieframe.dll/noaddon.htm
        “Home”=270
        “PostNotCached”=res://ieframe.dll/repost.htm
        “DesktopItemNavigationFailure”=res://ieframe.dll/navcancl.htm
        “NavigationCanceled”=res://ieframe.dll/navcancl.htm
        “SecurityRisk”=res://ieframe.dll/securityatrisk.htm
        “Compat”=res://mshtml.dll/compat.htm

        [HKLM\Software\Microsoft\Windows\CurrentVersion\URL \DefaultPrefix]
        “”=http://

        [HKLM\Software\Microsoft\Windows\CurrentVersion\URL \Prefixes]
        “mosaic”=http://
        “www”=http://
        “home”=http://
        “ftp”=ftp://

        [HKLM\Software\Microsoft\Windows\CurrentVersion\Int ernet settings]
        “EnablePunycode”=1
        “CodeBaseSearchPath”=CODEBASE
        “WarnOnIntranet”=1
        “MinorVersion”=0
        “ActiveXCache”=C:\Windows\Downloaded Program Files

        [HKLM\Software\WOW6432Node\Microsoft\Internet Explorer\Main]
        “AutoHide”=yes
        “Security Risk Page”=about:SecurityRisk
        “Extensions Off Page”=about:NoAdd-ons
        “Default_Search_URL”= Search - Microsoft Bing
        “Default_Page_URL”= MSN
        “Anchor_Visitation_Horizon”=0x01000000
        “Cache_Percent_of_Disk”=0x0A000000
        “Placeholder_Width”=0x1A000000
        “Placeholder_Height”=0x1A000000
        “Default_Secondary_Page_URL”=
        “Use_Async_DNS”=yes
        “Start Page”= MSN
        “Local Page”=C:\Windows\SysWOW64\blank.htm
        “Search Page”= Search - Microsoft Bing
        “Delete_Temp_Files_On_Exit”=yes
        “Enable_Disk_Cache”=yes
        “Check_Associations”=yes
        “ApplicationTileImmersiveActivation”=1
        “AssociationActivationMode”=0
        “x86AppPath”=C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

        [HKLM\Software\WOW6432Node\Microsoft\Internet Explorer\AboutURLs]
        “blank”=res://mshtml.dll/blank.htm
        “NoAdd-onsInfo”=res://ieframe.dll/noaddoninfo.htm
        “InPrivate”=res://ieframe.dll/inprivate_win7.htm
        “NavigationFailure”=res://ieframe.dll/navcancl.htm
        “NoAdd-ons”=res://ieframe.dll/noaddon.htm
        “Home”=270
        “PostNotCached”=res://ieframe.dll/repost.htm
        “DesktopItemNavigationFailure”=res://ieframe.dll/navcancl.htm
        “NavigationCanceled”=res://ieframe.dll/navcancl.htm
        “SecurityRisk”=res://ieframe.dll/securityatrisk.htm
        “Compat”=res://mshtml.dll/compat.htm

        [HKLM\Software\WOW6432Node\Microsoft\Windows\Curren tVersion\URL\DefaultPrefix]
        “”=http://

        [HKLM\Software\WOW6432Node\Microsoft\Windows\Curren tVersion\URL\Prefixes]
        “mosaic”=http://
        “www”=http://
        “home”=http://
        “ftp”=ftp://

        [HKLM\Software\WOW6432Node\Microsoft\Windows\Curren tVersion\Internet settings]
        “EnablePunycode”=1
        “CodeBaseSearchPath”=CODEBASE
        “WarnOnIntranet”=1
        “MinorVersion”=0
        “ActiveXCache”=C:\Windows\Downloaded Program Files

        ---------- | Proxy

        ---------- | reparsepoint

        ---------- | Detection of offsets

        ---------- | Notify

        ---------- | Execution FileExts

        ---------- | SIOI | SEH | URLSH

        [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Exp lorer\ShellIconOverlayIdentifiers\EnhancedStorageS hell] -

        {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} – %SystemRoot%\system32\EhStorShell.dll
        [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Exp lorer\ShellIconOverlayIdentifiers\Offline Files] -

        {4E77131D-3629-431c-9818-C5679DC83E81} – %SystemRoot%\System32\cscui.dll
        [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Exp lorer\ShellIconOverlayIdentifiers\SharingPrivate] -

        {08244EE6-92F0-47f2-9FC9-929BAA2E7235} – %SystemRoot%\system32\ntshrui.dll
        [HKLM\Software\WOW6432Node\Microsoft\Windows\Curren tVersion\Explorer\ShellIconOverlayIdentifiers

        \EnhancedStorageShell] - {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} – %SystemRoot%\system32\EhStorShell.dll
        [HKLM\Software\WOW6432Node\Microsoft\Windows\Curren tVersion\Explorer\ShellIconOverlayIdentifiers

        \SharingPrivate] - {08244EE6-92F0-47f2-9FC9-929BAA2E7235} – %SystemRoot%\system32\ntshrui.dll

        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks]
        “{CFBFAE00-17A6-11D0-99CB-00C04FD64497}”=

        ---------- | Toolbar

        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
        “Locked”=1
        “ShowDiscussionButton”=Yes

        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser]
        “ITBar7Height”=0

        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
        “DefaultScope”={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
        “DefaultPackCorrection”=1
        “DefaultPackNTCorrection”=1
        “KnownProvidersUpgradeTime”=0x22717741BACCD401
        “DownloadRetries”=1
        “Version”=4
        “UpgradeTime”=0x56CB4B08D838D501

        [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
        “DefaultScope”={0633EE93-D776-472f-A0FF-E1416B8B2E3A}

        [HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes]
        “DefaultScope”={0633EE93-D776-472f-A0FF-E1416B8B2E3A}

        ---------- | Extensions

        [HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions{2670000A-7350-4f3c-8081-5663EE0C6C49}] : (Se&nd to

        OneNote) -
        [HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}] : (OneNote

        Lin&ked Notes) -
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions{2670000A-7350-4f3c-8081-5663EE0C6C49}] :

        (Se&nd to OneNote) -
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}] :

        (OneNote Lin&ked Notes) -

        ---------- | SearchScopes

        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

        {0633EE93-D776-472f-A0FF-E1416B8B2E3A}] - (Bing) - Search - Microsoft Bing

        N0400A915F698E57&form=CONBDF&conlogo=CT3335818&q={ searchTerms} :
        [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] -

        (@ieframe.dll,-12512) - Search - Microsoft Bing {searchTerms}&FORM=IE8SRC :
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] -

        (@ieframe.dll,-12512) - Search - Microsoft Bing {searchTerms}&FORM=IE8SRC :

        ---------- | Browser Helper Objects

        [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Exp lorer\Browser Helper Objects{B4F3A835-0E21-4959-BA22-

        42B3008E02FF}] → (Office Document Cache Handler) : C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [21/12/2010

        01:05:22]
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\Curren tVersion\Explorer\Browser Helper Objects{B4F3A835-0E21-

        4959-BA22-42B3008E02FF}] → (Office Document Cache Handler) : C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

        [21/12/2010 01:05:22]

        ---------- | Chrome

        C:\Users********\AppData\Local\Google\Chrome\User Data\Default\extensions\aapocclcgogkmnckokdopfmhon fmgoek =

        : Google & co - Google & co - https://clients2.google.com/service/update2/crx
        C:\Users********\AppData\Local\Google\Chrome\User Data\Default\extensions\aohghmighlieiainnegkcijnfi lokake =

        : Google & co - Google & co - https://clients2.google.com/service/update2/crx
        C:\Users********\AppData\Local\Google\Chrome\User Data\Default\extensions\apdfllckaahabafndbhieahigk jlhalf =

        : Google & co - https://drive.google.com/?usp=chrome_app - Google & co -

        [ http://docs.google.com/http://drive....ve.google.com/ ] -


        C:\Users********\AppData\Local\Google\Chrome\User Data\Default\extensions\blpcfgokakmgnkcojhhkbfbldk acnbeo =

        : Google & co - http://www.youtube.com - http://www.youtube.com - Google & co -


        C:\Users********\AppData\Local\Google\Chrome\User Data\Default\extensions\felcaaldnbdncclmgdcncolpeb giejap =

        : Google & co - Google & co - https://clients2.google.com/service/update2/crx
        C:\Users********\AppData\Local\Google\Chrome\User Data\Default\extensions\ghbmnnjooekpmoecnnnilnnbdl olhkhi =

        : MSG_extDesc - MSG_extName - https://clients2.google.com/service/update2/crx
        C:\Users********\AppData\Local\Google\Chrome\User Data\Default\extensions\nmmhkkegccagdldgiimedpiccm gmieda =

        : Google & co - Google & co - 203784468217.apps.googleusercontent.com -


        C:\Users********\AppData\Local\Google\Chrome\User Data\Default\extensions\pjkljhegncpnkpknbcohdijeoe jaedia =

        : Google & co - https://mail.google.com/mail - Google & co - [*://mail.google.com/mail] -


        C:\Users********\AppData\Local\Google\Chrome\User Data\Default\extensions\pkedcjkdefgpdelpbcmbmeomcj beemfm =

        : Provider for discovery and services for mirroring of Chrome Media Router - Chrome Media Router -

        919648714761-55j965o0km033psv3i9qls5mo3qtdrb0.apps.googleuserco ntent.com -



        ---------- | Opera

        ---------- | Firefox

        [HKLM\Software\MozillaPlugins@adobe.com/FlashPlayer] - (Adobe® Flash® Player 29.0.0.171 Plugin) : C:\Windows

        \system32\Macromed\Flash\NPSWF64_29_0_0_171.dll
        [HKLM\Software\MozillaPlugins@microsoft.com/GENUINE] - () : disabled
        [HKLM\Software\MozillaPlugins@microsoft.com/OfficeAuthz,version=14.0] - (Office Authorization plug-in for

        NPAPI browsers) : C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL
        [HKLM\Software\MozillaPlugins@videolan.org/vlc,version=3.0.6] - (VLC Multimedia Plugin) : C:\Program Files

        \VideoLAN\VLC\npvlc.dll
        [HKLM\Software\WOW6432Node\MozillaPlugins@adobe.com/FlashPlayer] - (Adobe® Flash® Player 29.0.0.171 Plugin) :

        C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_29_0_0_ 171.dll
        [HKLM\Software\WOW6432Node\MozillaPlugins@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf]
        • () : C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll
          [HKLM\Software\WOW6432Node\MozillaPlugins@foxitsoftware.com/Foxit Reader

        Plugin,version=1.0,application/vnd.fdf] - () : C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins

        \npFoxitReaderPlugin.dll
        [HKLM\Software\WOW6432Node\MozillaPlugins@foxitsoftware.com/Foxit Reader

        Plugin,version=1.0,application/vnd.xdp] - () : C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins

        \npFoxitReaderPlugin.dll
        [HKLM\Software\WOW6432Node\MozillaPlugins@foxitsoftware.com/Foxit Reader

        Plugin,version=1.0,application/vnd.xfdf] - () : C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins

        \npFoxitReaderPlugin.dll
        [HKLM\Software\WOW6432Node\MozillaPlugins@intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5] - (Intel IPT

        WebApi plugin) : C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
        [HKLM\Software\WOW6432Node\MozillaPlugins@intel-webapi.intel.com/Intel WebAPI updater] - (This plugin updates

        Intel WebAPI component) : C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT

        \npIntelWebAPIUpdater.dll
        [HKLM\Software\WOW6432Node\MozillaPlugins@microsoft.com/GENUINE] - () : disabled
        [HKLM\Software\WOW6432Node\MozillaPlugins@microsoft.com/OfficeAuthz,version=14.0] - (Office Authorization

        plug-in for NPAPI browsers) : C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
        [HKLM\Software\WOW6432Node\MozillaPlugins@microsoft.com/SharePoint,version=14.0] - (Microsoft SharePoint

        Plug-in for Firefox) : C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
        [HKLM\Software\WOW6432Node\MozillaPlugins@tools.google.com/Google Update;version=3] - (Google Update) : C:

        \Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll
        [HKLM\Software\WOW6432Node\MozillaPlugins@tools.google.com/Google Update;version=9] - (Google Update) : C:

        \Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll

        C:\Users********\AppData\Roaming\Mozilla\Firefox\P rofiles\54mhv969.default-1563029380061\Prefs.js

        user_pref(“browser.startup.homepage_override.build ID”, “20190705220548”);
        user_pref(“browser.startup.homepage_override.mston e”, “68.0”);
        user_pref(“extensions.activeThemeID”, “default-theme@mozilla.org”);
        user_pref(“extensions.blocklist.lastModified”, “Wed, 17 Jul 2019 12:38:35 GMT”);
        user_pref(“extensions.blocklist.pingCountTotal”, 2);
        user_pref(“extensions.blocklist.pingCountVersion”, 2);
        user_pref(“extensions.databaseSchema”, 31);
        user_pref(“extensions.getAddons.cache.lastUpdate”, 1563150826);
        user_pref(“extensions.getAddons.databaseSchema”, 5);
        user_pref(“extensions.incognito.migrated”, true);
        user_pref(“extensions.lastAppBuildId”, “20190705220548”);
        user_pref(“extensions.lastAppVersion”, “68.0”);
        user_pref(“extensions.lastPlatformVersion”, “68.0”);
        user_pref(“extensions.pendingOperations”, false);
        user_pref(“extensions.systemAddonSet”, “{"schema":1,"addons":{}}”);
        user_pref(“extensions.ui.dictionary.hidden”, true);
        user_pref(“extensions.ui.lastCategory”, “addons://discover/”);
        user_pref(“extensions.ui.locale.hidden”, true);
        user_pref(“extensions.webcompat.perform_injections ”, true);
        user_pref(“extensions.webcompat.perform_ua_overrid es”, true);
        user_pref(“extensions.webextensions.uuids”, "{"formautofill@mozilla.org":"8cf51839-5178-4706-8894-

        a7604ccd544e","fxmonitor@mozilla.org":"37e8b279-98eb-40af-ae9e-714ca5e53b59","screenshots@mozilla.org

        ":"9e8e57a4-a57a-465a-93c7-40cf00e8aceb","webcompat-reporter@mozilla.org":"9feda981-b02b-42b5-bc59-

        48e9b1989934","webcompat@mozilla.org":"0f4ee8cc-7ede-4f2a-b7f8-d8726fd90941","default-theme@mozilla.org

        ":"f21a9632-2965-4ca3-ad00-41f54b213db7","google@search.mozilla.org":"56c1156f-d2c3-49dc-af9b-

        16737fbddbb1","amazondotcom@search.mozilla.org":"a37be111-df1b-4dc2-b0ab-03c2cc85b89c",

        "bing@search.mozilla.org":"1fda2a1f-e04a-4cac-aa0c-1af55c5ccdb9","ddg@search.mozilla.org":"1db4767d-

        a28b-43bf-9729-274fa7df05e8","ebay@search.mozilla.org":"8c8e9597-c05c-425f-aba4-606c5ed3d48c",

        "twitter@search.mozilla.org":"905358ea-8b10-4d20-98e1-879b9504d9a8","wikipedia@search.mozilla.org":

        "d39ae4b1-368d-4b56-b802-174647ad82de"}");

        C:\Users*\AppData\Roaming\Mozilla\Firefox\Profiles\54mhv969 .default-1563029380061
        C:\Users*
        \AppData\Roaming\Mozilla\Firefox\Profiles\w9ra6rx2 .default

        [Profile0] - Name=default → Profiles/54mhv969.default-1563029380061

        ---------- | DNS

        [HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Param eters]
        “DhcpNameServer”=209.18.47.62 209.18.47.61
        [HKLM\SYSTEM\ControlSet001\services\Tcpip\Parameter s\Interfaces{F1ABA7E1-57DC-49E4-8FA4-8A72EEFAFE0B}]
        “DhcpNameServer”=209.18.47.62 209.18.47.61
        [HKLM\SYSTEM\ControlSet002\services\Tcpip\Parameter s\Interfaces{F1ABA7E1-57DC-49E4-8FA4-8A72EEFAFE0B}]
        “DhcpNameServer”=8.8.8.8 8.8.4.4
        [HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Param eters\Interfaces{F1ABA7E1-57DC-49E4-8FA4-8A72EEFAFE0B}]
        “DhcpNameServer”=209.18.47.62 209.18.47.61

        ---------- | Applications

        [HKLM\SOFTWARE\Classes\Applications\ehshell.exe] : “C:\Windows\eHome\ehshell.exe” “%1”
        [HKLM\SOFTWARE\Classes\Applications\iexplore.exe] : “C:\Program Files\Internet Explorer\iexplore.exe” %1
        [HKLM\SOFTWARE\Classes\Applications\i_view32.exe] : “C:\Program Files (x86)\IrfanView\i_view32.exe” “%1”
        [HKLM\SOFTWARE\Classes\Applications\notepad.exe] : %SystemRoot%\system32\NOTEPAD.EXE %1
        [HKLM\SOFTWARE\Classes\Applications\ois.exe] : C:\PROGRA~2\MICROS~1\Office14\OIS.EXE /shellOpen “%1”
        [HKLM\SOFTWARE\Classes\Applications\photoviewer.dll] : %SystemRoot%\System32\rundll32.exe "%ProgramFiles%

        \Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
        [HKLM\SOFTWARE\Classes\Applications\vlc.exe] : “C:\Program Files\VideoLAN\VLC\vlc.exe” --started-from-file

        “%1”
        [HKLM\SOFTWARE\Classes\Applications\wmplayer.exe] : “%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe”

        /Open “%L”
        [HKLM\SOFTWARE\Classes\Applications\wordpad.exe] : “%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE” “%1”
        [HKLM\SOFTWARE\WOW6432Node\Classes\Applications\ehs hell.exe] : “C:\Windows\eHome\ehshell.exe” “%1”
        [HKLM\SOFTWARE\WOW6432Node\Classes\Applications\iex plore.exe] : "C:\Program Files\Internet Explorer

        \iexplore.exe" %1
        [HKLM\SOFTWARE\WOW6432Node\Classes\Applications\i_v iew32.exe] : "C:\Program Files (x86)\IrfanView

        \i_view32.exe" “%1”
        [HKLM\SOFTWARE\WOW6432Node\Classes\Applications\not epad.exe] : %SystemRoot%\system32\NOTEPAD.EXE %1
        [HKLM\SOFTWARE\WOW6432Node\Classes\Applications\ois .exe] : C:\PROGRA~2\MICROS~1\Office14\OIS.EXE /shellOpen

        “%1”
        [HKLM\SOFTWARE\WOW6432Node\Classes\Applications\pho toviewer.dll] : %SystemRoot%\System32\rundll32.exe

        “%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll”, ImageView_Fullscreen %1
        [HKLM\SOFTWARE\WOW6432Node\Classes\Applications\vlc .exe] : “C:\Program Files\VideoLAN\VLC\vlc.exe” --started-

        from-file “%1”
        [HKLM\SOFTWARE\WOW6432Node\Classes\Applications\wmp layer.exe] : "%ProgramFiles(x86)%\Windows Media Player

        \wmplayer.exe" /Open “%L”
        [HKLM\SOFTWARE\WOW6432Node\Classes\Applications\wor dpad.exe] : "%ProgramFiles%\Windows NT\Accessories

        \WORDPAD.EXE" “%1”

        ---------- | SvcHost (Whitelist)

        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
        “regsvc”=RemoteRegistry
        “DcomLaunch”=Power
        PlugPlay
        DcomLaunch
        “secsvcs”=WinDefend
        “bthsvcs”=bthserv
        “PeerDist”=PeerDistSvc
        “GPSvcGroup”=GPSvc

        [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost]
        “DcomLaunch”=Power
        PlugPlay
        DcomLaunch

        ---------- | SvcHost - Netsvcs (Whitelist)

        ---------- | Software

        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\7-Zip]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Alps]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\AppDataLow]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\BitTorrentPersist]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Clients]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Dell Computer Corporation]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Foxit Software]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\g3n-h@ckm@n]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Google]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Hewlett-Packard]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Intel]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\iZotope]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Lavasoft]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Macrium]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\MixMeister Technology]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Mozilla]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Netscape]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\ODBC]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Policies]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Propellerhead Software]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\ProtectedStorage]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\RegisteredApplications]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\SimonTatham]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\skype]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\skypeapp-8527ec7da092]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\skypeapp-908498f39d08]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\SmartImage]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\sysinternals]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Trolltech]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Visioneer]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Winamp]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Wow6432Node]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\AppDataLow\Software\Microsoft]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\DWM]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\Shell]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\ShellNoRoam]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\TabletPC]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\Windows Error Reporting]
        [HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows NT\CurrentVersion]
        [HKLM\Software\7-Zip]
        [HKLM\Software\Alps]
        [HKLM\Software\ASIO]
        [HKLM\Software\ATI Technologies]
        [HKLM\Software\CBSTEST]
        [HKLM\Software\Clients]
        [HKLM\Software\Dell]
        [HKLM\Software\Dell Computer Corporation]
        [HKLM\Software\Dell Inc.]
        [HKLM\Software\Foxit Software]
        [HKLM\Software\g3n-h@ckm@n]
        [HKLM\Software\IDT]
        [HKLM\Software\InstalledOptions]
        [HKLM\Software\Intel]
        [HKLM\Software\Khronos]
        [HKLM\Software\Macromedia]
        [HKLM\Software\ManageableUpdatePackage]
        [HKLM\Software\Microsoft]
        [HKLM\Software\Mozilla]
        [HKLM\Software\mozilla.org]
        [HKLM\Software\MozillaPlugins]
        [HKLM\Software\ODBC]
        [HKLM\Software\PC-Doctor]
        [HKLM\Software\Policies]
        [HKLM\Software\Propellerhead Software]
        [HKLM\Software\RegisteredApplications]
        [HKLM\Software\SimonTatham]
        [HKLM\Software\Sonic]
        [HKLM\Software\sysinternals]
        [HKLM\Software\VideoLAN]
        [HKLM\Software\Visioneer]
        [HKLM\Software\Wow6432Node]
        [HKLM\Software\Microsoft\Windows\CurrentVersion]
        [HKLM\Software\Microsoft\Windows\HTML Help]
        [HKLM\Software\Microsoft\Windows\ITStorage]
        [HKLM\Software\Microsoft\Windows\ScheduledDiagnosti cs]
        [HKLM\Software\Microsoft\Windows\ScriptedDiagnostic sProvider]
        [HKLM\Software\Microsoft\Windows\Tablet PC]
        [HKLM\Software\Microsoft\Windows\TabletPC]
        [HKLM\Software\Microsoft\Windows\Windows Error Reporting]
        [HKLM\Software\Microsoft\Windows\Windows Search]
        [HKLM\Software\Microsoft\Windows NT\CurrentVersion]
        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\AxInstSVGroup]
        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\defragsvc]
        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\GPSvcGroup]
        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalService]
        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalServiceAndNoImperso nation]
        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalServiceNetworkRestr icted]
        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalServiceNoNetwork]
        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalSystemNetworkRestri cted]
        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs]
        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\NetworkService]
        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\NetworkServiceRemoteDesk topHyperVAgent]
        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\NetworkServiceRemoteDesk topPublishing]
        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\SDRSVC]
        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\swprv]
        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\termsvcs]
        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\utcsvc]
        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\wcssvc]
        [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\wercplsupport]
        [HKLM\Software\WOW6432Node\ASIO]
        [HKLM\Software\WOW6432Node\Foxit Software]
        [HKLM\Software\WOW6432Node\Google]
        [HKLM\Software\WOW6432Node\IDT]
        [HKLM\Software\WOW6432Node\Intel]
        [HKLM\Software\WOW6432Node\IrfanView]
        [HKLM\Software\WOW6432Node\iZotope, Inc./Neutron 2 Advanced]
        [HKLM\Software\WOW6432Node\iZotope, Inc./Ozone 8 Advanced]
        [HKLM\Software\WOW6432Node\Khronos]
        [HKLM\Software\WOW6432Node\Lame For Audacity]
        [HKLM\Software\WOW6432Node\Lavasoft]
        [HKLM\Software\WOW6432Node\Line 6]
        [HKLM\Software\WOW6432Node\Macromedia]
        [HKLM\Software\WOW6432Node\Microsoft]
        [HKLM\Software\WOW6432Node\MixMeister Technology]
        [HKLM\Software\WOW6432Node\Mozilla]
        [HKLM\Software\WOW6432Node\MozillaPlugins]
        [HKLM\Software\WOW6432Node\Notepad++]
        [HKLM\Software\WOW6432Node\Nullsoft]
        [HKLM\Software\WOW6432Node\ODBC]
        [HKLM\Software\WOW6432Node\Panda Security]
        [HKLM\Software\WOW6432Node\Panda Software]
        [HKLM\Software\WOW6432Node\Prolific Technology INC]
        [HKLM\Software\WOW6432Node\Visioneer]
        [HKLM\Software\WOW6432Node\Clients]
        [HKLM\Software\WOW6432Node\Policies]
        [HKLM\Software\WOW6432Node\RegisteredApplications]
        [HKLM\Software\WOW6432Node\Microsoft\Windows\Curren tVersion]
        [HKLM\Software\WOW6432Node\Microsoft\Windows\Help]
        [HKLM\Software\WOW6432Node\Microsoft\Windows\HTML Help]
        [HKLM\Software\WOW6432Node\Microsoft\Windows\ITStor age]
        [HKLM\Software\WOW6432Node\Microsoft\Windows\Script edDiagnosticsProvider]
        [HKLM\Software\WOW6432Node\Microsoft\Windows\Window s Error Reporting]
        [HKLM\Software\WOW6432Node\Microsoft\Windows\Window s Search]
        [HKLM\Software\WOW6432Node\Microsoft\Windows\Tablet PC]
        [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion]
        [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalService]
        [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalServiceAndNoImperso nation]
        [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalServiceNetworkRestr icted]
        [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalServiceNoNetwork]
        [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalSystemNetworkRestri cted]
        [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs]
        [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\NetworkService]
        [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\NetworkServiceRemoteDesk topHyperVAgent]
        [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\NetworkServiceRemoteDesk topPublishing]
        [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\termsvcs]
        [HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\wcssvc]

        ---------- | Drives

        F:

        ---------- | C:

        [13/07/2009 23:18:56] - |SHD| - [8531617394] - C:$Recycle.Bin
        [31/10/2018 18:03:25] - |SHD| - [3523720] - C:\Config.Msi
        [14/07/2009 01:08:56] - |SHD| - [0] - C:\Documents and Settings
        [26/06/2018 13:17:53] - |D| - [281775] - C:\Drivers
        [14/07/2019 21:35:29] - |D| - [105575672] - C:\FRST
        [MD5.D41D8CD98F00B204E9800998ECF8427E] - [26/06/2018 12:21:24] - |ASH| - (.-.) - [12783353856] - (0.0.0.0) -

        C:\hiberfil.sys
        [26/06/2018 13:17:53] - |D| - [33569904] - C:\Hotfix
        [26/06/2018 10:01:32] - |D| - [37360] - C:\Intel
        [27/06/2018 08:28:07] - |RHD| - [649826903] - C:\MSOCache
        [MD5.D41D8CD98F00B204E9800998ECF8427E] - [26/06/2018 12:21:24] - |ASH| - (.-.) - [17044475904] - (0.0.0.0) -

        C:\pagefile.sys
        [13/07/2009 23:20:08] - |D| - [0] - C:\PerfLogs
        [13/07/2009 23:20:08] - |RD| - [57066968275] - C:\Program Files
        [13/07/2009 23:20:08] - |RD| - [3594947406] - C:\Program Files (x86)
        [13/07/2009 23:20:08] - |HD| - [7724597251] - C:\ProgramData
        [30/10/2018 18:29:52] - |D| - [0] - C:\python-scripts
        [15/07/2019 10:24:39] - |D| - [309016] - C:\QuickDiag
        [MD5.413141830607B3FD3B2C82ACD9A3D022] - [15/07/2019 10:40:00] - |A| - (.-.) - [107256] - (0.0.0.0) - C:

        \QuickDiag.txt
        [MD5.DF70DB7C478D62CDF2903994E01FDBFE] - [15/07/2019 10:26:54] - |RAST| - (.-.) - [234523] - (0.0.0.0) - C:

        \QuickDiag_15_07_2019_10_26_54.txt
        [26/06/2018 09:29:06] - |SHD| - [295090159] - C:\Recovery
        [30/10/2018 18:32:02] - |D| - [311764819] - C:\Sleep Playlist
        [26/06/2018 12:21:24] - |SHD| - [0] - C:\System Volume Information
        [29/10/2018 20:46:56] - |D| - [0] - C:\temp
        [13/07/2009 23:20:08] - |RD| - [71182103676] - C:\Users
        [20/03/2019 21:55:37] - |D| - [1471760606] - C:\VSTs
        [13/07/2009 23:20:08] - |D| - [27250990995] - C:\Windows

        ---------- | C:\Windows

        [MD5.E809E1FAA8A40B74787077028B385E6E] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \1f8bf2vui4tpp8w
        [MD5.7B14EDAD6B2509C7E473EACE82935E27] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \1f8bf4c2m4tpp8w
        [MD5.07520BE893D14D360FD558C54DD695C4] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \1f8bf4f5i4tpp8w
        [MD5.D954CF6201902E9B47A948AD571BE32A] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \1f8bf7q2d4tpp8w
        [MD5.B617806483C7B20495D1C0F5D55349B2] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \1f8bfmk8m4tpp8w
        [MD5.5BD7810EA166D44AB32058C2DE503DE4] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \2e2uf4b4q8p2kci
        [MD5.F7AB403899391B1EBDA99FAD162E8709] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \4cwyf4jbcce5n1p
        [MD5.E560112DBE06C00119562B55876FE48A] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \4cwyfyv7x1w5n1p
        [MD5.160C7598C55154670531399F68CEFC2E] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \5b4wf2e7p2v8qio
        [MD5.2FBE828181EE5EE81AAE003BDD62CEB8] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \5b4wf4c8n5s1jta
        [MD5.7F2833A4520A051C7C82D04943BAF0A0] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \5b4wf4poy2v8qio
        [MD5.0A8074B30B1CFB5931BFB39F99E869E4] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \5b4wf4t4k2v8qio
        [MD5.5CFE017757A09E53518572C2A0AF4369] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \5b4wf7y1l7q8qio
        [MD5.EF5CD7A92582CCFF75D16EE102A9AEEE] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \5b4wffx8w5s1jta
        [MD5.A1385BB4C24E0FB3F4D91EECAD0A2B5C] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \5b4wfyk4b2v8qio
        [MD5.3F0EBE13E5D5C713288B7748C2CE6C5E] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \5b4wfyn5a5s1jta
        [MD5.B16BEA90634E3861F216519F42730387] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \5b4wfyn5s5s1jta
        [14/07/2009 01:32:38] - |D| - [802] - C:\Windows\addins
        [13/07/2009 23:20:08] - |D| - [6865258] - C:\Windows\AppCompat
        [13/07/2009 23:20:08] - |D| - [10942180] - C:\Windows\AppPatch
        [13/07/2009 23:20:08] - |RSD| - [1747935411] - C:\Windows\assembly
        [MD5.317CD1CE327B6520BF4EE007BCD39E61] - [20/11/2010 23:24:22] - |A| - (.© Microsoft Corporation. - Boot File

        Servicing Utility.) - [71168] - (6.1.7601.17514) - C:\Windows\bfsvc.exe
        [13/07/2009 23:20:09] - |D| - [29189342] - C:\Windows\Boot
        [MD5.5D41CA5B9A5AA7F7F5A71D991FB08DA4] - [14/07/2009 01:38:36] - |AS| - (.-.) - [67584] - (0.0.0.0) - C:

        \Windows\bootstat.dat
        [13/07/2009 23:20:09] - |D| - [2418176] - C:\Windows\Branding
        [21/11/2010 03:17:10] - |D| - [0] - C:\Windows\CSC
        [MD5.A4C15BCAD35B4DB7A9DCF859B4E0BEF7] - [26/06/2018 13:17:53] - |RA| - (.-.) - [13] - (0.0.0.0) - C:\Windows

        \csup.txt
        [13/07/2009 23:20:09] - |D| - [2113488] - C:\Windows\Cursors
        [14/07/2009 00:45:54] - |D| - [29552] - C:\Windows\debug
        [26/06/2018 13:45:10] - |D| - [948] - C:\Windows\Dell
        [14/07/2009 01:32:38] - |D| - [3003724] - C:\Windows\diagnostics
        [14/07/2009 01:37:46] - |D| - [0] - C:\Windows\DigitalLocker
        [14/07/2009 01:32:38] - |D| - [65] - C:\Windows\Downloaded Program Files
        [MD5.94F1B93B30FECAD7F8DDF99037EF8D23] - [14/11/2018 18:47:04] - |A| - (.-.) - [6058] - (0.0.0.0) - C:

        \Windows\DPINST.LOG
        [21/11/2010 03:17:11] - |D| - [117959641] - C:\Windows\ehome
        [14/07/2009 01:37:46] - |D| - [110080] - C:\Windows\en-US
        [MD5.BCCD6F8B278450DE25224C0157789584] - [26/06/2018 13:45:10] - |A| - (.-.) - [17776] - (0.0.0.0) - C:

        \Windows\EvtMessage.dll
        [MD5.38AE1B3C38FAEF56FE4907922F0385BA] - [26/06/2018 11:02:30] - |A| - (.© Microsoft Corporation. - Windows

        Explorer.) - [3229696] - (6.1.7601.23537) - C:\Windows\explorer.exe
        [13/07/2009 23:20:09] - |RSD| - [388351939] - C:\Windows\Fonts
        [MD5.92BB2E9AA28542C685C59EFCBAC2490B] - [13/07/2009 19:22:13] - |A| - (.© Microsoft Corporation. - BitLocker

        Drive Encryption Servicing Utility.) - [15360] - (6.1.7600.16385) - C:\Windows\fveupdate.exe
        [13/07/2009 23:20:09] - |D| - [32090797] - C:\Windows\Globalization
        [13/07/2009 23:20:09] - |D| - [30366808] - C:\Windows\Help
        [MD5.A66E522F3CBFB8709EA37844922A002E] - [26/06/2018 09:55:47] - |A| - (.© Microsoft Corporation. - Microsoft

        Help and Support.) - [733696] - (6.1.7601.23834) - C:\Windows\HelpPane.exe
        [MD5.12589371C087A76B6E8E152939E59E98] - [26/06/2018 09:55:46] - |A| - (.© Microsoft Corporation. - Microsoft®

        HTML Help Executable.) - [16896] - (6.1.7601.24134) - C:\Windows\hh.exe
        [13/07/2009 23:20:09] - |D| - [143540740] - C:\Windows\IME
        [13/07/2009 23:20:10] - |D| - [148300674] - C:\Windows\inf
        [26/06/2018 11:09:19] - |SHD| - [1914297515] - C:\Windows\Installer
        [13/07/2009 23:20:10] - |D| - [48371] - C:\Windows\L2Schemas
        [13/07/2009 23:20:10] - |D| - [0] - C:\Windows\LiveKernelReports
        [13/07/2009 23:20:10] - |D| - [75617344] - C:\Windows\Logs
        [13/07/2009 23:20:10] - |RSD| - [13327133] - C:\Windows\Media
        [MD5.D0F3DD75203DB96D38BDA64F492F1E87] - [04/07/2018 21:03:29] - |A| - (.-.) - [749232895] - (0.0.0.0) - C:

        \Windows\MEMORY.DMP
        [MD5.23AF90D2355D8C83AA4567EF1763B467] - [13/07/2009 20:10:29] - |A| - (.-.) - [43131] - (0.0.0.0) - C:

        \Windows\mib.bin
        [13/07/2009 23:20:10] - |D| - [873800845] - C:\Windows\Microsoft.NET
        [26/06/2018 11:09:31] - |D| - [4398] - C:\Windows\Migration
        [04/07/2018 21:03:31] - |D| - [2222584] - C:\Windows\Minidump
        [13/07/2009 23:20:10] - |D| - [0] - C:\Windows\ModemLogs
        [MD5.B9FB94A8DA62711C6955825DEFB25C5A] - [13/07/2009 22:35:42] - |A| - (.-.) - [1405] - (0.0.0.0) - C:

        \Windows\msdfmap.ini
        [MD5.B32189BDFF6E577A92BAA61AD49264E6] - [26/06/2018 11:06:21] - |A| - (.© Microsoft Corporation. - Notepad.)
        • [193536] - (6.1.7601.18917) - C:\Windows\notepad.exe
          [14/07/2009 01:32:38] - |D| - [65] - C:\Windows\Offline Web Pages
          [26/06/2018 13:18:27] - |D| - [0] - C:\Windows\Panther
          [27/06/2018 08:31:04] - |D| - [0] - C:\Windows\PCHEALTH
          [14/07/2009 01:32:38] - |D| - [62438456] - C:\Windows\Performance
          [MD5.AFB1846B83AAEE4BCADCA21260DB9733] - [18/07/2018 16:20:26] - |A| - (.-.) - [69938] - (0.0.0.0) - C:

        \Windows\PFRO.log
        [13/07/2009 23:20:10] - |D| - [1109514] - C:\Windows\PLA
        [13/07/2009 23:20:10] - |D| - [4903900] - C:\Windows\PolicyDefinitions
        [26/06/2018 12:22:12] - |D| - [52004630] - C:\Windows\Prefetch
        [MD5.FFB8B91BD19E5BC10A3344AAF34880F3] - [21/11/2010 03:17:51] - |A| - (.-.) - [53551] - (0.0.0.0) - C:

        \Windows\Professional.xml
        [MD5.2E2C937846A0B8789E5E91739284D17A] - [13/07/2009 19:27:10] - |A| - (.© Microsoft Corporation. - Registry

        Editor.) - [427008] - (6.1.7600.16385) - C:\Windows\regedit.exe
        [13/07/2009 23:20:10] - |D| - [22588] - C:\Windows\Registration
        [13/07/2009 23:20:10] - |D| - [5807844] - C:\Windows\rescache
        [13/07/2009 23:20:10] - |D| - [1674534] - C:\Windows\Resources
        [13/07/2009 23:20:10] - |D| - [0] - C:\Windows\SchCache
        [13/07/2009 23:20:10] - |D| - [58021] - C:\Windows\schemas
        [13/07/2009 23:20:10] - |D| - [2215878] - C:\Windows\security
        [14/07/2009 00:45:47] - |D| - [53275028] - C:\Windows\ServiceProfiles
        [13/07/2009 23:20:10] - |D| - [159759889] - C:\Windows\servicing
        [14/07/2009 00:45:50] - |D| - [4038] - C:\Windows\Setup
        [MD5.D1E4D206D7DF436266301ACCA3CC853A] - [18/07/2018 16:20:51] - |A| - (.-.) - [24250] - (0.0.0.0) - C:

        \Windows\setupact.log
        [MD5.D41D8CD98F00B204E9800998ECF8427E] - [18/07/2018 16:20:51] - |A| - (.-.) - [0] - (0.0.0.0) - C:\Windows

        \setuperr.log
        [27/06/2018 08:28:38] - |D| - [35886] - C:\Windows\SHELLNEW
        [26/06/2018 12:24:33] - |D| - [1836341289] - C:\Windows\SoftwareDistribution
        [13/07/2009 23:20:10] - |D| - [181014046] - C:\Windows\Speech
        [MD5.D01628AF9F7FB3F415B357D446FBE6D9] - [20/11/2010 23:24:16] - |A| - (.© Microsoft Corporation. - Print

        driver host for 32bit applications.) - [67072] - (6.1.7601.17514) - C:\Windows\splwow64.exe
        [MD5.9060C3C745E7B2D8E1A81DD061021546] - [14/07/2009 01:28:38] - |A| - (.-.) - [48201] - (0.0.0.0) - C:

        \Windows\Starter.xml
        [13/07/2009 23:20:10] - |D| - [0] - C:\Windows\system
        [MD5.286A9EDB379DC3423A528B0864A0F111] - [13/07/2009 22:34:57] - |A| - (.-.) - [219] - (0.0.0.0) - C:\Windows

        \system.ini
        [13/07/2009 23:20:10] - |D| - [3965717846] - C:\Windows\System32
        [13/07/2009 23:20:14] - |D| - [1227294567] - C:\Windows\SysWOW64
        [13/07/2009 23:20:14] - |D| - [15] - C:\Windows\TAPI
        [13/07/2009 23:20:14] - |D| - [17170] - C:\Windows\Tasks
        [13/07/2009 23:20:14] - |D| - [90185128] - C:\Windows\Temp
        [13/07/2009 23:20:14] - |D| - [0] - C:\Windows\tracing
        [MD5.0BEA3F79A36B1F67B2CE0F595524C77C] - [10/06/2009 17:41:17] - |A| - (.- Twain Source Manager (Image

        Acquisition Interface).) - [94784] - (1.7.0.0) - C:\Windows\twain.dll
        [14/07/2009 01:32:38] - |D| - [14385108] - C:\Windows\twain_32
        [MD5.163A95975E1D8819E653AA3E961371CA] - [20/11/2010 23:25:10] - |A| - (.- Twain_32 Source Manager (Image

        Acquisition Interface).) - [51200] - (1.7.1.3) - C:\Windows\twain_32.dll
        [29/10/2018 20:45:56] - |D| - [16988116] - C:\Windows\Twain_64
        [MD5.F36A271706EDD23C94956AFB56981184] - [13/07/2009 18:47:26] - |A| - (.- Twain_32.dll Client’s 16-Bit

        Thunking Server.) - [49680] - (1.7.0.0) - C:\Windows\twunk_16.exe
        [MD5.0BD6E68F3EA0DD62CD86283D86895381] - [13/07/2009 20:14:40] - |A| - (.- Twain.dll Client’s 32-Bit Thunking

        Server.) - [31232] - (1.7.1.0) - C:\Windows\twunk_32.exe
        [MD5.85726231A5D21A86BEF871F552ECBB0F] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \ugisf2r8ffbdd5t
        [06/04/2019 14:02:57] - |D| - [3553943] - C:\Windows\usb-audio.deAkaiEIE
        [MD5.F5F5F500A20CB350BA5DE93BE7E8763F] - [26/06/2018 13:17:54] - |RAH| - (.-.) - [29] - (0.0.0.0) - C:

        \Windows\version
        [13/07/2009 23:20:14] - |D| - [12420] - C:\Windows\Vss
        [13/07/2009 23:20:14] - |D| - [44155055] - C:\Windows\Web
        [MD5.2465EBC8CD6E412CDC1AB9FEF40BCAE6] - [13/07/2009 22:34:57] - |A| - (.-.) - [478] - (0.0.0.0) - C:\Windows

        \win.ini
        [MD5.5A5CFF37F1BD0F86B9BDAAD7A9445882] - [14/07/2009 00:54:24] - |RAH| - (.-.) - [749] - (0.0.0.0) - C:

        \Windows\WindowsShell.Manifest
        [MD5.55F310719071386CAC1A8DE3736F4435] - [26/06/2018 12:24:31] - |A| - (.-.) - [1916132] - (0.0.0.0) - C:

        \Windows\WindowsUpdate.log
        [MD5.1D420D66250BCAAAED05724FB34008CF] - [13/07/2009 20:12:29] - |A| - (.© Microsoft Corporation. - Windows

        Winhlp32 Stub.) - [9728] - (6.1.7600.16385) - C:\Windows\winhlp32.exe
        [13/07/2009 23:20:14] - |D| - [13228677245] - C:\Windows\winsxs
        [MD5.DC17DD0189B0C36D863B4DD0A036C10F] - [10/06/2009 16:52:44] - |A| - (.-.) - [316640] - (0.0.0.0) - C:

        \Windows\WMSysPr9.prx
        [MD5.F8ED3B4B209E2CB49028E36CF06CA851] - [13/07/2009 19:56:28] - |A| - (.© Microsoft Corporation. - Windows

        Write.) - [10240] - (6.1.7600.16385) - C:\Windows\write.exe
        [MD5.77802F8703462B1721F42CB116E606B8] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \yxa4f1odk8u8v5
        [MD5.51E998034011BA21C7AB51136DC3B004] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \yxa4f1w5a8u8v5
        [MD5.FD9D0357DF3715976C84D19284658D09] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \yxa4fff5a8u8v5
        [MD5.B9A2867AC53D9A75E99448D43DE3D615] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

        \yxa4fmw5a8u8v5

        ---------- | C:\Windows\System32\GroupPolicy

        ---------- | Systemroot\System

        ---------- | Systemroot\Installer (Microsoft Files Whitelisted)

        [26/06/2018 22:12:55] - C:\Windows\Installer\10406fa.msi : (7-Zip (x64 edition) Package - Igor Pavlov)

        [Offsets ok ! : D0CF11E0A1B11AE10000000000000000]
        [12/07/2019 13:36:26] - C:\Windows\Installer\16985d.msi : (Google Update Helper - Google LLC)

        [Offsets ok ! : D0CF11E0A1B11AE10000000000000000]
        [02/06/2016 15:08:14] - C:\Windows\Installer\3f5a6b7f.msi : (Visioneer RoadWarrior 3 Series Driver - Visioneer

        Inc.) [Offsets ok ! : D0CF11E0A1B11AE10000000000000000]
        [02/06/2016 14:44:00] - C:\Windows\Installer\3f5a6b86.msi : (Visioneer Acuity Assets V1 - Visioneer Inc.)
        Code:
        [Offsets ok ! : D0CF11E0A1B11AE10000000000000000]
        [17/01/2019 20:46:44] - C:\Windows\Installer\7652fd62.msi : ( -) [Offsets ok ! :

        D0CF11E0A1B11AE10000000000000000]
        [30/05/2019 09:44:38] - C:\Windows\Installer\b8ad7f5.msi : (Dell SupportAssist - Dell Inc.) [Offsets

        ok ! : D0CF11E0A1B11AE10000000000000000]
        [26/06/2018 21:10:23] - C:\Windows\Installer\ceac6b.msi : (PuTTY release 0.70 installer - Simon Tatham)

        [Offsets ok ! : D0CF11E0A1B11AE10000000000000000]
        [13/11/2013 15:23:14] - C:\Windows\Installer\e73ad.msi : (Intel(R) Trusted Connect Service Client - Intel

        Corporation) [Offsets ok ! : D0CF11E0A1B11AE10000000000000000]
        [25/07/2013 03:00:48] - C:\Windows\Installer\e73b2.msi : (Intel® WiFi - Intel Corporation) [Offsets

        ok ! : D0CF11E0A1B11AE10000000000000000]
        [17/07/2013 14:57:16] - C:\Windows\Installer\e73b7.msi : (Intel® WiFi - Intel Corporation) [Offsets

        ok ! : D0CF11E0A1B11AE10000000000000000]
        [17/07/2013 14:57:24] - C:\Windows\Installer\e73bc.msi : (Intel® WiFi - Intel Corporation) [Offsets

        ok ! : D0CF11E0A1B11AE10000000000000000]
        [09/04/2019 19:34:58] - [41828352] - (.().-. - ()) - C:\Windows\Installer\1af6a9a8.msp
        [15/05/2019 22:28:12] - [41816064] - (.().-. - ()) - C:\Windows\Installer\1afd1dd3.msp
        [07/06/2018 07:41:40] - [10661888] - (.().-. - ()) - C:\Windows\Installer\1f3b43.msp
        [14/08/2018 17:08:56] - [41676800] - (.().-. - ()) - C:\Windows\Installer\1fcc0b.msp
        [31/08/2018 01:38:14] - [41668608] - (.().-. - ()) - C:\Windows\Installer\23c104.msp
        [07/07/2011 18:53:20] - [14467072] - (.().-. - ()) - C:\Windows\Installer\33719d1.msp
        [07/07/2011 18:53:20] - [11155456] - (.().-. - ()) - C:\Windows\Installer\3371a0f.msp
        [07/07/2011 18:53:20] - [16972800] - (.().-. - ()) - C:\Windows\Installer\3371a24.msp
        [07/07/2011 18:53:20] - [11056128] - (.().-. - ()) - C:\Windows\Installer\3371a37.msp
        [07/07/2011 18:53:20] - [13031936] - (.().-. - ()) - C:\Windows\Installer\3371a5e.msp
        [07/07/2011 18:53:20] - [2426880] - (.().-. - ()) - C:\Windows\Installer\3371a65.msp
        [07/07/2011 18:53:20] - [608768] - (.().-. - ()) - C:\Windows\Installer\3371a6c.msp
        [07/07/2011 18:53:20] - [3459584] - (.().-. - ()) - C:\Windows\Installer\3371ba6.msp
        [07/07/2011 18:53:20] - [3994624] - (.().-. - ()) - C:\Windows\Installer\3371bb5.msp
        [28/06/2011 21:27:28] - [4028928] - (.().-. - ()) - C:\Windows\Installer\a6453.msp
        [28/06/2011 21:21:32] - [4637184] - (.().-. - ()) - C:\Windows\Installer\e5797.msp
        [04/06/2019 03:15:38] - [41811968] - (.().-. - ()) - C:\Windows\Installer\f11588.msp

        ---------- | %System%*.in*

        [14/07/2009 00:57:09] - [73] - C:\Windows\System32\desktop.ini
        [26/06/2018 11:38:47] - [16303] - C:\Windows\System32\ieuinit.inf
        [14/07/2009 01:13:15] - [781790] - C:\Windows\System32\PerfStringBackup.INI
        [10/06/2009 17:01:25] - [60124] - C:\Windows\System32\tcpmon.ini
        [26/06/2018 11:38:47] - [16303] - C:\Windows\Syswow64\ieuinit.inf
        [14/07/2009 00:55:01] - [535] - C:\Windows\Syswow64\mapisvc.inf
        [26/06/2018 11:10:24] - [774404] - C:\Windows\Syswow64\PerfStringBackup.INI

        ---------- | Listing no Microsoft signed files (Not necessary Malwares) | system32 | Syswow64 | General scan

        [MD5.6712E83EA2BF4FB46A316EEEF51E8101] - |A| - [03/07/2019 22:16:13] - (.-.) - [124.99 Ko] - (0.0.0.0) - C:

        \Windows\AppPatch\AppPatch64\sysmain.sdb
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:08] - [0 Ko] - C:\Windows\AppPatch\Custom

        \Custom64
        [MD5.00000000000000000000000000000000] - |D| - [08/05/2019 08:49:50] - [0 Ko] - C:\Windows\Temp\7zS6D2D.tmp
        [MD5.00000000000000000000000000000000] - |D| - [19/03/2019 18:13:17] - [0 Ko] - C:\Windows\Temp\7zSBC48.tmp
        [MD5.00000000000000000000000000000000] - |D| - [07/04/2019 14:54:28] - [0 Ko] - C:\Windows\Temp\7zSD1CA.tmp
        [MD5.E9E131B47B5F401894A1256C945DA58D] - |A| - [15/08/2018 09:58:26] - (.-.) - [4.47 Ko] - (0.0.0.0) - C:

        \Windows\Temp\ASPNETSetup_00000.log
        [MD5.ED15F7C2043E446541E5E18DE0273940] - |A| - [15/08/2018 09:58:37] - (.-.) - [2.9 Ko] - (0.0.0.0) - C:

        \Windows\Temp\ASPNETSetup_00001.log
        [MD5.A6207B26D0687EFDFC7EE1A866022ECB] - |A| - [10/12/2018 23:13:31] - (.-.) - [4.47 Ko] - (0.0.0.0) - C:

        \Windows\Temp\ASPNETSetup_00002.log
        [MD5.D000CCB7D2D8D1B66A365C1C6630A10E] - |A| - [10/12/2018 23:13:44] - (.-.) - [2.9 Ko] - (0.0.0.0) - C:

        \Windows\Temp\ASPNETSetup_00003.log
        [MD5.A46CF44A5F4E47BB421AC92579F70B1E] - |A| - [10/12/2018 23:16:39] - (.-.) - [4.47 Ko] - (0.0.0.0) - C:

        \Windows\Temp\ASPNETSetup_00004.log
        [MD5.DA4FAFF057A0032BDBE8D448027D0076] - |A| - [10/12/2018 23:16:50] - (.-.) - [2.9 Ko] - (0.0.0.0) - C:

        \Windows\Temp\ASPNETSetup_00005.log
        [MD5.305F9377876CCA3D256621465AADF1DB] - |A| - [10/12/2018 23:20:54] - (.-.) - [4.47 Ko] - (0.0.0.0) - C:

        \Windows\Temp\ASPNETSetup_00006.log
        [MD5.6595E9949FE6B2A6B8F388519B83C182] - |A| - [10/12/2018 23:21:04] - (.-.) - [2.9 Ko] - (0.0.0.0) - C:

        \Windows\Temp\ASPNETSetup_00007.log
        [MD5.F3492D2CA7E1136B24D9D4B0E6CB2249] - |A| - [03/07/2019 22:22:19] - (.-.) - [4.47 Ko] - (0.0.0.0) - C:

        \Windows\Temp\ASPNETSetup_00008.log
        [MD5.BCCB51111B4C3188D527EF7D5FB12B6C] - |A| - [03/07/2019 22:22:46] - (.-.) - [2.9 Ko] - (0.0.0.0) - C:

        \Windows\Temp\ASPNETSetup_00009.log
        [MD5.B41CC0595BAD22F30B191D997F54E405] - |A| - [03/07/2019 22:28:41] - (.-.) - [4.47 Ko] - (0.0.0.0) - C:

        \Windows\Temp\ASPNETSetup_00010.log
        [MD5.658F72C1515F61708B9BF9CA273284EE] - |A| - [03/07/2019 22:28:49] - (.-.) - [2.9 Ko] - (0.0.0.0) - C:

        \Windows\Temp\ASPNETSetup_00011.log
        [MD5.B2EA5738FB72DEA3116B7AFDDD59D9E6] - |A| - [09/10/2018 21:54:09] - (.-.) - [3.89 Ko] - (0.0.0.0) - C:

        \Windows\Temp\AutoUpdateScheduler.xml
        [MD5.00000000000000000000000000000000] - |D| - [14/07/2019 20:29:33] - [0 Ko] - C:\Windows\Temp\C78D8CC8-

        270A-44A8-ACEF-885EF75722CE-Sigs
        [MD5.00000000000000000000000000000000] - |D| - [12/07/2019 13:36:51] - [0.04 Ko] - C:\Windows\Temp\Crashpad
        [MD5.F9E6B0E3691B63E4A0F7D4E00A83655A] - |A| - [23/10/2018 21:05:06] - (.-.) - [24.57 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dat445A.tmp
        [MD5.AE05638BF81CBF345EBCD8B470E409AF] - |A| - [23/10/2018 21:05:06] - (.-.) - [18.72 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dat446A.tmp
        [MD5.46E48CE0628835F68A7369D0254E4283] - |A| - [23/10/2018 21:05:06] - (.-.) - [123.82 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dat448B.tmp
        [MD5.894A2EDE85A483BF9BEDEFD4DB45CDB9] - |A| - [23/10/2018 21:05:09] - (.-.) - [124.5 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dat5167.tmp
        [MD5.0825F1DFB7B05FECE8D5CBF12928DD35] - |A| - [23/10/2018 21:05:09] - (.-.) - [26.71 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dat5178.tmp
        [MD5.D5F6D36274376F4727D6F90C95C4CCDC] - |A| - [23/10/2018 21:05:12] - (.-.) - [3.77 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dat5975.tmp
        [MD5.F4769F9BDB7466BE65088239C12046D1] - |A| - [23/10/2018 21:05:12] - (.-.) - [19.66 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dat59B4.tmp
        [MD5.75801960794B7873D87AAA597BCF7447] - |A| - [23/10/2018 21:05:12] - (.-.) - [38.18 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dat5BE7.tmp
        [MD5.AE05638BF81CBF345EBCD8B470E409AF] - |A| - [22/07/2018 22:22:25] - (.-.) - [18.72 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dat9677.tmp
        [MD5.46E48CE0628835F68A7369D0254E4283] - |A| - [22/07/2018 22:22:25] - (.-.) - [123.82 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dat96B7.tmp
        [MD5.F9E6B0E3691B63E4A0F7D4E00A83655A] - |A| - [22/07/2018 22:22:25] - (.-.) - [24.57 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dat96D7.tmp
        [MD5.0825F1DFB7B05FECE8D5CBF12928DD35] - |A| - [22/07/2018 22:22:35] - (.-.) - [26.71 Ko] - (0.0.0.0) - C:

        \Windows\Temp\datC038.tmp
        [MD5.D5F6D36274376F4727D6F90C95C4CCDC] - |A| - [22/07/2018 22:22:42] - (.-.) - [3.77 Ko] - (0.0.0.0) - C:

        \Windows\Temp\datD935.tmp
        [MD5.75801960794B7873D87AAA597BCF7447] - |A| - [22/07/2018 22:22:42] - (.-.) - [38.18 Ko] - (0.0.0.0) - C:

        \Windows\Temp\datD9F1.tmp
        [MD5.FF2581D26B5DE2E906348EE4C68F16B9] - |A| - [15/08/2018 09:57:42] - (.-.) - [1.2 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dd_NDP46-KB4344146-x64_decompression_log.txt
        [MD5.F90999AC16A0F79DDE85979BE1AFE769] - |A| - [10/12/2018 23:15:49] - (.-.) - [1.25 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dd_NDP46-KB4457035-x64_decompression_log.txt
        [MD5.ACEFC0CDA1B4E5DCF9344B014ACEE009] - |A| - [10/12/2018 23:20:12] - (.-.) - [1.2 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dd_NDP46-KB4459942-x64_decompression_log.txt
        [MD5.ABA771F52BEEFDCB99DDFF1DB0FD6024] - |A| - [03/07/2019 22:20:38] - (.-.) - [1.18 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dd_NDP46-KB4495588-x64_decompression_log.txt
        [MD5.FD1BBF332340BA16BBCE03D9797B72BF] - |A| - [03/07/2019 22:28:09] - (.-.) - [1.18 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dd_NDP47-KB4502558-x64_decompression_log.txt
        [MD5.A5DFAFA27D1C0A8B085099D24C88281F] - |A| - [10/12/2018 23:10:38] - (.-.) - [1.29 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dd_ndp472-kb4054541-x86-x64-enu_decompression_log.txt
        [MD5.365E7F8279C00E3803ED17D9397F8DD3] - |A| - [10/12/2018 23:15:19] - (.-.) - [1.22 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dd_ndp472-kb4087364-x64_decompression_log.txt
        [MD5.CD4BB68004280C23DAFAD97658E011F6] - |A| - [10/12/2018 23:11:23] - (.-.) - [0.46 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dd_SetupUtility.txt
        [MD5.4D70B5E2F73283F7C67E6D5A314908EF] - |A| - [15/08/2018 09:58:18] - (.-.) - [4.57 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dd_wcf_CA_smci_20180815_135818_368.t xt
        [MD5.454F4661A98F9A5F4392DD7F1EB1547C] - |A| - [15/08/2018 09:58:20] - (.-.) - [2.63 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dd_wcf_CA_smci_20180815_135820_958.t xt
        [MD5.93E339E94A8BAA4B320BC8E325DA4F45] - |A| - [10/12/2018 23:13:18] - (.-.) - [4.57 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dd_wcf_CA_smci_20181211_031318_725.t xt
        [MD5.98D43FF9F73ADB25A6677CF1B744D7A6] - |A| - [10/12/2018 23:13:28] - (.-.) - [2.63 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dd_wcf_CA_smci_20181211_031328_246.t xt
        [MD5.2991C504D7F2E26F45F3B6040F7923E0] - |A| - [10/12/2018 23:16:18] - (.-.) - [4.57 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dd_wcf_CA_smci_20181211_031618_754.t xt
        [MD5.174DACDB97075A2426DA1C2031708C63] - |A| - [10/12/2018 23:16:33] - (.-.) - [2.63 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dd_wcf_CA_smci_20181211_031633_144.t xt
        [MD5.613A71FB24791A30966A37D30E20D2C5] - |A| - [10/12/2018 23:20:40] - (.-.) - [4.57 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dd_wcf_CA_smci_20181211_032040_241.t xt
        [MD5.3A73EA977881DF379E1367A28ACB5CD3] - |A| - [10/12/2018 23:20:46] - (.-.) - [2.63 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dd_wcf_CA_smci_20181211_032046_711.t xt
        [MD5.BC917652DA88915E6A9EDB070256B97C] - |A| - [03/07/2019 22:22:01] - (.-.) - [4.57 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dd_wcf_CA_smci_20190704_022201_410.t xt
        [MD5.68A8668DEBF07332B5C4FF34C0DA2990] - |A| - [03/07/2019 22:22:09] - (.-.) - [2.63 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dd_wcf_CA_smci_20190704_022209_858.t xt
        [MD5.C53B9B64DB679ACD8883D4B744C295ED] - |A| - [03/07/2019 22:28:35] - (.-.) - [4.57 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dd_wcf_CA_smci_20190704_022835_582.t xt
        [MD5.6A33F4D5BC3DE2556C450C68D3877CA8] - |A| - [03/07/2019 22:28:37] - (.-.) - [2.63 Ko] - (0.0.0.0) - C:

        \Windows\Temp\dd_wcf_CA_smci_20190704_022837_009.t xt
        [MD5.D41D8CD98F00B204E9800998ECF8427E] - |A| - [26/06/2018 13:37:47] - (.-.) - [0 Ko] - (0.0.0.0) - C:

        \Windows\Temp\FXSAPIDebugLogFile.txt
        [MD5.D41D8CD98F00B204E9800998ECF8427E] - |A| - [26/06/2018 13:37:47] - (.-.) - [0 Ko] - (0.0.0.0) - C:

        \Windows\Temp\FXSTIFFDebugLogFile.txt
        [MD5.F4AFADC868347D16519E982371C4EF74] - |A| - [10/12/2018 23:15:25] - (.-.) - [3836.99 Ko] - (0.0.0.0) - C:

        \Windows\Temp\KB4087364_20181210_221522500-Microsoft .NET Framework 4.7.2-MSP0.txt
        [MD5.29B674EB6B07DD5F9DCDDC7B827CA290] - |A| - [10/12/2018 23:15:21] - (.-.) - [76.2 Ko] - (0.0.0.0) - C:

        \Windows\Temp\KB4087364_20181210_221522500.html
        [MD5.AFECAE9137438CE4419E8149F6890891] - |A| - [15/08/2018 09:57:54] - (.-.) - [9997.8 Ko] - (0.0.0.0) - C:

        \Windows\Temp\KB4344146_20180815_095750038-Microsoft .NET Framework 4.7.1-MSP0.txt
        [MD5.C7108B51CD6ACD131A425143EBF75548] - |A| - [15/08/2018 09:57:48] - (.-.) - [98.92 Ko] - (0.0.0.0) - C:

        \Windows\Temp\KB4344146_20180815_095750038.html
        [MD5.233F21D00B3ABA8CE4CA15997460D805] - |A| - [10/12/2018 23:16:02] - (.-.) - [9012.59 Ko] - (0.0.0.0) - C:

        \Windows\Temp\KB4457035_20181210_221555184-Microsoft .NET Framework 4.7.2-MSP0.txt
        [MD5.3D75FE1311FBF6A1DB65155C51DBE84D] - |A| - [10/12/2018 23:15:53] - (.-.) - [101.6 Ko] - (0.0.0.0) - C:

        \Windows\Temp\KB4457035_20181210_221555184.html
        [MD5.55F5817CF9046B9447FD3B8B61C054AB] - |A| - [10/12/2018 23:20:21] - (.-.) - [8858.76 Ko] - (0.0.0.0) - C:

        \Windows\Temp\KB4459942_20181210_222016771-Microsoft .NET Framework 4.7.2-MSP0.txt
        [MD5.4A6EA5A5E4D080A8E29E30E71AC692AB] - |A| - [10/12/2018 23:20:15] - (.-.) - [101.07 Ko] - (0.0.0.0) - C:

        \Windows\Temp\KB4459942_20181210_222016771.html
        [MD5.875DC6719E07F4914626D7D019C42338] - |A| - [03/07/2019 22:21:09] - (.-.) - [9996.27 Ko] - (0.0.0.0) - C:

        \Windows\Temp\KB4495588_20190703_222055263-Microsoft .NET Framework 4.7.2-MSP0.txt
        [MD5.DC503177561FC3C3D392BE96CE029B30] - |A| - [03/07/2019 22:20:50] - (.-.) - [100.81 Ko] - (0.0.0.0) - C:

        \Windows\Temp\KB4495588_20190703_222055263.html
        [MD5.01DE25AB7B3750DBB84BC32661BFBC25] - |A| - [03/07/2019 22:28:17] - (.-.) - [10435.86 Ko] - (0.0.0.0) - C:

        \Windows\Temp\KB4502558_20190703_222814635-Microsoft .NET Framework 4.7.2-MSP0.txt
        [MD5.CABF8F1F5F9639A31AE1B45701A3599B] - |A| - [03/07/2019 22:28:13] - (.-.) - [99.33 Ko] - (0.0.0.0) - C:

        \Windows\Temp\KB4502558_20190703_222814635.html
        [MD5.CA7FAEC305931463F4D8E51E5C6E33C7] - |A| - [10/12/2018 23:11:26] - (.-.) - [17473.14 Ko] - (0.0.0.0) - C:

        \Windows\Temp\Microsoft .NET Framework 4.7.2 Setup_20181210_221059895-MSI_netfx_Full_x64.msi.txt
        [MD5.E2E0696FB31E74FACBC54263CAFC5584] - |A| - [10/12/2018 23:10:49] - (.-.) - [668.69 Ko] - (0.0.0.0) - C:

        \Windows\Temp\Microsoft .NET Framework 4.7.2 Setup_20181210_221059895.html
        [MD5.6D545BDFB69214468090A5F026A3B615] - |A| - [24/07/2018 03:37:16] - (.-.) - [156.78 Ko] - (0.0.0.0) - C:

        \Windows\Temp\MpCmdRun.log
        [MD5.00000000000000000000000000000000] - |D| - [22/07/2018 22:20:59] - [0 Ko] - C:\Windows\Temp

        \MPInstrumentation
        [MD5.280473151997F840803405C9220443D8] - |A| - [18/07/2018 15:54:47] - (.-.) - [89.65 Ko] - (0.0.0.0) - C:

        \Windows\Temp\MpSigStub.log
        [MD5.00000000000000000000000000000000] - |D| - [18/07/2018 15:54:53] - [0 Ko] - C:\Windows\Temp

        \MPTelemetrySubmit
        [MD5.00000000000000000000000000000000] - |D| - [14/11/2018 18:47:03] - [3681.12 Ko] - C:\Windows\Temp\PL-

        2303_backup
        [MD5.004FA62F61DF14EA8623B474E49921AF] - |A| - [14/11/2018 18:47:04] - (.Copyright (C) 2001 - QRemover MFC

        Application.) - [144 Ko] - (1.0.0.1) - C:\Windows\Temp\QRemover.exe
        [MD5.DBEF78447120E830587017C581F994F1] - |A| - [10/12/2018 23:21:00] - (.-.) - [10.19 Ko] - (0.0.0.0) - C:

        \Windows\Temp\RGI564B.tmp
        [MD5.4AAE089D3731C3F9DCA27587E61CC4A2] - |A| - [10/12/2018 23:21:00] - (.-.) - [8.79 Ko] - (0.0.0.0) - C:

        \Windows\Temp\RGI564B.tmp-tmp
        [MD5.DBEF78447120E830587017C581F994F1] - |A| - [10/12/2018 23:16:45] - (.-.) - [10.19 Ko] - (0.0.0.0) - C:

        \Windows\Temp\RGI7437.tmp
        [MD5.4AAE089D3731C3F9DCA27587E61CC4A2] - |A| - [10/12/2018 23:16:45] - (.-.) - [8.79 Ko] - (0.0.0.0) - C:

        \Windows\Temp\RGI7437.tmp-tmp
        [MD5.DBEF78447120E830587017C581F994F1] - |A| - [03/07/2019 22:28:46] - (.-.) - [10.19 Ko] - (0.0.0.0) - C:

        \Windows\Temp\RGI8D4F.tmp
        [MD5.4AAE089D3731C3F9DCA27587E61CC4A2] - |A| - [03/07/2019 22:28:46] - (.-.) - [8.79 Ko] - (0.0.0.0) - C:

        \Windows\Temp\RGI8D4F.tmp-tmp
        [MD5.DBEF78447120E830587017C581F994F1] - |A| - [10/12/2018 23:13:39] - (.-.) - [10.19 Ko] - (0.0.0.0) - C:

        \Windows\Temp\RGI9C8E.tmp
        [MD5.4AAE089D3731C3F9DCA27587E61CC4A2] - |A| - [10/12/2018 23:13:39] - (.-.) - [8.79 Ko] - (0.0.0.0) - C:

        \Windows\Temp\RGI9C8E.tmp-tmp
        [MD5.DBEF78447120E830587017C581F994F1] - |A| - [15/08/2018 09:58:33] - (.-.) - [10.19 Ko] - (0.0.0.0) - C:

        \Windows\Temp\RGIC626.tmp
        [MD5.4AAE089D3731C3F9DCA27587E61CC4A2] - |A| - [15/08/2018 09:58:33] - (.-.) - [8.79 Ko] - (0.0.0.0) - C:

        \Windows\Temp\RGIC626.tmp-tmp
        [MD5.DBEF78447120E830587017C581F994F1] - |A| - [03/07/2019 22:22:41] - (.-.) - [10.19 Ko] - (0.0.0.0) - C:

        \Windows\Temp\RGIFCD3.tmp
        [MD5.4AAE089D3731C3F9DCA27587E61CC4A2] - |A| - [03/07/2019 22:22:41] - (.-.) - [8.79 Ko] - (0.0.0.0) - C:

        \Windows\Temp\RGIFCD3.tmp-tmp
        [MD5.00000000000000000000000000000000] - |D| - [22/07/2018 22:39:09] - [514.78 Ko] - C:\Windows\Temp

        \SupportAssistAgent
        [MD5.59071590099D21DD439896592338BF95] - |A| - [22/07/2018 22:19:34] - (.-.) - [512 Ko] - (0.0.0.0) - C:

        \Windows\Temp\TMPCA02463A00ECA135
        [MD5.59071590099D21DD439896592338BF95] - |A| - [22/07/2018 22:25:39] - (.-.) - [512 Ko] - (0.0.0.0) - C:

        \Windows\Temp\TMPDFA6F2776A4DEE34
        [MD5.3E628653AFD3EAA739D69BEC0E21E913] - |A| - [04/07/2019 00:50:36] - (.-.) - [128 Ko] - (0.0.0.0) - C:

        \Windows\Temp\TS_4D06.tmp
        [MD5.55C536FA338683D16C6ADA6AE7501EB2] - |A| - [04/07/2019 00:50:53] - (.-.) - [256 Ko] - (0.0.0.0) - C:

        \Windows\Temp\TS_905D.tmp
        [MD5.A0F17DD1D8D018D5FA536764A6120350] - |A| - [06/04/2019 14:02:50] - (.-.) - [48.7 Ko] - (0.0.0.0) - C:

        \Windows\Temp\USB_AUDIO_SETUP.LOG
        [MD5.8BE389E76473CD5F1B5DD15BD4EE411F] - |A| - [19/03/2019 18:13:15] - (.-.) - [12.53 Ko] - (0.0.0.0) - C:

        \Windows\Temp\WcInstaller.log
        [MD5.00000000000000000000000000000000] - |D| - [07/04/2019 14:54:27] - [346.9 Ko] - C:\Windows\Temp

        \wctmp_1920530832
        [MD5.00000000000000000000000000000000] - |D| - [19/03/2019 18:13:16] - [346.95 Ko] - C:\Windows\Temp

        \wctmp_558918626
        [MD5.00000000000000000000000000000000] - |D| - [08/05/2019 08:49:49] - [347.76 Ko] - C:\Windows\Temp

        \wctmp_727316983
        [MD5.D85AD4E72DBDC9B3338FD0DE945BA3FA] - |A| - [19/03/2019 18:13:19] - (.-.) - [9286.35 Ko] - (0.0.0.0) - C:

        \Windows\Temp\WebCompanion.zip
        [MD5.00000000000000000000000000000000] - |D| - [24/09/2018 21:27:02] - [0 Ko] - C:\Windows\Temp__SKIP_598
        [MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [0 Ko] - C:\Windows\System32\0409
        [MD5.D41D8CD98F00B204E9800998ECF8427E] - |AH| - [14/07/2009 00:45:49] - (.-.) - [21 Ko] - (0.0.0.0) - C:

        \Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
        [MD5.D41D8CD98F00B204E9800998ECF8427E] - |AH| - [14/07/2009 00:45:49] - (.-.) - [21 Ko] - (0.0.0.0) - C:

        \Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [4987.5 Ko] - C:\Windows

        \System32\AdvancedInstallers
        [MD5.00000000000000000000000000000000] - |D| - [26/06/2018 13:22:12] - [2732.89 Ko] - C:\Windows

        \System32\appraiser
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [201.5 Ko] - C:\Windows\System32\ar-SA
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [173 Ko] - C:\Windows\System32\bg-BG
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [2584.8 Ko] - C:\Windows\System32\Boot
        [MD5.F02F93D5AEC524052E4A37C1BB7CCF31] - |A| - [13/07/2009 21:20:24] - (.Copyright(C)Brother Industries

        Ltd.1997-2006 - Brother Multi Function CoInstaller.) - [19 Ko] - (1.0.0.20) - C:\Windows\System32\brcoinst.dll
        [MD5.7D00FF6A4315FDF4ACAFBB4EF157EA9F] - |A| - [13/07/2009 20:07:04] - (.Copyright (C) 2008 - Bthpan Context

        Handler.) - [91.5 Ko] - (1.0.0.1) - C:\Windows\System32\BthpanContextHandler.dll
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [99444.95 Ko] - C:\Windows

        \System32\catroot
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [27138.78 Ko] - C:\Windows

        \System32\catroot2
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [10612.11 Ko] - C:\Windows

        \System32\CodeIntegrity
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [357 Ko] - C:\Windows\System32\com
        [MD5.00000000000000000000000000000000] - |SD| - [26/06/2018 13:22:12] - [5028.19 Ko] - C:\Windows

        \System32\CompatTel
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [271083.36 Ko] - C:\Windows

        \System32\config
        [MD5.55A9CC0ABBBDA692CD6F3AFDD3847524] - |N| - [06/04/2019 14:02:59] - (.Copyright (C) Ploytec GmbH 2000-2011
        • AKAI USB Audio control panel.) - [257.23 Ko] - (2.9.30.0) - C:\Windows\System32\CPLAKAIEIEPRO.CPL
          [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [432 Ko] - C:\Windows\System32\cs-CZ
          [MD5.59075B2A63DF6A568123218BF4DC2696] - |A| - [02/06/2016 13:15:54] - (.-.) - [0.87 Ko] - (0.0.0.0) - C:

        \Windows\System32\CustomModeApp.exe.config
        [MD5.899E708E589C09700BFF1C73CB7D7002] - |A| - [02/06/2016 13:15:54] - (.-.) - [0.87 Ko] - (0.0.0.0) - C:

        \Windows\System32\CustomModeAppv2_0.exe.config
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [427.5 Ko] - C:\Windows\System32\da-DK
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [457.5 Ko] - C:\Windows\System32\de-DE
        [MD5.079B8AEB4A55BF8493BD1EC70285D920] - |ASH| - [14/07/2009 00:57:09] - (.-.) - [0.07 Ko] - (0.0.0.0) - C:

        \Windows\System32\desktop.ini
        [MD5.0E2B7D35E3DDD21AF04FB4D98C2BCF7F] - |A| - [02/06/2016 13:15:54] - (.-.) - [308.83 Ko] - (0.0.0.0) - C:

        \Windows\System32\DisplayAudiox64.cab
        [MD5.59075B2A63DF6A568123218BF4DC2696] - |A| - [02/06/2016 13:15:54] - (.-.) - [0.87 Ko] - (0.0.0.0) - C:

        \Windows\System32\DPTopologyApp.exe.config
        [MD5.899E708E589C09700BFF1C73CB7D7002] - |A| - [02/06/2016 13:15:54] - (.-.) - [0.87 Ko] - (0.0.0.0) - C:

        \Windows\System32\DPTopologyAppv2_0.exe.config
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [63125.15 Ko] - C:\Windows

        \System32\drivers
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [1267107.62 Ko] - C:\Windows

        \System32\DriverStore
        [MD5.884BE1FCF1D321D560063BB78E84FEE0] - |A| - [06/01/2012 22:02:08] - (.-.) - [3.04 Ko] - (0.0.0.0) - C:

        \Windows\System32\e1c62x64.din
        [MD5.DFFDB573AEB313E6F70CDF4590BCC215] - |A| - [18/07/2018 16:20:47] - (.-.) - [329.95 Ko] - (0.0.0.0) - C:

        \Windows\System32\FNTCACHE.DAT
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [454 Ko] - C:\Windows\System32\fr-FR
        [MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [0 Ko] - C:\Windows\System32\FxsTmp
        [MD5.2AE808CB0D9A667B0CF41EA74B3B9BAC] - |A| - [10/06/2009 16:36:24] - (.-.) - [39.6 Ko] - (0.0.0.0) - C:

        \Windows\System32\gatherNetworkInfo.vbs
        [MD5.899E708E589C09700BFF1C73CB7D7002] - |A| - [02/06/2016 13:15:54] - (.-.) - [0.87 Ko] - (0.0.0.0) - C:

        \Windows\System32\Gfxv2_0.exe.config
        [MD5.59075B2A63DF6A568123218BF4DC2696] - |A| - [02/06/2016 13:15:54] - (.-.) - [0.87 Ko] - (0.0.0.0) - C:

        \Windows\System32\Gfxv4_0.exe.config
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [0 Ko] - C:\Windows

        \System32\GroupPolicy
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [0 Ko] - C:\Windows

        \System32\GroupPolicyUsers
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [191.5 Ko] - C:\Windows\System32\he-IL
        [MD5.17646020C8DACD0F51E76846CFDAEB3A] - |A| - [13/07/2009 21:20:27] - (.-.) - [18.46 Ko] - (0.0.0.0) - C:

        \Windows\System32\HPEACLHN.HPI
        [MD5.93243A03EA8FB94AB6F3D5E4A3CBD69C] - |A| - [02/06/2016 13:34:16] - (.-.) - [100.5 Ko] - (0.0.0.0) - C:

        \Windows\System32\IccLibDll_x64.dll
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [36.27 Ko] - C:\Windows\System32\icsxml
        [MD5.0B0A9C46F9A8450857383D4CB798ED28] - |A| - [26/06/2018 13:41:42] - (.Copyright © 2004 - 2009 IDT, Inc. -

        IDT PC Audio.) - [1853.5 Ko] - (1.0.6491.0) - C:\Windows\System32\IDTNC64.cpl
        [MD5.C6BC3358BFC6ECAA2E830F05B64EDC42] - |A| - [02/06/2016 13:38:58] - (.-.) - [167 Ko] - (0.0.0.0) - C:

        \Windows\System32\igdail64.dll
        [MD5.BFBFC29FF7D0149EB354C46B7ADB06D7] - |A| - [02/06/2016 13:39:04] - (.-.) - [224.5 Ko] - (0.0.0.0) - C:

        \Windows\System32\igdde64.dll
        [MD5.F5EC784EBD55DFF46764A0134C3CBCB4] - |A| - [02/06/2016 13:40:26] - (.Copyright (C) 2012-2013 - MDF(CM)

        Runtime DX11 Dynamic Link Library.) - [188.99 Ko] - (3.0.0.1284) - C:\Windows\System32\igfx11cmrt64.dll
        [MD5.DADEA3888F8175EA4B7E8EF24DA73DFF] - |A| - [02/06/2016 13:40:36] - (.Copyright (C) 2010 - 2013 - MDF(CM)

        JIT Dynamic Link Library.) - [1987.99 Ko] - (3.0.0.1284) - C:\Windows\System32\igfxcmjit64.dll
        [MD5.521E38CB6C096E91E46D9436DD85AA0C] - |A| - [02/06/2016 13:48:06] - (.Copyright (C) 2010 - 2013 - MDF(CM)

        Runtime Dynamic Link Library.) - [194.43 Ko] - (3.0.0.1284) - C:\Windows\System32\igfxcmrt64.dll
        [MD5.B554A0591241BD7310C692D540FE9720] - |A| - [02/06/2016 13:40:38] - (.-.) - [258 Ko] - (0.0.0.0) - C:

        \Windows\System32\igfxCPL.cpl
        [MD5.533E9CC9949165FE3E36491665B54864] - |A| - [02/06/2016 13:40:40] - (.-.) - [92.99 Ko] - (0.0.0.0) - C:

        \Windows\System32\igfxCUIServicePS.dll
        [MD5.857B333695676433E5AB27365BAE2F8F] - |A| - [02/06/2016 13:40:44] - (.-.) - [67 Ko] - (1.0.0.0) - C:

        \Windows\System32\igfxDHLib.dll
        [MD5.857912645067D137D31A429657A02074] - |A| - [02/06/2016 13:40:46] - (.-.) - [76.5 Ko] - (1.0.0.0) - C:

        \Windows\System32\igfxDHLibv2_0.dll
        [MD5.0D8E7EDF1BAE5345236BDE69B5938179] - |A| - [02/06/2016 13:40:48] - (.-.) - [18.99 Ko] - (1.0.0.0) - C:

        \Windows\System32\igfxDILib.dll
        [MD5.FCA27E38DB40D86E0AB16100647292C2] - |A| - [02/06/2016 13:40:50] - (.-.) - [19 Ko] - (1.0.0.0) - C:

        \Windows\System32\igfxDILibv2_0.dll
        [MD5.9742A8FB45D39C1AE6530AEB2FFF31ED] - |A| - [02/06/2016 13:40:54] - (.-.) - [18.5 Ko] - (1.0.0.0) - C:

        \Windows\System32\igfxEMLib.dll
        [MD5.075F721C433FCDB7EAC66009A265C7D8] - |A| - [02/06/2016 13:40:54] - (.-.) - [18.49 Ko] - (1.0.0.0) - C:

        \Windows\System32\igfxEMLibv2_0.dll
        [MD5.865BB0C723B21D62A16BE6EDD831A17C] - |A| - [02/06/2016 13:41:02] - (.-.) - [13.5 Ko] - (1.0.0.0) - C:

        \Windows\System32\igfxLHMLib.dll
        [MD5.11BC4B4011AA5FE01FA22A360B875184] - |A| - [02/06/2016 13:41:02] - (.-.) - [13.49 Ko] - (1.0.0.0) - C:

        \Windows\System32\igfxLHMLibv2_0.dll
        [MD5.6C0F36ABFE80433B352FA7748ED887BF] - |A| - [02/06/2016 13:16:10] - (.-.) - [2748 Ko] - (0.0.0.0) - C:

        \Windows\System32\iglhxa64.cpa
        [MD5.2FCCF7939D4D3F392AB3C0F5F40039DD] - |A| - [02/06/2016 13:16:10] - (.-.) - [1.1 Ko] - (0.0.0.0) - C:

        \Windows\System32\iglhxa64.vp
        [MD5.B226B85123619EF1394339C1B5EB5A8D] - |A| - [02/06/2016 13:16:10] - (.-.) - [42.47 Ko] - (0.0.0.0) - C:

        \Windows\System32\iglhxc64.vp
        [MD5.55C71EDC47B57E5115B40095EEC9E205] - |A| - [02/06/2016 13:16:10] - (.-.) - [42.79 Ko] - (0.0.0.0) - C:

        \Windows\System32\iglhxc64_dev.vp
        [MD5.94ED4F871997E5DFC610DC1649C38911] - |A| - [02/06/2016 13:16:10] - (.-.) - [42.24 Ko] - (0.0.0.0) - C:

        \Windows\System32\iglhxg64.vp
        [MD5.04590E9E52E13EF34B2AA02C7EA2431B] - |A| - [02/06/2016 13:16:10] - (.-.) - [42.28 Ko] - (0.0.0.0) - C:

        \Windows\System32\iglhxg64_dev.vp
        [MD5.3B6EF4F03F2DE75A3B7DDF627A3EC146] - |A| - [02/06/2016 13:16:10] - (.-.) - [42.99 Ko] - (0.0.0.0) - C:

        \Windows\System32\iglhxo64.vp
        [MD5.715DBDBED4599E798F94EDF6003F75B6] - |A| - [02/06/2016 13:16:10] - (.-.) - [41.09 Ko] - (0.0.0.0) - C:

        \Windows\System32\iglhxo64_dev.vp
        [MD5.1C70F59C563D05DE6CAFFA7C280987F5] - |A| - [02/06/2016 13:16:10] - (.-.) - [2.52 Ko] - (0.0.0.0) - C:

        \Windows\System32\iglhxs64.vp
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [36875.94 Ko] - C:\Windows\System32\IME
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [0 Ko] - C:\Windows\System32\inetsrv
        [MD5.AAA0C03BF54FC8A4E895B576861A9848] - |A| - [20/11/2010 23:07:41] - (.-.) - [29.12 Ko] - (0.0.0.0) - C:

        \Windows\System32\InstallPackage_ETW.Log
        [MD5.4D38B30EF71C8F2CDAAD31166BA66756] - |A| - [02/06/2016 13:41:14] - (.Copyright © The Khronos Group Inc

        2011 - OpenCL Client DLL.) - [71 Ko] - (1.2.11.0) - C:\Windows\System32\Intel_OpenCL_ICD64.dll
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [452 Ko] - C:\Windows\System32\it-IT
        [MD5.C1B7AB03AC2F3C990A40BC2E18E02CF1] - |A| - [13/07/2009 22:35:50] - (.-.) - [11687.04 Ko] - (0.0.0.0) - C:

        \Windows\System32\korwbrkr.lex
        [MD5.E89C001FB4D9E08CC7072CE774CDB999] - |A| - [20/11/2010 22:52:07] - (.-.) - [0.01 Ko] - (0.0.0.0) - C:

        \Windows\System32\LocalGroupAdminAdd.log
        [MD5.563C3703A9B57CC9B370A76D6173D09C] - |A| - [20/11/2010 22:52:08] - (.-.) - [0.05 Ko] - (0.0.0.0) - C:

        \Windows\System32\Local_LLU.log
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [2536.51 Ko] - C:\Windows

        \System32\LogFiles
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [165 Ko] - C:\Windows\System32\lt-LT
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [166 Ko] - C:\Windows\System32\lv-LV
        [MD5.00000000000000000000000000000000] - |D| - [26/06/2018 14:06:44] - [57417.1 Ko] - C:\Windows

        \System32\Macromed
        [MD5.7A495CA1402C2F9F5D035092AD808669] - |A| - [13/07/2009 16:17:48] - (.-.) - [0.85 Ko] - (0.0.0.0) - C:

        \Windows\System32\manage-bde.wsf
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [1981.88 Ko] - C:\Windows

        \System32\manifeststore
        [MD5.39E801545FFF6230C80140E0F8A06629] - |A| - [14/07/2009 00:57:09] - (.-.) - [1.21 Ko] - (0.0.0.0) - C:

        \Windows\System32\migwiz.lnk
        [MD5.00000000000000000000000000000000] - |D| - [26/06/2018 11:19:54] - [0 Ko] - C:\Windows\System32\MRT
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [4148.28 Ko] - C:\Windows

        \System32\Msdtc
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [11.33 Ko] - C:\Windows\System32\MUI
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [422.5 Ko] - C:\Windows\System32\nb-NO
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [384 Ko] - C:\Windows\System32\NDF
        [MD5.CD48AD912839B9FB6CCA5D4AA9B37500] - |A| - [13/07/2009 18:01:19] - (.-.) - [21.3 Ko] - (0.0.0.0) - C:

        \Windows\System32\NetTrace.PLA.Diagnostics.xml
        [MD5.8E24A7BCAEF2045DA1FF29217622843E] - |A| - [20/11/2010 22:52:07] - (.-.) - [0.04 Ko] - (0.0.0.0) - C:

        \Windows\System32\Network_LLU.log
        [MD5.1C96B3DA6ABE5E18B63C64DF75884F6A] - |A| - [13/07/2009 22:35:51] - (.-.) - [1.45 Ko] - (0.0.0.0) - C:

        \Windows\System32\noise.kor
        [MD5.4BAEC8EF638F43F289868C8DBB48B893] - |A| - [07/04/2016 15:07:44] - (.Copyright (c) NovaTek 2009 - 2013 -

        NovaTek Msdc Ext - Avision.) - [66.5 Ko] - (12.1.13.23) - C:\Windows\System32\NvUSBScan.dll
        [MD5.00000000000000000000000000000000] - |D| - [26/06/2018 13:17:53] - [114.78 Ko] - C:\Windows\System32\OEM
        [MD5.2901049544FDF863362FABA2363EB647] - |A| - [13/07/2009 16:24:21] - (.-.) - [0.82 Ko] - (0.0.0.0) - C:

        \Windows\System32\onlinesetup.cmd
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [14429.42 Ko] - C:\Windows

        \System32\oobe
        [MD5.C906B7C38274609652827718DA41D2C3] - |A| - [13/07/2009 22:36:59] - (.-.) - [119.28 Ko] - (0.0.0.0) - C:

        \Windows\System32\perfc009.dat
        [MD5.B7795BC96C1CEB86E04E8DC843E9C784] - |A| - [10/06/2009 16:33:35] - (.-.) - [113.56 Ko] - (0.0.0.0) - C:

        \Windows\System32\PerfCenterCpl.ico
        [MD5.7AAA3E23CE4C7845B112F7A79B110E60] - |A| - [13/07/2009 22:36:59] - (.-.) - [30.81 Ko] - (0.0.0.0) - C:

        \Windows\System32\perfd009.dat
        [MD5.83CB269D4BEDBC99E35408C54FEDB50A] - |A| - [13/07/2009 22:36:59] - (.-.) - [646.79 Ko] - (0.0.0.0) - C:

        \Windows\System32\perfh009.dat
        [MD5.F1AC5B24012847B39B328104FA2886A5] - |A| - [14/07/2009 01:13:15] - (.-.) - [763.47 Ko] - (0.0.0.0) - C:

        \Windows\System32\PerfStringBackup.INI
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [439 Ko] - C:\Windows\System32\pl-PL
        [MD5.1DD626FE4DE2D4B710DD1360F404A54F] - |A| - [26/06/2018 09:56:00] - (.Copyright (C) 2001 - PrintBrm

        Application.) - [70 Ko] - (1.0.0.0) - C:\Windows\System32\PrintBrmUi.exe
        [MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:50] - [413.88 Ko] - C:\Windows

        \System32\Printing_Admin_Scripts
        [MD5.F5A689BA3FDB5F8A6F13622B5AC02FD8] - |A| - [29/10/2018 20:46:24] - (.-.) - [2842 Ko] - (4.7.0.0) - C:

        \Windows\System32\QtCoreViz4.dll
        [MD5.15A0D55B076B0A0CB201B9B286277CA4] - |A| - [29/10/2018 20:46:24] - (.-.) - [10360 Ko] - (4.7.0.0) - C:

        \Windows\System32\QtGuiViz4.dll
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [23.75 Ko] - C:\Windows\System32\ras
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [0.78 Ko] - C:\Windows

        \System32\Recovery
        [MD5.7C47E200D9D049C49156A7D416586C4F] - |A| - [02/06/2016 13:16:24] - (.-.) - [161.58 Ko] - (0.0.0.0) - C:

        \Windows\System32\resARA.cui
        [MD5.BB02E0907790B462282C099197F01A07] - |A| - [02/06/2016 13:16:26] - (.-.) - [146.02 Ko] - (0.0.0.0) - C:

        \Windows\System32\resCHS.cui
        [MD5.2F6B4B08827D5B994B097C0D8A9F15C3] - |A| - [02/06/2016 13:16:26] - (.-.) - [146.88 Ko] - (0.0.0.0) - C:

        \Windows\System32\resCHT.cui
        [MD5.971B2384427DD0133F9FD7B923F395DF] - |A| - [02/06/2016 13:16:26] - (.-.) - [152.96 Ko] - (0.0.0.0) - C:

        \Windows\System32\resCSY.cui
        [MD5.D48CD2D59E5C72C187883320AFB5FE93] - |A| - [02/06/2016 13:16:26] - (.-.) - [149.91 Ko] - (0.0.0.0) - C:

        \Windows\System32\resDAN.cui
        [MD5.82566CB31CEA7567BF8B45D832668439] - |A| - [02/06/2016 13:16:26] - (.-.) - [154.68 Ko] - (0.0.0.0) - C:

        \Windows\System32\resDEU.cui
        [MD5.211F5776CF333B89D0BD361F92CB38C3] - |A| - [02/06/2016 13:16:26] - (.-.) - [179.72 Ko] - (0.0.0.0) - C:

        \Windows\System32\resELL.cui
        [MD5.7CDD3D6A64BC621EB92E97ADBD7C0711] - |A| - [02/06/2016 13:16:26] - (.-.) - [148.6 Ko] - (0.0.0.0) - C:

        \Windows\System32\resENU.cui
        [MD5.3C63073FF29B04706024E5678CF43CF8] - |A| - [02/06/2016 13:16:26] - (.-.) - [154.35 Ko] - (0.0.0.0) - C:

        \Windows\System32\resESN.cui
        [MD5.E34147497C3346D48000124EC377A868] - |A| - [02/06/2016 13:16:26] - (.-.) - [152.32 Ko] - (0.0.0.0) - C:

        \Windows\System32\resFIN.cui
        [MD5.6E29BB7D3A84B8ED2C398483CF037308] - |A| - [02/06/2016 13:16:26] - (.-.) - [156.44 Ko] - (0.0.0.0) - C:

        \Windows\System32\resFRA.cui
        [MD5.342DC30F883BEA56448B60A2E1F0D432] - |A| - [02/06/2016 13:16:26] - (.-.) - [161.02 Ko] - (0.0.0.0) - C:

        \Windows\System32\resHEB.cui
        [MD5.3E4404DF28CE437D634BF3EDFC9A10BE] - |A| - [02/06/2016 13:16:26] - (.-.) - [151.89 Ko] - (0.0.0.0) - C:

        \Windows\System32\resHRV.cui
        [MD5.C4E050B32A65B326819AD20331AAB818] - |A| - [02/06/2016 13:16:26] - (.-.) - [156.5 Ko] - (0.0.0.0) - C:

        \Windows\System32\resHUN.cui
        [MD5.2E9301D9FAFB38E6014BB850E3CC4FD6] - |A| - [02/06/2016 13:16:26] - (.-.) - [154.64 Ko] - (0.0.0.0) - C:

        \Windows\System32\resITA.cui
        [MD5.75CF363FB4F974F7D037F1D1BD883E75] - |A| - [02/06/2016 13:16:26] - (.-.) - [161.08 Ko] - (0.0.0.0) - C:

        \Windows\System32\resJPN.cui
        [MD5.5168626800CC0FAA332BF1A9E7942D05] - |A| - [02/06/2016 13:16:26] - (.-.) - [154.82 Ko] - (0.0.0.0) - C:

        \Windows\System32\resKOR.cui
        [MD5.CA5A38DCA65C8540183DB5989B45971B] - |A| - [02/06/2016 13:16:26] - (.-.) - [153.64 Ko] - (0.0.0.0) - C:

        \Windows\System32\resNLD.cui
        [MD5.E3ECBE665A85EDA30A7F3FEA0427FA3E] - |A| - [02/06/2016 13:16:26] - (.-.) - [150.39 Ko] - (0.0.0.0) - C:

        \Windows\System32\resNOR.cui
        [MD5.A179BBDE67244C7413CC9DD94350575B] - |A| - [02/06/2016 13:16:26] - (.-.) - [153.96 Ko] - (0.0.0.0) - C:

        \Windows\System32\resPLK.cui
        [MD5.5CCF59C6E0B3FB08FE2058533D448FDD] - |A| - [02/06/2016 13:16:26] - (.-.) - [153.04 Ko] - (0.0.0.0) - C:

        \Windows\System32\resPTB.cui
        [MD5.82C21F51E2E9912158831CDFB0A206B6] - |A| - [02/06/2016 13:16:26] - (.-.) - [152.75 Ko] - (0.0.0.0) - C:

        \Windows\System32\resPTG.cui
        [MD5.BEC45D17F77784FDE5FEE50B626F1BDC] - |A| - [02/06/2016 13:16:26] - (.-.) - [154.44 Ko] - (0.0.0.0) - C:

        \Windows\System32\resROM.cui
        [MD5.EB9FF588AAF2E64CB52F6B6C3BD6BF1A] - |A| - [02/06/2016 13:16:26] - (.-.) - [175.61 Ko] - (0.0.0.0) - C:

        \Windows\System32\resRUS.cui
        [MD5.CD28EBD732ECF7A0FAD7E7F334F04938] - |A| - [02/06/2016 13:16:26] - (.-.) - [153.8 Ko] - (0.0.0.0) - C:

        \Windows\System32\resSKY.cui
        [MD5.6C1F10F831655D5AFA97FE16FB917067] - |A| - [02/06/2016 13:16:26] - (.-.) - [151.33 Ko] - (0.0.0.0) - C:

        \Windows\System32\resSLV.cui
        [MD5.5782CEFEAEF7CA26BAE4CAA27E020F3C] - |A| - [02/06/2016 13:16:26] - (.-.) - [151.49 Ko] - (0.0.0.0) - C:

        \Windows\System32\resSVE.cui
        [MD5.267A52FC1DC0DB12959A1F1E293A8E68] - |A| - [02/06/2016 13:16:26] - (.-.) - [186.99 Ko] - (0.0.0.0) - C:

        \Windows\System32\resTHA.cui
        [MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [0.07 Ko] - C:\Windows\System32\restore
        [MD5.CD1ACAC2BEEFEB1684C975496AC7EDA8] - |A| - [02/06/2016 13:16:26] - (.-.) - [152.93 Ko] - (0.0.0.0) - C:

        \Windows\System32\resTRK.cui
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [169 Ko] - C:\Windows\System32\ro-RO
        [MD5.61AE1F36E653B0CC54EFFED0B0977407] - |A| - [07/04/2016 15:07:44] - (.Copyright (c) 2015, Visioneer Inc. -

        Visioneer RoadWarrior 3 LLD.) - [393 Ko] - (0.9.115.331) - C:\Windows\System32\RWAR3.dll
        [MD5.942E76C23637C9971EFC250017D52EB9] - |A| - [11/04/2016 19:09:42] - (.Copyright © 2016, Visioneer Inc. -

        TNG CoInstaller.) - [417 Ko] - (5.1.16.4119) - C:\Windows\System32\RWAR3CI.dll
        [MD5.5430507217D8AD114349064CC2ED616D] - |A| - [20/07/2015 15:14:14] - (.Copyright © 2015, Visioneer Inc. -

        Visioneer WIA Driver.) - [537.5 Ko] - (5.1.15.7205) - C:\Windows\System32\RWAR3WIAT.DLL
        [MD5.A8D2065C893DC8B656D3C3FA8180F2AA] - |A| - [20/07/2015 11:08:48] - (.Copyright © 2015, Visioneer Inc. -

        Visioneer WIA UI Extension.) - [528.5 Ko] - (5.1.15.7202) - C:\Windows\System32\RWAR3WUI.DLL
        [MD5.5C18CD22BE4628865FCB63337A6E5EF6] - |A| - [20/11/2010 23:24:25] - (.-.) - [10.18 Ko] - (0.0.0.0) - C:

        \Windows\System32\ScavengeSpace.xml
        [MD5.8C3D0C73A0850A0EE62DF9EC36DBDE80] - |N| - [26/06/2018 13:46:08] - (.-.) - [1.86 Ko] - (0.0.0.0) - C:

        \Windows\System32\SetupBD.din
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [169.5 Ko] - C:\Windows\System32\sk-SK
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [166 Ko] - C:\Windows\System32\sl-SI
        [MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [37.8 Ko] - C:\Windows\System32\slmgr
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [19650.02 Ko] - C:\Windows\System32\SMI
        [MD5.C74D61FCA22F36791105D7878AF73572] - |A| - [10/06/2009 17:08:17] - (.-.) - [8.09 Ko] - (0.0.0.0) - C:

        \Windows\System32\spcinstrumentation.man
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [26875.5 Ko] - C:\Windows

        \System32\Speech
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [69368.74 Ko] - C:\Windows

        \System32\spool
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [2133.41 Ko] - C:\Windows\System32\spp
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [30.19 Ko] - C:\Windows\System32\sppui
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [170 Ko] - C:\Windows\System32\sr-

        Latn-CS
        [MD5.631F98A02426216B8E0DAA0CF012BEF4] - |A| - [26/06/2018 13:41:19] - (.Copyright © 2004 - 2009 IDT, Inc. -

        IDT PC Audio.) - [250 Ko] - (1.0.6491.0) - C:\Windows\System32\st646491.dll
        [MD5.02FF0CDD04B9E54BB989EDE66B5C2D6B] - |N| - [26/06/2018 13:41:19] - (.Copyright © 2004 - 2009 IDT, Inc. -

        IDT PC Audio.) - [681.5 Ko] - (1.0.6491.0) - C:\Windows\System32\stapi64.dll
        [MD5.CA416663232F14D4EFB6A8E2640DD7D4] - |A| - [26/06/2018 13:41:19] - (.Copyright © 2004 - 2009 IDT, Inc. -

        IDT PC Audio.) - [2161.5 Ko] - (1.0.6491.0) - C:\Windows\System32\stapo64.dll
        [MD5.5FD8F1D4A6B8A9D39BEA42C3FE298C4D] - |A| - [26/06/2018 13:41:19] - (.Copyright © 2004 - 2009 IDT, Inc. -

        IDT PC Audio.) - [487.5 Ko] - (1.0.6491.0) - C:\Windows\System32\stcplx64.dll
        [MD5.A1C3D414D61A9269CD37098D6E969236] - |A| - [26/06/2018 13:41:42] - (.Copyright © 2004 - 2009 IDT, Inc. -

        IDT PC Audio.) - [5958.5 Ko] - (1.0.6491.0) - C:\Windows\System32\stlang64.dll
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [426.5 Ko] - C:\Windows\System32\sv-SE
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [133 Ko] - C:\Windows\System32\sysprep
        [MD5.5EC92F0EAE3CA59F647C3CA5AA7CB053] - |A| - [20/11/2010 23:24:36] - (.-.) - [339.75 Ko] - (0.0.0.0) - C:

        \Windows\System32\systemsf.ebd
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [276.48 Ko] - C:\Windows\System32\Tasks
        [MD5.47F22CAD4A16BB40153555D631546B94] - |A| - [10/06/2009 17:01:25] - (.-.) - [58.71 Ko] - (0.0.0.0) - C:

        \Windows\System32\tcpmon.ini
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [157 Ko] - C:\Windows\System32\th-TH
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [424 Ko] - C:\Windows\System32\tr-TR
        [MD5.DCD85D844C1583C61D3AFABD983AA0B5] - |A| - [29/10/2018 20:46:24] - (.(C) 1993-2013 TWAIN Working Group. -

        TWAIN 32 Source Manager (Image Acquisition Interface).) - [164.2 Ko] - (2.3.0.0) - C:\Windows

        \System32\TWAINDSM.dll
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [166.5 Ko] - C:\Windows\System32\uk-UA
        [MD5.05F9840831C29F5BE93AD8BE810D5614] - |A| - [14/07/2009 00:45:37] - (.-.) - [18 Ko] - (0.0.0.0) - C:

        \Windows\System32\umstartup.etl
        [MD5.F736AA948D0C3CBCE212B7B2CB0EF115] - |A| - [14/07/2009 00:45:37] - (.-.) - [45 Ko] - (0.0.0.0) - C:

        \Windows\System32\umstartup000.etl
        [MD5.A6E1379EBE20E0BFA119DAA11D764008] - |A| - [26/06/2018 13:44:55] - (.Copyright (C) 1999-2013 Alps Electric

        Co., Ltd. - Vxdif.) - [113.34 Ko] - (8.0.0.40) - C:\Windows\System32\Vxdif.dll
        [MD5.00000000000000000000000000000000] - |D| - [26/06/2018 11:53:32] - [1754.83 Ko] - C:\Windows\System32\Wat
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [47697.36 Ko] - C:\Windows

        \System32\wbem
        [MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:50] - [60.46 Ko] - C:\Windows\System32\WCN
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [102675.76 Ko] - C:\Windows

        \System32\wdi
        [MD5.6EDD021A8B6457DDE09DE7B7FA4E8C8B] - |A| - [13/07/2009 17:54:15] - (.-.) - [0.6 Ko] - (0.0.0.0) - C:

        \Windows\System32\WdsUnattendTemplate.xml
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [96 Ko] - C:\Windows\System32\wfp
        [MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [0 Ko] - C:\Windows

        \System32\WinBioDatabase
        [MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [73.5 Ko] - C:\Windows

        \System32\WinBioPlugIns
        [MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [8665.44 Ko] - C:\Windows

        \System32\WindowsPowerShell
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [80992 Ko] - C:\Windows\System32\winevt
        [MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [99.06 Ko] - C:\Windows\System32\winrm
        [MD5.00000000000000000000000000000000] - |HD| - [26/06/2018 13:44:40] - [1.63 Ko] - C:\Windows

        \System32\WLANProfiles
        [MD5.CB136B267569A62EF63D798BC90ABD5A] - |A| - [26/06/2018 12:39:55] - (.-.) - [0.14 Ko] - (0.0.0.0) - C:

        \Windows\System32{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
        [MD5.9F45771914360A925252A1B7226EC7EC] - |A| - [26/06/2018 10:21:33] - (.-.) - [0.44 Ko] - (0.0.0.0) - C:

        \Windows\System32{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat
        [MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [0 Ko] - C:\Windows\SysWOW64\0409
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [2258.5 Ko] - C:\Windows

        \SysWOW64\AdvancedInstallers
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [201.5 Ko] - C:\Windows\SysWOW64\ar-SA
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [173 Ko] - C:\Windows\SysWOW64\bg-BG
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0 Ko] - C:\Windows\SysWOW64\catroot
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0 Ko] - C:\Windows\SysWOW64\catroot2
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [302.5 Ko] - C:\Windows\SysWOW64\com
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [157.02 Ko] - C:\Windows

        \SysWOW64\config
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [427.5 Ko] - C:\Windows\SysWOW64\cs-CZ
        [MD5.F2A1B71072E64F3CBF1045CDA048C945] - |A| - [26/06/2018 13:46:23] - (.Copyright 2011 - CSVer.) - [52 Ko] -

        (9.3.0.1019) - C:\Windows\SysWOW64\CSVer.dll
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [422.5 Ko] - C:\Windows\SysWOW64\da-DK
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [452 Ko] - C:\Windows\SysWOW64\de-DE
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [4141.5 Ko] - C:\Windows\SysWOW64\Dism
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [3481.93 Ko] - C:\Windows

        \SysWOW64\drivers
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [1.05 Ko] - C:\Windows

        \SysWOW64\DriverStore
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [451.5 Ko] - C:\Windows\SysWOW64\el-GR
        [MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [1648 Ko] - C:\Windows\SysWOW64\en
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [32600.57 Ko] - C:\Windows

        \SysWOW64\en-US
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [443 Ko] - C:\Windows\SysWOW64\es-ES
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [160.5 Ko] - C:\Windows\SysWOW64\et-EE
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [425 Ko] - C:\Windows\SysWOW64\fi-FI
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [449 Ko] - C:\Windows\SysWOW64\fr-FR
        [MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [0 Ko] - C:\Windows\SysWOW64\FxsTmp
        [MD5.A8A9E272B84E2E0A90247B65BC877BD4] - |A| - [28/06/2002 09:08:00] - (.Copyright © 2000-2002 GEAR Software

        Inc. - GEARAspi.) - [60 Ko] - (1.0.6.0) - C:\Windows\SysWOW64\GEARAspi.dll
        [MD5.17B77D83C53AE007C11ED811D992E727] - |A| - [02/09/2002 10:51:00] - (.Copyright © 2001 GEAR Software -

        gearsec.) - [48 Ko] - (1.0.0.3) - C:\Windows\SysWOW64\gearsec.exe
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0 Ko] - C:\Windows

        \SysWOW64\GroupPolicy
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0 Ko] - C:\Windows

        \SysWOW64\GroupPolicyUsers
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [191.5 Ko] - C:\Windows\SysWOW64\he-IL
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [168 Ko] - C:\Windows\SysWOW64\hr-HR
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [429 Ko] - C:\Windows\SysWOW64\hu-HU
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [36.27 Ko] - C:\Windows\SysWOW64\icsxml
        [MD5.D384FAC33A6A3E4EDACFE7C1C81105BD] - |A| - [02/06/2016 13:34:14] - (.-.) - [149 Ko] - (0.0.0.0) - C:

        \Windows\SysWOW64\igdail32.dll
        [MD5.6A2EB90AF06BB1DB56F11FCEC8D5A137] - |A| - [02/06/2016 13:41:12] - (.Copyright © The Khronos Group Inc

        2011 - OpenCL Client DLL.) - [67.5 Ko] - (1.2.11.0) - C:\Windows\SysWOW64\Intel_OpenCL_ICD32.dll
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [447 Ko] - C:\Windows\SysWOW64\it-IT
        [MD5.FA2E1F09ED6C4C221E4513A7E815E13D] - |A| - [27/08/2013 14:00:08] - (.-.) - [1.5 Ko] - (0.0.0.0) - C:

        \Windows\SysWOW64\IusEventLog.dll
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [361 Ko] - C:\Windows\SysWOW64\ja-JP
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [356.5 Ko] - C:\Windows\SysWOW64\ko-KR
        [MD5.C1B7AB03AC2F3C990A40BC2E18E02CF1] - |A| - [13/07/2009 22:35:50] - (.-.) - [11687.04 Ko] - (0.0.0.0) - C:

        \Windows\SysWOW64\korwbrkr.lex
        [MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [0 Ko] - C:\Windows\SysWOW64\LogFiles
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [165 Ko] - C:\Windows\SysWOW64\lt-LT
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [166 Ko] - C:\Windows\SysWOW64\lv-LV
        [MD5.00000000000000000000000000000000] - |D| - [26/06/2018 14:06:12] - [47832.1 Ko] - C:\Windows

        \SysWOW64\Macromed
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [1968.26 Ko] - C:\Windows

        \SysWOW64\manifeststore
        [MD5.98071B6EE16AA76DABFF377A5DC69C86] - |A| - [14/07/2009 00:55:01] - (.-.) - [0.52 Ko] - (0.0.0.0) - C:

        \Windows\SysWOW64\mapisvc.inf
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [3178.93 Ko] - C:\Windows

        \SysWOW64\migration
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [32737.45 Ko] - C:\Windows

        \SysWOW64\migwiz
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [52.28 Ko] - C:\Windows\SysWOW64\Msdtc
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [11.33 Ko] - C:\Windows\SysWOW64\MUI
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [418 Ko] - C:\Windows\SysWOW64\nb-NO
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0 Ko] - C:\Windows\SysWOW64\NDF
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [51 Ko] - C:\Windows

        \SysWOW64\NetworkList
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [438.5 Ko] - C:\Windows\SysWOW64\nl-NL
        [MD5.1C96B3DA6ABE5E18B63C64DF75884F6A] - |A| - [13/07/2009 22:35:50] - (.-.) - [1.45 Ko] - (0.0.0.0) - C:

        \Windows\SysWOW64\noise.kor
        [MD5.E5BB16FC0CF8F16C7CB7BDC51A50F5DB] - |A| - [07/04/2016 15:07:44] - (.Copyright (c) NovaTek 2009 - 2013 -

        NovaTek Msdc Ext - Avision.) - [64.5 Ko] - (12.1.13.23) - C:\Windows\SysWOW64\NvUSBScan.dll
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [2566.05 Ko] - C:\Windows\SysWOW64\oobe
        [MD5.B7795BC96C1CEB86E04E8DC843E9C784] - |A| - [10/06/2009 17:17:19] - (.-.) - [113.56 Ko] - (0.0.0.0) - C:

        \Windows\SysWOW64\PerfCenterCpl.ico
        [MD5.44A2D826C266384D0138AD8F556F00D3] - |A| - [26/06/2018 11:10:24] - (.-.) - [756.25 Ko] - (0.0.0.0) - C:

        \Windows\SysWOW64\PerfStringBackup.INI
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [434 Ko] - C:\Windows\SysWOW64\pl-PL
        [MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [413.88 Ko] - C:\Windows

        \SysWOW64\Printing_Admin_Scripts
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [431 Ko] - C:\Windows\SysWOW64\pt-BR
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [433 Ko] - C:\Windows\SysWOW64\pt-PT
        [MD5.03CC2DBAA07B1A6FC2CEE0E5FA96AC8B] - |A| - [29/10/2018 20:46:24] - (.-.) - [2224.5 Ko] - (4.7.0.0) - C:

        \Windows\SysWOW64\QtCoreViz4.dll
        [MD5.3BD34B2BC0242ACB8C1B5F125674093B] - |A| - [29/10/2018 20:46:24] - (.-.) - [7960 Ko] - (4.7.0.0) - C:

        \Windows\SysWOW64\QtGuiViz4.dll
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [23.75 Ko] - C:\Windows\SysWOW64\ras
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0.64 Ko] - C:\Windows

        \SysWOW64\Recovery
        [MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [0 Ko] - C:\Windows\SysWOW64\restore
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [169 Ko] - C:\Windows\SysWOW64\ro-RO
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [429.5 Ko] - C:\Windows\SysWOW64\ru-RU
        [MD5.DEDB6A2F987B056D5FF22FD571745B8F] - |A| - [07/04/2016 15:07:44] - (.Copyright (c) 2015, Visioneer Inc. -

        Visioneer RoadWarrior 3 LLD.) - [368 Ko] - (0.9.115.331) - C:\Windows\SysWOW64\RWAR3.dll
        [MD5.3D3CD5895450C50B37DC20F48C5F735C] - |A| - [11/04/2016 19:08:56] - (.Copyright © 2016, Visioneer Inc. -

        TNG CoInstaller.) - [308 Ko] - (5.1.16.4119) - C:\Windows\SysWOW64\RWAR3CI.dll
        [MD5.D1FB5EAEAD98E28242D90DAA978A9F2B] - |A| - [20/07/2015 15:13:34] - (.Copyright © 2015, Visioneer Inc. -

        Visioneer WIA Driver.) - [408.5 Ko] - (5.1.15.7205) - C:\Windows\SysWOW64\RWAR3WIAT.DLL
        [MD5.09418478BB1C1491DD93CED3EE528DAC] - |A| - [20/07/2015 11:07:34] - (.Copyright © 2015, Visioneer Inc. -

        Visioneer WIA UI Extension.) - [411 Ko] - (5.1.15.7202) - C:\Windows\SysWOW64\RWAR3WUI.DLL
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [169.5 Ko] - C:\Windows\SysWOW64\sk-SK
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [166 Ko] - C:\Windows\SysWOW64\sl-SI
        [MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [37.8 Ko] - C:\Windows\SysWOW64\slmgr
        [MD5.A95238DEB5AEF6CCF70B034F915C1229] - |A| - [18/07/2018 16:07:20] - (.-.) - [0.11 Ko] - (0.0.0.0) - C:

        \Windows\SysWOW64\SmartFlow.txt
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [2800 Ko] - C:\Windows\SysWOW64\Speech
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [1142.37 Ko] - C:\Windows\SysWOW64\spp
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [30.19 Ko] - C:\Windows\SysWOW64\sppui
        [MD5.D41D8CD98F00B204E9800998ECF8427E] - |A| - [26/03/2019 23:17:48] - (.-.) - [0 Ko] - (0.0.0.0) - C:

        \Windows\SysWOW64\SpyWareFolderstoFilter.txt
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [170 Ko] - C:\Windows\SysWOW64\sr-

        Latn-CS
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [421.5 Ko] - C:\Windows\SysWOW64\sv-SE
        [MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [0 Ko] - C:\Windows\SysWOW64\sysprep
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0 Ko] - C:\Windows\SysWOW64\Tasks
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [157 Ko] - C:\Windows\SysWOW64\th-TH
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [419 Ko] - C:\Windows\SysWOW64\tr-TR
        [MD5.569EB253765F2B0854F26A1D7A0191BC] - |A| - [29/10/2018 20:46:24] - (.(C) 1993-2013 TWAIN Working Group. -

        TWAIN 32 Source Manager (Image Acquisition Interface).) - [147.2 Ko] - (2.3.0.0) - C:\Windows

        \SysWOW64\TWAINDSM.dll
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [166.5 Ko] - C:\Windows\SysWOW64\uk-UA
        [MD5.15BD0F8D507546F512EE5D73C3721FA8] - |A| - [13/07/2009 22:35:41] - (.Copyright © 2000 - vfpodbc.) - [20.05

        Ko] - (1.0.2.0) - C:\Windows\SysWOW64\vfpodbc.dll
        [MD5.00000000000000000000000000000000] - |D| - [26/06/2018 11:53:32] - [237.33 Ko] - C:\Windows\SysWOW64\Wat
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [9058.19 Ko] - C:\Windows\SysWOW64\wbem
        [MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [60.46 Ko] - C:\Windows\SysWOW64\WCN
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [101.23 Ko] - C:\Windows\SysWOW64\wdi
        [MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [8539.71 Ko] - C:\Windows

        \SysWOW64\WindowsPowerShell
        [MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [99.06 Ko] - C:\Windows\SysWOW64\winrm
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [333.5 Ko] - C:\Windows\SysWOW64\zh-CN
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [255.5 Ko] - C:\Windows\SysWOW64\zh-HK
        [MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [334 Ko] - C:\Windows\SysWOW64\zh-TW

        ---------- | [Public]

        [13/07/2009 23:20:08] - |RHD| - [6788] - C:\Users\Public\Desktop
        [14/07/2009 00:54:24] - |ASH| - [174] - C:\Users\Public\desktop.ini
        [13/07/2009 23:20:08] - |RD| - [323] - C:\Users\Public\Documents
        [13/07/2009 23:20:08] - |RD| - [174] - C:\Users\Public\Downloads
        [13/07/2009 23:20:08] - |RHD| - [0] - C:\Users\Public\Favorites
        [23/02/2019 19:07:47] - |D| - [1834] - C:\Users\Public\Foxit Software
        [13/07/2009 23:20:08] - |RHD| - [3966] - C:\Users\Public\Libraries
        [13/07/2009 23:20:08] - |RD| - [17440357] - C:\Users\Public\Music
        [13/07/2009 23:20:08] - |RD| - [5838651] - C:\Users\Public\Pictures
        [21/11/2010 03:16:58] - |RD| - [9699579] - C:\Users\Public\Recorded TV
        [26/06/2018 13:44:20] - |D| - [0] - C:\Users\Public\Roaming
        [13/07/2009 23:20:08] - |RD| - [26246732] - C:\Users\Public\Videos

        ---------- | [********]

        [26/06/2018 09:29:15] - |HD| - [37593398117] - C:\Users*\AppData
        [26/06/2018 09:29:15] - |SHD| - [0] - C:\Users*
        \Application Data
        [26/06/2018 09:29:28] - |RD| - [45008] - C:\Users*\Contacts
        [26/06/2018 09:29:15] - |SHD| - [0] - C:\Users*
        \Cookies
        [26/06/2018 09:29:15] - |RD| - [2906776435] - C:\Users*\Desktop
        [26/06/2018 09:29:15] - |RD| - [1112685926] - C:\Users*
        \Documents
        [26/06/2018 09:29:15] - |RD| - [21760657332] - C:\Users*\Downloads
        [26/06/2018 09:29:15] - |RD| - [3432] - C:\Users*
        \Favorites
        [26/06/2018 10:21:40] - |SHD| - [24444] - C:\Users*\IntelGraphicsProfiles
        [26/06/2018 09:29:15] - |RD| - [2304] - C:\Users*
        \Links
        [26/06/2018 09:29:15] - |SHD| - [0] - C:\Users*\Local Settings
        [26/06/2018 09:29:15] - |RD| - [21497044] - C:\Users*
        \Music
        [26/06/2018 09:29:15] - |SHD| - [0] - C:\Users*\My Documents
        [26/06/2018 09:29:15] - |SHD| - [0] - C:\Users*
        \NetHood
        [26/06/2018 09:29:15] - |ASH| - [1835008] - C:\Users*\NTUSER.DAT
        [26/06/2018 09:29:15] - |ASH| - [262144] - C:\Users*
        \ntuser.dat.LOG1
        [26/06/2018 09:29:15] - |ASH| - [0] - C:\Users*\ntuser.dat.LOG2
        [26/06/2018 09:29:15] - |ASH| - [65536] - C:\Users*
        \NTUSER.DAT{016888bd-6c6f-11de-8d1d-

        001e0bcde3ec}.TM.blf
        [26/06/2018 09:29:15] - |ASH| - [524288] - C:\Users********\NTUSER.DAT{016888bd-6c6f-11de-8d1d-

        001e0bcde3ec}.TMContainer00000000000000000001.regt rans-ms
        [26/06/2018 09:29:15] - |ASH| - [524288] - C:\Users********\NTUSER.DAT{016888bd-6c6f-11de-8d1d-

        001e0bcde3ec}.TMContainer00000000000000000002.regt rans-ms
        [26/06/2018 09:29:15] - |SH| - [20] - C:\Users*\ntuser.ini
        [26/06/2018 09:29:15] - |RD| - [504] - C:\Users*
        \Pictures
        [26/06/2018 09:29:15] - |SHD| - [0] - C:\Users*\PrintHood
        [26/06/2018 09:29:15] - |SHD| - [0] - C:\Users*
        \Recent
        [26/06/2018 13:44:20] - |D| - [0] - C:\Users*\Roaming
        [26/06/2018 09:29:15] - |RD| - [282] - C:\Users*
        \Saved Games
        [26/06/2018 09:29:40] - |RD| - [2156] - C:\Users*\Searches
        [26/06/2018 09:29:15] - |SHD| - [0] - C:\Users*
        \SendTo
        [30/08/2018 00:14:03] - |D| - [0] - C:\Users*\source
        [26/06/2018 09:29:15] - |SHD| - [0] - C:\Users*
        \Start Menu
        [26/06/2018 09:29:15] - |SHD| - [0] - C:\Users*\Templates
        [26/06/2018 09:29:15] - |RD| - [504] - C:\Users*
        \Videos
        [26/06/2018 09:29:15] - |D| - [37353303098] - C:\Users*\AppData\Local
        [26/06/2018 09:29:15] - |D| - [283563] - C:\Users*
        \AppData\LocalLow
        [26/06/2018 09:29:15] - |D| - [239811456] - C:\Users*\AppData\Roaming
        [30/08/2018 00:13:41] - |D| - [2] - C:\Users*
        \AppData\Local.IdentityService
        [24/02/2019 23:25:18] - |D| - [0] - C:\Users*\AppData\Local\Adobe
        [26/06/2018 09:29:15] - |SHD| - [0] - C:\Users*
        \AppData\Local\Application Data
        [30/08/2018 08:09:46] - |D| - [0] - C:\Users*\AppData\Local\Apps
        [13/08/2018 21:54:20] - |D| - [0] - C:\Users*
        \AppData\Local\Audacity
        [26/06/2018 13:46:18] - |D| - [0] - C:\Users*\AppData\Local\dell
        [12/01/2019 00:03:36] - |D| - [11231313] - C:\Users*
        \AppData\Local\Dell Inc
        [30/08/2018 08:09:45] - |D| - [0] - C:\Users*\AppData\Local\Deployment
        [08/04/2019 10:57:30] - |D| - [101749] - C:\Users*
        \AppData\Local\Diagnostics
        [27/06/2018 22:18:51] - |A| - [90928] - C:\Users*\AppData\Local\GDIPFONTCACHEV1.DAT
        [12/07/2019 13:36:58] - |D| - [424917179] - C:\Users*
        \AppData\Local\Google
        [26/06/2018 09:29:15] - |SHD| - [0] - C:\Users*\AppData\Local\History
        [26/06/2018 10:11:51] - |AH| - [2633857] - C:\Users*
        \AppData\Local\IconCache.db
        [26/06/2018 09:29:15] - |D| - [403277230] - C:\Users*\AppData\Local\Microsoft
        [27/06/2018 08:28:25] - |D| - [145260] - C:\Users*
        \AppData\Local\Microsoft Help
        [26/06/2018 13:51:55] - |D| - [208431218] - C:\Users*\AppData\Local\Mozilla
        [27/06/2018 13:07:36] - |D| - [0] - C:\Users*
        \AppData\Local\Notepad++
        [27/06/2018 12:00:34] - |D| - [0] - C:\Users*\AppData\Local\Programs
        [10/03/2019 17:53:01] - |D| - [17260365515] - C:\Users*
        \AppData\Local\Propellerhead Software
        [07/12/2018 01:43:28] - |A| - [600] - C:\Users*\AppData\Local\PUTTY.RND
        [30/08/2018 00:04:17] - |D| - [32] - C:\Users*
        \AppData\Local\ServiceHub
        [26/06/2018 09:29:15] - |D| - [19041990985] - C:\Users*\AppData\Local\Temp
        [26/06/2018 09:29:15] - |SHD| - [0] - C:\Users*
        \AppData\Local\Temporary Internet Files
        [26/06/2018 09:29:26] - |D| - [0] - C:\Users*\AppData\Local\VirtualStore
        [29/10/2018 20:51:50] - |D| - [117230] - C:\Users*
        \AppData\Local\Visioneer
        [26/06/2018 11:08:58] - |SD| - [283563] - C:\Users*\AppData\LocalLow\Microsoft
        [26/06/2018 13:51:59] - |D| - [0] - C:\Users*
        \AppData\LocalLow\Mozilla
        [30/08/2018 08:01:19] - |D| - [0] - C:\Users*\AppData\LocalLow\Temp
        [26/06/2018 12:39:59] - |D| - [0] - C:\Users*
        \AppData\Roaming\Adobe
        [13/08/2018 21:54:20] - |D| - [57419] - C:\Users*\AppData\Roaming\audacity
        [23/02/2019 19:07:39] - |D| - [12] - C:\Users*
        \AppData\Roaming\Foxit AgentInformation
        [23/02/2019 19:07:33] - |D| - [90981165] - C:\Users*\AppData\Roaming\Foxit Software
        [26/06/2018 09:29:30] - |D| - [0] - C:\Users*
        \AppData\Roaming\Identities
        [26/06/2018 13:44:29] - |D| - [101299] - C:\Users*\AppData\Roaming\Intel
        [26/06/2018 22:04:50] - |D| - [3760] - C:\Users*
        \AppData\Roaming\IrfanView
        [20/03/2019 22:28:06] - |D| - [445325] - C:\Users*\AppData\Roaming\iZotope
        [23/08/2018 19:50:09] - |D| - [7454] - C:\Users*
        \AppData\Roaming\KeePass
        [27/06/2018 12:03:16] - |D| - [964852] - C:\Users*\AppData\Roaming\Line 6
        [26/06/2018 14:06:48] - |D| - [510022] - C:\Users*
        \AppData\Roaming\Macromedia
        [26/06/2018 09:29:15] - |D| - [0] - C:\Users*\AppData\Roaming\Media Center Programs
        [26/06/2018 09:29:15] - |SD| - [25338783] - C:\Users*
        \AppData\Roaming\Microsoft
        [30/08/2018 00:04:12] - |D| - [0] - C:\Users*\AppData\Roaming\Microsoft Visual Studio
        [17/01/2019 20:51:45] - |D| - [3805258] - C:\Users*
        \AppData\Roaming\MixMeister Technology
        [26/06/2018 13:51:57] - |D| - [73381144] - C:\Users*\AppData\Roaming\Mozilla
        [26/06/2018 21:16:07] - |D| - [2507165] - C:\Users*
        \AppData\Roaming\Notepad++
        [30/08/2018 08:00:53] - |D| - [210] - C:\Users*\AppData\Roaming\NuGet
        [27/06/2018 12:01:01] - |D| - [36444928] - C:\Users*
        \AppData\Roaming\Propellerhead Software
        [30/08/2018 18:35:48] - |D| - [357] - C:\Users*\AppData\Roaming\Skype
        [30/08/2018 00:04:15] - |D| - [4788763] - C:\Users*
        \AppData\Roaming\Visual Studio Setup
        [27/04/2019 23:59:13] - |D| - [96417] - C:\Users*\AppData\Roaming\vlc
        [30/08/2018 00:04:16] - |D| - [66] - C:\Users*
        \AppData\Roaming\vstelemetry
        [26/06/2018 20:44:43] - |D| - [377057] - C:\Users*\AppData\Roaming\Winamp
        [26/06/2018 09:29:40] - |SH| - [174] - C:\Users*
        \AppData\Roaming\Microsoft\Windows\Start Menu

        \desktop.ini
        [26/06/2018 09:29:15] - |RD| - [17432] - C:\Users********\AppData\Roaming\Microsoft\Windows \Start Menu

        \Programs
        [26/06/2018 09:29:15] - |RD| - [14615] - C:\Users********\AppData\Roaming\Microsoft\Windows \Start Menu

        \Programs\Accessories
        [26/06/2018 09:29:40] - |RD| - [174] - C:\Users********\AppData\Roaming\Microsoft\Windows \Start Menu

        \Programs\Administrative Tools
        [26/06/2018 09:29:40] - |SH| - [476] - C:\Users********\AppData\Roaming\Microsoft\Windows \Start Menu

        \Programs\desktop.ini
        [26/06/2018 09:29:41] - |A| - [1413] - C:\Users********\AppData\Roaming\Microsoft\Windows \Start Menu

        \Programs\Internet Explorer.lnk
        [26/06/2018 09:29:15] - |RD| - [580] - C:\Users********\AppData\Roaming\Microsoft\Windows \Start Menu

        \Programs\Maintenance
        [26/06/2018 09:29:40] - |RD| - [174] - C:\Users********\AppData\Roaming\Microsoft\Windows \Start Menu

        \Programs\Startup
        [26/06/2018 09:29:40] - |SH| - [174] - C:\Users********\AppData\Roaming\Microsoft\Windows \Start Menu

        \Programs\Startup\desktop.ini

        ---------- | C:\ProgramData

        [14/07/2009 01:08:56] - |SHD| - [0] - C:\ProgramData\Application Data
        [26/06/2018 13:40:00] - |D| - [1804255] - C:\ProgramData\dell
        [26/06/2018 13:36:38] - |D| - [358787008] - C:\ProgramData\Dell Inc
        [14/07/2009 01:08:56] - |SHD| - [0] - C:\ProgramData\Desktop
        [14/07/2009 01:08:56] - |SHD| - [0] - C:\ProgramData\Documents
        [14/07/2009 01:08:56] - |SHD| - [0] - C:\ProgramData\Favorites
        [23/02/2019 19:07:39] - |D| - [29] - C:\ProgramData\Foxit ContentPlatform
        [23/02/2019 19:07:53] - |D| - [14336] - C:\ProgramData\Foxit Software
        [26/06/2018 13:41:00] - |D| - [81505] - C:\ProgramData\Intel
        [26/06/2018 13:43:56] - |D| - [1455] - C:\ProgramData\Intel.sav
        [27/06/2018 12:03:15] - |D| - [21621574] - C:\ProgramData\Line 6
        [22/02/2019 10:31:22] - |D| - [591] - C:\ProgramData\Macrium
        [13/07/2009 23:20:08] - |SD| - [952933339] - C:\ProgramData\Microsoft
        [27/06/2018 08:28:24] - |D| - [57380] - C:\ProgramData\Microsoft Help
        [29/08/2018 23:57:35] - |D| - [1096] - C:\ProgramData\Microsoft Visual Studio
        [08/02/2019 01:45:00] - |D| - [24] - C:\ProgramData\Mozilla
        [26/06/2018 13:43:04] - |D| - [163404477] - C:\ProgramData\Package Cache
        [26/06/2018 13:37:27] - |D| - [182257943] - C:\ProgramData\PCDr
        [27/06/2018 12:01:03] - |D| - [5964808815] - C:\ProgramData\Propellerhead Software
        [26/06/2018 13:44:20] - |D| - [0] - C:\ProgramData\Roaming
        [14/07/2009 01:08:56] - |SHD| - [0] - C:\ProgramData\Start Menu
        [26/06/2018 13:36:35] - |D| - [78823424] - C:\ProgramData\SupportAssist
        [14/07/2009 01:08:56] - |SHD| - [0] - C:\ProgramData\Templates
        [29/10/2018 20:46:56] - |D| - [0] - C:\ProgramData\Visioneer

        ---------- | C:\ProgramData\Microsoft\Windows\Start Menu

        [14/07/2009 01:01:14] - |A| - [1282] - C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
        [14/07/2009 00:49:40] - |ASH| - [442] - C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini
        [13/07/2009 23:20:08] - |RD| - [182250] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs
        [14/07/2009 00:49:40] - |A| - [1266] - C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk

        ---------- | C:\ProgramData\Microsoft\Windows\Start Menu\Programs

        [26/06/2018 22:13:31] - |D| - [1637] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
        [13/07/2009 23:20:08] - |RD| - [43554] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
        [14/07/2009 01:32:38] - |RD| - [21157] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative

        Tools
        [06/04/2019 14:02:59] - |D| - [1600] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AKAI PROFESSIONAL
        [13/08/2018 21:54:14] - |A| - [1019] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
        [30/05/2019 09:48:51] - |D| - [2143] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
        [14/07/2009 00:54:23] - |ASH| - [1130] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini
        [13/07/2019 10:49:39] - |A| - [942] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
        [23/02/2019 19:07:35] - |D| - [2739] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
        [14/07/2009 01:32:38] - |RD| - [778] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
        [12/07/2019 13:36:58] - |A| - [2298] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
        [26/06/2018 13:40:31] - |RD| - [3490] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
        [26/06/2018 13:44:04] - |RD| - [11852] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel PROSet

        Wireless
        [26/06/2018 22:04:52] - |D| - [9633] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IrfanView
        [20/03/2019 21:59:53] - |D| - [4730] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iZotope
        [23/08/2018 18:00:52] - |A| - [1131] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass 2.lnk
        [27/06/2018 12:03:16] - |D| - [2144] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Line 6
        [13/07/2009 23:20:08] - |RD| - [4370] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance
        [26/06/2018 12:24:35] - |A| - [1345] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
        [27/06/2018 08:31:39] - |D| - [31702] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
        [17/01/2019 20:47:45] - |D| - [918] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MixMeister
        [26/06/2018 21:16:08] - |D| - [1037] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
        [05/05/2019 22:45:13] - |D| - [2623] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
        [27/06/2018 12:00:56] - |D| - [4114] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Propellerhead
        [26/06/2018 21:15:05] - |D| - [5242] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PuTTY (64-bit)
        [14/07/2009 00:57:08] - |A| - [1330] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
        [30/08/2018 18:35:39] - |D| - [1332] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
        [13/07/2009 23:20:08] - |RD| - [174] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
        [27/04/2019 23:56:09] - |D| - [5592] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
        [30/08/2018 00:12:40] - |D| - [0] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Visual Studio 2017
        [26/06/2018 20:45:57] - |D| - [3813] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Winamp
        [14/07/2009 00:57:09] - |A| - [1352] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime

        Upgrade.lnk
        [26/06/2018 12:24:35] - |A| - [1326] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD

        Maker.lnk
        [14/07/2009 00:54:59] - |A| - [1210] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and

        Scan.lnk
        [14/07/2009 00:57:06] - |A| - [1547] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media

        Player.lnk
        [14/07/2009 00:57:08] - |A| - [1246] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk

        ---------- | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

        [14/07/2009 00:54:23] - |ASH| - [174] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

        \desktop.ini

        ---------- | C:\Program Files (x86)

        [13/08/2018 21:54:09] - |D| - [55066342] - C:\Program Files (x86)\Audacity
        [26/06/2018 13:44:00] - |D| - [7114563] - C:\Program Files (x86)\Cisco
        [13/07/2009 23:20:08] - |D| - [1393552496] - C:\Program Files (x86)\Common Files
        [14/07/2009 00:54:24] - |ASH| - [174] - C:\Program Files (x86)\desktop.ini
        [23/02/2019 19:07:26] - |D| - [262446973] - C:\Program Files (x86)\Foxit Software
        [12/07/2019 13:36:26] - |D| - [535966281] - C:\Program Files (x86)\Google
        [26/06/2018 13:41:18] - |HD| - [7992886] - C:\Program Files (x86)\InstallShield Installation Information
        [26/06/2018 10:01:47] - |D| - [50297901] - C:\Program Files (x86)\Intel
        [13/07/2009 23:20:08] - |D| - [10317233] - C:\Program Files (x86)\Internet Explorer
        [26/06/2018 22:04:50] - |D| - [3978395] - C:\Program Files (x86)\IrfanView
        [20/03/2019 21:56:54] - |D| - [87560357] - C:\Program Files (x86)\iZotope
        [23/08/2018 18:00:52] - |D| - [7048580] - C:\Program Files (x86)\KeePass Password Safe 2
        [22/10/2018 00:33:43] - |D| - [1615211] - C:\Program Files (x86)\Lame For Audacity
        [30/08/2018 18:35:32] - |D| - [196515002] - C:\Program Files (x86)\Microsoft
        [27/06/2018 08:28:44] - |D| - [39769547] - C:\Program Files (x86)\Microsoft Analysis Services
        [27/06/2018 08:28:24] - |D| - [602654491] - C:\Program Files (x86)\Microsoft Office
        [30/08/2018 00:04:04] - |D| - [0] - C:\Program Files (x86)\Microsoft Visual Studio
        [26/06/2018 11:09:32] - |D| - [8251487] - C:\Program Files (x86)\Microsoft.NET
        [17/01/2019 20:47:44] - |D| - [13503903] - C:\Program Files (x86)\MixMeister Pro 5
        [13/07/2019 10:49:38] - |D| - [330977] - C:\Program Files (x86)\Mozilla Maintenance Service
        [14/07/2009 01:32:38] - |D| - [25757] - C:\Program Files (x86)\MSBuild
        [26/06/2018 21:16:07] - |D| - [10359025] - C:\Program Files (x86)\Notepad++
        [05/05/2019 22:45:13] - |D| - [138958688] - C:\Program Files (x86)\Panda Security
        [14/07/2009 01:32:38] - |D| - [36962049] - C:\Program Files (x86)\Reference Assemblies
        [14/07/2009 00:57:06] - |HD| - [0] - C:\Program Files (x86)\Uninstall Information
        [29/10/2018 20:45:33] - |D| - [63898285] - C:\Program Files (x86)\Visioneer
        [26/06/2018 20:44:43] - |D| - [26487570] - C:\Program Files (x86)\Winamp
        [14/07/2009 01:32:38] - |D| - [512000] - C:\Program Files (x86)\Windows Defender
        [13/07/2009 23:20:08] - |D| - [6115840] - C:\Program Files (x86)\Windows Mail
        [14/07/2009 01:32:38] - |D| - [5008657] - C:\Program Files (x86)\Windows Media Player
        [13/07/2009 23:20:08] - |D| - [12062388] - C:\Program Files (x86)\Windows NT
        [14/07/2009 01:32:38] - |D| - [4394248] - C:\Program Files (x86)\Windows Photo Viewer
        [14/07/2009 01:32:38] - |D| - [189952] - C:\Program Files (x86)\Windows Portable Devices
        [14/07/2009 01:32:38] - |D| - [5990148] - C:\Program Files (x86)\Windows Sidebar

        ---------- | C:\Program Files

        [26/06/2018 22:13:30] - |D| - [5158872] - C:\Program Files\7-Zip
        [13/07/2009 23:20:08] - |D| - [1356788886] - C:\Program Files\Common Files
        [26/06/2018 13:36:35] - |D| - [513645403] - C:\Program Files\Dell
        [26/06/2018 13:45:06] - |D| - [24509650] - C:\Program Files\DellTPad
        [14/07/2009 00:54:24] - |ASH| - [174] - C:\Program Files\desktop.ini
        [14/07/2009 01:32:38] - |D| - [90245652] - C:\Program Files\DVD Maker
        [26/06/2018 13:41:18] - |D| - [46886304] - C:\Program Files\IDT
        [26/06/2018 10:01:27] - |D| - [258387305] - C:\Program Files\Intel
        [13/07/2009 23:20:08] - |D| - [30309460] - C:\Program Files\Internet Explorer
        [27/06/2018 08:28:53] - |D| - [6730385] - C:\Program Files\Microsoft Office
        [13/07/2019 10:49:38] - |D| - [189693669] - C:\Program Files\Mozilla Firefox
        [14/07/2009 01:32:38] - |D| - [25757] - C:\Program Files\MSBuild
        [27/06/2018 12:00:54] - |D| - [54260677671] - C:\Program Files\Propellerhead
        [26/06/2018 21:15:05] - |D| - [3748404] - C:\Program Files\PuTTY
        [14/07/2009 01:32:38] - |D| - [34625193] - C:\Program Files\Reference Assemblies
        [14/07/2009 01:09:26] - |HD| - [0] - C:\Program Files\Uninstall Information
        [27/04/2019 23:55:43] - |D| - [174855255] - C:\Program Files\VideoLAN
        [29/10/2018 20:45:35] - |D| - [3861966] - C:\Program Files\Visioneer
        [15/01/2019 20:21:43] - |D| - [23264232] - C:\Program Files\VSTPlugins
        [14/07/2009 01:32:38] - |D| - [4016640] - C:\Program Files\Windows Defender
        [13/07/2009 23:20:08] - |D| - [6602240] - C:\Program Files\Windows Mail
        [14/07/2009 01:32:38] - |D| - [7665069] - C:\Program Files\Windows Media Player
        [13/07/2009 23:20:08] - |D| - [12492468] - C:\Program Files\Windows NT
        [14/07/2009 01:32:38] - |D| - [5492504] - C:\Program Files\Windows Photo Viewer
        [14/07/2009 01:32:38] - |D| - [244736] - C:\Program Files\Windows Portable Devices
        [14/07/2009 01:32:38] - |D| - [7040380] - C:\Program Files\Windows Sidebar

        ---------- | C:\Program Files (x86)\Common Files

        [20/03/2019 21:57:06] - |D| - [461383680] - C:\Program Files (x86)\Common Files\Digidesign
        [26/06/2018 10:01:23] - |D| - [106832389] - C:\Program Files (x86)\Common Files\Intel
        [13/07/2009 23:20:08] - |D| - [201086897] - C:\Program Files (x86)\Common Files\microsoft shared
        [26/06/2018 13:40:28] - |D| - [196972] - C:\Program Files (x86)\Common Files\postureAgent
        [26/06/2018 20:44:47] - |D| - [4780336] - C:\Program Files (x86)\Common Files\PX Storage Engine
        [13/07/2009 23:20:08] - |D| - [2702] - C:\Program Files (x86)\Common Files\Services
        [13/07/2009 23:20:08] - |D| - [41103783] - C:\Program Files (x86)\Common Files\SpeechEngines
        [13/07/2009 23:20:08] - |D| - [10535331] - C:\Program Files (x86)\Common Files\System
        [29/10/2018 20:46:18] - |D| - [27408454] - C:\Program Files (x86)\Common Files\Visioneer
        [20/03/2019 21:57:05] - |D| - [491844096] - C:\Program Files (x86)\Common Files\VST3
        [17/01/2019 20:46:44] - |D| - [48377856] - C:\Program Files (x86)\Common Files\Wise Installation Wizard

        ---------- | C:\Program Files\Common files

        [20/03/2019 21:57:06] - |D| - [571580920] - C:\Program Files\Common files\Avid
        [26/06/2018 13:44:00] - |D| - [49890704] - C:\Program Files\Common files\Intel
        [13/07/2009 23:20:08] - |D| - [70059393] - C:\Program Files\Common files\Microsoft Shared
        [27/06/2018 12:03:12] - |D| - [2081280] - C:\Program Files\Common files\Propellerhead Software
        [13/07/2009 23:20:08] - |D| - [2702] - C:\Program Files\Common files\Services
        [13/07/2009 23:20:08] - |D| - [608768] - C:\Program Files\Common files\SpeechEngines
        [13/07/2009 23:20:08] - |D| - [12145651] - C:\Program Files\Common files\System
        [29/10/2018 20:45:40] - |D| - [28621132] - C:\Program Files\Common files\Visioneer
        [20/03/2019 21:57:05] - |D| - [621798336] - C:\Program Files\Common files\VST3

        ---------- | Tasks

        [MD5.F1A6CD5ADAAB953A6764EA364E17BFB8] - [14/07/2009 01:08:49] - |AH| - [6] - C:\Windows\Tasks\SA.DAT
        [MD5.308D90E72887F9B5246AAF2FB1854666] - [14/07/2009 01:08:49] - |A| - [17164] - C:\Windows\Tasks\SCHEDLGU.TXT
        [MD5.24B1A797A4DC202EF43B0C1FA9FF0181] - [26/06/2018 13:36:59] - |A| - [4208] - C:\Windows\System32\Tasks\Dell

        SupportAssistAgent AutoUpdate : C:\Program Files\Dell\SupportAssistAgent\bin

        \SupportAssistInstaller.exe
        [MD5.5AFF56636FE26F748FF1155056CE6896] - [12/07/2019 13:36:26] - |A| - [3204] - C:\Windows\System32\Tasks

        \GoogleUpdateTaskMachineCore : C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        [MD5.A57909F45AE203BCED744BBF7653EB3C] - [12/07/2019 13:36:26] - |A| - [3332] - C:\Windows\System32\Tasks

        \GoogleUpdateTaskMachineUA : C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
        [MD5.00000000000000000000000000000000] - [13/07/2009 23:20:13] - |D| - [264846] - C:\Windows\System32\Tasks

        \Microsoft
        [MD5.00000000000000000000000000000000] - [27/06/2018 08:30:03] - |D| - [4392] - C:\Windows\System32\Tasks

        \OfficeSoftwareProtectionPlatform
        [MD5.00000000000000000000000000000000] - [14/07/2009 01:09:57] - |D| - [0] - C:\Windows\System32\Tasks\WPD
        [MD5.5CF981DB98F4965F9D8F6377991E9F54] - [01/10/2018 08:40:59] - |A| - [3136] - C:\Windows\System32\Tasks

        {EE1BEB1A-D10C-43A0-9D62-B7BBC4690C0E} : C:\Windows\system32\pcalua.exe
        [MD5.00000000000000000000000000000000] - [13/07/2009 23:20:14] - |D| - [0] - C:\Windows\Syswow64\Tasks

        \Microsoft

        ---------- | Firewall

        [HKLM\SYSTEM\CurrentControlSet\Services\sharedacces s\Parameters\FirewallPolicy\FirewallRules]
        “Netlogon-NamedPipe-In”=v2.10|Action=Allow|Active=FALSE|Dir=In|Protoco l=6|LPort=445|App=System|

        Name=@netlogon.dll,-1003|Desc=@netlogon.dll,-1006|EmbedCtxt=@netlogon.dll,-1010|
        “{C9D920BF-E6BD-40EC-9693-86D8D875A097}”=v2.10|Action=Allow|Active=FALSE|Dir =In|Protocol=6|LPort=808|App=C:

        \Windows\Microsoft.NET\Framework64\v4.0.30319\SMSv cHost.exe|Svc=NetTcpActivator|Name=@C:\Windows

        \Microsoft.NET\Framework64\v4.0.30319\ServiceModel Events.dll,-2000|Desc=@C:\Windows\Microsoft.NET

        \Framework64\v4.0.30319\ServiceModelEvents.dll,-2001|EmbedCtxt=@C:\Windows\Microsoft.NET

        \Framework64\v4.0.30319\ServiceModelEvents.dll,-2002|
        “{DA3FC957-B91F-4B12-B5BC-387B37AEA4A6}”=v2.10|Action=Allow|Active=TRUE|Dir= In|App=C:\Program Files\Intel

        \WiFi\bin\PanDhcpDns.exe|Name=Wireless PAN DHCP Server|EmbedCtxt=MyWiFiDHCPDNS|
        “{1146613B-9846-4149-AAA7-EED5F9DCFA35}”=v2.10|Action=Allow|Active=TRUE|Dir= In|Protocol=6|Profile=Private|

        Profile=Public|App=C:\Program Files (x86)\Winamp\winamp.exe|Name=Winamp|
        “{4EB93D04-534E-4F05-A655-E0F1761C493A}”=v2.10|Action=Allow|Active=TRUE|Dir= In|Protocol=17|Profile=Private|

        Profile=Public|App=C:\Program Files (x86)\Winamp\winamp.exe|Name=Winamp|
        “{DD6A69A7-6F4D-4C94-93A3-EFD897DCD692}”=v2.10|Action=Allow|Active=TRUE|Dir= In|Protocol=6|App=C:\Users

        ********\AppData\Roaming\uTorrent\uTorrent.exe|Nam e=μTorrent (TCP-In)|Desc=Allow μTorrent network traffic

        with Edge Traversal|Edge=TRUE|
        “{D0C21295-8A4D-4AAF-867C-F5606173A37E}”=v2.10|Action=Allow|Active=TRUE|Dir= In|Protocol=17|App=C:\Users

        ********\AppData\Roaming\uTorrent\uTorrent.exe|Nam e=μTorrent (UDP-In)|Desc=Allow μTorrent network traffic

        with Edge Traversal|Edge=TRUE|
        “{43FE1F9D-0162-42B6-B9BC-30E45CEDC654}”=v2.10|Action=Allow|Active=TRUE|Dir= In|Protocol=17|LPort=5353|App=C:

        \Program Files (x86)\Google\Chrome\Application\chrome.exe|Name=Go ogle Chrome (mDNS-In)|Desc=Inbound rule for

        Google Chrome to allow mDNS traffic.|EmbedCtxt=Google Chrome|

        ---------- | Control\Class

        [HKLM\SYSTEM\CurrentControlSet\Control\Class{0475BB 51-5A02-4EE0-B36C-29040FAD2650}] : (igfx) →
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{126476 0F-A5C8-4BFE-B314-D56A7B44A362}] : (DXGKrnl) →
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{24A0C8 40-2C3D-4410-8236-8B40816C7B90}] : (aswVmm) →
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{25DBCE 51-6C8F-4A72-8A6D-B54C2B4FC835}] : (WCEUSBS) → @

        %SystemRoot%\System32\SysClass.Dll,-3026
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{36FC9E 60-C465-11CF-8056-444553540000}] : (USB) → @

        %SystemRoot%\System32\SysClass.Dll,-3025
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4116F6 0B-25B3-4662-B732-99A6111EDC0B}] : (IPMIDRV) →
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{43675D 81-502A-4A82-9F84-B75F418C5DEA}] : (Media Center Extender)

        → @%SystemRoot%\system32\McxDriv.dll,-100
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4658EE 7E-F050-11D1-B6BD-00C04FA372A7}] : (PnpPrinters) → @

        %systemroot%\system32\ntprint.dll,-1300
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{48721B 56-6795-11D2-B1A8-0080C72E74A2}] : (Dot4) → @

        %SystemRoot%\system32\sysclass.dll,-3023
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{49CE6A C8-6F86-11D2-B1E5-0080C72E74A2}] : (Dot4Print) → @

        %SystemRoot%\system32\sysclass.dll,-3024
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 65-E325-11CE-BFC1-08002BE10318}] : (CDROM) → @

        %SystemRoot%\System32\StorProp.dll,-17001
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 66-E325-11CE-BFC1-08002BE10318}] : (Computer) → @

        %SystemRoot%\System32\SysClass.dll,-3000
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 67-E325-11CE-BFC1-08002BE10318}] : (DiskDrive) → @

        %SystemRoot%\System32\StorProp.dll,-17000
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 68-E325-11CE-BFC1-08002BE10318}] : (Display) →

        @DispCI.dll,-3100
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 69-E325-11CE-BFC1-08002BE10318}] : (fdc) → @

        %SystemRoot%\System32\SysClass.Dll,-3013
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 6A-E325-11CE-BFC1-08002BE10318}] : (hdc) → @

        %SystemRoot%\System32\SysClass.Dll,-3001
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 6B-E325-11CE-BFC1-08002BE10318}] : (Keyboard) → @

        %SystemRoot%\System32\SysClass.Dll,-3002
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 6C-E325-11CE-BFC1-08002BE10318}] : (MEDIA) →

        @mmci.dll,-3000
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 6D-E325-11CE-BFC1-08002BE10318}] : (Modem) → @

        %SystemRoot%\System32\mdminst.dll,-14100
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 6E-E325-11CE-BFC1-08002BE10318}] : (Monitor) →

        @Montr_CI.dll,-3100
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 6F-E325-11CE-BFC1-08002BE10318}] : (Mouse) → @

        %SystemRoot%\System32\SysClass.Dll,-3004
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 70-E325-11CE-BFC1-08002BE10318}] : (MTD) →

        @SysClass.Dll,-3021
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 71-E325-11CE-BFC1-08002BE10318}] : (MultiFunction) →

        @%SystemRoot%\System32\SysClass.Dll,-3014
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 72-E325-11CE-BFC1-08002BE10318}] : (Net) →

        @NetCfgx.dll,-1502
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 73-E325-11CE-BFC1-08002BE10318}] : (NetClient) →

        @NetCfgx.dll,-1504
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 74-E325-11CE-BFC1-08002BE10318}] : (NetService) →

        @NetCfgx.dll,-1505
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 75-E325-11CE-BFC1-08002BE10318}] : (NetTrans) →

        @NetCfgx.dll,-1503
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 77-E325-11CE-BFC1-08002BE10318}] : (PCMCIA) → @

        %SystemRoot%\System32\SysClass.Dll,-3010
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 78-E325-11CE-BFC1-08002BE10318}] : (Ports) → @

        %SystemRoot%\System32\msports.dll,-10000
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 79-E325-11CE-BFC1-08002BE10318}] : (Printer) → @

        %systemroot%\system32\ntprint.dll,-1004
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 7B-E325-11CE-BFC1-08002BE10318}] : (SCSIAdapter) → @

        %SystemRoot%\System32\SysClass.Dll,-3005
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 7D-E325-11CE-BFC1-08002BE10318}] : (System) → @

        %SystemRoot%\System32\SysClass.Dll,-3008
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 7E-E325-11CE-BFC1-08002BE10318}] : (Unknown) → @

        %SystemRoot%\System32\SysClass.Dll,-3009
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{4D36E9 80-E325-11CE-BFC1-08002BE10318}] : (FloppyDisk) → @

        %SystemRoot%\System32\SysClass.Dll,-3015
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{50127D C3-0F36-415E-A6CC-4CB3BE910B65}] : (Processor) → @

        %SystemRoot%\system32\procinst.dll,-100
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{50906C B8-BA12-11D1-BF5D-0000F805F530}] : (MultiPortSerial) →

        @%SystemRoot%\system32\sysclass.dll,-3022
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{509994 4A-F6B9-4057-A056-8C550228544C}] : (Memory) → @

        %SystemRoot%\System32\SysClass.Dll,-3018
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{50DD52 30-BA8A-11D1-BF5D-0000F805F530}] : (SmartCardReader) →

        @StorProp.dll,-17002
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{5175D3 34-C371-4806-B3BA-71FD53C9258D}] : (Sensor) → @

        %systemroot%\system32\SensorsCpl.dll,-10000
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{533C5B 84-EC70-11D2-9505-00C04F79DEAF}] : (VolumeSnapshot) →

        @%SystemRoot%\System32\SysClass.Dll,-3011
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{53D29E F7-377C-4D14-864B-EB3A85769359}] : (BiometricDevice) →

        @%SystemRoot%\System32\SysClass.DLL,-3028
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{6BDD1F C1-810F-11D0-BEC7-08002BE2092F}] : (1394) → @

        %SystemRoot%\System32\SysClass.Dll,-3016
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{6BDD1F C5-810F-11D0-BEC7-08002BE2092F}] : (Infrared) →

        @NetCfgx.dll,-1501
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{6BDD1F C6-810F-11D0-BEC7-08002BE2092F}] : (Image) → @

        %systemroot%\system32\sti_ci.dll,-52
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{6D8078 84-7D21-11CF-801C-08002BE10318}] : (TapeDrive) → @

        %SystemRoot%\System32\SysClass.Dll,-3006
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{6FAE73 B7-B735-4B50-A0DA-0DC2484B1F1A}] : (igfx) →
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{71A27C DD-812A-11D0-BEC7-08002BE2092F}] : (Volume) → @

        %SystemRoot%\System32\SysClass.Dll,-3007
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{72631E 54-78A4-11D0-BCF7-00AA00B7B32A}] : (Battery) → @

        %SystemRoot%\system32\batt.dll,-100
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{745A17 A0-74D3-11D0-B6FE-00A0C90F57DA}] : (HIDClass) →

        @hid.dll,-101
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{7EBEFB C0-3200-11D2-B4C2-00A0C9697D07}] : (61883) → @

        %SystemRoot%\System32\SysClass.Dll,-3019
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{8ECC05 5D-047F-11D1-A537-0000F8753ED1}] : (LegacyDriver) → @

        %SystemRoot%\System32\SysClass.Dll,-3003
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{990A2B D7-E738-46C7-B26F-1CF8FB9F1391}] : (SmartCard) →

        @sccls.dll,-300
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{997B5D 8D-C442-4F2E-BAF3-9C8E671E9E21}] : (SideShow) → @

        %systemroot%\system32\AuxiliaryDisplayClassInstall er.dll,-10000
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{A0A588 A4-C46F-4B37-B7EA-C82FE89870C6}] : (SDHost) → @

        %SystemRoot%\System32\SysClass.Dll,-3012
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{A3E32D BA-BA89-4F17-8386-2D0127FBD4CC}] : (rdpbus) →
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{BC1037 02-DD72-406F-9B28-95C868337B59}] : (Transfer Cable) →

        @%SystemRoot%\System32\migwiz\migres.dll,-20
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{C06FF2 65-AE09-48F0-812C-16753D7CBA83}] : (AVC) → @

        %SystemRoot%\System32\SysClass.Dll,-3027
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{CE5939 AE-EBDE-11D0-B181-0000F8753EC4}] : (MediumChanger) →

        @%SystemRoot%\System32\StorProp.dll,-17003
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{D48179 BE-EC20-11D1-B6B8-00C04FA372A7}] : (SBP2) → @

        %SystemRoot%\System32\SysClass.Dll,-3017
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{D61CA3 65-5AF4-4486-998B-9DB4734C6CA3}] : (XnaComposite) → @

        %SystemRoot%\system32\XInput9_1_0.dll,-1000
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{D94EE5 D8-D189-4994-83D2-F68D7D41B0E6}] : (SecurityDevices) →

        @%SystemRoot%\System32\SysClass.Dll,-3020
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{DB4F6D DD-9C0E-45E4-9597-78DBBAD0F412}] : (SmartCardFilter) →

        @sccls.dll,-301
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{E0CBF0 6C-CD8B-4647-BB8A-263B43F0F974}] : (Bluetooth) → @

        %SystemRoot%\system32\bthci.dll,-4001
        [HKLM\SYSTEM\CurrentControlSet\Control\Class{EEC5AD 98-8080-425F-922A-DABF3DE3F69A}] : (WPD) →

        @wpd_ci.dll,-101
        [HKLM\SYSTEM\CurrentControlSet\Control\Els\Services {2D64B439-6CAF-4f6b-B688-E5D0F4FAA7D7}] : (Script

        Detection) [@elscore.dll,-2] → ElsLad.dll (Copyright (c) Microsoft Corporation.)
        [HKLM\SYSTEM\CurrentControlSet\Control\Els\Services {A22D52C1-DBFD-40cb-AE78-E3BA9EE1D88F}] :

        (Transliteration) [@elscore.dll,-5] → elstrans.dll (Copyright (c) Microsoft Corporation.)
        [HKLM\SYSTEM\CurrentControlSet\Control\Els\Services {CF7E00B1-909B-4d95-A8F4-611F7C377702}] : (Language

        Detection) [@elscore.dll,-1] → ElsLad.dll (Copyright (c) Microsoft Corporation.)

        ---------- | Loaded modules (whitelist)

        [26/06/2018 13:44:55] - (8.0.0.395) - (Alps Electric Co., Ltd. - Alps Touch Pad Driver) - C:\Windows

        \system32\DRIVERS\Apfiltr.sys
        [08/05/2018 11:33:24] - (1.4.2.0) - (Dell Inc. - DDDriver.sys) - C:\Windows\system32\drivers

        \DDDriver64Dcsa.sys
        [08/05/2018 11:33:24] - (3.0.1.4) - (Dell Computer Corporation - DellProf.sys) - C:\Windows\system32\drivers

        \DellProf.sys
        [26/06/2018 13:41:19] - (6.10.6491.0) - (IDT, Inc. - IDT PC Audio) - C:\Windows\system32\DRIVERS\stwrt64.sys
        [27/05/2016 08:03:50] - (1.0.0.0) - (LXD Development, Inc. - Gaming Mouse 33052 Driver) - C:\Windows

        \system32\drivers\GMLXDFltr01.sys
        [06/04/2019 14:02:57] - (2.9.30.0) - (Ploytec GmbH - Ploytec USB Audio driver) - C:\Windows\System32\Drivers

        \akaieieu.sys
        [06/04/2019 14:02:57] - (2.9.30.0) - (Numark - Numark WDM MIDI Driver) - C:\Windows\system32\drivers

        \akaieiem.sys
        [06/04/2019 14:02:57] - (2.9.30.0) - (Numark - Numark USB Audio WDM Driver) - C:\Windows\system32\drivers

        \akaieiea.sys
        [// ::] - (0.0.0.0) - ( -) - C:\Users*\AppData\Local\Temp\aswMBR.sys
        [// ::] - (0.0.0.0) - ( -) - C:\Users*
        \AppData\Local\Temp\aswVmm.sys

        ---------- | Services | 0 : Starting up | 1 : System | 2 : Automatic | 3 : Manual | 4 : Disabled | R : Running

        service | S : Stopped service

        R0 - [Kernel Driver] - ACPI (Microsoft ACPI Driver) → system32\drivers\ACPI.sys - AcceptPause: False -

        AcceptStop: True
        R0 - [Kernel Driver] - amdxata () → system32\drivers\amdxata.sys - AcceptPause: False - AcceptStop: True
        R0 - [Kernel Driver] - CLFS (@%SystemRoot%\system32\clfs.sys,-100) → System32\CLFS.sys - AcceptPause: False -

        AcceptStop: True
        R0 - [Kernel Driver] - CNG () → System32\Drivers\cng.sys - AcceptPause: False - AcceptStop: True
        R0 - [Kernel Driver] - Compbatt (Microsoft Composite Battery Driver) → system32\DRIVERS\compbatt.sys -

        AcceptPause: False - AcceptStop: True
        R0 - [Kernel Driver] - Disk (Disk Driver) → system32\drivers\disk.sys - AcceptPause: False - AcceptStop: True
        R0 - [File System Driver] - FileInfo (@%SystemRoot%\system32\drivers\fileinfo.sys,-100) → system32\drivers

        \fileinfo.sys - AcceptPause: False - AcceptStop: True
        R0 - [File System Driver] - FltMgr (@%SystemRoot%\system32\drivers\fltmgr.sys,-10001) → system32\drivers

        \fltmgr.sys - AcceptPause: False - AcceptStop: True
        R0 - [Kernel Driver] - fvevol (@%SystemRoot%\system32\drivers\fvevol.sys,-100) → System32\DRIVERS\fvevol.sys
        • AcceptPause: False - AcceptStop: True
          R0 - [Kernel Driver] - hwpolicy (@%systemroot%\system32\drivers\hwpolicy.sys,-101) → System32\drivers

        \hwpolicy.sys - AcceptPause: False - AcceptStop: True
        R0 - [Kernel Driver] - iaStorV (Intel RAID Controller Windows 7) → system32\drivers\iaStorV.sys -

        AcceptPause: False - AcceptStop: True
        R0 - [Kernel Driver] - KSecDD () → System32\Drivers\ksecdd.sys - AcceptPause: False - AcceptStop: True
        R0 - [Kernel Driver] - KSecPkg () → System32\Drivers\ksecpkg.sys - AcceptPause: False - AcceptStop: True
        R0 - [Kernel Driver] - mountmgr (@%SystemRoot%\system32\drivers\mountmgr.sys,-100) → System32\drivers

        \mountmgr.sys - AcceptPause: False - AcceptStop: True
        R0 - [Kernel Driver] - msisadrv () → system32\drivers\msisadrv.sys - AcceptPause: False - AcceptStop: True
        R0 - [File System Driver] - Mup (@%systemroot%\system32\drivers\mup.sys,-101) → System32\Drivers\mup.sys -

        AcceptPause: False - AcceptStop: True
        R0 - [Kernel Driver] - NDIS (@%SystemRoot%\system32\drivers\ndis.sys,-200) → system32\drivers\ndis.sys -

        AcceptPause: False - AcceptStop: True
        R0 - [Kernel Driver] - partmgr (@%SystemRoot%\system32\drivers\partmgr.sys,-100) → System32\drivers

        \partmgr.sys - AcceptPause: False - AcceptStop: True
        R0 - [Kernel Driver] - pci (PCI Bus Driver) → system32\drivers\pci.sys - AcceptPause: False - AcceptStop:

        True
        R0 - [Kernel Driver] - pcw (Performance Counters for Windows Driver) → System32\drivers\pcw.sys -

        AcceptPause: False - AcceptStop: True
        R0 - [Kernel Driver] - rdyboost (ReadyBoost) → System32\drivers\rdyboost.sys - AcceptPause: False -

        AcceptStop: True
        R0 - [Kernel Driver] - spldr (Security Processor Loader Driver) → (?) - AcceptPause: False - AcceptStop: True
        R0 - [Kernel Driver] - storflt (@%SystemRoot%\system32\vmstorfltres.dll,-1000) → system32\drivers

        \vmstorfl.sys - AcceptPause: False - AcceptStop: True
        R0 - [Kernel Driver] - Tcpip (@%SystemRoot%\system32\tcpipcfg.dll,-50003) → System32\drivers\tcpip.sys -

        AcceptPause: False - AcceptStop: True
        R0 - [Kernel Driver] - vdrvroot (Microsoft Virtual Drive Enumerator Driver) → system32\drivers\vdrvroot.sys -

        AcceptPause: False - AcceptStop: True
        R0 - [Kernel Driver] - volmgr (Volume Manager Driver) → system32\drivers\volmgr.sys - AcceptPause: False -

        AcceptStop: True
        R0 - [Kernel Driver] - volmgrx (@%SystemRoot%\system32\drivers\volmgrx.sys,-100) → System32\drivers

        \volmgrx.sys - AcceptPause: False - AcceptStop: True
        R0 - [Kernel Driver] - volsnap (Storage volumes) → system32\drivers\volsnap.sys - AcceptPause: False -

        AcceptStop: True
        R0 - [Kernel Driver] - Wdf01000 (@%SystemRoot%\system32\drivers\Wdf01000.sys,-1000) → system32\drivers

        \Wdf01000.sys - AcceptPause: False - AcceptStop: True
        R1 - [Kernel Driver] - AFD (@%systemroot%\system32\drivers\afd.sys,-1000) → \SystemRoot\system32\drivers

        \afd.sys - AcceptPause: False - AcceptStop: True
        R1 - [Kernel Driver] - Beep (Beep) → (?) - AcceptPause: False - AcceptStop: True
        R1 - [Kernel Driver] - blbdrive () → system32\DRIVERS\blbdrive.sys - AcceptPause: False - AcceptStop: True
        R1 - [Kernel Driver] - cdrom (CD-ROM Driver) → system32\DRIVERS\cdrom.sys - AcceptPause: False - AcceptStop:

        True
        R1 - [Kernel Driver] - CSC (@%systemroot%\system32\cscsvc.dll,-202) → system32\drivers\csc.sys - AcceptPause:

        False - AcceptStop: True
        R1 - [File System Driver] - DfsC (@%systemroot%\system32\drivers\dfsc.sys,-101) → System32\Drivers\dfsc.sys -

        AcceptPause: False - AcceptStop: True
        R1 - [Kernel Driver] - discache (@%systemroot%\system32\drivers\discache.sys,-102) → System32\drivers

        \discache.sys - AcceptPause: False - AcceptStop: True
        R1 - [File System Driver] - Msfs () → (?) - AcceptPause: False - AcceptStop: True
        R1 - [Kernel Driver] - mssmbios (Microsoft System Management BIOS Driver) → \SystemRoot\system32\drivers

        \mssmbios.sys - AcceptPause: False - AcceptStop: True
        R1 - [File System Driver] - NetBIOS (NetBIOS Interface) → system32\DRIVERS\netbios.sys - AcceptPause: False -

        AcceptStop: True
        R1 - [Kernel Driver] - NetBT (@%SystemRoot%\system32\drivers\netbt.sys,-2) → System32\DRIVERS\netbt.sys -

        AcceptPause: False - AcceptStop: True
        R1 - [File System Driver] - Npfs () → (?) - AcceptPause: False - AcceptStop: True
        R1 - [Kernel Driver] - nsiproxy (@%SystemRoot%\system32\drivers\nsiproxy.sys,-2) → system32\drivers

        \nsiproxy.sys - AcceptPause: False - AcceptStop: True
        R1 - [Kernel Driver] - Null () → (?) - AcceptPause: False - AcceptStop: True
        R1 - [Kernel Driver] - Psched (@%SystemRoot%\System32\drivers\pacer.sys,-101) → system32\DRIVERS\pacer.sys -

        AcceptPause: False - AcceptStop: True
        R1 - [File System Driver] - rdbss (@%systemroot%\system32\wkssvc.dll,-1000) → system32\DRIVERS\rdbss.sys -

        AcceptPause: False - AcceptStop: True
        R1 - [Kernel Driver] - RDPCDD (@%systemroot%\system32\DRIVERS\RDPCDD.sys,-100) → System32\DRIVERS\RDPCDD.sys
        • AcceptPause: False - AcceptStop: True
          R1 - [Kernel Driver] - RDPENCDD (@%systemroot%\system32\drivers\RDPENCDD.sys,-101) → system32\drivers

        \rdpencdd.sys - AcceptPause: False - AcceptStop: True
        R1 - [Kernel Driver] - RDPREFMP (@%systemroot%\system32\drivers\RdpRefMp.sys,-101) → system32\drivers

        \rdprefmp.sys - AcceptPause: False - AcceptStop: True
        R1 - [Kernel Driver] - Serial (Serial port driver) → system32\DRIVERS\serial.sys - AcceptPause: False -

        AcceptStop: True
        R1 - [Kernel Driver] - tdx (@%SystemRoot%\system32\tcpipcfg.dll,-50004) → system32\DRIVERS\tdx.sys -

        AcceptPause: False - AcceptStop: True
        R1 - [Kernel Driver] - TermDD (Terminal Device Driver) → \SystemRoot\system32\drivers\termdd.sys -

        AcceptPause: False - AcceptStop: True
        R1 - [Kernel Driver] - VgaSave () → \SystemRoot\System32\drivers\vga.sys - AcceptPause: False - AcceptStop:

        True
        R1 - [Kernel Driver] - vwififlt (Virtual WiFi Filter Driver) → system32\DRIVERS\vwififlt.sys - AcceptPause:

        False - AcceptStop: True
        R1 - [Kernel Driver] - Wanarpv6 (@%systemroot%\system32\rascfg.dll,-32012) → system32\DRIVERS\wanarp.sys -

        AcceptPause: False - AcceptStop: True
        R1 - [Kernel Driver] - WfpLwf (WFP Lightweight Filter) → system32\DRIVERS\wfplwf.sys - AcceptPause: False -

        AcceptStop: True
        R2 - [Kernel Driver] - lltdio (Link-Layer Topology Discovery Mapper I/O Driver) → system32\DRIVERS\lltdio.sys
        • AcceptPause: False - AcceptStop: True
          R2 - [File System Driver] - luafv (@%systemroot%\system32\drivers\luafv.sys,-100) → \SystemRoot

        \system32\drivers\luafv.sys - AcceptPause: False - AcceptStop: True
        R2 - [Kernel Driver] - PEAUTH (PEAUTH) → system32\drivers\peauth.sys - AcceptPause: False - AcceptStop: True
        R2 - [Kernel Driver] - rspndr (Link-Layer Topology Discovery Responder) → system32\DRIVERS\rspndr.sys -

        AcceptPause: False - AcceptStop: True
        R2 - [Kernel Driver] - tcpipreg (TCP/IP Registry Compatibility) → System32\drivers\tcpipreg.sys -

        AcceptPause: False - AcceptStop: True

        ---------- | System files (Microsoft|Avast|Atheros|Adaptec|Brother|Intel Files whitelisted)

        [MD5.9FC9C4753876A96C7DEE2E7FF8911294] - [20/03/2003 09:48:00] - (.Copyright (c) GEAR Software 2003 - Filter

        Driver for 2k and XP.) - [9.22 Ko] - (1.0.2.3) - C:\Windows\Syswow64\Drivers\GEARAspiWDM.sys

        ---------- | Uninstall (Whitelist)

        [HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall\AddressBook] : (.-.) →
        ----------[{Hidden}][HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall\Connection Manager] : (.-.) →
        [HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall\DirectDrawEx] : (.-.) →
        [HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall\DXM_Runtime] : (.-.) →
        [HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall\Fontcore] : (.-.) →
        [HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall\IE40] : (.-.) →
        [HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall\IE4Data] : (.-.) →
        [HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall\IE5BAKEX] : (.-.) →
        [HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall\IEData] : (.-.) →
        [HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall\MobileOptionPack] : (.-.) →
        [HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall\MPlayer2] : (.-.) →
        [HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall\PROSet] : (Intel(R) Network Connections

        Drivers.-.Intel) → Prounstl.exe
        [HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall\Reason10.0Stable_64_is1] : (Reason 10

        10.4.0d4.-.Propellerhead Software AB) → "C:\Program Files\Propellerhead\Reason 10\Uninstall Reason

        10\unins000.exe"
        [HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall\Reason8.0Stable_64_is1] : (Reason 8

        8.3.2d7.-.Propellerhead Software AB) → "C:\Program Files\Propellerhead\Reason 8\Uninstall Reason

        8\unins000.exe"
        [HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall\SchedulingAgent] : (.-.) →
        [HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall\USB_AUDIO_DEusb-audio.deAkaiEIE] : (Akai EIE Pro USB

        Audio driver.-.) → C:\Windows\usb-audio.deAkaiEIE\Setup.exe /l1
        [HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall\WIC] : (.-.) →
        [HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall{23170F69-40C1-2702-1805-000001000000}] : (7-Zip

        18.05 (x64 edition).-.Igor Pavlov) → MsiExec.exe /I{23170F69-40C1-2702-1805-000001000000}
        [HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall{45B3032F-22CC-40CD-9E97-4DA7095FA5A2}] : (PuTTY

        release 0.70 (64-bit).-.Simon Tatham) → MsiExec.exe /X{45B3032F-22CC-40CD-9E97-4DA7095FA5A2}
        ----------[{Hidden}][HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall{73ca1ddf-9d19-45f2-ad4c-

        04169ec13342}] : (Intel(R) PRO/Wireless Driver.-.Intel Corporation) →
        [HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall{806422F1-FC4E-4D7C-8855-05748AEFC031}] : (Dell

        SupportAssist.-.Dell Inc.) → MsiExec.exe /X{806422F1-FC4E-4D7C-8855-05748AEFC031}
        ----------[{Hidden}][HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall{9C481E27-751F-48B9-801D-

        C583F032DA50}] : (Intel® PROSet/Wireless WiFi Software.-.Intel Corporation) → MsiExec.exe /I{9C481E27-751F-

        48B9-801D-C583F032DA50}
        ----------[{Hidden}][HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall{B5E06417-A4AC-4225-B36E-

        7E34C91616E7}] : (Intel® Trusted Connect Service Client.-.Intel Corporation) → MsiExec.exe /I{B5E06417-A4AC-

        4225-B36E-7E34C91616E7}
        ----------[{Hidden}][HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall{BE1CF6CA-3182-45D8-9535-

        A18055B73607}] : (Dell Custom Help.-.Intel Corporation) →
        [HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uni nstall{F6762963-9AE5-4bc6-A70F-2D749F6AC02F}_is1] :

        (Authorizer 2.9.5d1.-.Propellerhead Software AB) → "C:\Program Files\Propellerhead\Authorizer\Uninstall

        Authorizer\unins000.exe"
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\Curren tVersion\Uninstall\AddressBook] : (.-.) →
        ----------[{Hidden}][HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\Curren tVersion\Uninstall\Connection Manager]

        : (.-.) →
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\Curren tVersion\Uninstall\DirectDrawEx] : (.-.) →
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\Curren tVersion\Uninstall\Fontcore] : (.-.) →
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\Curren tVersion\Uninstall\IE40] : (.-.) →
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\Curren tVersion\Uninstall\IE4Data] : (.-.) →
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\Curren tVersion\Uninstall\IE5BAKEX] : (.-.) →
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\Curren tVersion\Uninstall\IEData] : (.-.) →
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\Curren tVersion\Uninstall\Line 6 Uninstaller] : (Line 6

        Uninstaller.-.Line 6) → C:\Users********\AppData\Roaming\Line 6\L6TWXY\Tools\Line 6 Uninstaller.exe
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\Curren tVersion\Uninstall\MobileOptionPack] : (.-.) →
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\Curren tVersion\Uninstall\Neutron 2] : (Neutron 2

        Advanced.-.iZotope, Inc.) → C:\Program Files (x86)\iZotope\Neutron 2\Uninstall Neutron 2.exe
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\Curren tVersion\Uninstall\Ozone 8] : (Ozone 8 Advanced.-.iZotope,

        Inc.) → C:\VSTs\iZotope\Ozone 8\Uninstall Ozone 8.exe
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\Curren tVersion\Uninstall\SchedulingAgent] : (.-.) →
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\Curren tVersion\Uninstall\WIC] : (.-.) →
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\Curren tVersion\Uninstall{24D75A2D-A712-42F7-B71B-2FFF95905C97}

        _is1] : (Europa by Reason.-.Propellerhead Software) → "C:\Users********\AppData\Roaming\Propellerhea d

        Software\Europa by Reason\unins000.exe"
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\Curren tVersion\Uninstall{4920CF11-4A79-4D8D-B643-58E0611FC106}]

        : (MixMeister Pro 5.-.MixMeister Technology LLC) → MsiExec.exe /I{4920CF11-4A79-4D8D-B643-58E0611FC106}
        ----------[{Hidden}][HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\Curren tVersion\Uninstall{60EC980A-BDA2-4CB6

        -A427-B07A5498B4CA}] : (Google Update Helper.-.Google LLC) → MsiExec.exe /I{60EC980A-BDA2-4CB6-A427-

        B07A5498B4CA}
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\Curren tVersion\Uninstall{88374377-FCCE-498B-AD19-D72D755F0D46}]

        : (Visioneer RoadWarrior 3 Series Driver.-.Visioneer Inc.) → MsiExec.exe /I{88374377-FCCE-498B-AD19-

        D72D755F0D46}
        [HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\Curren tVersion\Uninstall{AAF91E62-A45B-489B-9C98-3E8C06EBB74F}]

        : (Visioneer Acuity Assets V1.-.Visioneer Inc.) → MsiExec.exe /I{AAF91E62-A45B-489B-9C98-3E8C06EBB74F}

        ---------- | Ports

        ---------- | Installer

        [HKCR\Installer\Products\11FC029497A4D8D46B34850E16 F11C60] : MixMeister Pro 5
        [HKCR\Installer\Products\1F224608E4CFC7D488555047A8 FE0C13] : Dell SupportAssist → C:\Windows\Installer

        {806422F1-FC4E-4D7C-8855-05748AEFC031}\ARPPRODUCTICON.exe
        [HKCR\Installer\Products\26E19FAAB54AB984C989E3C860 BE7BF4] : Visioneer Acuity Assets V1 → C:\Windows

        \Installer{AAF91E62-A45B-489B-9C98-3E8C06EBB74F}_6FEFF9B68218417F98F549.exe
        [HKCR\Installer\Products\71460E5BCA4A52243BE6E7439C 61617E] : Intel® Trusted Connect Service Client
        [HKCR\Installer\Products\72E184C9F1579B8408D15C380F 23AD05] : Intel® PROSet/Wireless WiFi Software → C:

        \Windows\Installer{9C481E27-751F-48B9-801D-C583F032DA50}\ARPPRODUCTICON.exe
        [HKCR\Installer\Products\77347388ECCFB894DA917DD257 F5D064] : Visioneer RoadWarrior 3 Series Driver → C:

        \Windows\Installer{88374377-FCCE-498B-AD19-D72D755F0D46}_RWAR3ICON
        [HKCR\Installer\Products\96F071321C0420728150000010 000000] : 7-Zip 18.05 (x64 edition)
        [HKCR\Installer\Products\A089CE062ADB6BC44A720BA745 894BAC] : Google Update Helper
        [HKCR\Installer\Products\AC6FC1EB28138D5459531A0855 7B6370] : Dell Custom Help → C:\Windows\Installer

        {BE1CF6CA-3182-45D8-9535-A18055B73607}\ARPPRODUCTICON.exe
        [HKCR\Installer\Products\F2303B54CC22DC04E979D47A90 F55A2A] : PuTTY release 0.70 (64-bit) → C:\Windows

        \Installer{45B3032F-22CC-40CD-9E97-4DA7095FA5A2}\installericon.exe
        [HKCR\Installer\Products\FDD1AC3791D92F54DAC44061E9 1C3324] : Intel(R) PRO/Wireless Driver → C:\Windows

        \Installer{73CA1DDF-9D19-45F2-AD4C-04169EC13342}\ARPPRODUCTICON.exe

        ---------- | Drives

        ---------- | MBR

        64 bits not supported by MBR.exe, Dump : C:\QuickDiag\MBR.Bin

        ---------- | 20 La********ntLog

        Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

        “Win32_Processor” AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

        “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem
        [HEADING=1]is corrected.[/HEADING]
        Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

        “Win32_Processor” AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

        “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem
        [HEADING=1]is corrected.[/HEADING]
        Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

        “Win32_Processor” AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

        “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem
        [HEADING=1]is corrected.[/HEADING]
        Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

        “Win32_Processor” AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

        “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem
        [HEADING=1]is corrected.[/HEADING]
        Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

        “Win32_Processor” AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

        “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem
        [HEADING=1]is corrected.[/HEADING]
        Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

        “Win32_Processor” AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

        “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem
        [HEADING=1]is corrected.[/HEADING]
        Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

        “Win32_Processor” AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

        “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem
        [HEADING=1]is corrected.[/HEADING]
        Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

        “Win32_Processor” AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

        “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem
        [HEADING=1]is corrected.[/HEADING]
        Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

        “Win32_Processor” AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

        “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem
        [HEADING=1]is corrected.[/HEADING]




        Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

        “Win32_Processor” AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

        “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem
        [HEADING=1]is corrected.[/HEADING]
        Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

        “Win32_Processor” AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

        “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem
        [HEADING=1]is corrected.[/HEADING]
        An exception occurred in session change of service start: System.Reflection.TargetInvocationException:

        Exception has been thrown by the target of an invocation. —> System.TypeLoadException: Could not find

        Windows Runtime type ‘Windows.UI.Notifications.ToastNotificationManager ’. —>

        System.PlatformNotSupportedException: Operation is not supported on this platform.
        — End of inner exception stack trace —
        at

        Dell.Services.SupportAssist.Notification.Command.N otificationCommand.d__23.M

        oveNext()
        at System.Runtime.CompilerServices.AsyncTaskMethodBui lder.Start[TStateMachine](TStateMachine& stateMachine)
        at Dell.Services.SupportAssist.Notification.Command.N otificationCommand.DeleteNotificationWhileUninstal l()
        at Dell.Services.SupportAssist.Notification.Command.N otificationCommand.ShowNotificationsOnSessionUnloc k

        (SessionChangeDescription changeDescription)
        — End of inner exception stack trace —
        at System.RuntimeMethodHandle.InvokeMethod(Object target, Object arguments, Signature sig, Boolean

        constructor)
        at System.Reflection.RuntimeMethodInfo.UnsafeInvokeIn ternal(Object obj, Object parameters, Object

        arguments)
        at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object

        parameters, CultureInfo culture)
        at Dell.Services.SupportAssist.SupportAssistAgent.Boo tStrapperMinimized.SessionChangeAction

        (SessionChangeDescription changeDescription)
        at Dell.Services.SupportAssist.SupportAssistAgent.Sup portAssistAgent.OnSessionChange
        [HEADING=1](SessionChangeDescription changeDescription)[/HEADING]
        Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

        “Win32_Processor” AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

        “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem
        [HEADING=1]is corrected.[/HEADING]
        Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

        “Win32_Processor” AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

        “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem
        [HEADING=1]is corrected.[/HEADING]
        Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

        “Win32_Processor” AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

        “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem
        [HEADING=1]is corrected.[/HEADING]
        [HEADING=1]Faulting application name: wmiprvse.exe, version: 6.1.7601.17514, time stamp: 0x4ce79d42
        Faulting module name: WINTRUST.dll, version: 6.1.7601.23971, time stamp: 0x5a26d97f
        Exception code: 0xc0000005
        Fault offset: 0x000000000000a8ea
        Faulting process id: 0xaa8
        Faulting application start time: 0x01d51ee7b4e3a1e7
        Faulting application path: C:\Windows\system32\wbem\wmiprvse.exe
        Faulting module path: C:\Windows\system32\WINTRUST.dll
        Report Id: c8af1667-8c90-11e9-bb6e-b8ca3ad5e05a[/HEADING]
        Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

        “Win32_Processor” AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

        “//./root/CIMV2” because of error 0x80041003. Events cannot be delivered through this filter until the problem
        [HEADING=1]is corrected.[/HEADING]
        ----------( EOF)---------- - 3076 | 10:41:58

        Comment

        • Malnutrition
          PCHF Moderator
          • Jul 2016
          • 7045

          #5
          Make sure and add your user name to this fix, where it is needed.

          Download attached fixlist.txt file and save it to the Desktop. NOTE. It’s important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system. Run FRST/FRST64 and press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

          Comment

          • Malnutrition
            PCHF Moderator
            • Jul 2016
            • 7045

            #6
            The way you broke the log up to edit your name makes it difficult to read…

            What is in these folders??

            C:\Windows\1f8bf2vui4tpp8w
            C:\Windows\2e2uf4b4q8p2kci
            C:\Windows\4cwyf4jbcce5n1p
            C:\Windows\4cwyfyv7x1w5n1p
            C:\Windows\5b4wf2e7p2v8qio
            C:\Windows\5b4wf4c8n5s1jta
            C:\Windows\5b4wf4poy2v8qio
            C:\Windows\5b4wf7y1l7q8qio
            C:\Windows\5b4wffx8w5s1jta
            C:\Windows\5b4wfyn5s5s1jta

            Comment

            • Fla_Panther
              PCHF Member
              • Sep 2016
              • 38

              #7
              Those are 1kb hidden files, containing non-human-readable characters.
              Not sure how Find & Replace is breaking the logs … it should just be converting only the relevant characters, not adding any line breaks.
              [HEADING=1]Fix result of Farbar Recovery Scan Tool (x64) Version: 15-07-2019 01
              Ran by ******** (15-07-2019 12:07:29) Run:1
              Running from C:\Users********\Desktop
              Loaded Profiles: ******** (Available Profiles: ********)
              Boot Mode: Normal[/HEADING]
              fixlist content:


              Start
              Closeprocesses:
              CreateRestorePoint:
              Emptytemp:
              RemoveProxy:
              FirewallRules: [{DD6A69A7-6F4D-4C94-93A3-EFD897DCD692}] => (Allow) C:\Users*\AppData\Roaming\uTorrent\uTorrent.exe No File
              FirewallRules: [{D0C21295-8A4D-4AAF-867C-F5606173A37E}] => (Allow) C:\Users*
              \AppData\Roaming\uTorrent\uTorrent.exe No File
              HKU\S-1-5-21-3206243102-205974907-2145499838-1000...\MountPoints2: {a08823cb-795d-11e8-b725-e41f28566541} - E:\RTK_NIC_DRIVER_INSTALLER.sfx.exe
              Task: {D67DBDCB-4494-4132-A263-D7274A930236} - System32\Tasks{EE1BEB1A-D10C-43A0-9D62-B7BBC4690C0E} => C:\Windows\system32\pcalua.exe -a C:\Users*\Desktop\out_lame.binf_v164.exe -d C:\Users*\Desktop
              Task: {F3CA5017-53C0-47CD-A21A-E197090FB41D} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistIns taller.exe [1512920 2019-05-24] (Dell Inc. → Dell Inc.)
              Tcpip\Parameters: [DhcpNameServer] 209.18.47.62 209.18.47.61
              Tcpip..\Interfaces{F1ABA7E1-57DC-49E4-8FA4-8A72EEFAFE0B}: [DhcpNameServer] 209.18.47.62 209.18.47.61
              HKLM\System...\Parameters\PersistentRoutes: [0.0.0.0,0.0.0.0,192.168.0.201,-1]
              HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.dell.com/
              HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
              FF Plugin: @microsoft.com/GENUINE → disabled [No File]
              FF Plugin-x32: @microsoft.com/GENUINE → disabled [No File]
              C:\Users*\AppData\Local*.
              C:\Users*
              \AppData\Roaming*.
              ContextMenuHandlers5: [igfxcui] → {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => → No File
              C:\Windows\system32\drivers\etc\hosts
              hosts:
              StartBatch:
              ipconfig /flushdns
              netsh advfirewall reset
              net stop Hamachi2Svc
              net stop HiPatchService
              net stop DDVRulesProcessor
              net stop Dell Hardware Support
              net stop SupportAssistAgent
              net stop WinDefend
              sc config “Hamachi2Svc” start= demand
              sc config “HiPatchService” start= demand
              sc config DDVRulesProcessor start= demand
              sc config Dell Hardware Support start= demand
              sc config SupportAssistAgent= demand
              sc config Windefend= demand
              dir /a C:\temp
              dir /a “C:\Program Files\Common Files\AV”
              dir /a C:\Users???\AppData\Roaming
              dir /a C:\Users???\AppData\Local
              EndBatch:
              Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Pol icy\Local /f
              Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Pol icy\Local /f
              CMD: netsh advfirewall reset
              CMD: netsh advfirewall set allprofiles state ON
              CMD: ipconfig /flushdns
              CMD: netsh winsock reset catalog
              CMD: netsh int ip reset c:\resetlog.txt
              CMD: ipconfig /release
              CMD: ipconfig /renew
              CMD: netsh int ipv4 reset
              CMD: netsh int ipv6 reset
              CMD: bitsadmin /reset /allusers
              EmptyTemp:
              reboot:
              end


              Processes closed successfully.
              Restore point was successfully created.

              ========= RemoveProxy: =========

              “HKU.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVer sion\Internet Settings\Connections\DefaultConnectionSettings” => removed successfully
              “HKU.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVer sion\Internet Settings\Connections\SavedLegacySettings” => removed successfully
              “HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Int ernet Settings\Connections\DefaultConnectionSettings” => removed successfully
              “HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Int ernet Settings\Connections\SavedLegacySettings” => removed successfully

              ========= End of RemoveProxy: =========

              “HKLM\SYSTEM\CurrentControlSet\services\SharedAcce ss\Parameters\FirewallPolicy\FirewallRules\{DD6A69 A7-6F4D-4C94-93A3-EFD897DCD692}” => removed successfully
              “HKLM\SYSTEM\CurrentControlSet\services\SharedAcce ss\Parameters\FirewallPolicy\FirewallRules\{D0C212 95-8A4D-4AAF-867C-F5606173A37E}” => removed successfully
              HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Exp lorer\MountPoints2{a08823cb-795d-11e8-b725-e41f28566541} => removed successfully
              HKLM\Software\Classes\CLSID{a08823cb-795d-11e8-b725-e41f28566541} => not found
              “HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain{D67DBDC B-4494-4132-A263-D7274A930236}” => removed successfully
              “HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{D67DBDC B-4494-4132-A263-D7274A930236}” => removed successfully
              C:\Windows\System32\Tasks{EE1BEB1A-D10C-43A0-9D62-B7BBC4690C0E} => moved successfully
              “HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree{EE1BEB1A-D10C-43A0-9D62-B7BBC4690C0E}” => removed successfully
              “HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain{F3CA501 7-53C0-47CD-A21A-E197090FB41D}” => removed successfully
              “HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks{F3CA501 7-53C0-47CD-A21A-E197090FB41D}” => removed successfully
              C:\Windows\System32\Tasks\Dell SupportAssistAgent AutoUpdate => moved successfully
              “HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Dell SupportAssistAgent AutoUpdate” => removed successfully
              “HKLM\System\CurrentControlSet\Services\Tcpip\Para meters\DhcpNameServer” => removed successfully
              “HKLM\System\CurrentControlSet\Services\Tcpip\Para meters\Interfaces{F1ABA7E1-57DC-49E4-8FA4-8A72EEFAFE0B}\DhcpNameServer” => removed successfully
              “HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Para meters\PersistentRoutes\0.0.0.0,0.0.0.0,192.168.0. 201,-1” => removed successfully
              HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Internet Explorer\Main\Start Page => value restored successfully
              HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL => value restored successfully
              HKLM\Software\MozillaPlugins@microsoft.com/GENUINE => removed successfully
              HKLM\Software\Wow6432Node\MozillaPlugins@microsoft.com/GENUINE => removed successfully

              =========== “C:\Users*******\AppData\Local*.” ==========

              C:\Users*\AppData\Local\GDIPFONTCACHEV1.DAT => moved successfully
              C:\Users*
              \AppData\Local\IconCache.db => moved successfully
              C:\Users********\AppData\Local\PUTTY.RND => moved successfully

              ========= End → “C:\Users*******\AppData\Local*.” ========

              =========== “C:\Users*******\AppData\Roaming*.” ==========

              not found

              ========= End → “C:\Users*******\AppData\Roaming*.” ========

              HKLM\Software\Classes\Directory\Background\ShellEx \ContextMenuHandlers\igfxcui => removed successfully
              HKLM\Software\Classes\CLSID{3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => not found
              C:\Windows\system32\drivers\etc\hosts => moved successfully
              Hosts restored successfully.

              ========= Batch: =========

              Windows IP Configuration

              Successfully flushed the DNS Resolver Cache.
              Ok.

              The service name is invalid.

              More help is available by typing NET HELPMSG 2185.

              The service name is invalid.

              More help is available by typing NET HELPMSG 2185.

              The Dell Data Vault Processor service is not started.

              More help is available by typing NET HELPMSG 3521.

              The syntax of this command is:

              NET STOP
              service

              The Dell SupportAssist service is not started.

              More help is available by typing NET HELPMSG 3521.

              ..
              The Windows Defender service was stopped successfully.

              [SC] OpenService FAILED 1060:

              The specified service does not exist as an installed service.

              [SC] OpenService FAILED 1060:

              The specified service does not exist as an installed service.

              [SC] ChangeServiceConfig SUCCESS
              DESCRIPTION:
              Modifies a service entry in the registry and Service Database.
              USAGE:
              sc config [service name] …

              OPTIONS:
              NOTE: The option name includes the equal sign.
              A space is required between the equal sign and the value.
              type= <own|share|interact|kernel|filesys|rec|adapt>
              start= <boot|system|auto|demand|disabled|delayed-auto>
              error= <normal|severe|critical|ignore>
              binPath=
              group=
              tag= <yes|no>
              depend= <Dependencies(separated by / (forward slash))>
              obj= <AccountName|ObjectName>
              DisplayName=
              password=
              DESCRIPTION:
              Modifies a service entry in the registry and Service Database.
              USAGE:
              sc config [service name] …

              OPTIONS:
              NOTE: The option name includes the equal sign.
              A space is required between the equal sign and the value.
              type= <own|share|interact|kernel|filesys|rec|adapt>
              start= <boot|system|auto|demand|disabled|delayed-auto>
              error= <normal|severe|critical|ignore>
              binPath=
              group=
              tag= <yes|no>
              depend= <Dependencies(separated by / (forward slash))>
              obj= <AccountName|ObjectName>
              DisplayName=
              password=
              DESCRIPTION:
              Modifies a service entry in the registry and Service Database.
              USAGE:
              sc config [service name] …

              OPTIONS:
              NOTE: The option name includes the equal sign.
              A space is required between the equal sign and the value.
              type= <own|share|interact|kernel|filesys|rec|adapt>
              start= <boot|system|auto|demand|disabled|delayed-auto>
              error= <normal|severe|critical|ignore>
              binPath=
              group=
              tag= <yes|no>
              depend= <Dependencies(separated by / (forward slash))>
              obj= <AccountName|ObjectName>
              DisplayName=
              password=
              Volume in drive C has no label.
              Volume Serial Number is B62F-E83E

              Directory of C:\temp

              10/29/2018 08:46 PM .
              10/29/2018 08:46 PM ..
              0 File(s) 0 bytes
              2 Dir(s) 25,897,353,216 bytes free
              Volume in drive C has no label.
              Volume Serial Number is B62F-E83E

              Directory of C:\Program Files\Common Files

              File Not Found
              The filename, directory name, or volume label syntax is incorrect.
              The filename, directory name, or volume label syntax is incorrect.

              ========= End of Batch: =========

              ========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Pol icy\Local /f =========

              The operation completed successfully.

              ========= End of Reg: =========

              ========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Pol icy\Local /f =========

              The operation completed successfully.

              ========= End of Reg: =========

              ========= netsh advfirewall reset =========

              Ok.

              ========= End of CMD: =========

              ========= netsh advfirewall set allprofiles state ON =========

              Ok.

              ========= End of CMD: =========

              ========= ipconfig /flushdns =========

              Windows IP Configuration

              Successfully flushed the DNS Resolver Cache.

              ========= End of CMD: =========

              ========= netsh winsock reset catalog =========

              Sucessfully reset the Winsock Catalog.
              You must restart the computer in order to complete the reset.

              ========= End of CMD: =========

              ========= netsh int ip reset c:\resetlog.txt =========

              Reseting Global, OK!
              Reseting Interface, OK!
              Reseting Unicast Address, OK!
              Reseting Route, OK!
              Reseting Subinterface, OK!
              Restart the computer to complete this action.

              ========= End of CMD: =========

              ========= ipconfig /release =========

              Windows IP Configuration

              No operation can be performed on Wireless Network Connection 3 while it has its media disconnected.
              No operation can be performed on Wireless Network Connection 2 while it has its media disconnected.

              Wireless LAN adapter Wireless Network Connection 3:

              Media State . . . . . . . . . . . : Media disconnected
              Connection-specific DNS Suffix . :

              Wireless LAN adapter Wireless Network Connection 2:

              Media State . . . . . . . . . . . : Media disconnected
              Connection-specific DNS Suffix . :

              Wireless LAN adapter Wireless Network Connection:

              Connection-specific DNS Suffix . :
              IPv6 Address. . . . . . . . . . . : ::808b:ac54:2e88:6506
              Temporary IPv6 Address. . . . . . : ::d039:672f:5fd9:d29a
              Link-local IPv6 Address . . . . . : fe80::808b:ac54:2e88:6506%14
              Default Gateway . . . . . . . . . :

              Ethernet adapter Local Area Connection 2:

              Media State . . . . . . . . . . . : Media disconnected
              Connection-specific DNS Suffix . :

              Tunnel adapter isatap.{41B84864-2D3D-4D17-B09E-E347F560F7F7}:

              Media State . . . . . . . . . . . : Media disconnected
              Connection-specific DNS Suffix . :

              Tunnel adapter isatap.{3D0D15B6-5A19-4873-88B7-D9B5B9D67406}:

              Media State . . . . . . . . . . . : Media disconnected
              Connection-specific DNS Suffix . :

              Tunnel adapter isatap.{AFE20685-E901-42C7-A0EA-94EC69D7938C}:

              Media State . . . . . . . . . . . : Media disconnected
              Connection-specific DNS Suffix . :

              Tunnel adapter isatap.mifi.local:

              Media State . . . . . . . . . . . : Media disconnected
              Connection-specific DNS Suffix . :

              ========= End of CMD: =========

              ========= ipconfig /renew =========

              Windows IP Configuration

              No operation can be performed on Wireless Network Connection 3 while it has its media disconnected.
              No operation can be performed on Wireless Network Connection 2 while it has its media disconnected.
              No operation can be performed on Local Area Connection 2 while it has its media disconnected.

              Wireless LAN adapter Wireless Network Connection 3:

              Media State . . . . . . . . . . . : Media disconnected
              Connection-specific DNS Suffix . :

              Wireless LAN adapter Wireless Network Connection 2:

              Media State . . . . . . . . . . . : Media disconnected
              Connection-specific DNS Suffix . :

              Wireless LAN adapter Wireless Network Connection:

              Connection-specific DNS Suffix . :
              IPv6 Address. . . . . . . . . . . : ::808b:ac54:2e88:6506
              Temporary IPv6 Address. . . . . . : ::d039:672f:5fd9:d29a
              Link-local IPv6 Address . . . . . : fe80::808b:ac54:2e88:6506%14
              IPv4 Address. . . . . . . . . . . : 192.168.0.3
              Subnet Mask . . . . . . . . . . . : 255.255.255.0
              Default Gateway . . . . . . . . . : 192.168.0.1

              Ethernet adapter Local Area Connection 2:

              Media State . . . . . . . . . . . : Media disconnected
              Connection-specific DNS Suffix . :

              Tunnel adapter isatap.{41B84864-2D3D-4D17-B09E-E347F560F7F7}:

              Media State . . . . . . . . . . . : Media disconnected
              Connection-specific DNS Suffix . :

              Tunnel adapter isatap.{3D0D15B6-5A19-4873-88B7-D9B5B9D67406}:

              Media State . . . . . . . . . . . : Media disconnected
              Connection-specific DNS Suffix . :

              Tunnel adapter isatap.{AFE20685-E901-42C7-A0EA-94EC69D7938C}:

              Media State . . . . . . . . . . . : Media disconnected
              Connection-specific DNS Suffix . :

              Tunnel adapter isatap.mifi.local:

              Media State . . . . . . . . . . . : Media disconnected
              Connection-specific DNS Suffix . :

              ========= End of CMD: =========

              ========= netsh int ipv4 reset =========

              Reseting Interface, OK!
              Restart the computer to complete this action.

              ========= End of CMD: =========

              ========= netsh int ipv6 reset =========

              There’s no user specified settings to be reset.

              ========= End of CMD: =========

              ========= bitsadmin /reset /allusers =========

              BITSADMIN version 3.0 [ 7.5.7601 ]
              BITS administration utility.
              (C) Copyright 2000-2006 Microsoft Corp.

              BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
              Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

              Unable to cancel {97BBEDF9-9744-46DB-8361-9072ACC2FB39}.
              Unable to cancel {EB242197-4D7C-460A-95BA-496CC5DE1902}.
              0 out of 2 jobs canceled.

              ========= End of CMD: =========

              =========== EmptyTemp: ==========

              BITS transfer queue => 8388608 B
              DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 114554891 B
              Java, Flash, Steam htmlcache => 508998 B
              Windows/system/drivers => 90185128 B
              Edge => 0 B
              Chrome => 266632772 B
              Firefox => 210102278 B
              Opera => 0 B

              Temp, IE cache, history, cookies, recent:
              Users => 0 B
              Default => 0 B
              Public => 0 B
              ProgramData => 0 B
              systemprofile => 66356 B
              systemprofile32 => 66356 B
              LocalService => 0 B
              NetworkService => 228608 B
              ******** => 19243430732 B

              RecycleBin => 609313796 B
              EmptyTemp: => 19.1 GB temporary data Removed.

              ================================

              The system needed a reboot.

              ==== End of Fixlog 12:07:57 ====

              Comment

              • Malnutrition
                PCHF Moderator
                • Jul 2016
                • 7045

                #8
                You are safe to delete those folders, there is no malware that I can see.

                I’d Run this tool to clean up more crap from your machine tho, just empty of the temp files cleaned up 20 gigs.

                Privazer

                Adware Cleaner Scan.

                Please download AdwCleaner by Xplode onto your desktop.

                [ul]
                [li]Close all open programs and internet browsers.[/li][li]Right Click on adwcleaner.exe and run as admin to run the tool.[/li][li]Click on Scan button.[/li][li]When the scan has finished click on Clean button.[/li][li]Your computer will be rebooted automatically. A text file will open after the restart.[/li][li]Please Attach the contents of that logfile with your next reply.[/li][li]You can find the logfile at C:\AdwCleaner[S1].txt as well.[/li][/ul]

                ================================================== ==================================

                ZHP Scan.

                Please download Zhp Cleaner to your desktop. Right Click the icon and select run as administrator.
                1. Once you have started the program, you will need to click the scanner button.

                [IMG alt="EgsT69u" width="602px" height="129px"]https://windowsinstructed.com/wp-content/uploads/2015/06/EgsT69u.png[/IMG]

                The program will close all open browsers!
                3. Once the scan is completed, the you will want to click the Repair button.

                [URL unfurl="true"]http://windowsinstructed.com/wp-content/uploads/2015/06/6QJjV50.png[/URL]

                At the end of the process you may be asked to reboot your machine. After you reboot a report will open on your desktop.

                Copy and paste the report here in your next reply.

                ================================================== ==================

                Security Check Scan.
                [HEADING=1][ul]
                [li]Download Security Check to your desktop.[/li][li]Right click it run as administrator.[/li][li]When the program completes, the tool will automatically open a log file.[/li][li]Please post that log here in your next post.[/li][/ul][/HEADING]
                HijackThis.

                1- Please click HERE to download HijackThis.
                2- Run the program.
                3- Click on the Main Menu button if not already there.
                4- Select Do a system scan and save a logfile.
                5- Copy paste the log here.

                Comment

                • Fla_Panther
                  PCHF Member
                  • Sep 2016
                  • 38

                  #9
                  No, the temp folder was empty. I had a 20GB folder of WAV files on my desktop that I moved to F: and I emptied the recycle bin, which was another 20GB. But Privizer did delete almost another 20GB, so I’ve got almost 60GB free now.

                  My main concern about whether or not I’ve been infected is that in the last year I started using a password manager with different complex passwords for every website. Of course if my PC is infected with a keylogger then they could download my password file and open that and have all the keys anyway. It will be super annoying if I have to go change the passwords for all these sites again (I have something like 100+ recorded).

                  Here are the logs:

                  ~ ZHPCleaner v2019.7.19.103 by Nicolas Coolman (2019/07/19)
                  ~ Run by ******** (Administrator) (15/07/2019 15:07:42)
                  ~ Web: https://www.nicolascoolman.com
                  ~ Blog: https://nicolascoolman.eu/
                  ~ Facebook : ZHP
                  ~ State version : Version OK
                  ~ Certificate ZHPCleaner: Legal
                  ~ Type : Scan
                  ~ Report : C:\Users*\Desktop\ZHPCleaner (S).txt
                  ~ Quarantine : C:\Users*
                  \AppData\Roaming\ZHP\ZHPCleaner_Reg.txt
                  ~ System Restore Point :
                  ~ UAC : Activate
                  ~ Boot Mode : Normal (Normal boot)
                  Windows 7 Professional, 64-bit Service Pack 1 (Build 7601)

                  —\ Alternate Data Stream (ADS). (0)
                  ~ No malicious or unnecessary items found.

                  —\ Services (0)
                  ~ No malicious or unnecessary items found.

                  —\ Browser internet (0)
                  ~ No malicious or unnecessary items found.

                  —\ Hosts file (1)
                  ~ The hosts file is legitimate (1)

                  —\ Scheduled automatic tasks. (0)
                  ~ No malicious or unnecessary items found.

                  —\ Explorer ( File, Folder) (12)
                  FOUND file: C:\Windows\Installer\wix{B5E06417-A4AC-4225-B36E-7E34C91616E7}.SchedServiceConfig.rmi =>.SUP.Empty
                  FOUND folder: C:\Users*\AppData\Local\Google\Chrome\User Data\Default\File System\000 =>.SUP.Temporary.Chrome
                  FOUND folder: C:\Users*
                  \AppData\Local\Google\Chrome\User Data\Default\File System\001 =>.SUP.Temporary.Chrome
                  FOUND folder: C:\Users*\AppData\Local\Google\Chrome\User Data\Default\File System\002 =>.SUP.Temporary.Chrome
                  FOUND folder: C:\Users*
                  \AppData\Local\Google\Chrome\User Data\Default\File System\003 =>.SUP.Temporary.Chrome
                  FOUND folder: C:\Users*\AppData\Local\Google\Chrome\User Data\Default\File System\004 =>.SUP.Temporary.Chrome
                  FOUND folder: C:\Users*
                  \AppData\Local\Google\Chrome\User Data\Default\File System\005 =>.SUP.Temporary.Chrome
                  FOUND folder: C:\Users*\AppData\Local\Google\Chrome\User Data\Default\File System\006 =>.SUP.Temporary.Chrome
                  FOUND folder: C:\Users*
                  \AppData\Local\Google\Chrome\User Data\Default\File System\007 =>.SUP.Temporary.Chrome
                  FOUND folder: C:\Users*\AppData\Local\Google\Chrome\User Data\Default\File System\008 =>.SUP.Temporary.Chrome
                  FOUND folder: C:\Users*
                  \AppData\Local\Google\Chrome\User Data\Default\File System\009 =>.SUP.Temporary.Chrome
                  FOUND folder: C:\Users********\AppData\Local\Google\Chrome\User Data\Default\File System\010 =>.SUP.Temporary.Chrome

                  —\ Registry ( Key, Value, Data) (0)
                  ~ No malicious or unnecessary items found.

                  —\ Summary of the elements found (2)
                  Zone Anti-Malware - ZAM =>.SUP.Empty
                  Zone Anti-Malware - ZAM =>.SUP.Temporary.Chrome

                  —\ Result of repair
                  ~ Any repair made
                  ~ Browser not found (Opera Software)

                  —\ Statistics
                  ~ Items scanned : 64416
                  ~ Items found : 12
                  ~ Items cancelled : 0
                  ~ Items options : 13/13
                  ~ Space saving (bytes) : 0

                  ~ End of search in 00h03mn09s

                  —\ Reports (0)
                  ZHPCleaner--15072019-15_10_51.txt

                  ~ ZHPCleaner v2019.7.19.103 by Nicolas Coolman (2019/07/19)
                  ~ Run by ******** (Administrator) (15/07/2019 15:12:37)
                  ~ Web: https://www.nicolascoolman.com
                  ~ Blog: https://nicolascoolman.eu/
                  ~ Facebook : ZHP
                  ~ State version : Version OK
                  ~ Certificate ZHPCleaner: Legal
                  ~ Type : Repair
                  ~ Report : C:\Users*\Desktop\ZHPCleaner (R).txt
                  ~ Quarantine : C:\Users*
                  \AppData\Roaming\ZHP\ZHPCleaner_Reg.txt
                  ~ System Restore Point : OK
                  ~ UAC : Activate
                  ~ Boot Mode : Normal (Normal boot)
                  Windows 7 Professional, 64-bit Service Pack 1 (Build 7601)

                  —\ Alternate Data Stream (ADS). (0)
                  ~ No malicious or unnecessary items found.

                  —\ Services (0)
                  ~ No malicious or unnecessary items found.

                  —\ Browser internet (0)
                  ~ No malicious or unnecessary items found.

                  —\ Hosts file (1)
                  ~ The hosts file is legitimate (1)

                  —\ Scheduled automatic tasks. (0)
                  ~ No malicious or unnecessary items found.

                  —\ Explorer ( File, Folder) (12)
                  MOVED file: C:\Windows\Installer\wix{B5E06417-A4AC-4225-B36E-7E34C91616E7}.SchedServiceConfig.rmi =>.SUP.Empty
                  MOVED folder: C:\Users*\AppData\Local\Google\Chrome\User Data\Default\File System\000 =>.SUP.Temporary.Chrome
                  MOVED folder: C:\Users*
                  \AppData\Local\Google\Chrome\User Data\Default\File System\001 =>.SUP.Temporary.Chrome
                  MOVED folder: C:\Users*\AppData\Local\Google\Chrome\User Data\Default\File System\002 =>.SUP.Temporary.Chrome
                  MOVED folder: C:\Users*
                  \AppData\Local\Google\Chrome\User Data\Default\File System\003 =>.SUP.Temporary.Chrome
                  MOVED folder: C:\Users*\AppData\Local\Google\Chrome\User Data\Default\File System\004 =>.SUP.Temporary.Chrome
                  MOVED folder: C:\Users*
                  \AppData\Local\Google\Chrome\User Data\Default\File System\005 =>.SUP.Temporary.Chrome
                  MOVED folder: C:\Users*\AppData\Local\Google\Chrome\User Data\Default\File System\006 =>.SUP.Temporary.Chrome
                  MOVED folder: C:\Users*
                  \AppData\Local\Google\Chrome\User Data\Default\File System\007 =>.SUP.Temporary.Chrome
                  MOVED folder: C:\Users*\AppData\Local\Google\Chrome\User Data\Default\File System\008 =>.SUP.Temporary.Chrome
                  MOVED folder: C:\Users*
                  \AppData\Local\Google\Chrome\User Data\Default\File System\009 =>.SUP.Temporary.Chrome
                  MOVED folder: C:\Users********\AppData\Local\Google\Chrome\User Data\Default\File System\010 =>.SUP.Temporary.Chrome

                  —\ Registry ( Key, Value, Data) (0)
                  ~ No malicious or unnecessary items found.

                  —\ Summary of the elements found (2)
                  Zone Anti-Malware - ZAM =>.SUP.Empty
                  Zone Anti-Malware - ZAM =>.SUP.Temporary.Chrome

                  —\ Other deletions. (4)
                  ~ Registry Keys Tracing deleted (4)
                  ~ Remove the old reports ZHPCleaner. (0)

                  —\ Result of repair
                  ~ Repair carried out successfully
                  ~ Browser not found (Opera Software)

                  —\ Statistics
                  ~ Items scanned : 684
                  ~ Items found : 0
                  ~ Items cancelled : 0
                  ~ Items options : 13/13
                  ~ Space saving (bytes) : 0

                  ~ End of clean in 00h00mn07s

                  —\ Reports (2)
                  ZHPCleaner–15072019-15_10_51.txt
                  ZHPCleaner-[R]-15072019-15_12_44.txt

                  SecurityCheck by glax24 & Severnyj v.1.4.0.53 [27.10.17]
                  WebSite: www.safezone.cc
                  DateLog: 15.07.2019 15:15:57
                  Path starting: C:\Users********\AppData\Local\Temp\SecurityCheck\ SecurityCheck.exe
                  Log directory: C:\SecurityCheck
                  IsAdmin: True
                  User: ********
                  VersionXML: 6.63is-06.07.2019


                  Windows 7(6.1.7601) Service Pack 1 (x64) Professional Lang: English(0409)
                  Installation date OS: 26.06.2018 13:29:10
                  LicenseStatus: Windows(R) 7, Professional edition The machine is permanently activated.
                  Boot Mode: Normal
                  Default Browser: C:\Program Files\Mozilla Firefox\firefox.exe
                  SystemDrive: C: FS: [NTFS] Capacity: [200 Gb] Used: [140.6 Gb] Free: [59.4 Gb]
                  ------------------------------- [ Windows ] -------------------------------
                  Internet Explorer 11.0.9600.19403 [+]
                  User Account Control enabled (Level 3)
                  Notify before download
                  Date install updates: 2019-07-15 00:30:27
                  Windows Update (wuauserv) - The service has stopped
                  Security Center (wscsvc) - The service has stopped
                  Remote Registry (RemoteRegistry) - The service has stopped
                  SSDP Discovery (SSDPSRV) - The service is running
                  Remote Desktop Services (TermService) - The service has stopped
                  Windows Remote Management (WS-Management) (WinRM) - The service has stopped
                  ------------------------------ [ MS Office ] ------------------------------
                  Microsoft Office 2010 x86 v.14.0.6029.1000
                  --------------------------- [ FirewallWindows ] ---------------------------
                  Windows Firewall (MpsSvc) - The service is running
                  --------------------------- [ AntiSpyware_WMI ] ---------------------------
                  Windows Defender (enabled and up to date)
                  --------------------------- [ OtherUtilities ] ----------------------------
                  VLC media player v.3.0.6 Warning! Download Update
                  Microsoft .NET Framework 4.7.2 v.4.7.03062
                  PuTTY release 0.70 (64-bit) v.0.70.0.0 Warning! Download Update
                  Dell SupportAssist v.3.2.2.119 [+]
                  Foxit Reader v.9.4.1.16828 Warning! Download Update
                  IrfanView 4.51 (32-bit) v.4.51
                  KeePass Password Safe 2.39.1 v.2.39.1 Warning! Download Update
                  Winamp v.5.666 [+]
                  -------------------------------- [ Arch ] ---------------------------------
                  7-Zip 18.05 (x64 edition) v.18.05.00.0 Warning! Download Update
                  Uninstall old version and install new one.
                  --------------------------------- [ IM ] ----------------------------------
                  Skype version 8.29 v.8.29 Warning! Download Update
                  --------------------------- [ AdobeProduction ] ---------------------------
                  Adobe Flash Player 32 ActiveX v.32.0.0.142 Warning! Download Update
                  Adobe Flash Player 29 NPAPI v.29.0.0.171 Warning! Download Update
                  ------------------------------- [ Browser ] -------------------------------
                  Mozilla Firefox 68.0 (x64 en-US) v.68.0 [+]
                  Google Chrome v.75.0.3770.142 [+]
                  ------------------ [ AntivirusFirewallProcessServices ] -------------------
                  Windows Defender (WinDefend) - The service has stopped
                  ----------------------------- [ End of Log ] ------------------------------

                  Logfile of HiJackThis Fork by Alex Dragokas v.2.9.0.19

                  Platform: x64 Windows 7 (Pro), 6.1.7601.24496, Service Pack: 1
                  Time: 15.07.2019 - 15:18 (UTC-04:00)
                  Language: OS: English (0x409). Display: English (0x409). Non-Unicode: English (0x409)
                  Elevated: Yes
                  Ran by: ******** (group: Administrator) on ********-PC, FirstRun: yes

                  Chrome: 75.0.3770.142
                  Firefox: 68.0.0.7125
                  Internet Explorer: 11.0.9600.19404
                  Default: “C:\Program Files\Mozilla Firefox\firefox.exe” -osint -url “%1” (Firefox)

                  Boot mode: Normal

                  Running processes:
                  Number | Path
                  1 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
                  1 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
                  1 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
                  1 C:\Program Files (x86)\Notepad++\notepad++.exe
                  1 C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
                  1 C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
                  1 C:\Program Files\DellTPad\ApMsgFwd.exe
                  1 C:\Program Files\DellTPad\ApntEx.exe
                  1 C:\Program Files\DellTPad\Apoint.exe
                  1 C:\Program Files\DellTPad\hidfind.exe
                  1 C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe
                  1 C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe
                  1 C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe
                  1 C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6 .0.7033.2285\DSAPI.exe
                  1 C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6 .0.7033.2285\pcdrwi.exe
                  1 C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAge nt.exe
                  1 C:\Program Files\IDT\WDM\stacsv64.exe
                  1 C:\Program Files\IDT\WDM\sttray64.exe
                  1 C:\Program Files\Intel\WiFi\bin\EvtEng.exe
                  1 C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
                  1 C:\Program Files\Intel\iCLS Client\HeciServer.exe
                  1 C:\Program Files\Visioneer\RWAR3\RWAR3HV_0001_0.EXE
                  1 C:\Program Files\Visioneer\RWAR3\RWAR3Monitor.exe
                  1 C:\Program Files\Windows Media Player\wmpnetwk.exe
                  1 C:\Users********\Desktop\HiJackThis.exe
                  1 C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\Pres entationFontCache.exe
                  1 C:\Windows\SysWOW64\gearsec.exe
                  1 C:\Windows\System32\SearchFilterHost.exe
                  1 C:\Windows\System32\SearchIndexer.exe
                  1 C:\Windows\System32\SearchProtocolHost.exe
                  1 C:\Windows\System32\VSSVC.exe
                  1 C:\Windows\System32\WUDFHost.exe
                  1 C:\Windows\System32\audiodg.exe
                  3 C:\Windows\System32\conhost.exe
                  2 C:\Windows\System32\csrss.exe
                  1 C:\Windows\System32\dwm.exe
                  1 C:\Windows\System32\igfxCUIService.exe
                  1 C:\Windows\System32\igfxEM.exe
                  1 C:\Windows\System32\igfxHK.exe
                  1 C:\Windows\System32\igfxTray.exe
                  1 C:\Windows\System32\lsass.exe
                  1 C:\Windows\System32\lsm.exe
                  1 C:\Windows\System32\services.exe
                  1 C:\Windows\System32\smss.exe
                  1 C:\Windows\System32\spoolsv.exe
                  1 C:\Windows\System32\sppsvc.exe
                  16 C:\Windows\System32\svchost.exe
                  1 C:\Windows\System32\taskeng.exe
                  1 C:\Windows\System32\taskhost.exe
                  1 C:\Windows\System32\wbem\WmiApSrv.exe
                  3 C:\Windows\System32\wbem\WmiPrvSE.exe
                  2 C:\Windows\System32\wbem\unsecapp.exe
                  1 C:\Windows\System32\wininit.exe
                  1 C:\Windows\System32\winlogon.exe
                  1 C:\Windows\System32\wlanext.exe
                  1 C:\Windows\explorer.exe

                  O4 - HKLM..\Run: [Apoint] = C:\Program Files\DellTPad\Apoint.exe
                  O4 - HKLM..\Run: [IntelPROSet] = C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe /tf Intel PROSet/Wireless
                  O4 - HKLM..\Run: [SysTrayApp] = C:\Program Files\IDT\WDM\sttray64.exe
                  O4-32 - HKLM..\Run: [IMSS] = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
                  O4-32 - HKLM..\Run: [KeePass 2 PreLoad] = C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe --preload
                  O15 - Trusted Zone: *.dell.com
                  O15 - Trusted Zone: *.localhost
                  O17 - DHCP DNS 1: 209.18.47.62
                  O17 - DHCP DNS 2: 209.18.47.61
                  O23 - Service R2: Audio Service - (STacSV) - C:\Program Files\IDT\WDM\STacSV64.exe
                  O23 - Service R2: Dell Data Vault Collector - (DDVDataCollector) - C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe
                  O23 - Service R2: Dell Data Vault Service API - (DDVCollectorSvcApi) - C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe
                  O23 - Service R2: Dell Hardware Support - C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6 .0.7033.2285\DSAPI.exe
                  O23 - Service R2: Dell SupportAssist - (SupportAssistAgent) - C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAge nt.exe
                  O23 - Service R2: Diagnostics Tracking Service - (DiagTrack) - C:\Windows\System32\svchost.exe -k utcsvc; “ServiceDll” = C:\Windows\system32\diagtrack.dll
                  O23 - Service R2: Intel(R) Capability Licensing Service Interface - C:\Program Files\Intel\iCLS Client\HeciServer.exe
                  O23 - Service R2: Intel(R) Dynamic Application Loader Host Interface Service - (jhi_service) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
                  O23 - Service R2: Intel(R) HD Graphics Control Panel Service - (igfxCUIService1.0.0.0) - C:\Windows\system32\igfxCUIService.exe
                  O23 - Service R2: Intel(R) Management and Security Application Local Management Service - (LMS) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
                  O23 - Service R2: Intel(R) PROSet/Wireless Event Log - (EvtEng) - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
                  O23 - Service R2: Intel(R) PROSet/Wireless Registry Service - (RegSrvc) - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
                  O23 - Service R2: Intel(R) PROSet/Wireless Zero Configuration Service - (ZeroConfigService) - C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
                  O23 - Service R2: RWAR3HV_0001_0 - C:\Program Files\Visioneer\RWAR3\RWAR3HV_0001_0.EXE
                  O23 - Service R2: RWAR3Monitor - C:\Program Files\Visioneer\RWAR3\RWAR3Monitor.exe
                  O23 - Service R2: gearsec - C:\Windows\SysWOW64\gearsec.exe
                  O23 - Service R3: Dell Data Vault Processor - (DDVRulesProcessor) - C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe
                  O23 - Service S2: Google Update Service (gupdate) - (gupdate) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /svc
                  O23 - Service S3: Google Chrome Elevation Service - (GoogleChromeElevationService) - C:\Program Files (x86)\Google\Chrome\Application\75.0.3770.142\elev ation_service.exe
                  O23 - Service S3: Google Update Service (gupdatem) - (gupdatem) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /medsvc
                  O23 - Service S3: Intel(R) Capability Licensing Service TCP IP Interface - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
                  O23 - Service S3: Intel(R) Content Protection HECI Service - (cphs) - C:\Windows\SysWow64\IntelCpHeciSvc.exe
                  O23 - Service S3: Mozilla Maintenance Service - (MozillaMaintenance) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                  O23 - Service S3: Wireless PAN DHCP Server - (MyWiFiDHCPDNS) - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe


                  End of file - Time spent: 12.1 sec. - 14354 bytes, CRC32: FFFFFFFF. Sign: :left_arrow:짾

                  Comment

                  • Fla_Panther
                    PCHF Member
                    • Sep 2016
                    • 38

                    #10
                    Well, on the plus side, I just noticed that my laptop’s date was somehow switched to Wednesday the 17th. I corrected it to the proper date and FireFox was able to load the webpages properly that had been failing before.

                    Comment

                    • Malnutrition
                      PCHF Moderator
                      • Jul 2016
                      • 7045

                      #11
                      Update your programs with Patch My PC, then post a new security check log please.

                      This freeware tool from DougKnox.com lets you change the Internet Time Update interval from Weekly to Daily or Hourly. You will have to run the tool as an administrator.

                      Comment

                      • Fla_Panther
                        PCHF Member
                        • Sep 2016
                        • 38

                        #12
                        When you ask for a security check log … which of the programs are you asking me to run? None of them were called “security check”.

                        Comment

                        • Malnutrition
                          PCHF Moderator
                          • Jul 2016
                          • 7045

                          #13
                          Originally posted by Malnutrition
                          Security Check Scan.

                          [ul]
                          [li]Download Security Check to your desktop.[/li][li]Right click it run as administrator.[/li][li]When the program completes, the tool will automatically open a log file.[/li][li]Please post that log here in your next post.[/li][/ul]

                          Comment

                          • Fla_Panther
                            PCHF Member
                            • Sep 2016
                            • 38

                            #14
                            Bah. My bad. I don’t know how I missed it before. Here’s the log:

                            SecurityCheck by glax24 & Severnyj v.1.4.0.53 [27.10.17]
                            WebSite: www.safezone.cc
                            DateLog: 23.07.2019 18:35:00
                            Path starting: C:\Users********\AppData\Local\Temp\SecurityCheck\ SecurityCheck.exe
                            Log directory: C:\SecurityCheck
                            IsAdmin: True
                            User: ********
                            VersionXML: 6.63is-06.07.2019


                            Windows 7(6.1.7601) Service Pack 1 (x64) Professional Lang: English(0409)
                            Installation date OS: 26.06.2018 13:29:10
                            LicenseStatus: Windows(R) 7, Professional edition The machine is permanently activated.
                            Boot Mode: Normal
                            Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
                            SystemDrive: C: FS: [NTFS] Capacity: [200 Gb] Used: [142 Gb] Free: [58 Gb]
                            ------------------------------- [ Windows ] -------------------------------
                            Internet Explorer 11.0.9600.19403
                            User Account Control enabled (Level 3)
                            Notify before download
                            Date install updates: 2019-07-15 00:30:27
                            Windows Update (wuauserv) - The service is running
                            Security Center (wscsvc) - The service is running
                            Remote Registry (RemoteRegistry) - The service has stopped
                            SSDP Discovery (SSDPSRV) - The service is running
                            Remote Desktop Services (TermService) - The service has stopped
                            Windows Remote Management (WS-Management) (WinRM) - The service has stopped
                            ------------------------------ [ MS Office ] ------------------------------
                            Microsoft Office 2010 x86 v.14.0.6029.1000
                            --------------------------- [ FirewallWindows ] ---------------------------
                            Windows Firewall (MpsSvc) - The service is running
                            --------------------------- [ AntiSpyware_WMI ] ---------------------------
                            Windows Defender (enabled and up to date)
                            --------------------------- [ OtherUtilities ] ----------------------------
                            VLC media player v.3.0.7.1
                            Microsoft .NET Framework 4.8 v.4.8.03761
                            Dell SupportAssist v.3.2.2.119
                            PuTTY release 0.72 (64-bit) v.0.72.0.0
                            Foxit Reader v.9.6.0.25114
                            IrfanView 4.53 (32-bit) v.4.53
                            KeePass Password Safe 2.42.1 v.2.42.1
                            Winamp v.5.666
                            -------------------------------- [ Arch ] ---------------------------------
                            7-Zip 19.00 (x64 edition) v.19.00.00.0
                            --------------------------------- [ IM ] ----------------------------------
                            Skype version 8.50 v.8.50
                            --------------------------- [ AdobeProduction ] ---------------------------
                            Adobe Flash Player 32 ActiveX v.32.0.0.223
                            Adobe Flash Player 32 NPAPI v.32.0.0.223
                            ------------------------------- [ Browser ] -------------------------------
                            Mozilla Firefox 68.0.1 (x64 en-US) v.68.0.1
                            Google Chrome v.75.0.3770.142 [+]
                            ------------------ [ AntivirusFirewallProcessServices ] -------------------
                            Windows Defender (WinDefend) - The service is running
                            Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - The service has stopped
                            ----------------------------- [ End of Log ] ------------------------------

                            Comment

                            • Malnutrition
                              PCHF Moderator
                              • Jul 2016
                              • 7045

                              #15
                              I do not see any malware, but to be certain a couple more checks just to be on the safe side.
                              [HEADING=1]Note: You can expect this process to take a long time, up to several hours or more.
                              [ul]
                              [li]Download ESET Online Scanner and save it to your Desktop[/li][li]Right click on esetonlinescanner_enu.exe and select Run as administrator[/li][li]Click Computer scan[/li][li]Click Full scan[/li][li]Click Start scan, leaving the default setting[/li][li]If threats were found click Save scan log and save it to your Desktop as ESETScan.txt[/li][li]Click Continue 3 times[/li][li]Click Close[/li][li]Copy and paste the ESETScan.txt file contents in your reply[/li][li]Review the list and let me know if you think any of the items are legitimate and should be restored[/li][li]If no threats were found, click Continue 3 times[/li][li]Place a check mark in Delete application data on closing then click Close[/li][/ul][/HEADING]
                              Rogue Killer Scan.

                              Download RogueKiller – (Portable) – from one of the following links and save it to your Desktop:

                              Link 1
                              Link 2

                              [ul]
                              [li]Close all other the running programs[/li][li]Disable ALL Antivirus – Antimalware – Applications.[/li][li]Right Click Rogue Killer and Run as Administrator.[/li][li]Click the Start Scan button.[/li][li]Allow the scan to run – it can take ten minutes or more.[/li][li]Once the scan is complete check All items for removal.[/li][/ul]

                              [ul]
                              [li]https://pchelpforum.net/attachments/upload_2017-2-23_10-55-54-png.1658/[/li]

                              [li]After All items are checked then press Remove Selected.[/li][li]Wait until the Status box shows Deleting Finished.[/li][li]Click on open report – then open txt[/li][li]Copy the content of the report and paste it here in your next reply.[/li][/ul]

                              Comment

                              Working...