Solved Not sure if I'm infected, but it can't hurt to check ...

  • Hi there and welcome to PC Help Forum (PCHF), a more effective way to get the Tech Support you need!
    We have Experts in all areas of Tech, including Malware Removal, Crash Fixing and BSOD's , Microsoft Windows, Computer DIY and PC Hardware, Networking, Gaming, Tablets and iPads, General and Specific Software Support and so much more.

    Why not Click Here To Sign Up and start enjoying great FREE Tech Support.

    This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.
Welcome to our Community
Wanting to join the rest of our members? Feel free to sign up today.
Sign up
Status
Not open for further replies.

Fla_Panther

PCHF Member
PCHF Member
Sep 19, 2016
38
4
44
Firefox started acting strange 2-3 days ago. Some HTTPS sites load fine, others won't. Some load but the HTML doesn't load properly. I've installed some recent MS updates but I can't remember if this started just before or just after. Anyway, here are my prework logs. Thanks in advance.

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 15-07-2019 01
Ran by ******** (administrator) on ********-PC (Dell Inc. Latitude E6430) (14-07-2019 21:35:49)
Running from C:\Users\********\Desktop\Virus Removal
Loaded Profiles: ******** (Available Profiles: ********)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Alps Electric Co., LTD. -> Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., LTD. -> Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(Alps Electric Co., LTD. -> Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Alps Electric Co., LTD. -> Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Dell Inc -> Dell Inc.) C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe
(Dell Inc -> Dell Inc.) C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe
(Dell Inc -> Dell Inc.) C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe
(Dell Inc. -> Dell Inc.) C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe
(GEAR Software) [File not signed] C:\Windows\SysWOW64\gearsec.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google LLC -> Google LLC) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation - Intel® Management Engine Firmware -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation - Software and Firmware Products -> Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation-Mobile Wireless Group -> Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Intel Corporation-Mobile Wireless Group -> Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Intel Corporation-Mobile Wireless Group -> Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation-Mobile Wireless Group -> Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel(R) Corporation) [File not signed] C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel(R) pGFX -> Intel Corporation) C:\Windows\System32\igfxTray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Windows Hardware Compatibility Publisher -> IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Microsoft Windows Hardware Compatibility Publisher -> IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Microsoft Windows Hardware Compatibility Publisher -> Visioneer Inc.) C:\Program Files\Visioneer\RWAR3\RWAR3HV_0001_0.EXE
(Notepad++ -> Don HO [email protected]) C:\Program Files (x86)\Notepad++\notepad++.exe
(PC-Doctor, Inc. -> PC-Doctor, Inc.) C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6.0.7033.2285\DSAPI.exe
(PC-Doctor, Inc. -> PC-Doctor, Inc.) C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6.0.7033.2285\pcdrwi.exe
(Visioneer Inc.) [File not signed] C:\Program Files\Visioneer\RWAR3\RWAR3Monitor.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1703424 2013-08-16] (Microsoft Windows Hardware Compatibility Publisher -> IDT, Inc.)
HKLM\...\Run: [IntelPROSet] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [4791024 2013-07-17] (Intel Corporation-Mobile Wireless Group -> Intel(R) Corporation)
HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [708952 2013-07-08] (Alps Electric Co., LTD. -> Alps Electric Co., Ltd.)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-11-13] (Intel Corporation - Software and Firmware Products -> Intel Corporation)
HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [3255888 2018-05-12] (Open Source Developer, Dominik Reichl -> Dominik Reichl)
HKU\S-1-5-21-3206243102-205974907-2145499838-1000\...\MountPoints2: {a08823cb-795d-11e8-b725-e41f28566541} - E:\RTK_NIC_DRIVER_INSTALLER.sfx.exe
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\75.0.3770.142\Installer\chrmstp.exe [2019-07-12] (Google LLC -> Google LLC)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {28DC2AF6-1D16-4C75-B4DB-CE4C2D0241ED} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [154920 2019-07-12] (Google Inc -> Google LLC)
Task: {D67DBDCB-4494-4132-A263-D7274A930236} - System32\Tasks\{EE1BEB1A-D10C-43A0-9D62-B7BBC4690C0E} => C:\Windows\system32\pcalua.exe -a C:\Users\********\Desktop\out_lame.binf_v164.exe -d C:\Users\********\Desktop
Task: {EB9DB395-1B49-4B4D-B3E1-B5F4BF91DDE5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [154920 2019-07-12] (Google Inc -> Google LLC)
Task: {F3CA5017-53C0-47CD-A21A-E197090FB41D} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistInstaller.exe [1512920 2019-05-24] (Dell Inc. -> Dell Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 209.18.47.62 209.18.47.61
Tcpip\..\Interfaces\{F1ABA7E1-57DC-49E4-8FA4-8A72EEFAFE0B}: [DhcpNameServer] 209.18.47.62 209.18.47.61
HKLM\System\...\Parameters\PersistentRoutes: [0.0.0.0,0.0.0.0,192.168.0.201,-1]

Internet Explorer:
==================
HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.dell.com/
HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
SearchScopes: HKU\S-1-5-21-3206243102-205974907-2145499838-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?pc=COSP&ptag=D031719-N0400A915F698E57&form=CONBDF&conlogo=CT3335818&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3206243102-205974907-2145499838-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?pc=COSP&ptag=D031719-N0400A915F698E57&form=CONBDF&conlogo=CT3335818&q={searchTerms}
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation -> Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation -> Microsoft Corporation)

FireFox:
========
FF DefaultProfile: 54mhv969.default-1563029380061
FF ProfilePath: C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\54mhv969.default-1563029380061 [2019-07-14]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_29_0_0_171.dll [2018-06-26] (Adobe Systems Incorporated -> )
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=3.0.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2019-01-10] (VideoLAN -> VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_29_0_0_171.dll [2018-06-26] (Adobe Systems Incorporated -> )
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2019-01-17] (Foxit Software Incorporated -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2019-01-17] (Foxit Software Incorporated -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2019-01-17] (Foxit Software Incorporated -> Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2019-01-17] (Foxit Software Incorporated -> Foxit Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-11-13] (Intel® Identity Protection Technology Software -> Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-11-13] (Intel® Identity Protection Technology Software -> Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation -> Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-07-12] (Google Inc -> Google LLC)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll [2019-07-12] (Google Inc -> Google LLC)

Chrome:
=======
CHR Profile: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default [2019-07-14]
CHR Extension: (Slides) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2019-07-12]
CHR Extension: (Docs) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2019-07-12]
CHR Extension: (Google Drive) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2019-07-12]
CHR Extension: (YouTube) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2019-07-12]
CHR Extension: (Sheets) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2019-07-12]
CHR Extension: (Google Docs Offline) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2019-07-13]
CHR Extension: (Chrome Web Store Payments) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2019-07-12]
CHR Extension: (Gmail) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2019-07-12]
CHR Extension: (Chrome Media Router) - C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2019-07-12]

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 DDVCollectorSvcApi; C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe [209392 2019-02-28] (Dell Inc -> Dell Inc.)
R2 DDVDataCollector; C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe [3363824 2019-02-28] (Dell Inc -> Dell Inc.)
R2 DDVRulesProcessor; C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe [218096 2019-02-28] (Dell Inc -> Dell Inc.)
R2 Dell Hardware Support; C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6.0.7033.2285\DSAPI.exe [1050952 2019-05-30] (PC-Doctor, Inc. -> PC-Doctor, Inc.)
R2 gearsec; C:\Windows\SysWOW64\gearsec.exe [49152 2002-09-02] (GEAR Software) [File not signed]
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [329192 2016-06-02] (Intel(R) pGFX -> Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel® Trusted Connect Service -> Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-11-13] (Intel Corporation - Intel® Management Engine Firmware -> Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-07-17] (Intel Corporation-Mobile Wireless Group -> )
R2 RWAR3HV_0001_0; C:\Program Files\Visioneer\RWAR3\RWAR3HV_0001_0.EXE [463360 2016-04-18] (Microsoft Windows Hardware Compatibility Publisher -> Visioneer Inc.)
R2 RWAR3Monitor; C:\Program Files\Visioneer\RWAR3\RWAR3Monitor.exe [246784 2018-10-29] (Visioneer Inc.) [File not signed]
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [339456 2013-08-16] (Microsoft Windows Hardware Compatibility Publisher -> IDT, Inc.)
R2 SupportAssistAgent; C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [39896 2019-05-24] (Dell Inc. -> Dell Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Windows -> Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3377904 2013-07-17] (Intel Corporation-Mobile Wireless Group -> Intel® Corporation)

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 AKAI_EIE_PRO_MIDI; C:\Windows\System32\drivers\akaieiem.sys [31984 2011-09-22] (Ploytec GmbH -> Numark)
R3 AKAI_EIE_PRO_USB; C:\Windows\System32\Drivers\akaieieu.sys [424176 2011-09-22] (Ploytec GmbH -> Ploytec GmbH)
R3 AKAI_EIE_WDM; C:\Windows\System32\drivers\akaieiea.sys [54000 2011-09-22] (Ploytec GmbH -> Numark)
R3 DDDriver; C:\Windows\System32\drivers\DDDriver64Dcsa.sys [41608 2018-05-08] (Techporch Incorporated -> Dell Inc.)
R3 DellProf; C:\Windows\System32\drivers\DellProf.sys [41208 2018-05-08] (Techporch Incorporated -> Dell Computer Corporation)
S3 GEARAspiWDM; C:\Windows\SysWOW64\DRIVERS\GEARAspiWDM.sys [9440 2003-03-20] (GEAR Software) [File not signed]
R3 GMLXD16Fltr; C:\Windows\System32\drivers\GMLXDFltr01.sys [19488 2016-05-27] (Microsoft Windows Hardware Compatibility Publisher -> LXD Development, Inc.)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-11-13] (Intel Corporation - Intel® Management Engine Firmware -> Intel Corporation)
S3 nusb3hub; C:\Windows\system32\drivers\nusb3hub.sys [80384 2010-09-30] (Microsoft Windows Hardware Compatibility Publisher -> Renesas Electronics Corporation)
S3 nusb3xhc; C:\Windows\system32\drivers\nusb3xhc.sys [180736 2010-09-30] (Microsoft Windows Hardware Compatibility Publisher -> Renesas Electronics Corporation)
S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [50320 2015-01-29] (Panda Security S.L. -> Panda Security, S.L.)
S3 RTLU3E8023-W7-64; C:\Windows\System32\DRIVERS\rtu30x64w7.sys [83160 2013-10-09] (Realtek Semiconductor Corp -> Realtek )
S3 Ser2pl; C:\Windows\System32\DRIVERS\ser2pl64.sys [238072 2018-07-12] (WDKTestCert charles-yeh,131345514351795974 -> Prolific Technology Inc.)
R3 STHDA; C:\Windows\System32\DRIVERS\stwrt64.sys [551936 2013-08-16] (Microsoft Windows Hardware Compatibility Publisher -> IDT, Inc.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-07-14 21:35 - 2019-07-14 21:35 - 000000000 ____D C:\FRST
2019-07-14 21:34 - 2019-07-14 21:35 - 000000000 ____D C:\Users\********\Desktop\Virus Removal
2019-07-14 20:29 - 2019-07-11 16:10 - 000397440 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2019-07-14 20:29 - 2019-07-11 15:13 - 000348792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2019-07-14 20:29 - 2019-07-10 00:08 - 025754624 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2019-07-14 20:29 - 2019-07-09 23:58 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2019-07-14 20:29 - 2019-07-09 23:58 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2019-07-14 20:29 - 2019-07-09 23:46 - 002909184 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2019-07-14 20:29 - 2019-07-09 23:45 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2019-07-14 20:29 - 2019-07-09 23:44 - 000578560 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2019-07-14 20:29 - 2019-07-09 23:44 - 000417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2019-07-14 20:29 - 2019-07-09 23:44 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2019-07-14 20:29 - 2019-07-09 23:43 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2019-07-14 20:29 - 2019-07-09 23:37 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2019-07-14 20:29 - 2019-07-09 23:36 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2019-07-14 20:29 - 2019-07-09 23:34 - 005775872 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2019-07-14 20:29 - 2019-07-09 23:34 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2019-07-14 20:29 - 2019-07-09 23:33 - 000790528 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2019-07-14 20:29 - 2019-07-09 23:33 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2019-07-14 20:29 - 2019-07-09 23:33 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2019-07-14 20:29 - 2019-07-09 23:32 - 020291072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2019-07-14 20:29 - 2019-07-09 23:32 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2019-07-14 20:29 - 2019-07-09 23:26 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2019-07-14 20:29 - 2019-07-09 23:25 - 000969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2019-07-14 20:29 - 2019-07-09 23:22 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2019-07-14 20:29 - 2019-07-09 23:16 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2019-07-14 20:29 - 2019-07-09 23:15 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2019-07-14 20:29 - 2019-07-09 23:15 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2019-07-14 20:29 - 2019-07-09 23:14 - 000496128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2019-07-14 20:29 - 2019-07-09 23:14 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2019-07-14 20:29 - 2019-07-09 23:13 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2019-07-14 20:29 - 2019-07-09 23:13 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2019-07-14 20:29 - 2019-07-09 23:12 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2019-07-14 20:29 - 2019-07-09 23:12 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2019-07-14 20:29 - 2019-07-09 23:11 - 002301952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2019-07-14 20:29 - 2019-07-09 23:11 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2019-07-14 20:29 - 2019-07-09 23:09 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2019-07-14 20:29 - 2019-07-09 23:08 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2019-07-14 20:29 - 2019-07-09 23:08 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2019-07-14 20:29 - 2019-07-09 23:07 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2019-07-14 20:29 - 2019-07-09 23:05 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2019-07-14 20:29 - 2019-07-09 23:04 - 000663040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2019-07-14 20:29 - 2019-07-09 23:04 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2019-07-14 20:29 - 2019-07-09 23:04 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2019-07-14 20:29 - 2019-07-09 22:58 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2019-07-14 20:29 - 2019-07-09 22:56 - 000809472 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2019-07-14 20:29 - 2019-07-09 22:56 - 000728064 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2019-07-14 20:29 - 2019-07-09 22:56 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2019-07-14 20:29 - 2019-07-09 22:54 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2019-07-14 20:29 - 2019-07-09 22:53 - 002132480 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2019-07-14 20:29 - 2019-07-09 22:52 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2019-07-14 20:29 - 2019-07-09 22:51 - 015389696 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2019-07-14 20:29 - 2019-07-09 22:51 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2019-07-14 20:29 - 2019-07-09 22:51 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2019-07-14 20:29 - 2019-07-09 22:48 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2019-07-14 20:29 - 2019-07-09 22:48 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2019-07-14 20:29 - 2019-07-09 22:46 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2019-07-14 20:29 - 2019-07-09 22:45 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2019-07-14 20:29 - 2019-07-09 22:43 - 004858880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2019-07-14 20:29 - 2019-07-09 22:42 - 004494848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2019-07-14 20:29 - 2019-07-09 22:40 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2019-07-14 20:29 - 2019-07-09 22:38 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2019-07-14 20:29 - 2019-07-09 22:38 - 000696320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2019-07-14 20:29 - 2019-07-09 22:37 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2019-07-14 20:29 - 2019-07-09 22:34 - 013791232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2019-07-14 20:29 - 2019-07-09 22:31 - 001566208 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2019-07-14 20:29 - 2019-07-09 22:19 - 004386304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2019-07-14 20:29 - 2019-07-09 22:19 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2019-07-14 20:29 - 2019-07-09 22:16 - 001331200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2019-07-14 20:29 - 2019-07-09 22:15 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2019-07-14 20:29 - 2019-07-03 21:56 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2019-07-14 20:29 - 2019-07-03 21:14 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2019-07-13 10:49 - 2019-07-13 10:49 - 000000942 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2019-07-13 10:49 - 2019-07-13 10:49 - 000000930 _____ C:\Users\Public\Desktop\Firefox.lnk
2019-07-13 10:49 - 2019-07-13 10:49 - 000000000 ____D C:\Users\********\Desktop\Old Firefox Data
2019-07-13 10:49 - 2019-07-13 10:49 - 000000000 ____D C:\Program Files\Mozilla Firefox
2019-07-13 10:49 - 2019-07-13 10:49 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2019-07-13 10:48 - 2019-07-13 10:49 - 000285408 _____ (Mozilla) C:\Users\********\Downloads\Firefox Installer.exe
2019-07-12 22:58 - 2019-07-12 22:58 - 000387228 _____ C:\Users\********\Desktop\Rick & Morty - Lambs to the cosmic slaughter.wav
2019-07-12 20:25 - 2019-02-16 01:32 - 000142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2019-07-12 20:25 - 2019-02-16 01:30 - 000123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2019-07-12 15:59 - 2019-06-28 01:24 - 000887808 _____ (Microsoft Corporation) C:\Windows\system32\wlansvc.dll
2019-07-12 15:59 - 2019-06-28 01:24 - 000448512 _____ (Microsoft Corporation) C:\Windows\system32\wlansec.dll
2019-07-12 15:59 - 2019-06-28 01:24 - 000414208 _____ (Microsoft Corporation) C:\Windows\system32\wlanmsm.dll
2019-07-12 15:59 - 2019-06-28 01:24 - 000118784 _____ (Microsoft Corporation) C:\Windows\system32\wlanhlp.dll
2019-07-12 15:59 - 2019-06-28 01:24 - 000113664 _____ (Microsoft Corporation) C:\Windows\system32\wlanapi.dll
2019-07-12 15:59 - 2019-06-28 01:23 - 000428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanmsm.dll
2019-07-12 15:59 - 2019-06-28 01:23 - 000392704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlansec.dll
2019-07-12 15:59 - 2019-06-28 01:23 - 000083968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanhlp.dll
2019-07-12 15:59 - 2019-06-28 01:23 - 000080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wlanapi.dll
2019-07-12 15:59 - 2019-06-20 23:09 - 000806400 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2019-07-12 15:59 - 2019-06-20 23:05 - 000628224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2019-07-12 15:59 - 2019-06-20 22:44 - 003229696 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2019-07-12 15:59 - 2019-06-20 21:41 - 001251840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2019-07-12 15:59 - 2019-06-18 23:06 - 006135296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2019-07-12 15:59 - 2019-06-18 21:52 - 007081984 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2019-07-12 15:59 - 2019-06-18 02:41 - 001649664 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2019-07-12 15:59 - 2019-06-12 23:25 - 000160488 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2019-07-12 15:59 - 2019-06-12 23:21 - 000732160 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2019-07-12 15:59 - 2019-06-12 11:23 - 004057320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2019-07-12 15:59 - 2019-06-12 11:23 - 003964136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2019-07-12 15:59 - 2019-06-12 11:22 - 001314104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2019-07-12 15:59 - 2019-06-12 11:21 - 012574208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2019-07-12 15:59 - 2019-06-12 11:21 - 011411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2019-07-12 15:59 - 2019-06-12 11:21 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2019-07-12 15:59 - 2019-06-12 11:21 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2019-07-12 15:59 - 2019-06-12 11:21 - 000617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2019-07-12 15:59 - 2019-06-12 11:21 - 000275968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2019-07-12 15:59 - 2019-06-12 11:21 - 000179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2019-07-12 15:59 - 2019-06-12 11:21 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2019-07-12 15:59 - 2019-06-12 11:21 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2019-07-12 15:59 - 2019-06-12 11:21 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2019-07-12 15:59 - 2019-06-12 11:21 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 003207168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 001329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000555520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000261632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000070144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssign32.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2019-07-12 15:59 - 2019-06-12 11:20 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 001177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 001005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000373248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000195072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:19 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:15 - 000631680 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2019-07-12 15:59 - 2019-06-12 11:11 - 000708328 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2019-07-12 15:59 - 2019-06-12 11:11 - 000262376 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
2019-07-12 15:59 - 2019-06-12 11:11 - 000153832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2019-07-12 15:59 - 2019-06-12 11:11 - 000094440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2019-07-12 15:59 - 2019-06-12 11:10 - 005550824 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2019-07-12 15:59 - 2019-06-12 11:10 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2019-07-12 15:59 - 2019-06-12 11:09 - 001664352 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2019-07-12 15:59 - 2019-06-12 11:08 - 014637568 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2019-07-12 15:59 - 2019-06-12 11:08 - 012574720 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2019-07-12 15:59 - 2019-06-12 11:08 - 000782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2019-07-12 15:59 - 2019-06-12 11:08 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2019-07-12 15:59 - 2019-06-12 11:08 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2019-07-12 15:59 - 2019-06-12 11:08 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2019-07-12 15:59 - 2019-06-12 11:08 - 000236032 _____ (Microsoft Corporation) C:\Windows\system32\srvsvc.dll
2019-07-12 15:59 - 2019-06-12 11:08 - 000229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2019-07-12 15:59 - 2019-06-12 11:08 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2019-07-12 15:59 - 2019-06-12 11:08 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2019-07-12 15:59 - 2019-06-12 11:08 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2019-07-12 15:59 - 2019-06-12 11:08 - 000094208 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2019-07-12 15:59 - 2019-06-12 11:08 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2019-07-12 15:59 - 2019-06-12 11:08 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2019-07-12 15:59 - 2019-06-12 11:08 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2019-07-12 15:59 - 2019-06-12 11:08 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\sscore.dll
2019-07-12 15:59 - 2019-06-12 11:08 - 000005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2019-07-12 15:59 - 2019-06-12 11:08 - 000005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 004120576 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 001574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 001484800 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 001472512 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 001211392 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 001202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 001162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 001068544 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000733184 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000632320 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000499712 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000433152 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000408576 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000317440 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000190976 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000187904 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000141824 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000081920 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\mssign32.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2019-07-12 15:59 - 2019-06-12 11:07 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000438784 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000295936 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2019-07-12 15:59 - 2019-06-12 11:06 - 000004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:06 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 11:05 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2019-07-12 15:59 - 2019-06-12 11:04 - 000023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2019-07-12 15:59 - 2019-06-12 11:01 - 000663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2019-07-12 15:59 - 2019-06-12 10:55 - 000009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sscore.dll
2019-07-12 15:59 - 2019-06-12 10:54 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2019-07-12 15:59 - 2019-06-12 10:50 - 000055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2019-07-12 15:59 - 2019-06-12 10:49 - 000205312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Dism.exe
2019-07-12 15:59 - 2019-06-12 10:49 - 000125952 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2019-07-12 15:59 - 2019-06-12 10:49 - 000024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2019-07-12 15:59 - 2019-06-12 10:48 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2019-07-12 15:59 - 2019-06-12 10:48 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2019-07-12 15:59 - 2019-06-12 10:48 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2019-07-12 15:59 - 2019-06-12 10:48 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2019-07-12 15:59 - 2019-06-12 10:47 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2019-07-12 15:59 - 2019-06-12 10:46 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 10:46 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 10:46 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 10:46 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2019-07-12 15:59 - 2019-06-12 10:42 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2019-07-12 15:59 - 2019-06-12 10:42 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2019-07-12 15:59 - 2019-06-12 10:42 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2019-07-12 15:59 - 2019-06-12 10:42 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2019-07-12 15:59 - 2019-06-12 10:39 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2019-07-12 15:59 - 2019-06-12 10:39 - 000129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\videoprt.sys
2019-07-12 15:59 - 2019-06-12 10:38 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2019-07-12 15:59 - 2019-06-12 10:37 - 000274944 _____ (Microsoft Corporation) C:\Windows\system32\Dism.exe
2019-07-12 15:59 - 2019-06-12 10:37 - 000011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2019-07-12 15:59 - 2019-06-12 10:37 - 000009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2019-07-12 15:59 - 2019-06-12 10:36 - 000464384 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2019-07-12 15:59 - 2019-06-12 10:36 - 000406016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2019-07-12 15:59 - 2019-06-12 10:36 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2019-07-12 15:59 - 2019-06-12 10:36 - 000169472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2019-07-12 15:59 - 2019-06-12 10:36 - 000160768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2019-07-12 15:59 - 2019-06-12 10:36 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2019-07-12 15:59 - 2019-06-12 10:35 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2019-07-12 15:59 - 2019-06-12 10:35 - 000064512 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\amdk8.sys
2019-07-12 15:59 - 2019-06-12 10:35 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\intelppm.sys
2019-07-12 15:59 - 2019-06-12 10:35 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\processr.sys
2019-07-12 15:59 - 2019-06-12 10:35 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\amdppm.sys
2019-07-12 15:59 - 2019-06-12 10:35 - 000044544 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\npfs.sys
2019-07-12 15:59 - 2019-06-12 10:35 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2019-07-12 15:59 - 2019-06-07 11:18 - 001425920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2019-07-12 15:59 - 2019-06-07 11:18 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
2019-07-12 15:59 - 2019-06-07 11:08 - 002072576 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2019-07-12 15:59 - 2019-06-07 11:08 - 000516096 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2019-07-12 15:59 - 2019-06-07 11:08 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2019-07-12 15:59 - 2019-06-07 11:07 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2019-07-12 15:59 - 2019-06-07 10:55 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
2019-07-12 15:59 - 2019-06-01 23:50 - 000216576 _____ (Microsoft Corporation) C:\Windows\system32\rdpclip.exe
2019-07-12 13:46 - 2019-07-12 13:47 - 000000000 ____D C:\Users\********\Desktop\3750
2019-07-12 13:36 - 2019-07-12 13:48 - 000000000 ____D C:\Users\********\AppData\Local\Google
2019-07-12 13:36 - 2019-07-12 13:36 - 001151544 _____ (Google LLC) C:\Users\********\Desktop\ChromeSetup.exe
2019-07-12 13:36 - 2019-07-12 13:36 - 000003332 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2019-07-12 13:36 - 2019-07-12 13:36 - 000003204 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2019-07-12 13:36 - 2019-07-12 13:36 - 000002298 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2019-07-12 13:36 - 2019-07-12 13:36 - 000002257 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2019-07-12 13:36 - 2019-07-12 13:36 - 000000000 ____D C:\Program Files (x86)\Google
2019-07-11 14:55 - 2019-07-11 14:55 - 000012209 _____ C:\Users\********\Desktop\Scale.xlsx
2019-07-03 22:16 - 2019-06-10 22:59 - 002863104 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2019-07-03 22:16 - 2019-06-10 22:59 - 001712640 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2019-07-03 22:16 - 2019-06-10 22:59 - 000801792 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2019-07-03 22:16 - 2019-06-10 22:59 - 000634368 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2019-07-03 22:16 - 2019-06-10 22:59 - 000501760 _____ (Microsoft Corporation) C:\Windows\system32\centel.dll
2019-07-03 22:16 - 2019-06-10 22:59 - 000456192 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2019-07-03 22:16 - 2019-06-10 22:59 - 000315904 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2019-07-03 22:16 - 2019-06-10 22:59 - 000257024 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2019-07-03 22:16 - 2019-06-03 19:11 - 001110528 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2019-07-03 22:16 - 2019-06-03 19:11 - 000474112 _____ (Microsoft Corporation) C:\Windows\system32\taskcomp.dll
2019-07-03 22:16 - 2019-06-03 19:10 - 000304640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskcomp.dll
2019-07-03 22:16 - 2019-05-24 20:04 - 014185984 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2019-07-03 22:16 - 2019-05-24 20:03 - 001867776 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2019-07-03 22:16 - 2019-05-24 19:59 - 012880384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2019-07-03 22:16 - 2019-05-24 19:58 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2019-07-03 22:16 - 2019-05-22 22:06 - 000405504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2019-07-03 22:16 - 2019-05-22 22:06 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\mf3216.dll
2019-07-03 22:16 - 2019-05-22 22:06 - 000008192 _____ (Microsoft Corporation) C:\Windows\system32\msimg32.dll
2019-07-03 22:16 - 2019-05-22 21:58 - 000313344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2019-07-03 22:16 - 2019-05-22 21:58 - 000046080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf3216.dll
2019-07-03 22:16 - 2019-05-22 21:58 - 000004608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimg32.dll
2019-07-03 22:16 - 2019-05-22 20:05 - 001182208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2019-07-03 22:16 - 2019-05-17 14:21 - 000372456 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2019-07-03 22:16 - 2019-05-13 10:44 - 001311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msjet40.dll
2019-07-03 22:16 - 2019-05-13 10:44 - 000353280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrd3x40.dll
2019-07-03 22:16 - 2019-05-13 10:44 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msexcl40.dll
2019-07-03 22:16 - 2019-05-13 10:44 - 000313344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrd2x40.dll
2019-07-03 22:16 - 2019-05-13 10:44 - 000241152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msltus40.dll
2019-07-03 22:16 - 2019-05-09 11:18 - 002368000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2019-07-03 22:16 - 2019-05-09 11:18 - 000337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2019-07-03 22:16 - 2019-05-09 11:18 - 000025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2019-07-03 22:16 - 2019-05-09 11:17 - 001806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2019-07-03 22:16 - 2019-05-09 11:17 - 000805376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll
2019-07-03 22:16 - 2019-05-09 11:09 - 000114400 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2019-07-03 22:16 - 2019-05-09 11:07 - 003247616 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2019-07-03 22:16 - 2019-05-09 11:07 - 000504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2019-07-03 22:16 - 2019-05-09 11:07 - 000025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2019-07-03 22:16 - 2019-05-09 11:06 - 001942016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2019-07-03 22:16 - 2019-05-09 11:06 - 001133568 _____ (Microsoft Corporation) C:\Windows\system32\cdosys.dll
2019-07-03 22:16 - 2019-05-09 11:06 - 000070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2019-07-03 22:16 - 2019-05-09 10:51 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2019-07-03 22:16 - 2019-05-09 10:40 - 000128512 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2019-07-03 22:16 - 2019-04-25 11:18 - 000083968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\userenv.dll
2019-07-03 22:16 - 2019-04-25 11:06 - 000110592 _____ (Microsoft Corporation) C:\Windows\system32\userenv.dll
2019-07-03 22:16 - 2019-04-24 11:11 - 001893096 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2019-07-03 22:16 - 2019-04-24 11:09 - 000377064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2019-07-03 22:16 - 2019-04-24 11:09 - 000287976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2019-07-03 22:16 - 2019-04-18 22:44 - 000185064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
2019-07-03 22:16 - 2019-04-18 22:43 - 000064232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ULIAGPKX.SYS
2019-07-03 22:16 - 2019-04-18 22:43 - 000063208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\termdd.sys
2019-07-03 22:16 - 2019-04-18 22:43 - 000060648 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\AGP440.sys
2019-07-03 22:16 - 2019-04-18 22:43 - 000031976 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mssmbios.sys
2019-07-03 22:16 - 2019-04-18 22:43 - 000023784 _____ (Microsoft Corporation) C:\Windows\system32\streamci.dll
2019-07-03 22:16 - 2019-04-18 22:43 - 000020200 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\isapnp.sys
2019-07-03 22:16 - 2019-04-18 22:42 - 000122600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\NV_AGP.SYS
2019-07-03 22:16 - 2019-04-18 22:42 - 000068328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volmgr.sys
2019-07-03 22:16 - 2019-04-18 22:42 - 000036064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vdrvroot.sys
2019-07-03 22:16 - 2019-04-18 22:42 - 000015080 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msisadrv.sys
2019-07-03 22:16 - 2019-04-18 22:42 - 000012136 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\swenum.sys
2019-07-03 22:16 - 2019-04-16 11:17 - 000583680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2019-07-03 22:16 - 2019-04-16 11:05 - 000878080 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2019-07-03 22:16 - 2019-04-16 09:15 - 000419648 _____ C:\Windows\SysWOW64\locale.nls
2019-07-03 22:16 - 2019-04-16 09:15 - 000419648 _____ C:\Windows\system32\locale.nls
2019-07-03 22:16 - 2019-04-14 01:42 - 000309480 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2019-07-03 22:16 - 2019-04-14 01:40 - 000111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\t2embed.dll
2019-07-03 22:16 - 2019-04-14 01:40 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2019-07-03 22:16 - 2019-04-14 01:39 - 000071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2019-07-03 22:16 - 2019-04-14 01:39 - 000010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2019-07-03 22:16 - 2019-04-14 01:28 - 000383720 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2019-07-03 22:16 - 2019-04-14 01:26 - 000151552 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll
2019-07-03 22:16 - 2019-04-14 01:26 - 000101376 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2019-07-03 22:16 - 2019-04-14 01:26 - 000046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2019-07-03 22:16 - 2019-04-14 01:26 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2019-07-03 22:16 - 2019-04-14 01:26 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2019-07-03 22:16 - 2019-04-14 01:12 - 000034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000994384 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000064248 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-private-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000020944 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-math-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000019408 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000017656 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-string-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000017656 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000016120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000015608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-convert-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000014288 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000014072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-time-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000013560 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000012752 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-conio-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000012536 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-process-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000012240 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000012024 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000012024 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-locale-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000012024 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-heap-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000012024 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-crt-environment-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000012024 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000011512 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000011512 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000011512 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:05 - 000011504 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000914584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000065784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-private-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000021752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-math-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000018680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000017352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-string-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000017144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000015608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000015096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000013560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-time-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000013560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000013048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000012024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000012024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000011728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-1.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000011512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000011512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000011512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000011512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000011512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000011000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l2-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000011000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-timezone-l1-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000011000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l2-1-0.dll
2019-07-03 22:16 - 2019-04-12 09:04 - 000011000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-2-0.dll
2019-07-03 22:16 - 2019-04-09 11:17 - 000174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2019-07-03 22:16 - 2019-04-09 11:05 - 003165184 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2019-07-03 22:16 - 2019-04-09 11:05 - 000573440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2019-07-03 22:16 - 2019-04-09 11:05 - 000192512 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2019-07-03 22:16 - 2019-04-09 11:05 - 000098816 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2019-07-03 22:16 - 2019-04-09 11:05 - 000093696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2019-07-03 22:16 - 2019-04-09 11:05 - 000035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2019-07-03 22:16 - 2019-04-09 11:05 - 000030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2019-07-03 22:16 - 2019-04-09 11:03 - 000091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2019-07-03 22:16 - 2019-04-09 10:53 - 002651136 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2019-07-03 22:16 - 2019-04-09 10:52 - 000709120 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2019-07-03 22:16 - 2019-04-09 10:52 - 000140288 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2019-07-03 22:16 - 2019-04-09 10:52 - 000037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2019-07-03 22:16 - 2019-04-09 10:52 - 000037888 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2019-07-03 22:16 - 2019-04-09 10:52 - 000036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2019-07-03 22:16 - 2019-04-09 10:52 - 000012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2019-07-03 22:16 - 2019-04-07 11:17 - 000382976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2019-07-03 22:16 - 2019-04-07 11:17 - 000160256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werui.dll
2019-07-03 22:16 - 2019-04-07 11:03 - 001281536 _____ (Microsoft Corporation) C:\Windows\system32\werconcpl.dll
2019-07-03 22:16 - 2019-04-07 11:03 - 000486400 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2019-07-03 22:16 - 2019-04-07 11:03 - 000174080 _____ (Microsoft Corporation) C:\Windows\system32\werui.dll
2019-07-03 22:16 - 2019-04-07 11:03 - 000086016 _____ (Microsoft Corporation) C:\Windows\system32\wercplsupport.dll
2019-07-03 22:16 - 2019-04-07 11:03 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
2019-07-03 22:16 - 2019-04-07 10:49 - 000054272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wermgr.exe
2019-07-03 22:16 - 2019-04-07 10:48 - 000028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\werdiagcontroller.dll
2019-07-03 22:16 - 2019-04-07 10:42 - 000475648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxbde40.dll
2019-07-03 22:16 - 2019-04-07 10:42 - 000376320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mspbde40.dll
2019-07-03 22:16 - 2019-04-07 10:38 - 000407040 _____ (Microsoft Corporation) C:\Windows\system32\nltest.exe
2019-07-03 22:16 - 2019-04-07 10:35 - 000050688 _____ (Microsoft Corporation) C:\Windows\system32\wermgr.exe
2019-07-03 22:16 - 2019-04-07 09:05 - 000634312 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2019-07-03 22:16 - 2019-04-04 20:34 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\cryptdll.dll
2019-07-03 22:16 - 2019-04-04 20:23 - 000057856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdll.dll
2019-07-03 22:16 - 2019-03-28 21:36 - 000114688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\luafv.sys
2019-07-03 22:16 - 2019-03-26 20:40 - 003181568 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2019-07-03 22:16 - 2019-03-20 22:10 - 000032768 _____ (Microsoft Corporation) C:\Windows\system32\sxssrv.dll
2019-07-03 22:16 - 2019-03-11 17:41 - 002009600 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2019-07-03 22:16 - 2019-03-11 17:41 - 001894912 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2019-07-03 22:16 - 2019-03-11 17:41 - 001032192 _____ (Microsoft Corporation) C:\Windows\system32\rdpcore.dll
2019-07-03 22:16 - 2019-03-11 17:41 - 000688128 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2019-07-03 22:16 - 2019-03-11 17:41 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\oleprn.dll
2019-07-03 22:16 - 2019-03-11 17:41 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2019-07-03 22:16 - 2019-03-11 17:41 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2019-07-03 22:16 - 2019-03-11 17:33 - 001391616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2019-07-03 22:16 - 2019-03-11 17:33 - 001241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2019-07-03 22:16 - 2019-03-11 17:33 - 000827904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpcore.dll
2019-07-03 22:16 - 2019-03-11 17:33 - 000107520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleprn.dll
2019-07-03 22:16 - 2019-03-11 17:33 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2019-07-03 22:16 - 2019-03-11 17:33 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2019-07-03 22:16 - 2019-03-04 22:44 - 000076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2019-07-03 22:16 - 2019-03-04 22:44 - 000033280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2019-07-03 22:16 - 2019-03-04 22:44 - 000030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidusb.sys
2019-07-03 22:16 - 2019-02-21 11:48 - 000025088 _____ (Microsoft Corporation) C:\Windows\system32\netbtugc.exe
2019-07-03 22:16 - 2019-02-21 11:43 - 000026624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netbtugc.exe
2019-07-03 22:16 - 2019-02-21 11:37 - 000262656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbt.sys
2019-07-03 22:16 - 2019-02-16 02:02 - 000972288 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2019-07-03 22:16 - 2019-02-16 02:02 - 000443904 _____ (Microsoft Corporation) C:\Windows\system32\winspool.drv
2019-07-03 22:16 - 2019-02-16 01:50 - 000321536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winspool.drv
2019-07-03 22:16 - 2019-02-15 12:09 - 000355328 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll
2019-07-03 22:16 - 2019-02-15 11:58 - 000320512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll
2019-07-03 22:16 - 2019-02-15 11:40 - 000415744 _____ (Microsoft Corporation) C:\Windows\system32\WerFault.exe
2019-07-03 22:16 - 2019-02-15 11:40 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe
2019-07-03 22:16 - 2019-02-15 11:38 - 000360960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFault.exe
2019-07-03 22:16 - 2019-02-15 11:38 - 000028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe
2019-07-03 22:16 - 2019-02-10 12:10 - 001680104 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2019-07-03 22:16 - 2019-02-10 11:36 - 000328192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\udfs.sys
2019-07-03 22:16 - 2019-02-10 11:36 - 000205312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys
2019-07-03 22:16 - 2019-02-10 11:36 - 000195584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\exfat.sys
2019-07-03 22:16 - 2019-02-10 11:35 - 000092672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cdfs.sys
2019-07-03 22:16 - 2019-02-07 12:06 - 000027648 _____ (Microsoft Corporation) C:\Windows\system32\brdgcfg.dll
2019-07-03 22:16 - 2019-02-07 12:06 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\bridgeres.dll
2019-07-03 22:16 - 2019-02-07 12:01 - 000095232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bridge.sys
2019-07-03 22:16 - 2019-02-07 11:46 - 000020992 _____ (Microsoft Corporation) C:\Windows\system32\bridgeunattend.exe
2019-07-03 22:16 - 2019-02-03 11:36 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msfs.sys
2019-07-03 22:16 - 2018-12-07 23:08 - 000095744 _____ (Microsoft Corporation) C:\Windows\system32\rascfg.dll
2019-07-03 22:16 - 2018-12-07 23:08 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\rasdiag.dll
2019-07-03 22:16 - 2018-12-07 23:08 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\ndptsp.tsp
2019-07-03 22:16 - 2018-12-07 23:08 - 000047104 _____ (Microsoft Corporation) C:\Windows\system32\kmddsp.tsp
2019-07-03 22:16 - 2018-12-07 23:08 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\rasmxs.dll
2019-07-03 22:16 - 2018-12-07 23:08 - 000029696 _____ (Microsoft Corporation) C:\Windows\system32\rasser.dll
2019-07-03 22:16 - 2018-12-07 22:56 - 000081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rascfg.dll
2019-07-03 22:16 - 2018-12-07 22:56 - 000061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasdiag.dll
2019-07-03 22:16 - 2018-12-07 22:56 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ndptsp.tsp
2019-07-03 22:16 - 2018-12-07 22:47 - 000088576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
2019-07-03 22:16 - 2018-12-07 22:47 - 000058368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys
2019-07-03 22:16 - 2018-12-07 22:47 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndistapi.sys
2019-07-03 22:16 - 2018-12-07 22:41 - 000038912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kmddsp.tsp
2019-07-03 22:16 - 2018-12-07 22:41 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasmxs.dll
2019-07-03 22:16 - 2018-12-07 22:41 - 000022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasser.dll
2019-07-03 22:16 - 2018-12-04 12:07 - 000194048 _____ (Microsoft Corporation) C:\Windows\system32\itircl.dll
2019-07-03 22:16 - 2018-12-04 12:07 - 000170496 _____ (Microsoft Corporation) C:\Windows\system32\itss.dll
2019-07-03 22:16 - 2018-12-04 11:55 - 000158720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itircl.dll
2019-07-03 22:16 - 2018-12-04 11:55 - 000142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\itss.dll
2019-07-03 22:16 - 2018-11-11 13:01 - 000366824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msrpc.sys

==================== One month (modified) ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2019-07-14 21:30 - 2018-08-23 19:50 - 000000000 ____D C:\Users\********\AppData\Roaming\KeePass
2019-07-14 21:30 - 2018-06-26 13:51 - 000000000 ____D C:\Users\********\AppData\LocalLow\Mozilla
2019-07-14 20:55 - 2009-07-14 00:45 - 000021504 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2019-07-14 20:55 - 2009-07-14 00:45 - 000021504 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2019-07-14 20:53 - 2009-07-14 01:13 - 000781790 _____ C:\Windows\system32\PerfStringBackup.INI
2019-07-14 20:53 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\inf
2019-07-14 20:48 - 2018-06-26 13:44 - 000000000 ___HD C:\Windows\system32\WLANProfiles
2019-07-14 20:48 - 2018-06-26 10:21 - 000000000 __SHD C:\Users\********\IntelGraphicsProfiles
2019-07-14 20:47 - 2009-07-14 01:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2019-07-14 20:43 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\PolicyDefinitions
2019-07-14 14:44 - 2018-12-14 00:40 - 000000000 ____D C:\Users\********\Desktop\My WAV Files
2019-07-13 16:38 - 2018-08-13 21:54 - 000000000 ____D C:\Users\********\AppData\Roaming\audacity
2019-07-12 20:20 - 2018-07-18 16:20 - 000337872 _____ C:\Windows\system32\FNTCACHE.DAT
2019-07-12 20:19 - 2018-06-26 13:22 - 000000000 ___SD C:\Windows\system32\CompatTel
2019-07-12 20:19 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\SysWOW64\Dism
2019-07-12 20:19 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\system32\Dism
2019-07-12 20:16 - 2018-06-26 11:10 - 000774404 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2019-07-12 20:15 - 2018-06-26 11:19 - 000000000 ____D C:\Windows\system32\MRT
2019-07-12 15:59 - 2018-06-26 11:19 - 136618864 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2019-07-12 13:35 - 2018-08-30 08:09 - 000000000 ____D C:\Users\********\AppData\Local\Deployment
2019-07-09 16:05 - 2010-11-20 23:27 - 000741432 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2019-07-06 19:24 - 2018-11-10 20:53 - 000002625 _____ C:\Users\********\Desktop\To Do.txt
2019-07-05 00:26 - 2009-07-13 23:20 - 000000000 ____D C:\Windows\rescache
2019-07-04 00:33 - 2018-06-26 13:22 - 000000000 ____D C:\Windows\system32\appraiser

==================== Files in the root of some directories ================

2018-12-07 01:43 - 2018-12-10 22:26 - 000000600 _____ () C:\Users\********\AppData\Local\PUTTY.RND

==================== SigCheck ===============================

(There is no automatic fix for files that do not pass verification.)


LastRegBack: 2019-07-14 20:21
==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-07-2019 01
Ran by ******** (14-07-2019 21:36:21)
Running from C:\Users\********\Desktop\Virus Removal
Windows 7 Professional Service Pack 1 (X64) (2018-06-26 13:29:10)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3206243102-205974907-2145499838-500 - Administrator - Disabled)
Guest (S-1-5-21-3206243102-205974907-2145499838-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3206243102-205974907-2145499838-1002 - Limited - Enabled)
******** (S-1-5-21-3206243102-205974907-2145499838-1000 - Administrator - Enabled) => C:\Users\********

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 18.05 (x64 edition) (HKLM\...\{23170F69-40C1-2702-1805-000001000000}) (Version: 18.05.00.0 - Igor Pavlov)
Adobe Flash Player 29 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 29.0.0.171 - Adobe Systems Incorporated)
Adobe Flash Player 32 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 32.0.0.142 - Adobe Systems Incorporated)
Akai EIE Pro USB Audio driver (HKLM\...\USB_AUDIO_DEusb-audio.deAkaiEIE) (Version: - )
Audacity 2.2.2 (HKLM-x32\...\Audacity_is1) (Version: 2.2.2 - Audacity Team)
Authorizer 2.9.5d1 (HKLM\...\{F6762963-9AE5-4bc6-A70F-2D749F6AC02F}_is1) (Version: 2.9.5d1 - Propellerhead Software AB)
Dell Custom Help (HKLM\...\{BE1CF6CA-3182-45D8-9535-A18055B73607}) (Version: 16.01.1000.0235 - Intel Corporation) Hidden
Dell SupportAssist (HKLM\...\{806422F1-FC4E-4D7C-8855-05748AEFC031}) (Version: 3.2.2.119 - Dell Inc.)
Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 8.1200.101.134 - ALPS ELECTRIC CO., LTD.)
Europa by Reason (HKLM-x32\...\{24D75A2D-A712-42F7-B71B-2FFF95905C97}_is1) (Version: 2.0.0d84 - Propellerhead Software)
Foxit Reader (HKLM-x32\...\Foxit Reader_is1) (Version: 9.4.1.16828 - Foxit Software Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 75.0.3770.142 - Google LLC)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.34.11 - Google LLC) Hidden
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6491.0 - IDT)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 18.1 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4425 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{b6b417a3-1f40-4618-aadd-49628bda7836}) (Version: 16.1.1 - Intel Corporation)
IrfanView 4.51 (32-bit) (HKLM-x32\...\IrfanView) (Version: 4.51 - Irfan Skiljan)
KeePass Password Safe 2.39.1 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.39.1 - Dominik Reichl)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )
Line 6 Uninstaller (HKLM-x32\...\Line 6 Uninstaller) (Version: - Line 6)
Microsoft .NET Framework 4.7.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.03062 - Microsoft Corporation)
Microsoft Office 2010 Service Pack 1 (SP1) (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}) (Version: - Microsoft)
Microsoft Office Home and Business 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2017 Redistributable (x64) - 14.15.26706 (HKLM-x32\...\{95ac1cfa-f4fb-4d1b-8912-7f9d5fbb140d}) (Version: 14.15.26706.0 - Microsoft Corporation)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (HKLM-x32\...\{7e9fae12-5bbf-47fb-b944-09c49e75c061}) (Version: 14.15.26706.0 - Microsoft Corporation)
MixMeister Pro 5 (HKLM-x32\...\{4920CF11-4A79-4D8D-B643-58E0611FC106}) (Version: 5.1.2.0 - MixMeister Technology LLC)
Mozilla Firefox 68.0 (x64 en-US) (HKLM\...\Mozilla Firefox 68.0 (x64 en-US)) (Version: 68.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 68.0 - Mozilla)
Neutron 2 Advanced (HKLM-x32\...\Neutron 2) (Version: 2.00 - iZotope, Inc.)
Notepad++ (32-bit x86) (HKLM-x32\...\Notepad++) (Version: 7.5.6 - Notepad++ Team)
Ozone 8 Advanced (HKLM-x32\...\Ozone 8) (Version: 8.00 - iZotope, Inc.)
Panda Cloud Cleaner (HKLM-x32\...\{92B2B132-C7F0-43DC-921A-4493C04F78A4}_is1) (Version: 1.1.10 - Panda Security)
PL2303 USB-to-Serial (HKLM-x32\...\{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}) (Version: 1.20.00 - Prolific Technology INC)
PuTTY release 0.70 (64-bit) (HKLM\...\{45B3032F-22CC-40CD-9E97-4DA7095FA5A2}) (Version: 0.70.0.0 - Simon Tatham)
Reason 10 10.4.0d4 (HKLM\...\Reason10.0Stable_64_is1) (Version: 10.4.0d4 - Propellerhead Software AB)
Reason 8 8.3.2d7 (HKLM\...\Reason8.0Stable_64_is1) (Version: 8.3.2d7 - Propellerhead Software AB)
Skype version 8.29 (HKLM-x32\...\Skype_is1) (Version: 8.29 - Skype Technologies S.A.)
Visioneer Acuity Assets V1 (HKLM-x32\...\{AAF91E62-A45B-489B-9C98-3E8C06EBB74F}) (Version: 5.1.1516.6024 - Visioneer Inc.)
Visioneer RoadWarrior 3 Series 5.1.216.4185 & Visioneer Acuity Assets V1 5.1.1516.6024 (HKLM-x32\...\{e6789094-a487-4886-953d-084857169a2e}) (Version: 5.1.216.6025 - Visioneer Inc.)
Visioneer RoadWarrior 3 Series Driver (HKLM-x32\...\{88374377-FCCE-498B-AD19-D72D755F0D46}) (Version: 5.1.216.4185 - Visioneer Inc.)
VLC media player (HKLM\...\VLC media player) (Version: 3.0.6 - VideoLAN)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666 - Nullsoft, Inc)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2018-04-30] (Igor Pavlov) [File not signed]
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files (x86)\Notepad++\NppShell_06.dll [2018-03-18] (Notepad++ -> )
ContextMenuHandlers1: [Foxit_ConvertToPDF_Reader] -> {A94757A0-0226-426F-B4F1-4DF381C630D3} => C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\ConvertToPDFShellExtension_x64.dll [2018-12-25] (Foxit Software Incorporated -> Foxit Software Inc.)
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2018-04-30] (Igor Pavlov) [File not signed]
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\Windows\system32\igfxDTCM.dll [2016-06-02] (Microsoft Windows Hardware Compatibility Publisher -> Intel Corporation)
ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2018-04-30] (Igor Pavlov) [File not signed]
ContextMenuHandlers6: [Foxit_ConvertToPDF_Reader] -> {A94757A0-0226-426F-B4F1-4DF381C630D3} => C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\ConvertToPDFShellExtension_x64.dll [2018-12-25] (Foxit Software Incorporated -> Foxit Software Inc.)

==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)

WMI:subscription\__FilterToConsumerBinding->CommandLineEventConsumer.Name=\"BVTConsumer\"",Filter="__EventFilter.Name=\"BVTFilter\"::
WMI:subscription\__EventFilter->BVTFilter::[Query => SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99]
WMI:subscription\CommandLineEventConsumer->BVTConsumer::[CommandLineTemplate => cscript KernCap.vbs][WorkingDirectory => C:\\tools\\kernrate]

==================== Loaded Modules (Whitelisted) ==============

2002-09-02 10:51 - 2002-09-02 10:51 - 000049152 _____ (GEAR Software) [File not signed] C:\Windows\SysWOW64\gearsec.exe
2018-04-30 17:00 - 2018-04-30 17:00 - 000075776 _____ (Igor Pavlov) [File not signed] C:\Program Files\7-Zip\7-zip.dll
2013-08-27 14:32 - 2013-08-27 14:32 - 000747520 _____ (Intel(R) Corporation) [File not signed] C:\Program Files\Intel\iCLS Client\HeciServer.exe
2018-03-26 14:07 - 2018-03-26 14:07 - 000126976 _____ (Microsoft Corporation) [File not signed] C:\Windows\Microsoft.Net\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
2018-10-29 20:45 - 2018-10-29 20:45 - 000246784 _____ (Visioneer Inc.) [File not signed] C:\Program Files\Visioneer\RWAR3\RWAR3Monitor.exe

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\.DEFAULT\...\dell.com -> dell.com
IE trusted site: HKU\.DEFAULT\...\localhost -> localhost
IE trusted site: HKU\.DEFAULT\...\webcompanion.com -> hxxp://webcompanion.com
IE trusted site: HKU\S-1-5-21-3206243102-205974907-2145499838-1000\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-3206243102-205974907-2145499838-1000\...\webcompanion.com -> hxxp://webcompanion.com

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 22:34 - 2009-06-10 17:00 - 000000824 _____ C:\Windows\system32\drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files (x86)\Intel\iCLS Client\;C:\Program Files\Intel\iCLS Client\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files\Intel\WiFi\bin\;C:\Program Files\Common Files\Intel\WirelessCommon\;C:\Program Files\PuTTY\
HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 209.18.47.62 - 209.18.47.61
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

If an entry is included in the fixlist, it will be removed.


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe (Microsoft Windows -> Microsoft Corporation)
FirewallRules: [{DA3FC957-B91F-4B12-B5BC-387B37AEA4A6}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe (Intel Corporation-Mobile Wireless Group -> )
FirewallRules: [{1146613B-9846-4149-AAA7-EED5F9DCFA35}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe (Nullsoft Inc. -> Nullsoft, Inc.)
FirewallRules: [{4EB93D04-534E-4F05-A655-E0F1761C493A}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe (Nullsoft Inc. -> Nullsoft, Inc.)
FirewallRules: [{0C0AE79B-9F67-4A86-97AC-E8426F18CF32}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{DE9D6E7A-D0B8-4848-8BF5-DC7A0C3DD432}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe (Skype Software Sarl -> Skype Technologies S.A.)
FirewallRules: [{DD6A69A7-6F4D-4C94-93A3-EFD897DCD692}] => (Allow) C:\Users\********\AppData\Roaming\uTorrent\uTorrent.exe No File
FirewallRules: [{D0C21295-8A4D-4AAF-867C-F5606173A37E}] => (Allow) C:\Users\********\AppData\Roaming\uTorrent\uTorrent.exe No File
FirewallRules: [{43FE1F9D-0162-42B6-B9BC-30E45CEDC654}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [{D68D42A9-3E58-4D9B-AE65-CF5B89CA74E3}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{7E0A3784-7574-4AB4-8A3D-34EFA74CB711}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)

==================== Restore Points =========================

12-07-2019 15:59:37 Windows Update
12-07-2019 20:25:39 Windows Update
14-07-2019 20:29:27 Windows Update

==================== Faulty Device Manager Devices =============

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Broadcom USH w/swipe sensor
Description: Broadcom USH w/swipe sensor
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Broadcom USH
Description: Broadcom USH
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Universal Serial Bus (USB) Controller
Description: Universal Serial Bus (USB) Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Visioneer RoadWarrior 3 Series
Description: Visioneer RoadWarrior 3 Series
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Visioneer Incorporated
Service: StillCam
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/14/2019 08:47:55 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (07/12/2019 01:16:55 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (07/16/2019 01:13:29 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (07/12/2019 08:20:20 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (07/12/2019 03:53:39 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (07/11/2019 03:33:44 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (07/11/2019 01:13:28 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (07/11/2019 10:20:51 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.


System errors:
=============
Error: (07/14/2019 08:53:22 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \SystemRoot\System32\DRIVERS\PSKMAD.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Error: (07/14/2019 08:47:35 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \SystemRoot\SysWow64\DRIVERS\GEARAspiWDM.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Error: (07/14/2019 08:16:52 PM) (Source: Microsoft-Windows-Time-Service) (EventID: 34) (User: NT AUTHORITY)
Description: The time service has detected that the system time needs to be changed by 431993 seconds. The time service will not change the system time by more than 54000 seconds. Verify that your time and time zone are correct, and that the time source time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->13.65.245.138:123) is working properly.

Error: (07/12/2019 01:16:57 PM) (Source: Serial) (EventID: 45) (User: )
Description: The serial driver detected a hardware failure on device \Device\Serial0 and will disable this device.

Error: (07/12/2019 01:16:49 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \SystemRoot\SysWow64\DRIVERS\GEARAspiWDM.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Error: (07/16/2019 01:12:59 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \SystemRoot\SysWow64\DRIVERS\GEARAspiWDM.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Error: (07/15/2019 04:09:26 AM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "********-PC :0" could not be registered on the interface with IP address 172.27.0.76.
The computer with the IP address 172.27.0.81 did not allow the name to be claimed by
this computer.

Error: (07/15/2019 04:09:26 AM) (Source: NetBT) (EventID: 4321) (User: )
Description: The name "********-PC :20" could not be registered on the interface with IP address 172.27.0.76.
The computer with the IP address 172.27.0.81 did not allow the name to be claimed by
this computer.


Windows Defender:
===================================
Date: 2018-07-18 15:54:53.741
Description:
Windows Defender has encountered an error trying to update signatures.
New Signature Version:1.271.1054.0
Previous Signature Version:1.269.1075.0
Update Source:User
Signature Type:AntiSpyware
Update Type:Delta
Current Engine Version:1.1.15000.2
Previous Engine Version:1.1.14901.4
Error code:0x80070666
Error description:Another version of this product is already installed. Installation of this version cannot continue. To configure or remove the existing version of this product, use Add/Remove Programs on the Control Panel.

Date: 2018-07-18 15:54:53.740
Description:
Windows Defender has encountered an error trying to update the engine.
New Engine Version:1.1.15000.2
Previous Engine Version:1.1.14901.4
Update Source:User
Error Code:0x80070666
Error description:Another version of this product is already installed. Installation of this version cannot continue. To configure or remove the existing version of this product, use Add/Remove Programs on the Control Panel.

==================== Memory info ===========================

BIOS: Dell Inc. A09 12/13/2012
Motherboard: Dell Inc. 08KTFF
Processor: Intel(R) Core(TM) i7-3520M CPU @ 2.90GHz
Percentage of memory in use: 31%
Total physical RAM: 16254.88 MB
Available physical RAM: 11195.27 MB
Total Virtual: 32507.9 MB
Available Virtual: 26815.71 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:200 GB) (Free:14.41 GB) NTFS
Drive f: (New Volume) (Fixed) (Total:97.99 GB) (Free:31.2 GB) NTFS

\\?\Volume{f4de852a-795c-11e8-9560-806e6f6e6963}\ (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 476.9 GB) (Disk ID: 523D5AD0)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=200 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=98 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

aswMBR version 1.0.1.2290 Copyright(c) 2014 AVAST Software
Run date: 2019-07-14 21:41:38
-----------------------------
21:41:38.679 OS Version: Windows x64 6.1.7601 Service Pack 1
21:41:38.679 Number of processors: 4 586 0x3A09
21:41:38.680 ComputerName: STEVE-PC UserName: Steve
21:41:39.181 Initialize success
21:41:39.192 VM: initialized successfully
21:41:39.192 VM: Intel CPU supported
21:41:49.027 VM: disk I/O iaStorV.sys
21:44:58.270 AVAST engine defs: 17030301
21:46:48.826 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
21:46:48.830 Disk 0 Vendor: SanDisk_ X218 Size: 488386MB BusType: 8
21:46:48.847 Disk 0 MBR read successfully
21:46:48.852 Disk 0 MBR scan
21:46:48.859 Disk 0 Windows 7 default MBR code
21:46:48.862 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
21:46:48.865 Disk 0 default boot code
21:46:48.869 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 204800 MB offset 206848
21:46:48.873 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 100342 MB offset 419637248
21:46:48.886 Disk 0 scanning C:\Windows\system32\drivers
21:46:51.499 Service scanning
21:46:58.074 Modules scanning
21:46:58.084 Disk 0 trace - called modules:
21:46:58.099 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStorV.sys hal.dll
21:46:58.103 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800db37060]
21:46:58.106 3 CLASSPNP.SYS[fffff880019cd43f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800d545050]
21:46:58.661 AVAST engine scan C:\Windows
21:46:59.008 AVAST engine scan C:\Windows\system32
21:47:58.674 AVAST engine scan C:\Windows\system32\drivers
21:48:02.043 AVAST engine scan C:\Users\Steve
21:48:50.602 AVAST engine scan C:\ProgramData
21:48:54.225 Disk 0 statistics 3842503/0/0 @ 37.44 MB/s
21:48:54.231 Scan finished successfully
21:50:11.910 Disk 0 MBR has been saved successfully to "C:\Users\Steve\Desktop\Virus Removal\MBR.dat"
21:50:11.913 The log file has been saved successfully to "C:\Users\Steve\Desktop\Virus Removal\aswMBR.txt"
 

Malnutrition

Malnurished Mod
Moderator
Security Team
Jul 22, 2016
3,379
551
Download Quick Diag to your desktop.
Very Important!! -- Make sure program is on your desktop.
Disable your Antivirus/Antispyware prior to scanning.
Right Click Run as Administrator.
Select the Quick Scan.








Post the log that is generated in your next post.
 

Malnutrition

Malnurished Mod
Moderator
Security Team
Jul 22, 2016
3,379
551
Drive c: () (Fixed) (Total:200 GB) (Free:14.41 GB) NTFS

Time to free up some space on your HDD, windows needs at least 15% free space....

 

Fla_Panther

PCHF Member
PCHF Member
Sep 19, 2016
38
4
44
Re: C drive ... yes, I know. I just bought a 512GB SSD two weeks ago and cloned my drive over to it. Haven't had time to extend the partition yet. And I came home last night to find my bathroom sink's faucet is broken, so that's taken priority. It's always something, isn't it?


--------------- QuickDiag | [email protected]@n | V5_27.02.19.1 ---------------

----- XP | Vista | 7 | 8 | 8.1 | 10 - 32/64 bits ----- - Start 15/07/2019 10:40:00

Updated 27/02/2019 | 11:10 (GMT) by [email protected]@n
Contact : http://www.sosvirus.net/

Time Zone : (UTC-05:00) Eastern Time (US & Canada)
[******** (Administrator)] - [********-PC] (S-1-5-21-3206243102-205974907-2145499838-1000)

System: Microsoft Windows 7 Professional - Service Pack 1 - (6.1.7601) - BuildType: Multiprocessor Free -

OSLanguage: 1033 (0409) -> ()
System: AutoReboot: True - DebugFilePath: %SystemRoot%\MEMORY.DMP - KernelDumpOnly: False -

OverwriteExistingDebugFile: True - WriteDebugInfo: True - WriteToSystemLog: True
Boot : Microsoft Windows 7 Professional |C:\Windows|\Device\Harddisk0\Partition2
Boot : Normal boot
PC: Latitude E6430 - Dell Inc. - IdNumber: JS7MTW1 - UUID: 4C4C4544-0053-3710-804D-CAC04F545731
Processor : X64 - 2890 Mhz - Intel(R) Core(TM) i7-3520M CPU @ 2.90GHz
BIOS Date: 12/13/12 20:36:48 Ver: A09.00 - en|US|iso8859-1 - Dell Inc. - S/N: JS7MTW1 - A09 - DELL - 1072009
CoreTemp : 63.5 Celsius

----------| Quick


---------- | SoundDevice

Akai EIE Pro Audio - WDM 2.9.30 - Status: OK - Manufacturer: Akai Professional - PNPDeviceID: MEDIA

\AKAI_EIE_AUDIOADAPTER\8&1EF45D8F&0&ID01
Intel(R) Display Audio - Status: OK - Manufacturer: Intel(R) Corporation - PNPDeviceID: HDAUDIO

\FUNC_01&VEN_8086&DEV_2806&SUBSYS_80860101&REV_1000\4&1A5CB910&0&0301
IDT High Definition Audio CODEC - Status: OK - Manufacturer: IDT - PNPDeviceID: HDAUDIO

\FUNC_01&VEN_111D&DEV_76DF&SUBSYS_10280534&REV_1002\4&1A5CB910&0&0001

---------- | Video

Intel(R) HD Graphics 4000 - Resolution: 1280x1024 - Colors: 4294967296 - RefreshRate: 60 - 32 Bits Per Pixel -

DeviceID: VideoController1 - Drivers:

igdumdim64.dll,igd10iumd64.dll,igd10iumd64.dll,igdumdim32,igd10iumd32,igd10iumd32 - PNPDeviceID: PCI

\VEN_8086&DEV_0166&SUBSYS_05341028&REV_09\3&11583659&0&10 - AdapterCompatibility: Intel Corporation - RAM: -

2080374784
Inegrated Video Chipset DeviceName: Intel(R) HD Graphics 4000 - DriverVersion: 10.18.10.4425 -

SpecificationVersion: 1025

---------- | Codecs

c:\windows\system32\imaadp32.acm - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 22016 -

Manufacturer: Microsoft Corporation - Status: OK
c:\windows\system32\msadp32.acm - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 24064 - Manufacturer:

Microsoft Corporation - Status: OK
c:\windows\system32\iyuv_32.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 54272 - Manufacturer:

Microsoft Corporation - Status: OK
c:\windows\system32\tsbyuv.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 14848 - Manufacturer:

Microsoft Corporation - Status: OK
c:\windows\system32\msgsm32.acm - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 29184 - Manufacturer:

Microsoft Corporation - Status: OK
c:\windows\system32\l3codeca.acm - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 81408 -

Manufacturer: Fraunhofer Institut Integrierte Schaltungen IIS - Status: OK
c:\windows\system32\msrle32.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 16384 - Manufacturer:

Microsoft Corporation - Status: OK
c:\windows\system32\msg711.acm - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 14848 - Manufacturer:

Microsoft Corporation - Status: OK
c:\windows\system32\msvidc32.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 38912 -

Manufacturer: Microsoft Corporation - Status: OK
c:\windows\system32\msyuv.dll - ClassName: Win32_CodecFile - FSName: NTFS - FileSize: 25600 - Manufacturer:

Microsoft Corporation - Status: OK

---------- | CPU

CPU #1 value:6 %
CPU #2 value:18 %
CPU #3 value:0 %
CPU #4 value:6 %
Total Overall CPU Usage value:7 %

---------- | Network

Intel[R] 82579LM Gigabit Network Connection : SENT:0 bytes/sec / RECVD:0 bytes/sec
Intel[R] Centrino[R] Advanced-N 6205 : SENT:0 bytes/sec / RECVD:0 bytes/sec
Microsoft Virtual WiFi Miniport Adapter : SENT:0 bytes/sec / RECVD:0 bytes/sec
Microsoft Virtual WiFi Miniport Adapter _2 : SENT:0 bytes/sec / RECVD:0 bytes/sec
isatap.{41B84864-2D3D-4D17-B09E-E347F560F7F7} : SENT:0 bytes/sec / RECVD:0 bytes/sec
isatap.{3D0D15B6-5A19-4873-88B7-D9B5B9D67406} : SENT:0 bytes/sec / RECVD:0 bytes/sec
isatap.{AFE20685-E901-42C7-A0EA-94EC69D7938C} : SENT:0 bytes/sec / RECVD:0 bytes/sec
isatap.mifi.local : SENT:0 bytes/sec / RECVD:0 bytes/sec

Overall -> SEND Maxium:7 bytes/sec, / RECEIVE Maximum:0 bytes/sec

WAN Miniport (SSTP) - - Microsoft - Status: - PnPID : ROOT\MS_SSTPMINIPORT\0000
WAN Miniport (IKEv2) - - Microsoft - Status: - PnPID : ROOT\MS_AGILEVPNMINIPORT\0000
WAN Miniport (L2TP) - - Microsoft - Status: - PnPID : ROOT\MS_L2TPMINIPORT\0000
WAN Miniport (PPTP) - - Microsoft - Status: - PnPID : ROOT\MS_PPTPMINIPORT\0000
WAN Miniport (PPPOE) - - Microsoft - Status: - PnPID : ROOT\MS_PPPOEMINIPORT\0000
WAN Miniport (IPv6) - - Microsoft - Status: - PnPID : ROOT\MS_NDISWANIPV6\0000
WAN Miniport (Network Monitor) - - Microsoft - Status: - PnPID : ROOT\MS_NDISWANBH\0000
Realtek USB GBE Family Controller - - - Status: - PnPID :
WAN Miniport (IP) - - Microsoft - Status: - PnPID : ROOT\MS_NDISWANIP\0000
Microsoft ISATAP Adapter - Tunnel - Microsoft - Status: - PnPID : ROOT\*ISATAP\0000
RAS Async Adapter - - - Status: - PnPID :
Microsoft 6to4 Adapter - Tunnel - Microsoft - Status: - PnPID : ROOT\*6TO4MP\0000
Intel(R) 82579LM Gigabit Network Connection - Ethernet 802.3 - Intel - Status: - PnPID : PCI

\VEN_8086&DEV_1502&SUBSYS_05341028&REV_04\3&11583659&0&C8
Microsoft ISATAP Adapter #2 - Tunnel - Microsoft - Status: - PnPID : ROOT\*ISATAP\0001
Intel(R) Centrino(R) Advanced-N 6205 - Ethernet 802.3 - Intel Corporation - Status: - PnPID : PCI

\VEN_8086&DEV_0082&SUBSYS_13218086&REV_34\4&752EA02&0&00E1
Microsoft ISATAP Adapter #3 - Tunnel - Microsoft - Status: - PnPID : ROOT\*ISATAP\0002
Microsoft Virtual WiFi Miniport Adapter - Ethernet 802.3 - Microsoft - Status: - PnPID : {5D624F94-8850-40C3-

A3FA-A4FD2080BAF3}\VWIFIMP\5&424B243&0&01
Microsoft Virtual WiFi Miniport Adapter #2 - Ethernet 802.3 - Microsoft - Status: - PnPID : {5D624F94-8850-

40C3-A3FA-A4FD2080BAF3}\VWIFIMP\5&424B243&0&02
Microsoft ISATAP Adapter #5 - Tunnel - Microsoft - Status: - PnPID : ROOT\*ISATAP\0004

---------- | Memory

RAM = Total (MB) : 16645 | Free (MB) : 11248
Pagefile = Total (MB) : 33288 | Free (MB) : 27351
Virtual = Total (MB) : 4194 | Free (MB) : 3966

Physical Memory 0 : Capacity: 8589934592 - ChannelA-DIMM0 - Posit.: 1 - Manufacturer: Samsung - PartNumber:

M471B1G73QH0-YK0 - S/N: 16D8CB97
Physical Memory 1 : Capacity: 8589934592 - ChannelB-DIMM0 - Posit.: 2 - Manufacturer: Samsung - PartNumber:

M471B1G73QH0-YK0 - S/N: 16D8CB97

---------- | SID Users

Administrator : [S-1-5-21-3206243102-205974907-2145499838-500]
Guest : [S-1-5-21-3206243102-205974907-2145499838-501]
HomeGroupUser$ : [S-1-5-21-3206243102-205974907-2145499838-1002]
******** : [S-1-5-21-3206243102-205974907-2145499838-1000]
Administrators : [S-1-5-32-544]
Backup Operators : [S-1-5-32-551]
Cryptographic Operators : [S-1-5-32-569]
Distributed COM Users : [S-1-5-32-562]
Event Log Readers : [S-1-5-32-573]
Guests : [S-1-5-32-546]
IIS_IUSRS : [S-1-5-32-568]
Network Configuration Operators : [S-1-5-32-556]
Performance Log Users : [S-1-5-32-559]
Performance Monitor Users : [S-1-5-32-558]
Power Users : [S-1-5-32-547]
Remote Desktop Users : [S-1-5-32-555]
Replicator : [S-1-5-32-552]
Users : [S-1-5-32-545]
HomeUsers : [S-1-5-21-3206243102-205974907-2145499838-1001]

---------- | SystemAccounts

Name: Everyone - SID: S-1-1-0 - SIDType: 5 - Status: OK
Name: LOCAL - SID: S-1-2-0 - SIDType: 5 - Status: OK
Name: CREATOR OWNER - SID: S-1-3-0 - SIDType: 5 - Status: OK
Name: CREATOR GROUP - SID: S-1-3-1 - SIDType: 5 - Status: OK
Name: CREATOR OWNER SERVER - SID: S-1-3-2 - SIDType: 5 - Status: OK
Name: CREATOR GROUP SERVER - SID: S-1-3-3 - SIDType: 5 - Status: OK
Name: OWNER RIGHTS - SID: S-1-3-4 - SIDType: 5 - Status: OK
Name: DIALUP - SID: S-1-5-1 - SIDType: 5 - Status: OK
Name: NETWORK - SID: S-1-5-2 - SIDType: 5 - Status: OK
Name: BATCH - SID: S-1-5-3 - SIDType: 5 - Status: OK
Name: INTERACTIVE - SID: S-1-5-4 - SIDType: 5 - Status: OK
Name: SERVICE - SID: S-1-5-6 - SIDType: 5 - Status: OK
Name: ANONYMOUS LOGON - SID: S-1-5-7 - SIDType: 5 - Status: OK
Name: PROXY - SID: S-1-5-8 - SIDType: 5 - Status: OK
Name: SYSTEM - SID: S-1-5-18 - SIDType: 5 - Status: OK
Name: ENTERPRISE DOMAIN CONTROLLERS - SID: S-1-5-9 - SIDType: 5 - Status: OK
Name: SELF - SID: S-1-5-10 - SIDType: 5 - Status: OK
Name: Authenticated Users - SID: S-1-5-11 - SIDType: 5 - Status: OK
Name: RESTRICTED - SID: S-1-5-12 - SIDType: 5 - Status: OK
Name: TERMINAL SERVER USER - SID: S-1-5-13 - SIDType: 5 - Status: OK
Name: REMOTE INTERACTIVE LOGON - SID: S-1-5-14 - SIDType: 5 - Status: OK
Name: IUSR - SID: S-1-5-17 - SIDType: 5 - Status: OK
Name: LOCAL SERVICE - SID: S-1-5-19 - SIDType: 5 - Status: OK
Name: NETWORK SERVICE - SID: S-1-5-20 - SIDType: 5 - Status: OK
Name: BUILTIN - SID: S-1-5-32 - SIDType: 3 - Status: OK

---------- | Drives

C:\ -> [Fixed] | [] | Total : 200 Go | Free : 14.19 Go -> NTFS (SSD) [RAID]
F:\ -> [Fixed] | [New Volume] | Total : 97.99 Go | Free : 31.2 Go -> NTFS (SSD) [RAID]

Disk Usage Information [1 total Physical Disks]

Physical Drive #0 [C:, F:] : Read:0 bytes/sec, Written:0 bytes/sec Max Read:0 bytes/sec, Max Write:0 bytes/sec

Overall - Read Maximum:0 bytes/sec, Write Maximum:0 bytes/sec

DeviceID: \\.\PHYSICALDRIVE0 - Status: OK - SCSI - Fixed hard disk media - 3 Part. - PnPID : IDE

\DISKSANDISK_SD7SB2Q-512G-1006_______________X2180006\4&241BACD1&0&0.0.0

---------- | Windows updates - Activation - License


W.A.T : :)

Last detection : 2019-07-15 00:12:22
Downloaded last ones : 2019-07-15 00:29:24
Installed last ones : 2019-07-15 00:30:27
Next search : 2019-07-15 21:18:22

Test 1 : Windows Is Activated

Volume License


---------- | Browsers

IE : 11.0.9600.19404 (© Microsoft Corporation.)
GC : 75.0.3770.142 (Copyright 2019 Google LLC.)

Default : "C:\Program Files\Internet Explorer\iexplore.exe"

---------- | FlashPlayer

FlashPlayer ActiveX : 32.0.0.142
FlashPlayer Plugin : 29.0.0.171

---------- | Security

AV :
AS : Windows Defender Disabled
FW : WINDOWS Firewall
WMI : OK
WU: Windows Update Service [Auto(2)] = Running
AS: Windows Defender [Manual(3)] = stopped
WMI: Windows Management Instrumentation [Auto(2)] = Running



---------- | Running processes

296 | [Owner : SYSTEM | Parent : 4(System) | 1.37 Mo] - (.Microsoft Corporation - Windows Session Manager.) -

(6.1.7601.24499) = C:\Windows\System32\smss.exe [12/07/2019 15:59:26] CPU Usage:0 %
404 | [Owner : SYSTEM | Parent : 372() | 5.02 Mo] - (.Microsoft Corporation - Client Server Runtime Process.)

- (6.1.7600.16385) = C:\Windows\System32\csrss.exe [13/07/2009 19:19:49] CPU Usage:0 %
448 | [Owner : SYSTEM | Parent : 372() | 4.86 Mo] - (.Microsoft Corporation - Windows Start-Up Application.) -

(6.1.7600.16385) = C:\Windows\System32\wininit.exe [13/07/2009 19:52:37] CPU Usage:0 %
464 | [Owner : SYSTEM | Parent : 456() | 56.34 Mo] - (.Microsoft Corporation - Client Server Runtime Process.)

- (6.1.7600.16385) = C:\Windows\System32\csrss.exe [13/07/2009 19:19:49] CPU Usage:0 %
512 | [Owner : SYSTEM | Parent : 448(wininit.exe) | 10.82 Mo] - (.Microsoft Corporation - Services and

Controller app.) - (6.1.7601.18829) = C:\Windows\System32\services.exe [26/06/2018 11:46:30] CPU

Usage:0 %
536 | [Owner : SYSTEM | Parent : 448(wininit.exe) | 13.86 Mo] - (.Microsoft Corporation - Local Security

Authority Process.) - (6.1.7601.24499) = C:\Windows\System32\lsass.exe [12/07/2019 15:59:25] CPU

Usage:0 %
544 | [Owner : SYSTEM | Parent : 448(wininit.exe) | 4.8 Mo] - (.Microsoft Corporation - Local Session Manager

Service.) - (6.1.7601.17514) = C:\Windows\System32\lsm.exe [20/11/2010 23:23:53] CPU Usage:0 %
592 | [Owner : SYSTEM | Parent : 456() | 8.74 Mo] - (.Microsoft Corporation - Windows Logon Application.) -

(6.1.7601.24000) = C:\Windows\System32\winlogon.exe [26/06/2018 09:56:04] CPU Usage:0 %
688 | [Owner : SYSTEM | Parent : 512(services.exe) | 11.06 Mo] - (.Microsoft Corporation - Host Process for

Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

Usage:0 %
768 | [Owner : NETWORK SERVICE | Parent : 512(services.exe) | 9.94 Mo] - (.Microsoft Corporation - Host

Process for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13]

CPU Usage:0 %
864 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 24.56 Mo] - (.Microsoft Corporation - Host Process

for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

Usage:0 %
904 | [Owner : SYSTEM | Parent : 512(services.exe) | 24.12 Mo] - (.Microsoft Corporation - Host Process for

Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

Usage:0 %
944 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 20.06 Mo] - (.Microsoft Corporation - Host Process

for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

Usage:0 %
976 | [Owner : SYSTEM | Parent : 512(services.exe) | 50.88 Mo] - (.Microsoft Corporation - Host Process for

Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

Usage:0 %
116 | [Owner : SYSTEM | Parent : 512(services.exe) | 8.67 Mo] - (.IDT, Inc. - IDT PC Audio.) - (1.0.6491.0) =

C:\Program Files\IDT\WDM\stacsv64.exe [26/06/2018 13:41:19] CPU Usage:0 %
972 | [Owner : SYSTEM | Parent : 512(services.exe) | 8.26 Mo] - (.Microsoft Corporation - Host Process for

Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

Usage:0 %
1120 | [Owner : SYSTEM | Parent : 512(services.exe) | 7.54 Mo] - (.Intel Corporation - igfxCUIService Module.)

- (6.15.10.4425) = C:\Windows\System32\igfxCUIService.exe [02/06/2016 13:40:40] CPU Usage:0 %
1260 | [Owner : NETWORK SERVICE | Parent : 512(services.exe) | 18.54 Mo] - (.Microsoft Corporation - Host

Process for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13]

CPU Usage:0 %
1348 | [Owner : SYSTEM | Parent : 904(svchost.exe) | 17.05 Mo] - (.Microsoft Corporation - Windows Wireless

LAN 802.11 Extensibility Framework.) - (6.1.7600.16385) = C:\Windows\System32\wlanext.exe [13/07/2009

20:07:15] CPU Usage:0 %
1360 | [Owner : SYSTEM | Parent : 404(csrss.exe) | 3.11 Mo] - (.Microsoft Corporation - Console Window Host.)

- (6.1.7601.24499) = C:\Windows\System32\conhost.exe [12/07/2019 15:59:25] CPU Usage:0 %
1448 | [Owner : SYSTEM | Parent : 512(services.exe) | 14.36 Mo] - (.Microsoft Corporation - Spooler SubSystem

App.) - (6.1.7601.24000) = C:\Windows\System32\spoolsv.exe [26/06/2018 09:55:35] CPU Usage:0 %
1476 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 16.89 Mo] - (.Microsoft Corporation - Host

Process for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13]

CPU Usage:0 %
1572 | [Owner : SYSTEM | Parent : 512(services.exe) | 7.95 Mo] - (.Microsoft Corporation - Host Process for

Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

Usage:0 %
1616 | [Owner : SYSTEM | Parent : 512(services.exe) | 14.79 Mo] - (.Intel(R) Corporation - Intel(R)

PROSet/Wireless Event Log Service.) - (16.1.0.0) = C:\Program Files\Intel\WiFi\bin\EvtEng.exe [17/07/2013

11:50:08] CPU Usage:0 %
1784 | [Owner : SYSTEM | Parent : 512(services.exe) | 6.14 Mo] - (.Intel(R) Corporation - Intel(R) Capability

Licensing Service Interface.) - (1.31.8.1) = C:\Program Files\Intel\iCLS Client\HeciServer.exe [27/08/2013

14:32:14] CPU Usage:0 %
1856 | [Owner : SYSTEM | Parent : 512(services.exe) | 8.1 Mo] - (.Intel(R) Corporation - Intel(R)

PROSet/Wireless Registry Service.) - (16.1.0.0) = C:\Program Files\Common Files\Intel\WirelessCommon

\RegSrvc.exe [17/07/2013 11:49:16] CPU Usage:0 %
1912 | [Owner : SYSTEM | Parent : 512(services.exe) | 7 Mo] - (.Visioneer Inc. - RoadWarrior 3 Series HAL.) -

(5.1.216.4184) = C:\Program Files\Visioneer\RWAR3\RWAR3HV_0001_0.EXE [29/10/2018 20:46:48] CPU Usage:0

%
1976 | [Owner : SYSTEM | Parent : 512(services.exe) | 6.88 Mo] - (.Visioneer Inc. - RoadWarrior 3 Series

Monitor.) - (5.1.216.4185) = C:\Program Files\Visioneer\RWAR3\RWAR3Monitor.exe [29/10/2018 20:45:37]

CPU Usage:0 %
2004 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 6.51 Mo] - (.Microsoft Corporation - Host Process

for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13] CPU

Usage:0 %
2028 | [Owner : SYSTEM | Parent : 512(services.exe) | 22.2 Mo] - (.Intel® Corporation - Intel® PROSet/Wireless

Zero Configure Service.) - (16.1.0.0) = C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [17/07/2013

11:51:24] CPU Usage:0 %
1288 | [Owner : SYSTEM | Parent : 688(svchost.exe) | 5.92 Mo] - (.Microsoft Corporation - Sink to receive

asynchronous callbacks for WMI client application.) - (6.1.7600.16385) = C:\Windows\System32\wbem\unsecapp.exe

[13/07/2009 19:47:12] CPU Usage:0 %
384 | [Owner : SYSTEM | Parent : 688(svchost.exe) | 26.62 Mo] - (.Microsoft Corporation - WMI Provider Host.)

- (6.1.7601.17514) = C:\Windows\System32\wbem\WmiPrvSE.exe [20/11/2010 23:24:15] CPU Usage:0 %
2304 | [Owner : LOCAL SERVICE | Parent : 904(svchost.exe) | 5.42 Mo] - (.Microsoft Corporation - Windows

Driver Foundation - User-mode Driver Framework Host Process.) - (6.2.9200.16384) = C:\Windows

\System32\WUDFHost.exe [26/06/2018 11:04:20] CPU Usage:0 %
3012 | [Owner : ******** | Parent : 904(svchost.exe) | 33.7 Mo] - (.Microsoft Corporation - Desktop Window

Manager.) - (6.1.7600.16385) = C:\Windows\System32\dwm.exe [13/07/2009 19:37:38] CPU Usage:2 %
3020 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 21.48 Mo] - (.Microsoft Corporation -

PresentationFontCache.exe.) - (3.0.6920.5011) = C:\Windows\Microsoft.NET\Framework64\v3.0\WPF

\PresentationFontCache.exe [20/11/2010 23:24:52] CPU Usage:0 %
2232 | [Owner : ******** | Parent : 512(services.exe) | 16.02 Mo] - (.Microsoft Corporation - Host Process for

Windows Tasks.) - (6.1.7601.18010) = C:\Windows\System32\taskhost.exe [26/06/2018 11:00:30] CPU Usage:0

%
2236 | [Owner : ******** | Parent : 2988() | 82.91 Mo] - (.Microsoft Corporation - Windows Explorer.) -

(6.1.7601.23537) = C:\Windows\explorer.exe [26/06/2018 11:02:30] CPU Usage:0 %
2784 | [Owner : ******** | Parent : 2752() | 12.94 Mo] - (.Intel Corporation - igfxEM Module.) -

(6.15.10.4425) = C:\Windows\System32\igfxEM.exe [02/06/2016 13:40:52] CPU Usage:0 %
2864 | [Owner : ******** | Parent : 2752() | 10.18 Mo] - (.Intel Corporation - igfxHK Module.) -

(6.15.10.4425) = C:\Windows\System32\igfxHK.exe [02/06/2016 13:40:58] CPU Usage:0 %
2884 | [Owner : ******** | Parent : 2752() | 12.18 Mo] - (.Intel Corporation - igfxTray Module.) -

(6.15.10.4425) = C:\Windows\System32\igfxTray.exe [02/06/2016 13:41:06] CPU Usage:0 %
1188 | [Owner : ******** | Parent : 2236(explorer.exe) | 11.17 Mo] - (.IDT, Inc. - IDT PC Audio.) -

(1.0.6491.0) = C:\Program Files\IDT\WDM\sttray64.exe [26/06/2018 13:41:19] CPU Usage:0 %
2744 | [Owner : ******** | Parent : 2236(explorer.exe) | 21.52 Mo] - (.Intel(R) Corporation - Intel(R)

PROSet/Wireless Framework.) - (16.1.0.0) = C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe

[17/07/2013 11:48:56] CPU Usage:0 %
2700 | [Owner : ******** | Parent : 2236(explorer.exe) | 11.07 Mo] - (.Alps Electric Co., Ltd. - Alps

Pointing-device Driver.) - (8.1.101.178) = C:\Program Files\DellTPad\Apoint.exe [26/06/2018 13:44:55]

CPU Usage:0 %
3336 | [Owner : ******** | Parent : 688(svchost.exe) | 6.82 Mo] - (.Microsoft Corporation - Sink to receive

asynchronous callbacks for WMI client application.) - (6.1.7600.16385) = C:\Windows\System32\wbem\unsecapp.exe

[13/07/2009 19:47:12] CPU Usage:0 %
3404 | [Owner : ******** | Parent : 2700(Apoint.exe) | 6.12 Mo] - (.Alps Electric Co., Ltd. - ApMsgFwd.) -

(8.0.0.39) = C:\Program Files\DellTPad\ApMsgFwd.exe [26/06/2018 13:44:55] CPU Usage:0 %
3460 | [Owner : ******** | Parent : 2700(Apoint.exe) | 5.04 Mo] - (.Alps Electric Co., Ltd. - Alps Pointing-

device Driver.) - (7.0.0.30) = C:\Program Files\DellTPad\hidfind.exe [26/06/2018 13:44:55] CPU Usage:0

%
3468 | [Owner : ******** | Parent : 3452() | 5.92 Mo] - (.Alps Electric Co., Ltd. - Alps Pointing-device

Driver for Windows NT/2000/XP/Vista.) - (7.0.1.33) = C:\Program Files\DellTPad\ApntEx.exe [26/06/2018

13:44:55] CPU Usage:0 %
3484 | [Owner : ******** | Parent : 464(csrss.exe) | 5.14 Mo] - (.Microsoft Corporation - Console Window

Host.) - (6.1.7601.24499) = C:\Windows\System32\conhost.exe [12/07/2019 15:59:25] CPU Usage:0 %
3840 | [Owner : SYSTEM | Parent : 512(services.exe) | 54.46 Mo] - (.Microsoft Corporation - Microsoft Windows

Search Indexer.) - (7.0.7601.24275) = C:\Windows\System32\SearchIndexer.exe [10/12/2018 23:07:41] CPU

Usage:0 %
3932 | [Owner : NETWORK SERVICE | Parent : 512(services.exe) | 11.72 Mo] - (.Microsoft Corporation - Windows

Media Player Network Sharing Service.) - (12.0.7601.17514) = C:\Program Files\Windows Media Player

\wmpnetwk.exe [20/11/2010 23:25:05] CPU Usage:0 %
3212 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 14.23 Mo] - (.Microsoft Corporation - Host

Process for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13]

CPU Usage:0 %
3168 | [Owner : LOCAL SERVICE | Parent : 512(services.exe) | 16.07 Mo] - (.Microsoft Corporation - Host

Process for Windows Services.) - (6.1.7600.16385) = C:\Windows\System32\svchost.exe [13/07/2009 19:31:13]

CPU Usage:2 %
3712 | [Owner : NETWORK SERVICE | Parent : 688(svchost.exe) | 19.28 Mo] - (.Microsoft Corporation - WMI

Provider Host.) - (6.1.7601.17514) = C:\Windows\System32\wbem\WmiPrvSE.exe [20/11/2010 23:24:15] CPU

Usage:0 %
4504 | [Owner : ******** | Parent : 2236(explorer.exe) | 197.93 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:2 %
5024 | [Owner : ******** | Parent : 4504(chrome.exe) | 6.1 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
4584 | [Owner : ******** | Parent : 4504(chrome.exe) | 6.85 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
5004 | [Owner : ******** | Parent : 4504(chrome.exe) | 675.98 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
1768 | [Owner : ******** | Parent : 4504(chrome.exe) | 48.85 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
5844 | [Owner : SYSTEM | Parent : 512(services.exe) | 11.98 Mo] - (.Dell Inc. - Dell Data Vault Rules

Processor.) - (5.2.8.103) = C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe [28/02/2019

11:26:18] CPU Usage:0 %
5900 | [Owner : SYSTEM | Parent : 512(services.exe) | 63.44 Mo] - (.PC-Doctor, Inc. - PC-Doctor Dell

SupportAssist API.) - (6.0.7033.2285) = C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist

\6.0.7033.2285\DSAPI.exe [30/05/2019 09:49:45] CPU Usage:0 %
5988 | [Owner : SYSTEM | Parent : 5900(DSAPI.exe) | 149.06 Mo] - (.PC-Doctor, Inc. - PC-Doctor Communications

Manager.) - (6.0.7033.2285) = C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist

\6.0.7033.2285\pcdrwi.exe [30/05/2019 09:49:49] CPU Usage:0 %
5996 | [Owner : SYSTEM | Parent : 404(csrss.exe) | 3.15 Mo] - (.Microsoft Corporation - Console Window Host.)

- (6.1.7601.24499) = C:\Windows\System32\conhost.exe [12/07/2019 15:59:25] CPU Usage:0 %
2360 | [Owner : SYSTEM | Parent : 512(services.exe) | 4.73 Mo] - (.Intel Corporation - Intel(R) Dynamic

Application Loader Host Interface.) - (9.5.12.1682) = C:\Program Files (x86)\Intel\Intel(R) Management Engine

Components\DAL\jhi_service.exe [26/06/2018 13:41:04] CPU Usage:0 %
5520 | [Owner : SYSTEM | Parent : 512(services.exe) | 11.07 Mo] - (.Intel Corporation - Intel(R) Local

Management Service.) - (9.5.10.1628) = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS

\LMS.exe [26/06/2018 13:40:29] CPU Usage:0 %
5152 | [Owner : SYSTEM | Parent : 512(services.exe) | 95.64 Mo] - (.Dell Inc. - Service.) - (3.2.2.119) = C:

\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe [24/05/2019 07:01:56] CPU Usage:0 %
7128 | [Owner : SYSTEM | Parent : 512(services.exe) | 27.77 Mo] - (.Dell Inc. - Dell Data Vault Data Collector

Service.) - (5.2.8.103) = C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe [28/02/2019 11:28:26]

CPU Usage:0 %
2520 | [Owner : SYSTEM | Parent : 512(services.exe) | 5.43 Mo] - (.Dell Inc. - Dell Data Vault Data Collector

Service API.) - (5.2.8.103) = C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe [28/02/2019

11:28:48] CPU Usage:0 %
6816 | [Owner : LOCAL SERVICE | Parent : 688(svchost.exe) | 10.99 Mo] - (.Microsoft Corporation - WMI Provider

Host.) - (6.1.7601.17514) = C:\Windows\System32\wbem\WmiPrvSE.exe [20/11/2010 23:24:15] CPU Usage:0 %
4076 | [Owner : ******** | Parent : 4504(chrome.exe) | 1541.13 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:31 %
4844 | [Owner : ******** | Parent : 4504(chrome.exe) | 69.72 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
5580 | [Owner : ******** | Parent : 4504(chrome.exe) | 188.56 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
612 | [Owner : ******** | Parent : 4504(chrome.exe) | 87.94 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
5408 | [Owner : ******** | Parent : 4504(chrome.exe) | 208.28 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
4284 | [Owner : ******** | Parent : 4504(chrome.exe) | 59.38 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
2256 | [Owner : ******** | Parent : 4504(chrome.exe) | 83.75 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:2 %
5432 | [Owner : ******** | Parent : 4504(chrome.exe) | 129.48 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
6332 | [Owner : LOCAL SERVICE | Parent : 864(svchost.exe) | ?????] - (.Microsoft Corporation - Windows Audio

Device Graph Isolation.) - (6.1.7601.24499) = C:\Windows\System32\audiodg.exe [12/07/2019 15:59:26] CPU

Usage:0 %
6304 | [Owner : ******** | Parent : 2236(explorer.exe) | 15.35 Mo] - (.Microsoft Corporation - Windows

Defender User Interface.) - (6.1.7600.16385) = C:\Program Files\Windows Defender\MSASCui.exe [13/07/2009

19:53:49] CPU Usage:0 %
1868 | [Owner : ******** | Parent : 4504(chrome.exe) | 21.53 Mo] - (.Google LLC - Google Chrome.) -

(75.0.3770.142) = C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [12/07/2019 13:36:58] CPU

Usage:0 %
5940 | [Owner : ******** | Parent : 2236(explorer.exe) | 51.28 Mo] - (.SosVirus - QuickDiag.) - (27.2.19.1) =

C:\Users\********\Desktop\quickdiag_V5_27.02.19.1.exe [15/07/2019 10:23:54] CPU Usage:0 %
3508 | [Owner : SYSTEM | Parent : 3840(SearchIndexer.exe) | 10.08 Mo] - (.Microsoft Corporation - Microsoft

Windows Search Protocol Host.) - (7.0.7601.24275) = C:\Windows\System32\SearchProtocolHost.exe [10/12/2018

23:07:40] CPU Usage:0 %
4348 | [Owner : SYSTEM | Parent : 3840(SearchIndexer.exe) | 8.21 Mo] - (.Microsoft Corporation - Microsoft

Windows Search Filter Host.) - (7.0.7601.24275) = C:\Windows\System32\SearchFilterHost.exe [10/12/2018

23:07:39] CPU Usage:0 %
3644 | [Owner : NETWORK SERVICE | Parent : 688(svchost.exe) | 7.48 Mo] - (.Microsoft Corporation - WMI

Provider Host.) - (6.1.7601.17514) = C:\Windows\SysWOW64\wbem\WmiPrvSE.exe [20/11/2010 23:24:27] CPU

Usage:0 %
3608 | [Owner : NETWORK SERVICE | Parent : 512(services.exe) | 9.02 Mo] - (.Microsoft Corporation - Microsoft

Software Protection Platform Service.) - (6.1.7601.17514) = C:\Windows\System32\sppsvc.exe [20/11/2010

23:23:56] CPU Usage:0 %

---------- | Locked Applications


---------- | Explorer.exe Modules (Microsoft Files Whitelisted)

(.Igor Pavlov.-.7-Zip Shell Extension.) - (18.5.0.0) -- C:\Program Files\7-Zip\7-zip.dll
(.Intel Corporation.-.igfxDTCM Module.) - (6.15.10.4425) -- C:\Windows\system32\igfxDTCM.dll
(.Intel Corporation.-.igfxDH Module.) - (6.15.10.4425) -- C:\Windows\system32\igfxDH.dll
(.Intel Corporation.-.igfxLHM Module.) - (6.15.10.4425) -- C:\Windows\system32\igfxLHM.dll
(.Intel Corporation.-.igfxDI Module.) - (6.15.10.4425) -- C:\Windows\system32\igfxDI.dll
(.Foxit Software Inc..-.ConvertToPDFShellExtension.) - (9.4.0.1491) -- C:\Program Files (x86)\Foxit Software

\Foxit Reader\plugins\ConvertToPDFShellExtension_x64.dll
(..-.ShellHandler for Notepad++ (64 bit).) - (0.1.0.0) -- C:\Program Files (x86)\Notepad++\NppShell_06.dll

---------- | Winlogon.exe Modules (Microsoft Files Whitelisted)


---------- | svchost.exe Modules (Microsoft Files Whitelisted)


---------- | ZeroAccess Check

[HKLM\Software\Classes\CLSID\{1108BE51-F58A-4CDA-BB99-7A0227D11D5E}\InProcServer32] : %systemroot%

\system32\wbem\fastprox.dll
[HKLM\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] : %SystemRoot%

\system32\shell32.dll
[HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] : %systemroot%

\system32\wbem\fastprox.dll
[HKLM\Software\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] : %systemroot%

\system32\wbem\wbemess.dll
[HKLM\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] : %SystemRoot%

\system32\shell32.dll
[HKLM\Software\WOW6432Node\Classes\CLSID\{1108BE51-F58A-4CDA-BB99-7A0227D11D5E}\InProcServer32] : %systemroot

%\system32\wbem\fastprox.dll
[HKLM\Software\WOW6432Node\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] : %SystemRoot

%\system32\shell32.dll
[HKLM\Software\WOW6432Node\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] : %systemroot

%\system32\wbem\fastprox.dll
[HKLM\Software\WOW6432Node\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] : %SystemRoot

%\system32\shell32.dll

---------- | Startings up

Sidebar - (%ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun [HKU\S-1-5-19\SOFTWARE\...\Run]) - User: NT

AUTHORITY\LOCAL SERVICE
Sidebar - (%ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun [HKU\S-1-5-20\SOFTWARE\...\Run]) - User: NT

AUTHORITY\NETWORK SERVICE
SysTrayApp - (C:\Program Files\IDT\WDM\sttray64.exe [HKLM\SOFTWARE\...\Run]) - User: Public
IntelPROSet - ("C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel PROSet/Wireless

[HKLM\SOFTWARE\...\Run]) - User: Public
Apoint - (C:\Program Files\DellTPad\Apoint.exe [HKLM\SOFTWARE\...\Run]) - User: Public

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Command Processor]
"CompletionChar"=9
"DefaultColor"=0
"EnableExtensions"=1
"PathCompletionChar"=9

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU]
"a"=cmd\1
"MRUList"=ab
"b"=regedit\1

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"UserSelectedDefault"=1
"Device"=Foxit Reader PDF Printer,winspool,Ne02:

[HKLM\Software\Microsoft\Command Processor]
"CompletionChar"=64
"DefaultColor"=0
"EnableExtensions"=1
"PathCompletionChar"=64

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"=C:\Program Files\IDT\WDM\sttray64.exe [26/06/2018 13:41:19]
"IntelPROSet"="C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel PROSet/Wireless
"Apoint"=C:\Program Files\DellTPad\Apoint.exe [26/06/2018 13:44:55]

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"IconServiceLib"=IconCodecService.dll
"DdeSendTimeout"=0
"DesktopHeapLogging"=1
"GDIProcessHandleQuota"=10000
"ShutdownWarningDialogTimeout"=4294967295
"USERNestedWindowLimit"=50
"USERPostMessageLimit"=10000
"USERProcessHandleQuota"=10000
""=mnmsrvc
"DeviceNotSelectedTimeout"=15
"Spooler"=yes
"TransmissionRetryTimeout"=90
"AppInit_DLLs"=
"LoadAppInit_DLLs"=0

[HKLM\Software\WOW6432Node\Microsoft\Command Processor]
"CompletionChar"=64
"DefaultColor"=0
"EnableExtensions"=1
"PathCompletionChar"=64

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run]
"IMSS"="C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"
"KeePass 2 PreLoad"="C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe" --preload

[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows]
"IconServiceLib"=IconCodecService.dll
"DdeSendTimeout"=0
"DesktopHeapLogging"=1
"GDIProcessHandleQuota"=10000
"ShutdownWarningDialogTimeout"=4294967295
"USERNestedWindowLimit"=50
"USERPostMessageLimit"=10000
"USERProcessHandleQuota"=10000
""=mnmsrvc
"DeviceNotSelectedTimeout"=15
"Spooler"=yes
"TransmissionRetryTimeout"=90
"AppInit_DLLs"=
"LoadAppInit_DLLs"=0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WebCheck"={E6FB5E20-DE35-11CF-9C87-00AA005127ED}


---------- | Win.ini :



---------- | System.ini :



---------- | Tasks List

Dell SupportAssistAgent AutoUpdate
GoogleUpdateTaskMachineCore
GoogleUpdateTaskMachineUA
{EE1BEB1A-D10C-43A0-9D62-B7BBC4690C0E}

---------- | Startings up registry ¦ Folder


---------- | Control - lsa - SecurityProviders - Session Manager - Terminal Server


[HKLM\System\CurrentControlSet\Control]
"PreshutdownOrder"=wuauserv
gpsvc
trustedinstaller
"WaitToKillServiceTimeout"=2000
"CurrentUser"=USERNAME
"BootDriverFlags"=0
"ServiceControlManagerExtension"=%systemroot%\system32\scext.dll
"SystemStartOptions"= NOEXECUTE=OPTIN
"SystemBootDevice"=multi(0)disk(0)rdisk(0)partition(2)
"FirmwareBootDevice"=multi(0)disk(0)rdisk(0)partition(1)
"ServicesPipeTimeout"=60000

[HKLM\System\CurrentControlSet\Control\lsa]
"auditbaseobjects"=0
"auditbasedirectories"=0
"crashonauditfail"=0
"fullprivilegeauditing"=0x00
"Bounds"=0x0030000000200000
"LimitBlankPasswordUse"=1
"NoLmHash"=1
"Notification Packages"=scecli
"Security Packages"=kerberos
msv1_0
schannel
wdigest
tspkg
pku2u
"Authentication Packages"=msv1_0
"LsaPid"=536
"SecureBoot"=1
"ProductType"=6
"disabledomaincreds"=0
"everyoneincludesanonymous"=0
"forceguest"=0
"restrictanonymous"=1
"restrictanonymoussam"=1

[HKLM\System\CurrentControlSet\Control\SecurityProviders]
"SecurityProviders"=credssp.dll

[HKLM\System\CurrentControlSet\Control\Session Manager]
"CriticalSectionTimeout"=2592000
"GlobalFlag"=0
"HeapDeCommitFreeBlockThreshold"=0
"HeapDeCommitTotalFreeThreshold"=0
"HeapSegmentCommit"=0
"HeapSegmentReserve"=0
"ProcessorControl"=2
"ResourceTimeoutCount"=648000
"BootExecute"=autocheck autochk *
"ExcludeFromKnownDlls"=
"ObjectDirectories"=\Windows
\RPC Control
"ProtectionMode"=1
"NumberOfInitialSessions"=2
"SetupExecute"=
"PendingFileRenameOperations"=\??\C:\Windows\system32\DRIVERS\pfdytcnk.sys

\??\C:\Users\********\AppData\Local

\Microsoft\Windows\Temporary Internet Files\counters.dat

\??\C:\Users\********\AppData\Local\Mozilla\Firefox

\Profiles\54mhv969.default-1563029380061\OfflineCache\index.sqlite

\??\C:\Users\********\AppData\Local\Mozilla

\Firefox\Profiles\54mhv969.default-1563029380061\OfflineCache


[HKLM\System\CurrentControlSet\Control\Terminal Server]
"RCDependentServices"=CertPropSvc
SessionEnv
"NotificationTimeOut"=0
"SnapshotMonitors"=1
"ProductVersion"=5.1
"AllowRemoteRPC"=0
"DelayConMgrTimeout"=0
"fDenyTSConnections"=1
"StartRCM"=0
"TSAdvertise"=0
"DeleteTempDirsOnExit"=1
"fSingleSessionPerUser"=1
"PerSessionTempDir"=0
"TSUserEnabled"=0
"InstanceID"=92d0cf0d-6ab8-4c98-8a4c-6c2c027
"fCredentialLessLogonSupportedTSS"=1
"fCredentialLessLogonSupported"=1
"fCredentialLessLogonSupportedKMRDP"=1


---------- | .LNK with Arguments


---------- | AppCertDlls


---------- | Dnsapi.dll

C:\Windows\System32\dnsapi.dll -> OK : \drivers\etc\hosts
C:\Windows\SysWOW64\dnsapi.dll -> OK : \drivers\etc\hosts

---------- | Policies | Registry

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Control Panel\Desktop]
"ScreenSaveActive"=1
"ActiveWndTrackTimeout"=0
"BlockSendInputResets"=0
"CaretWidth"=1
"ClickLockTime"=1200
"CoolSwitchColumns"=7
"CoolSwitchRows"=3
"CursorBlinkRate"=530
"DockMoving"=1
"DragFromMaximize"=1
"DragFullWindows"=1
"DragHeight"=4
"DragWidth"=4
"FocusBorderHeight"=1
"FocusBorderWidth"=1
"FontSmoothing"=2
"FontSmoothingGamma"=0
"FontSmoothingOrientation"=1
"FontSmoothingType"=2
"ForegroundFlashCount"=7
"ForegroundLockTimeout"=200000
"LeftOverlapChars"=3
"MenuShowDelay"=400
"PaintDesktopVersion"=0
"RightOverlapChars"=3
"SnapSizing"=1
"TileWallpaper"=0
"WallpaperOriginX"=0
"WallpaperOriginY"=0
"WallpaperStyle"=10
"WheelScrollChars"=3
"WheelScrollLines"=3
"WindowArrangementActive"=1
"UserPreferencesMask"=0x9E3E078012000000
"Wallpaper"=
"Pattern Upgrade"=TRUE
"WaitToKillAppTimeout"=2000
"HungAppTimeout"=2000

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer

\HideDesktopIcons\NewStartPanel]
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"=0

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer]
"ExplorerStartupTraceRecorded"=1
"ShellState"=0x240000003028000000000000000000000000000001000000120000000000000022000000
"CleanShutdown"=0
"Browse For Folder Width"=318
"Browse For Folder Height"=288
"link"=0x1D000000

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer

\Advanced]
"Start_SearchFiles"=2
"ServerAdminUI"=0
"Hidden"=2
"ShowCompColor"=1
"HideFileExt"=0
"DontPrettyPath"=0
"ShowInfoTip"=1
"HideIcons"=0
"MapNetDrvBtn"=0
"WebView"=1
"Filter"=0
"SuperHidden"=0
"SeparateProcess"=0
"AutoCheckSelect"=0
"IconsOnly"=0
"ShowTypeOverlay"=1
"ListviewAlphaSelect"=1
"ListviewShadow"=1
"TaskbarAnimations"=1
"StartMenuInit"=4
"Start_ShowMyGames"=0
""=0
"TaskbarSizeMove"=0
"DisablePreviewDesktop"=0
"TaskbarSmallIcons"=1
"TaskbarGlomLevel"=2
"Start_PowerButtonAction"=16
"Start_ShowControlPanel"=2
"Start_ShowMyDocs"=1
"Start_ShowMyMusic"=1
"Start_ShowNetPlaces"=1
"Start_ShowUser"=0
"Start_ShowMyPics"=1
"Start_LargeMFUIcons"=0
"Start_MinMFU"=10
"Start_JumpListItems"=10
"Start_AdminToolsRoot"=2
"StartMenuAdminTools"=1

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer

\WordWheelQuery]
"MRUListEx"=0x080000000700000006000000050000000400000003000000020000000100000000000000FFFFFFFF
"0"=0x73006E00690070000000
"1"=0x7200680065006C000000
"2"=0x3200350031000000
"3"=0x6E006F006E0061006D0065000000
"4"=0x310036000000
"5"=0x66006900720065002000620075006E000000
"6"=0x640061006400640079006F000000
"7"=0x7300690065007200720061000000
"8"=0x2A002E006D00700033000000

[HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers]
"authenticodeenabled"=0

[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableInstallerDetection"=1
"EnableLUA"=1
"EnableSecureUIAPaths"=1
"EnableUIADesktopToggle"=0
"EnableVirtualization"=1
"PromptOnSecureDesktop"=1
"ValidateAdminCodeSignatures"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"scforceoption"=0
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"FilterAdministratorToken"=0
"SlowLinkDetectEnabled"=1

[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]
"NoAddingComponents"=1
"NoComponents"=1

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]
"{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}"=1
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"=1
"{208D2C60-3AEA-1069-A2D7-08002B30309D}"=1
"{871C5380-42A0-1069-A2EA-08002B30309D}"=1
"{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}"=1
"{59031a47-3f72-44a7-89c5-5595fe6b30ee}"=1
"{031E4825-7B94-4dc3-B131-E946B44C8DD5}"=1
"{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}"=1
"{9343812e-1c37-4a49-a12e-4b2d810d956b}"=1

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu]
"{871C5380-42A0-1069-A2EA-08002B30309D}.default"=0
"{9343812e-1c37-4a49-a12e-4b2d810d956b}"=1

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"RegPath"=Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
"Text"[email protected],-30500
"Type"=radio
"CheckedValue"=1
"ValueName"=Hidden
"DefaultValue"=2
"HKeyRoot"=2147483649
"HelpID"=shell.hlp#51105

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer]
"ListViewPopupControl"={8be9f5ea-e746-4e47-ad57-3fb191ca1eed}
"BrowserCFCreator"={57f8510b-a5e2-41da-a8f0-8a5ae85dfffd}
"GlobalFolderSettings"={EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}
"LVPopupSearchControl"={fccf70c8-f4d7-4d8b-8c17-cd6715e37fff}
"FileOpenDialog"={DC1C5A9C-E88A-4dde-A5A1-60F82A20AEF7}
"IconUnderline"=2
"GlobalAssocChangedCounter"=24

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"TaskbarSizeMove"=0

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations]
"Application"=http://go.microsoft.com/fwlink/?LinkId=57426&Ext=%s

[HKLM\Software\WOW6432Node\Policies\Microsoft\Windows\Safer\CodeIdentifiers]
"authenticodeenabled"=0

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=5
"ConsentPromptBehaviorUser"=3
"EnableInstallerDetection"=1
"EnableLUA"=1
"EnableSecureUIAPaths"=1
"EnableUIADesktopToggle"=0
"EnableVirtualization"=1
"PromptOnSecureDesktop"=1
"ValidateAdminCodeSignatures"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"scforceoption"=0
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"FilterAdministratorToken"=0
"SlowLinkDetectEnabled"=1

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoActiveDesktop"=1
"NoActiveDesktopChanges"=1
"ForceActiveDesktopOn"=0

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop]
"NoAddingComponents"=1
"NoComponents"=1

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel]
"{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}"=1
"{20D04FE0-3AEA-1069-A2D8-08002B30309D}"=1
"{208D2C60-3AEA-1069-A2D7-08002B30309D}"=1
"{871C5380-42A0-1069-A2EA-08002B30309D}"=1
"{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}"=1
"{59031a47-3f72-44a7-89c5-5595fe6b30ee}"=1
"{031E4825-7B94-4dc3-B131-E946B44C8DD5}"=1
"{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}"=1
"{9343812e-1c37-4a49-a12e-4b2d810d956b}"=1

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu]
"{871C5380-42A0-1069-A2EA-08002B30309D}.default"=0
"{9343812e-1c37-4a49-a12e-4b2d810d956b}"=1

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"RegPath"=Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
"Text"[email protected],-30500
"Type"=radio
"CheckedValue"=1
"ValueName"=Hidden
"DefaultValue"=2
"HKeyRoot"=2147483649
"HelpID"=shell.hlp#51105

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer]
"ListViewPopupControl"={8be9f5ea-e746-4e47-ad57-3fb191ca1eed}
"BrowserCFCreator"={57f8510b-a5e2-41da-a8f0-8a5ae85dfffd}
"GlobalFolderSettings"={EF8AD2D1-AE36-11D1-B2D2-006097DF8C11}
"LVPopupSearchControl"={fccf70c8-f4d7-4d8b-8c17-cd6715e37fff}
"FileOpenDialog"={DC1C5A9C-E88A-4dde-A5A1-60F82A20AEF7}
"IconUnderline"=2
"GlobalAssocChangedCounter"=32

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"TaskbarSizeMove"=0

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Associations]
"Application"=http://go.microsoft.com/fwlink/?LinkId=57426&Ext=%s


---------- | Winlogon

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ExcludeProfileDirs"=AppData\Local;AppData\LocalLow;$Recycle.Bin
"BuildNumber"=7601
"FirstLogon"=0
"ParseAutoexec"=1

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ReportBootOk"=1
"Shell"=explorer.exe
"PreCreateKnownFolders"={A520A1A4-1780-4FF6-BD18-167343C5AF16}
"Userinit"=C:\Windows\system32\userinit.exe,
"VMApplet"=SystemPropertiesPerformance.exe /pagefile
"AutoRestartShell"=1
"Background"=0 0 0
"CachedLogonsCount"=10
"DebugServerCommand"=no
"ForceUnlockLogon"=0
"LegalNoticeCaption"=
"LegalNoticeText"=
"PasswordExpiryWarning"=5
"PowerdownAfterShutdown"=0
"ShutdownWithoutLogon"=0
"WinStationsDisabled"=0
"DisableCAD"=1
"scremoveoption"=0
"ShutdownFlags"=39
"AutoAdminLogon"=0
"DefaultUserName"=********

[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon]
"ReportBootOk"=1
"Shell"=explorer.exe
"PreCreateKnownFolders"={A520A1A4-1780-4FF6-BD18-167343C5AF16}
"DefaultDomainName"=
"DefaultUserName"=
"Userinit"=userinit.exe
"VMApplet"=SystemPropertiesPerformance.exe /pagefile


---------- | Associations

[HKLM\Software\Classes\.exe]
""=exefile
"Content Type"=application/x-msdownload

[HKLM\Software\Classes\exefile\Shell\Open\Command]
""="%1" %*
"IsolatedCommand"="%1" %*

[HKLM\Software\Classes\.com]
""=comfile

[HKLM\Software\Classes\comfile\Shell\Open\Command]
""="%1" %*

[HKLM\Software\Classes\.reg]
""=regfile

[HKLM\Software\Classes\regfile\Shell\Open\Command]
""=regedit.exe "%1"

[HKLM\Software\Classes\.scr]
""=scrfile

[HKLM\Software\Classes\scrfile\Shell\Open\Command]
""="%1" /S

[HKLM\Software\Classes\.bat]
""=batfile

[HKLM\Software\Classes\batfile\Shell\Open\Command]
""="%1" %*

[HKLM\Software\Classes\.cmd]
""=cmdfile

[HKLM\Software\Classes\cmdfile\Shell\Open\Command]
""="%1" %*

[HKLM\Software\Classes\.pif]
""=piffile

[HKLM\Software\Classes\piffile\Shell\Open\Command]
""="%1" %*

[HKLM\Software\Classes\.inf]
""=inffile

[HKLM\Software\Classes\inffile\Shell\Open\Command]
""=%SystemRoot%\system32\NOTEPAD.EXE %1

[HKLM\Software\Classes\.url]
""=InternetShortcut

[HKLM\Software\Classes\.lnk]
""=lnkfile

[HKLM\Software\Classes\.hta]
"PerceivedType"=text
""=htafile
"Content Type"=application/hta

[HKLM\Software\Classes\htafile\Shell\Open\Command]
""=C:\Windows\SysWOW64\mshta.exe "%1" %*

[HKLM\Software\Classes\InternetShortcut]
"NeverShowExt"=
"InfoTip"=prop:System.Link.TargetUrl;System.Rating;System.Link.Description;System.Link.Comment
"EditFlags"=2
"FullDetails"=prop:System.Link.TargetUrl;System.Rating;System.Link.Description;System.Link.Comment
"IsShortcut"=
"FriendlyTypeName"[email protected]:\Windows\System32\ieframe.dll,-10046
"PreviewDetails"=prop:System.Link.TargetUrl;System.Rating;System.History.VisitCount;System.History.DateChanged

;System.Link.DateVisited;System.Link.Description;System.Link.Comment

[HKLM\Software\Classes\Application.Manifest]
""=Application Manifest
"EditFlags"=65536
"BrowserFlags"=4096
"FriendlyTypeName"[email protected],-200

[HKLM\Software\Classes\Application.Reference]
"NeverShowExt"=
""=Application Reference
"IsShortcut"=
"EditFlags"=131072
"FriendlyTypeName"[email protected],-201

[HKLM\Software\Classes\Folder]
"ContentViewModeLayoutPatternForBrowse"=delta
"ContentViewModeForBrowse"=prop:~System.ItemNameDisplay;~System.LayoutPattern.PlaceHolder;~System.LayoutPatter

n.PlaceHolder;~System.LayoutPattern.PlaceHolder;System.DateModified
"ContentViewModeLayoutPatternForSearch"=alpha
"ContentViewModeForSearch"=prop:~System.ItemNameDisplay;System.DateModified;~System.ItemFolderPathDisplay
""=Folder
"EditFlags"=0xD2030000
"FullDetails"=prop:System.PropGroup.Description;System.ItemNameDisplay;System.ItemTypeText;System.Size
"NoRecentDocs"=
"ThumbnailCutoff"=0
"TileInfo"=prop:System.Title;System.ItemTypeText

[HKLM\Software\WOW6432Node\Classes\.exe]
""=exefile
"Content Type"=application/x-msdownload

[HKLM\Software\WOW6432Node\Classes\exefile\Shell\Open\Command]
""="%1" %*
"IsolatedCommand"="%1" %*

[HKLM\Software\WOW6432Node\Classes\.com]
""=comfile

[HKLM\Software\WOW6432Node\Classes\comfile\Shell\Open\Command]
""="%1" %*

[HKLM\Software\WOW6432Node\Classes\.reg]
""=regfile

[HKLM\Software\WOW6432Node\Classes\regfile\Shell\Open\Command]
""=regedit.exe "%1"

[HKLM\Software\WOW6432Node\Classes\.scr]
""=scrfile

[HKLM\Software\WOW6432Node\Classes\scrfile\Shell\Open\Command]
""="%1" /S

[HKLM\Software\WOW6432Node\Classes\.bat]
""=batfile

[HKLM\Software\WOW6432Node\Classes\batfile\Shell\Open\Command]
""="%1" %*

[HKLM\Software\WOW6432Node\Classes\.cmd]
""=cmdfile

[HKLM\Software\WOW6432Node\Classes\cmdfile\Shell\Open\Command]
""="%1" %*

[HKLM\Software\WOW6432Node\Classes\.pif]
""=piffile

[HKLM\Software\WOW6432Node\Classes\piffile\Shell\Open\Command]
""="%1" %*

[HKLM\Software\WOW6432Node\Classes\.inf]
""=inffile

[HKLM\Software\WOW6432Node\Classes\inffile\Shell\Open\Command]
""=%SystemRoot%\system32\NOTEPAD.EXE %1

[HKLM\Software\WOW6432Node\Classes\.url]
""=InternetShortcut

[HKLM\Software\WOW6432Node\Classes\.lnk]
""=lnkfile

[HKLM\Software\WOW6432Node\Classes\.hta]
"PerceivedType"=text
""=htafile
"Content Type"=application/hta

[HKLM\Software\WOW6432Node\Classes\htafile\Shell\Open\Command]
""=C:\Windows\SysWOW64\mshta.exe "%1" %*

[HKLM\Software\WOW6432Node\Classes\InternetShortcut]
"NeverShowExt"=
"InfoTip"=prop:System.Link.TargetUrl;System.Rating;System.Link.Description;System.Link.Comment
"EditFlags"=2
"FullDetails"=prop:System.Link.TargetUrl;System.Rating;System.Link.Description;System.Link.Comment
"IsShortcut"=
"FriendlyTypeName"[email protected]:\Windows\System32\ieframe.dll,-10046
"PreviewDetails"=prop:System.Link.TargetUrl;System.Rating;System.History.VisitCount;System.History.DateChanged

;System.Link.DateVisited;System.Link.Description;System.Link.Comment

[HKLM\Software\WOW6432Node\Classes\Application.Manifest]
""=Application Manifest
"EditFlags"=65536
"BrowserFlags"=4096
"FriendlyTypeName"[email protected],-200

[HKLM\Software\WOW6432Node\Classes\Application.Reference]
"NeverShowExt"=
""=Application Reference
"IsShortcut"=
"EditFlags"=131072
"FriendlyTypeName"[email protected],-201

[HKLM\Software\WOW6432Node\Classes\Folder]
"ContentViewModeLayoutPatternForBrowse"=delta
"ContentViewModeForBrowse"=prop:~System.ItemNameDisplay;~System.LayoutPattern.PlaceHolder;~System.LayoutPatter

n.PlaceHolder;~System.LayoutPattern.PlaceHolder;System.DateModified
"ContentViewModeLayoutPatternForSearch"=alpha
"ContentViewModeForSearch"=prop:~System.ItemNameDisplay;System.DateModified;~System.ItemFolderPathDisplay
""=Folder
"EditFlags"=0xD2030000
"FullDetails"=prop:System.PropGroup.Description;System.ItemNameDisplay;System.ItemTypeText;System.Size
"NoRecentDocs"=
"ThumbnailCutoff"=0
"TileInfo"=prop:System.Title;System.ItemTypeText

[HKLM\Software\Clients\StartMenuInternet\Firefox-308046B0AF4A39CB\Shell\open\Command]
""="C:\Program Files\Mozilla Firefox\firefox.exe"
[HKLM\Software\Clients\StartMenuInternet\Firefox-308046B0AF4A39CB\InstallInfo]
"ReinstallCommand"="C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal

[HKLM\Software\Clients\StartMenuInternet\Google Chrome\Shell\open\Command]
""="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
[HKLM\Software\Clients\StartMenuInternet\Google Chrome\InstallInfo]
"ReinstallCommand"="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --make-default-browser

[HKLM\Software\Clients\StartMenuInternet\IEXPLORE.EXE\Shell\open\Command]
""=C:\Program Files\Internet Explorer\iexplore.exe [14/07/2019 20:29:18]
[HKLM\Software\Clients\StartMenuInternet\IEXPLORE.EXE\InstallInfo]
"ReinstallCommand"="C:\Windows\System32\ie4uinit.exe" -reinstall

[HKLM\Software\WOW6432Node\Clients\StartMenuInternet\Firefox-308046B0AF4A39CB\Shell\open\Command]
""="C:\Program Files\Mozilla Firefox\firefox.exe"
[HKLM\Software\WOW6432Node\Clients\StartMenuInternet\Firefox-308046B0AF4A39CB\InstallInfo]
"ReinstallCommand"="C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal

[HKLM\Software\WOW6432Node\Clients\StartMenuInternet\Google Chrome\Shell\open\Command]
""="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
[HKLM\Software\WOW6432Node\Clients\StartMenuInternet\Google Chrome\InstallInfo]
"ReinstallCommand"="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --make-default-browser

[HKLM\Software\WOW6432Node\Clients\StartMenuInternet\IEXPLORE.EXE\Shell\open\Command]
""=C:\Program Files\Internet Explorer\iexplore.exe [14/07/2019 20:29:18]
[HKLM\Software\WOW6432Node\Clients\StartMenuInternet\IEXPLORE.EXE\InstallInfo]
"ReinstallCommand"="C:\Windows\System32\ie4uinit.exe" -reinstall


---------- | AppcompatFlags

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion

\AppCompatFlags\Compatibility Assistant\Persisted]
"C:\Users\********\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FCXADT0B

\SupportAssistLauncher.exe"=1
"SIGN.MEDIA=71426 SETUP.EXE"=1
"C:\Users\********\Desktop\Reason\Install Reason 8.exe"=1
"C:\Users\********\Desktop\audacity-win-2.2.2.exe"=1
"C:\Users\********\Desktop\KeePass-2.39.1-Setup.exe"=1
"C:\Users\********\Desktop\vs_community.exe"=1
"C:\Users\********\Desktop\Skype-8.29.0.50.exe"=1
"C:\Users\********\Desktop\out_lame.binf_v164.exe"=1
"C:\Users\********\Desktop\Lame_v3.99.3_for_Windows.exe"=1
"C:\Users\********\Desktop\RW3_5.1.216.4185.XX_.exe"=1
"C:\Users\********\Desktop\temp\PL2303-Prolific_DriverInstaller_v1200.exe"=1
"C:\Users\********\Desktop\EuropaSetup.exe"=1
"C:\Users\********\Desktop\MixMeister Pro 5.1.2.0 + Serial\mmp5all.exe"=1
"C:\Users\********\AppData\Local\Temp\is-45LNO.tmp\CountInstallation.exe"=1
"C:\Users\********\Desktop\FoxitReader941_enu_Setup_Prom.exe"=1
"C:\Users\********\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FCXADT0B

\flashplayer32ax_ra_install.exe"=1
"C:\Users\********\AppData\Roaming\Foxit Software\Addon\Foxit Reader\FoxitReaderUpdater.exe"=1
"C:\Users\********\Desktop\New folder\Install Reason 10.exe"=1
"C:\Users\********\Desktop\uTorrent.exe"=1
"C:\Users\********\Downloads\iZotope Ozone 8 and Neutron 2 Advanced WIN x64x86\iZotope Ozone Advanced v8

00\iZotope_Ozone_Advanced_v8_00.exe"=1
"C:\Users\********\Downloads\iZotope Ozone 8 and Neutron 2 Advanced WIN x64x86\iZotope Neutron Advanced v2

00\iZotope_Neutron_Advanced_v2_00.exe"=1
"C:\Users\********\Desktop\vlc-3.0.6-win64.exe"=1
"C:\Users\********\Desktop\PandaCloudCleaner.exe"=1
"C:\Users\********\Desktop\ChromeSetup.exe"=1
"C:\Users\********\Downloads\Firefox Installer.exe"=1


---------- | IFEO


---------- | Mountpoints2

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion\Explorer

\Mountpoints2\{a08823cb-795d-11e8-b725-e41f28566541}] : E:\RTK_NIC_DRIVER_INSTALLER.sfx.exe (AutoRun)

---------- | Windows

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini\Windows]
"MouseSpeed"=#USR:Control Panel\Mouse
"MouseThreshold1"=#USR:Control Panel\Mouse
"MouseThreshold2"=#USR:Control Panel\Mouse
"SwapMouseButtons"=#USR:Control Panel\Mouse
"Beep"=#USR:Control Panel\Sound
"DoubleClickSpeed"=#USR:Control Panel\Mouse
"CoolSwitch"=USR:Control Panel\Desktop
"DoubleClickHeight"=#USR:Control Panel\Mouse
"DoubleClickWidth"=#USR:Control Panel\Mouse
"DragFullWindows"=USR:Control Panel\Desktop
"InitialKeyboardIndicators"=USR:Control Panel\Keyboard
"LowPowerActive"=#USR:Control Panel\Desktop
"LowPowerTimeOut"=#USR:Control Panel\Desktop
"PowerOffActive"=#USR:Control Panel\Desktop
"PowerOffTimeOut"=#USR:Control Panel\Desktop
"ScreenSaveActive"=#USR:Control Panel\Desktop
"ScreenSaveTimeOut"=#USR:Control Panel\Desktop
"SnapToDefaultButton"=#USR:Control Panel\Mouse
""=USR:Software\Microsoft\Windows NT\CurrentVersion\Windows
"Spooler"=#SYS:Microsoft\Windows NT\CurrentVersion\Windows
"TRANSMISSIONRETRYTIMEOUT"=#SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS
"DEFAULTSEPARATEVDM"=\\REGISTRY\\MACHINE\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\WOW
"APPINIT_DLLS"=SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS
"DEVICENOTSELECTEDTIMEOUT"=#SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS
"SWAPDISK"=SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\Boot]
""=SYS:Microsoft\Windows NT\CurrentVersion\WOW\boot
"ScreenSaverActive"=USR:Control Panel\Desktop
"ScreenSaverIsSecure"=USR:Control Panel\Desktop
"SCRNSAVE.EXE"=USR:Control Panel\Desktop
"Shell"=SYS:Microsoft\Windows NT\CurrentVersion\Winlogon

[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini\Windows]
"MouseSpeed"=#USR:Control Panel\Mouse
"MouseThreshold1"=#USR:Control Panel\Mouse
"MouseThreshold2"=#USR:Control Panel\Mouse
"SwapMouseButtons"=#USR:Control Panel\Mouse
"Beep"=#USR:Control Panel\Sound
"DoubleClickSpeed"=#USR:Control Panel\Mouse
"CoolSwitch"=USR:Control Panel\Desktop
"DoubleClickHeight"=#USR:Control Panel\Mouse
"DoubleClickWidth"=#USR:Control Panel\Mouse
"DragFullWindows"=USR:Control Panel\Desktop
"InitialKeyboardIndicators"=USR:Control Panel\Keyboard
"LowPowerActive"=#USR:Control Panel\Desktop
"LowPowerTimeOut"=#USR:Control Panel\Desktop
"PowerOffActive"=#USR:Control Panel\Desktop
"PowerOffTimeOut"=#USR:Control Panel\Desktop
"ScreenSaveActive"=#USR:Control Panel\Desktop
"ScreenSaveTimeOut"=#USR:Control Panel\Desktop
"SnapToDefaultButton"=#USR:Control Panel\Mouse
"TRANSMISSIONRETRYTIMEOUT"=#SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS
"DEFAULTSEPARATEVDM"=\\REGISTRY\\MACHINE\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\WOW
"APPINIT_DLLS"=SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS
"DEVICENOTSELECTEDTIMEOUT"=#SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS
"SWAPDISK"=SYS:MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\WINDOWS

[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\IniFileMapping\system.ini\Boot]
""=SYS:Microsoft\Windows NT\CurrentVersion\WOW\boot
"ScreenSaverActive"=USR:Control Panel\Desktop
"ScreenSaverIsSecure"=USR:Control Panel\Desktop
"SCRNSAVE.EXE"=USR:Control Panel\Desktop
"Shell"=SYS:Microsoft\Windows NT\CurrentVersion\Winlogon

[HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems]
"windows"=%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On

SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3

ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

---------- | Security center

[HKLM\SOFTWARE\Microsoft\Security Center]
"cval"=1

[HKLM\SOFTWARE\Microsoft\Security Center\svc]
"VistaSp1"=128920218544262440
"AntiVirusOverride"=0
"AntiSpywareOverride"=0
"FirewallOverride"=0

[HKLM\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=1
"DisableRoutinelyTakingAction"=1
"ProductStatus"=0
"InstallTime"=0x00FA25256A0DD401

[HKLM\Software\WOW6432Node\Microsoft\Windows Defender]
"DisableAntiSpyware"=0
"DisableRoutinelyTakingAction"=1

[HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall"=1

[HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=1

[HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall"=1


---------- | Safeboot

[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppMgmt]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Base]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot Bus Extender]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot file system]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CryptSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DcomLaunch]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EFS]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EventLog]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Filter]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Netlogon]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PCI Configuration]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PlugPlay]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PNP Filter]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Power]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Primary disk]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcEptMapper]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SCSI Class]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sermouse.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Bus Extender]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vga.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vmms]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinMgmt]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AFD]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AppInfo]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AppMgmt]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Base]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BFE]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Boot Bus Extender]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Boot file system]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\bowser]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Browser]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CryptSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DcomLaunch]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\dfsc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dhcp]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DnsCache]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dot3Svc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Eaphost]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\EFS]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\EventLog]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\File system]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Filter]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\HelpSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\IKEEXT]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ipnat.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\KeyIso]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LanmanServer]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LanmanWorkstation]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LmHosts]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Messenger]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MPSDrv]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MPSSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mrxsmb]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mrxsmb10]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mrxsmb20]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NativeWifiP]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NDIS]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NDIS Wrapper]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ndiscap]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Ndisuio]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBIOS]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBIOSGroup]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBT]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetDDEGroup]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Netlogon]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetMan]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\netprofm]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Network]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetworkProvider]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NlaSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Nsi]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nsiproxy.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NTDS]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PCI Configuration]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PlugPlay]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PNP Filter]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PNP_TDI]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PolicyAgent]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Power]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Primary disk]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ProfSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdbss]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdpencdd.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdsessmgr]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RpcEptMapper]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RpcSs]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sacsvr]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SCardSvr]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SCSI Class]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sermouse.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SharedAccess]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Streams Drivers]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SWPRV]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\System Bus Extender]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TabletInputService]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TBS]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Tcpip]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TDI]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TrustedInstaller]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VaultSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VDS]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vga.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vgasave.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vmms]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\volmgr.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\volmgrx.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinMgmt]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wlansvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WudfPf]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WudfRd]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WudfSvc]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WudfUsbccidDriver]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{36FC9E60-C465-11CF-8056-444553540000}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{50DD5230-BA8A-11D1-BF5D-0000F805F530}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
[HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]

---------- | Winsock (Whitelist)


---------- | Hosts


---------- | Ping

Pinging google.com [172.217.3.238] with 32 bytes of data:
Reply from 172.217.3.238: bytes=32 time=31ms TTL=51
Reply from 172.217.3.238: bytes=32 time=142ms TTL=51
Reply from 172.217.3.238: bytes=32 time=60ms TTL=51
Reply from 172.217.3.238: bytes=32 time=94ms TTL=51

Ping statistics for 172.217.3.238:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 31ms, Maximum = 142ms, Average = 81ms

---------- | @

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Internet Explorer\Main]
"Disable Script Debugger"=yes
"Anchor Underline"=yes
"Cache_Update_Frequency"=Once_Per_Session
"Display Inline Images"=yes
"Do404Search"=0x01000000
"Local Page"=C:\Windows\system32\blank.htm
"Save_Session_History_On_Exit"=no
"Show_FullURL"=no
"Show_StatusBar"=yes
"Show_ToolBar"=yes
"Show_URLinStatusBar"=yes
"Show_URLToolBar"=yes
"Use_DlgBox_Colors"=yes
"Search Page"=http://go.microsoft.com/fwlink/?LinkId=54896
"XMLHTTP"=1
"NoUpdateCheck"=1
"UseClearType"=no
"Enable Browser Extensions"=yes
"Play_Background_Sounds"=yes
"Play_Animations"=yes
"Start Page"=http://www.dell.com/
"Default_Page_URL"=http://www.dell.com
"DisableFirstRunCustomize"=1
"DisableScriptDebuggerIE"=yes
"OperationalData"=5
"CompatibilityFlags"=0
"SearchBandRestoreBarCount"=0
"SearchBandMigrationVersion"=1
"FullScreen"=no
"Window_Placement"=0x2C0000000200000003000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF2300000023000000780300007B020000
"ImageStoreRandomFolder"=xs9y7oq
"DownloadWindowPlacement"=0x0000000000000000000000000000000000000000000000000000000000000000000000000000000000

000000
"Use FormSuggest"=yes
"Start Page_TIMESTAMP"=0x659D410ED838D501
"SyncHomePage Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy"=
"Check_Associations"=no
"IE11DefaultsFREGPOFileOptions"=0
"IE11DefaultsFREGPOFileCheck"=1
"IE11DefaultsFREGPOCheckTimestamp"=0x533DF504D838D501

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion\Internet

settings]
"IE5_UA_Backup_Flag"=5.0
"User Agent"=Mozilla/4.0 (compatible; MSIE 8.0; Win32)
"EmailName"[email protected]
"PrivDiscUiShown"=1
"EnableHttp1_1"=1
"WarnOnIntranet"=1
"MimeExclusionListForCache"=multipart/mixed multipart/x-mixed-replace multipart/x-byteranges
"AutoConfigProxy"=wininet.dll
"UseSchannelDirectly"=0x01000000
"WarnOnPost"=0x01000000
"UrlEncoding"=0
"SecureProtocols"=2688
"PrivacyAdvanced"=0
"ZonesSecurityUpgrade"=0xFC39CC526C0DD401
"DisableCachingOfSSLPages"=0
"WarnonZoneCrossing"=0
"CertificateRevocation"=1
"EnableNegotiate"=1
"MigrateProxy"=1
"ProxyEnable"=0

[HKLM\Software\Microsoft\Internet Explorer\Main]
"AutoHide"=yes
"Security Risk Page"=about:SecurityRisk
"Extensions Off Page"=about:NoAdd-ons
"Default_Search_URL"=http://go.microsoft.com/fwlink/?LinkId=54896
"Default_Page_URL"=http://go.microsoft.com/fwlink/p/?LinkId=255141
"Anchor_Visitation_Horizon"=0x01000000
"Cache_Percent_of_Disk"=0x0A000000
"Placeholder_Width"=0x1A000000
"Placeholder_Height"=0x1A000000
"Default_Secondary_Page_URL"=
"Use_Async_DNS"=yes
"Start Page"=http://go.microsoft.com/fwlink/p/?LinkId=255141
"Local Page"=C:\Windows\System32\blank.htm
"Search Page"=http://go.microsoft.com/fwlink/?LinkId=54896
"Delete_Temp_Files_On_Exit"=yes
"Enable_Disk_Cache"=yes
"ApplicationTileImmersiveActivation"=1
"AssociationActivationMode"=0
"x86AppPath"=C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

[HKLM\Software\Microsoft\Internet Explorer\AboutURLs]
"blank"=res://mshtml.dll/blank.htm
"NoAdd-onsInfo"=res://ieframe.dll/noaddoninfo.htm
"InPrivate"=res://ieframe.dll/inprivate_win7.htm
"NavigationFailure"=res://ieframe.dll/navcancl.htm
"NoAdd-ons"=res://ieframe.dll/noaddon.htm
"Home"=270
"PostNotCached"=res://ieframe.dll/repost.htm
"DesktopItemNavigationFailure"=res://ieframe.dll/navcancl.htm
"NavigationCanceled"=res://ieframe.dll/navcancl.htm
"SecurityRisk"=res://ieframe.dll/securityatrisk.htm
"Compat"=res://mshtml.dll/compat.htm

[HKLM\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix]
""=http://

[HKLM\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes]
"mosaic"=http://
"www"=http://
"home"=http://
"ftp"=ftp://

[HKLM\Software\Microsoft\Windows\CurrentVersion\Internet settings]
"EnablePunycode"=1
"CodeBaseSearchPath"=CODEBASE
"WarnOnIntranet"=1
"MinorVersion"=0
"ActiveXCache"=C:\Windows\Downloaded Program Files

[HKLM\Software\WOW6432Node\Microsoft\Internet Explorer\Main]
"AutoHide"=yes
"Security Risk Page"=about:SecurityRisk
"Extensions Off Page"=about:NoAdd-ons
"Default_Search_URL"=http://go.microsoft.com/fwlink/?LinkId=54896
"Default_Page_URL"=http://go.microsoft.com/fwlink/p/?LinkId=255141
"Anchor_Visitation_Horizon"=0x01000000
"Cache_Percent_of_Disk"=0x0A000000
"Placeholder_Width"=0x1A000000
"Placeholder_Height"=0x1A000000
"Default_Secondary_Page_URL"=
"Use_Async_DNS"=yes
"Start Page"=http://go.microsoft.com/fwlink/p/?LinkId=255141
"Local Page"=C:\Windows\SysWOW64\blank.htm
"Search Page"=http://go.microsoft.com/fwlink/?LinkId=54896
"Delete_Temp_Files_On_Exit"=yes
"Enable_Disk_Cache"=yes
"Check_Associations"=yes
"ApplicationTileImmersiveActivation"=1
"AssociationActivationMode"=0
"x86AppPath"=C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

[HKLM\Software\WOW6432Node\Microsoft\Internet Explorer\AboutURLs]
"blank"=res://mshtml.dll/blank.htm
"NoAdd-onsInfo"=res://ieframe.dll/noaddoninfo.htm
"InPrivate"=res://ieframe.dll/inprivate_win7.htm
"NavigationFailure"=res://ieframe.dll/navcancl.htm
"NoAdd-ons"=res://ieframe.dll/noaddon.htm
"Home"=270
"PostNotCached"=res://ieframe.dll/repost.htm
"DesktopItemNavigationFailure"=res://ieframe.dll/navcancl.htm
"NavigationCanceled"=res://ieframe.dll/navcancl.htm
"SecurityRisk"=res://ieframe.dll/securityatrisk.htm
"Compat"=res://mshtml.dll/compat.htm

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix]
""=http://

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\URL\Prefixes]
"mosaic"=http://
"www"=http://
"home"=http://
"ftp"=ftp://

[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet settings]
"EnablePunycode"=1
"CodeBaseSearchPath"=CODEBASE
"WarnOnIntranet"=1
"MinorVersion"=0
"ActiveXCache"=C:\Windows\Downloaded Program Files


---------- | Proxy


---------- | reparsepoint


---------- | Detection of offsets


---------- | Notify


---------- | Execution FileExts









---------- | SIOI | SEH | URLSH

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\EnhancedStorageShell] -

{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} -- %SystemRoot%\system32\EhStorShell.dll
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\Offline Files] -

{4E77131D-3629-431c-9818-C5679DC83E81} -- %SystemRoot%\System32\cscui.dll
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\SharingPrivate] -

{08244EE6-92F0-47f2-9FC9-929BAA2E7235} -- %SystemRoot%\system32\ntshrui.dll
[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers

\EnhancedStorageShell] - {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} -- %SystemRoot%\system32\EhStorShell.dll
[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers

\SharingPrivate] - {08244EE6-92F0-47f2-9FC9-929BAA2E7235} -- %SystemRoot%\system32\ntshrui.dll

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=


---------- | Toolbar

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"Locked"=1
"ShowDiscussionButton"=Yes

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"ITBar7Height"=0

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}
"DefaultPackCorrection"=1
"DefaultPackNTCorrection"=1
"KnownProvidersUpgradeTime"=0x22717741BACCD401
"DownloadRetries"=1
"Version"=4
"UpgradeTime"=0x56CB4B08D838D501

[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"={0633EE93-D776-472f-A0FF-E1416B8B2E3A}


---------- | Extensions

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}] : (Se&nd to

OneNote) - []
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}] : (OneNote

Lin&ked Notes) - []
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}] :

(Se&nd to OneNote) - []
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}] :

(OneNote Lin&ked Notes) - []

---------- | SearchScopes

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] - (Bing) - http://www.bing.com/search?pc=COSP&ptag=D031719-

N0400A915F698E57&form=CONBDF&conlogo=CT3335818&q={searchTerms} :
[HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] -

(@ieframe.dll,-12512) - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC :
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] -

(@ieframe.dll,-12512) - http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC :

---------- | Browser Helper Objects

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-

42B3008E02FF}] -> (Office Document Cache Handler) : C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL [21/12/2010

01:05:22]
[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B4F3A835-0E21-

4959-BA22-42B3008E02FF}] -> (Office Document Cache Handler) : C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL

[21/12/2010 01:05:22]

---------- | Chrome

C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\extensions\aapocclcgogkmnckokdopfmhonfmgoek =

: Google & co - Google & co - https://clients2.google.com/service/update2/crx
C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\extensions\aohghmighlieiainnegkcijnfilokake =

: Google & co - Google & co - https://clients2.google.com/service/update2/crx
C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\extensions\apdfllckaahabafndbhieahigkjlhalf =

: Google & co - https://drive.google.com/?usp=chrome_app - Google & co -

[http://docs.google.com/http://drive.google.com/https://docs.google.com/https://drive.google.com/] -

C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo =

: Google & co - http://www.youtube.com - http://www.youtube.com - Google & co -

C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\extensions\felcaaldnbdncclmgdcncolpebgiejap =

: Google & co - Google & co - https://clients2.google.com/service/update2/crx
C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi =

: __MSG_extDesc__ - __MSG_extName__ - https://clients2.google.com/service/update2/crx
C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\extensions\nmmhkkegccagdldgiimedpiccmgmieda =

: Google & co - Google & co - 203784468217.apps.googleusercontent.com -

C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\extensions\pjkljhegncpnkpknbcohdijeoejaedia =

: Google & co - https://mail.google.com/mail - Google & co - [*://mail.google.com/mail] -

C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm =

: Provider for discovery and services for mirroring of Chrome Media Router - Chrome Media Router -

919648714761-55j965o0km033psv3i9qls5mo3qtdrb0.apps.googleusercontent.com -



---------- | Opera


---------- | Firefox


[HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer] - (Adobe® Flash® Player 29.0.0.171 Plugin) : C:\Windows

\system32\Macromed\Flash\NPSWF64_29_0_0_171.dll
[HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE] - () : disabled
[HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0] - (Office Authorization plug-in for

NPAPI browsers) : C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL
[HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=3.0.6] - (VLC Multimedia Plugin) : C:\Program Files

\VideoLAN\VLC\npvlc.dll
[HKLM\Software\WOW6432Node\MozillaPlugins\@adobe.com/FlashPlayer] - (Adobe® Flash® Player 29.0.0.171 Plugin) :

C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_29_0_0_171.dll
[HKLM\Software\WOW6432Node\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf]

- () : C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll
[HKLM\Software\WOW6432Node\MozillaPlugins\@foxitsoftware.com/Foxit Reader

Plugin,version=1.0,application/vnd.fdf] - () : C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins

\npFoxitReaderPlugin.dll
[HKLM\Software\WOW6432Node\MozillaPlugins\@foxitsoftware.com/Foxit Reader

Plugin,version=1.0,application/vnd.xdp] - () : C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins

\npFoxitReaderPlugin.dll
[HKLM\Software\WOW6432Node\MozillaPlugins\@foxitsoftware.com/Foxit Reader

Plugin,version=1.0,application/vnd.xfdf] - () : C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins

\npFoxitReaderPlugin.dll
[HKLM\Software\WOW6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5] - (Intel IPT

WebApi plugin) : C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
[HKLM\Software\WOW6432Node\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater] - (This plugin updates

Intel WebAPI component) : C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT

\npIntelWebAPIUpdater.dll
[HKLM\Software\WOW6432Node\MozillaPlugins\@microsoft.com/GENUINE] - () : disabled
[HKLM\Software\WOW6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0] - (Office Authorization

plug-in for NPAPI browsers) : C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
[HKLM\Software\WOW6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0] - (Microsoft SharePoint

Plug-in for Firefox) : C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
[HKLM\Software\WOW6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3] - (Google Update) : C:

\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll
[HKLM\Software\WOW6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9] - (Google Update) : C:

\Program Files (x86)\Google\Update\1.3.34.11\npGoogleUpdate3.dll


C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\54mhv969.default-1563029380061\Prefs.js

user_pref("browser.startup.homepage_override.buildID", "20190705220548");
user_pref("browser.startup.homepage_override.mstone", "68.0");
user_pref("extensions.activeThemeID", "[email protected]");
user_pref("extensions.blocklist.lastModified", "Wed, 17 Jul 2019 12:38:35 GMT");
user_pref("extensions.blocklist.pingCountTotal", 2);
user_pref("extensions.blocklist.pingCountVersion", 2);
user_pref("extensions.databaseSchema", 31);
user_pref("extensions.getAddons.cache.lastUpdate", 1563150826);
user_pref("extensions.getAddons.databaseSchema", 5);
user_pref("extensions.incognito.migrated", true);
user_pref("extensions.lastAppBuildId", "20190705220548");
user_pref("extensions.lastAppVersion", "68.0");
user_pref("extensions.lastPlatformVersion", "68.0");
user_pref("extensions.pendingOperations", false);
user_pref("extensions.systemAddonSet", "{\"schema\":1,\"addons\":{}}");
user_pref("extensions.ui.dictionary.hidden", true);
user_pref("extensions.ui.lastCategory", "addons://discover/");
user_pref("extensions.ui.locale.hidden", true);
user_pref("extensions.webcompat.perform_injections", true);
user_pref("extensions.webcompat.perform_ua_overrides", true);
user_pref("extensions.webextensions.uuids", "{\"[email protected]\":\"8cf51839-5178-4706-8894-

a7604ccd544e\",\"[email protected]\":\"37e8b279-98eb-40af-ae9e-714ca5e53b59\",\"[email protected]

\":\"9e8e57a4-a57a-465a-93c7-40cf00e8aceb\",\"[email protected]\":\"9feda981-b02b-42b5-bc59-

48e9b1989934\",\"[email protected]\":\"0f4ee8cc-7ede-4f2a-b7f8-d8726fd90941\",\"[email protected]

\":\"f21a9632-2965-4ca3-ad00-41f54b213db7\",\"[email protected]\":\"56c1156f-d2c3-49dc-af9b-

16737fbddbb1\",\"[email protected]\":\"a37be111-df1b-4dc2-b0ab-03c2cc85b89c\",

\"[email protected]\":\"1fda2a1f-e04a-4cac-aa0c-1af55c5ccdb9\",\"[email protected]\":\"1db4767d-

a28b-43bf-9729-274fa7df05e8\",\"[email protected]\":\"8c8e9597-c05c-425f-aba4-606c5ed3d48c\",

\"[email protected]\":\"905358ea-8b10-4d20-98e1-879b9504d9a8\",\"[email protected]\":

\"d39ae4b1-368d-4b56-b802-174647ad82de\"}");

C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\54mhv969.default-1563029380061
C:\Users\********\AppData\Roaming\Mozilla\Firefox\Profiles\w9ra6rx2.default

[Profile0] - Name=default -> Profiles/54mhv969.default-1563029380061

---------- | DNS

[HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters]
"DhcpNameServer"=209.18.47.62 209.18.47.61
[HKLM\SYSTEM\ControlSet001\services\Tcpip\Parameters\Interfaces\{F1ABA7E1-57DC-49E4-8FA4-8A72EEFAFE0B}]
"DhcpNameServer"=209.18.47.62 209.18.47.61
[HKLM\SYSTEM\ControlSet002\services\Tcpip\Parameters\Interfaces\{F1ABA7E1-57DC-49E4-8FA4-8A72EEFAFE0B}]
"DhcpNameServer"=8.8.8.8 8.8.4.4
[HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{F1ABA7E1-57DC-49E4-8FA4-8A72EEFAFE0B}]
"DhcpNameServer"=209.18.47.62 209.18.47.61

---------- | Applications

[HKLM\SOFTWARE\Classes\Applications\ehshell.exe] : "C:\Windows\eHome\ehshell.exe" "%1"
[HKLM\SOFTWARE\Classes\Applications\iexplore.exe] : "C:\Program Files\Internet Explorer\iexplore.exe" %1
[HKLM\SOFTWARE\Classes\Applications\i_view32.exe] : "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1"
[HKLM\SOFTWARE\Classes\Applications\notepad.exe] : %SystemRoot%\system32\NOTEPAD.EXE %1
[HKLM\SOFTWARE\Classes\Applications\ois.exe] : C:\PROGRA~2\MICROS~1\Office14\OIS.EXE /shellOpen "%1"
[HKLM\SOFTWARE\Classes\Applications\photoviewer.dll] : %SystemRoot%\System32\rundll32.exe "%ProgramFiles%

\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
[HKLM\SOFTWARE\Classes\Applications\vlc.exe] : "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file

"%1"
[HKLM\SOFTWARE\Classes\Applications\wmplayer.exe] : "%ProgramFiles(x86)%\Windows Media Player\wmplayer.exe"

/Open "%L"
[HKLM\SOFTWARE\Classes\Applications\wordpad.exe] : "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE" "%1"
[HKLM\SOFTWARE\WOW6432Node\Classes\Applications\ehshell.exe] : "C:\Windows\eHome\ehshell.exe" "%1"
[HKLM\SOFTWARE\WOW6432Node\Classes\Applications\iexplore.exe] : "C:\Program Files\Internet Explorer

\iexplore.exe" %1
[HKLM\SOFTWARE\WOW6432Node\Classes\Applications\i_view32.exe] : "C:\Program Files (x86)\IrfanView

\i_view32.exe" "%1"
[HKLM\SOFTWARE\WOW6432Node\Classes\Applications\notepad.exe] : %SystemRoot%\system32\NOTEPAD.EXE %1
[HKLM\SOFTWARE\WOW6432Node\Classes\Applications\ois.exe] : C:\PROGRA~2\MICROS~1\Office14\OIS.EXE /shellOpen

"%1"
[HKLM\SOFTWARE\WOW6432Node\Classes\Applications\photoviewer.dll] : %SystemRoot%\System32\rundll32.exe

"%ProgramFiles%\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen %1
[HKLM\SOFTWARE\WOW6432Node\Classes\Applications\vlc.exe] : "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-

from-file "%1"
[HKLM\SOFTWARE\WOW6432Node\Classes\Applications\wmplayer.exe] : "%ProgramFiles(x86)%\Windows Media Player

\wmplayer.exe" /Open "%L"
[HKLM\SOFTWARE\WOW6432Node\Classes\Applications\wordpad.exe] : "%ProgramFiles%\Windows NT\Accessories

\WORDPAD.EXE" "%1"

---------- | SvcHost (Whitelist)

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
"regsvc"=RemoteRegistry
"DcomLaunch"=Power
PlugPlay
DcomLaunch
"secsvcs"=WinDefend
"bthsvcs"=bthserv
"PeerDist"=PeerDistSvc
"GPSvcGroup"=GPSvc

[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost]
"DcomLaunch"=Power
PlugPlay
DcomLaunch


---------- | SvcHost - Netsvcs (Whitelist)


---------- | Software

[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\7-Zip]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Alps]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\AppDataLow]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\BitTorrentPersist]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Clients]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Dell Computer Corporation]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Foxit Software]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\[email protected]@n]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Google]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Hewlett-Packard]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Intel]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\iZotope]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Lavasoft]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Macrium]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\MixMeister Technology]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Mozilla]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Netscape]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\ODBC]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Policies]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Propellerhead Software]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\ProtectedStorage]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\RegisteredApplications]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\SimonTatham]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\skype]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\skypeapp-8527ec7da092]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\skypeapp-908498f39d08]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\SmartImage]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\sysinternals]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Trolltech]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Visioneer]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Winamp]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Wow6432Node]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\AppDataLow\Software\Microsoft]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\CurrentVersion]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\DWM]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\Shell]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\ShellNoRoam]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\TabletPC]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows\Windows Error Reporting]
[HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Windows NT\CurrentVersion]
[HKLM\Software\7-Zip]
[HKLM\Software\Alps]
[HKLM\Software\ASIO]
[HKLM\Software\ATI Technologies]
[HKLM\Software\CBSTEST]
[HKLM\Software\Clients]
[HKLM\Software\Dell]
[HKLM\Software\Dell Computer Corporation]
[HKLM\Software\Dell Inc.]
[HKLM\Software\Foxit Software]
[HKLM\Software\[email protected]@n]
[HKLM\Software\IDT]
[HKLM\Software\InstalledOptions]
[HKLM\Software\Intel]
[HKLM\Software\Khronos]
[HKLM\Software\Macromedia]
[HKLM\Software\ManageableUpdatePackage]
[HKLM\Software\Microsoft]
[HKLM\Software\Mozilla]
[HKLM\Software\mozilla.org]
[HKLM\Software\MozillaPlugins]
[HKLM\Software\ODBC]
[HKLM\Software\PC-Doctor]
[HKLM\Software\Policies]
[HKLM\Software\Propellerhead Software]
[HKLM\Software\RegisteredApplications]
[HKLM\Software\SimonTatham]
[HKLM\Software\Sonic]
[HKLM\Software\sysinternals]
[HKLM\Software\VideoLAN]
[HKLM\Software\Visioneer]
[HKLM\Software\Wow6432Node]
[HKLM\Software\Microsoft\Windows\CurrentVersion]
[HKLM\Software\Microsoft\Windows\HTML Help]
[HKLM\Software\Microsoft\Windows\ITStorage]
[HKLM\Software\Microsoft\Windows\ScheduledDiagnostics]
[HKLM\Software\Microsoft\Windows\ScriptedDiagnosticsProvider]
[HKLM\Software\Microsoft\Windows\Tablet PC]
[HKLM\Software\Microsoft\Windows\TabletPC]
[HKLM\Software\Microsoft\Windows\Windows Error Reporting]
[HKLM\Software\Microsoft\Windows\Windows Search]
[HKLM\Software\Microsoft\Windows NT\CurrentVersion]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\AxInstSVGroup]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\defragsvc]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\GPSvcGroup]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalService]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalServiceAndNoImpersonation]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalServiceNetworkRestricted]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalServiceNoNetwork]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalSystemNetworkRestricted]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\NetworkService]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\NetworkServiceRemoteDesktopHyperVAgent]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\NetworkServiceRemoteDesktopPublishing]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\SDRSVC]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\swprv]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\termsvcs]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\utcsvc]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\wcssvc]
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\wercplsupport]
[HKLM\Software\WOW6432Node\ASIO]
[HKLM\Software\WOW6432Node\Foxit Software]
[HKLM\Software\WOW6432Node\Google]
[HKLM\Software\WOW6432Node\IDT]
[HKLM\Software\WOW6432Node\Intel]
[HKLM\Software\WOW6432Node\IrfanView]
[HKLM\Software\WOW6432Node\iZotope, Inc./Neutron 2 Advanced]
[HKLM\Software\WOW6432Node\iZotope, Inc./Ozone 8 Advanced]
[HKLM\Software\WOW6432Node\Khronos]
[HKLM\Software\WOW6432Node\Lame For Audacity]
[HKLM\Software\WOW6432Node\Lavasoft]
[HKLM\Software\WOW6432Node\Line 6]
[HKLM\Software\WOW6432Node\Macromedia]
[HKLM\Software\WOW6432Node\Microsoft]
[HKLM\Software\WOW6432Node\MixMeister Technology]
[HKLM\Software\WOW6432Node\Mozilla]
[HKLM\Software\WOW6432Node\MozillaPlugins]
[HKLM\Software\WOW6432Node\Notepad++]
[HKLM\Software\WOW6432Node\Nullsoft]
[HKLM\Software\WOW6432Node\ODBC]
[HKLM\Software\WOW6432Node\Panda Security]
[HKLM\Software\WOW6432Node\Panda Software]
[HKLM\Software\WOW6432Node\Prolific Technology INC]
[HKLM\Software\WOW6432Node\Visioneer]
[HKLM\Software\WOW6432Node\Clients]
[HKLM\Software\WOW6432Node\Policies]
[HKLM\Software\WOW6432Node\RegisteredApplications]
[HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion]
[HKLM\Software\WOW6432Node\Microsoft\Windows\Help]
[HKLM\Software\WOW6432Node\Microsoft\Windows\HTML Help]
[HKLM\Software\WOW6432Node\Microsoft\Windows\ITStorage]
[HKLM\Software\WOW6432Node\Microsoft\Windows\ScriptedDiagnosticsProvider]
[HKLM\Software\WOW6432Node\Microsoft\Windows\Windows Error Reporting]
[HKLM\Software\WOW6432Node\Microsoft\Windows\Windows Search]
[HKLM\Software\WOW6432Node\Microsoft\Windows\Tablet PC]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalService]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalServiceAndNoImpersonation]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalServiceNetworkRestricted]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalServiceNoNetwork]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\LocalSystemNetworkRestricted]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\netsvcs]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\NetworkService]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\NetworkServiceRemoteDesktopHyperVAgent]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\NetworkServiceRemoteDesktopPublishing]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\termsvcs]
[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SvcHost\wcssvc]

---------- | Drives


F:


---------- | C:

[13/07/2009 23:18:56] - |SHD| - [8531617394] - C:\$Recycle.Bin
[31/10/2018 18:03:25] - |SHD| - [3523720] - C:\Config.Msi
[14/07/2009 01:08:56] - |SHD| - [0] - C:\Documents and Settings
[26/06/2018 13:17:53] - |D| - [281775] - C:\Drivers
[14/07/2019 21:35:29] - |D| - [105575672] - C:\FRST
[MD5.D41D8CD98F00B204E9800998ECF8427E] - [26/06/2018 12:21:24] - |ASH| - (.-.) - [12783353856] - (0.0.0.0) -

C:\hiberfil.sys
[26/06/2018 13:17:53] - |D| - [33569904] - C:\Hotfix
[26/06/2018 10:01:32] - |D| - [37360] - C:\Intel
[27/06/2018 08:28:07] - |RHD| - [649826903] - C:\MSOCache
[MD5.D41D8CD98F00B204E9800998ECF8427E] - [26/06/2018 12:21:24] - |ASH| - (.-.) - [17044475904] - (0.0.0.0) -

C:\pagefile.sys
[13/07/2009 23:20:08] - |D| - [0] - C:\PerfLogs
[13/07/2009 23:20:08] - |RD| - [57066968275] - C:\Program Files
[13/07/2009 23:20:08] - |RD| - [3594947406] - C:\Program Files (x86)
[13/07/2009 23:20:08] - |HD| - [7724597251] - C:\ProgramData
[30/10/2018 18:29:52] - |D| - [0] - C:\python-scripts
[15/07/2019 10:24:39] - |D| - [309016] - C:\QuickDiag
[MD5.413141830607B3FD3B2C82ACD9A3D022] - [15/07/2019 10:40:00] - |A| - (.-.) - [107256] - (0.0.0.0) - C:

\QuickDiag.txt
[MD5.DF70DB7C478D62CDF2903994E01FDBFE] - [15/07/2019 10:26:54] - |RAST| - (.-.) - [234523] - (0.0.0.0) - C:

\QuickDiag_15_07_2019_10_26_54.txt
[26/06/2018 09:29:06] - |SHD| - [295090159] - C:\Recovery
[30/10/2018 18:32:02] - |D| - [311764819] - C:\Sleep Playlist
[26/06/2018 12:21:24] - |SHD| - [0] - C:\System Volume Information
[29/10/2018 20:46:56] - |D| - [0] - C:\temp
[13/07/2009 23:20:08] - |RD| - [71182103676] - C:\Users
[20/03/2019 21:55:37] - |D| - [1471760606] - C:\VSTs
[13/07/2009 23:20:08] - |D| - [27250990995] - C:\Windows

---------- | C:\Windows

[MD5.E809E1FAA8A40B74787077028B385E6E] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\1f8bf2vui4tpp8w
[MD5.7B14EDAD6B2509C7E473EACE82935E27] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\1f8bf4c2m4tpp8w
[MD5.07520BE893D14D360FD558C54DD695C4] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\1f8bf4f5i4tpp8w
[MD5.D954CF6201902E9B47A948AD571BE32A] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\1f8bf7q2d4tpp8w
[MD5.B617806483C7B20495D1C0F5D55349B2] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\1f8bfmk8m4tpp8w
[MD5.5BD7810EA166D44AB32058C2DE503DE4] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\2e2uf4b4q8p2kci
[MD5.F7AB403899391B1EBDA99FAD162E8709] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\4cwyf4jbcce5n1p
[MD5.E560112DBE06C00119562B55876FE48A] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\4cwyfyv7x1w5n1p
[MD5.160C7598C55154670531399F68CEFC2E] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\5b4wf2e7p2v8qio
[MD5.2FBE828181EE5EE81AAE003BDD62CEB8] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\5b4wf4c8n5s1jta
[MD5.7F2833A4520A051C7C82D04943BAF0A0] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\5b4wf4poy2v8qio
[MD5.0A8074B30B1CFB5931BFB39F99E869E4] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\5b4wf4t4k2v8qio
[MD5.5CFE017757A09E53518572C2A0AF4369] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\5b4wf7y1l7q8qio
[MD5.EF5CD7A92582CCFF75D16EE102A9AEEE] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\5b4wffx8w5s1jta
[MD5.A1385BB4C24E0FB3F4D91EECAD0A2B5C] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\5b4wfyk4b2v8qio
[MD5.3F0EBE13E5D5C713288B7748C2CE6C5E] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\5b4wfyn5a5s1jta
[MD5.B16BEA90634E3861F216519F42730387] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\5b4wfyn5s5s1jta
[14/07/2009 01:32:38] - |D| - [802] - C:\Windows\addins
[13/07/2009 23:20:08] - |D| - [6865258] - C:\Windows\AppCompat
[13/07/2009 23:20:08] - |D| - [10942180] - C:\Windows\AppPatch
[13/07/2009 23:20:08] - |RSD| - [1747935411] - C:\Windows\assembly
[MD5.317CD1CE327B6520BF4EE007BCD39E61] - [20/11/2010 23:24:22] - |A| - (.© Microsoft Corporation. - Boot File

Servicing Utility.) - [71168] - (6.1.7601.17514) - C:\Windows\bfsvc.exe
[13/07/2009 23:20:09] - |D| - [29189342] - C:\Windows\Boot
[MD5.5D41CA5B9A5AA7F7F5A71D991FB08DA4] - [14/07/2009 01:38:36] - |AS| - (.-.) - [67584] - (0.0.0.0) - C:

\Windows\bootstat.dat
[13/07/2009 23:20:09] - |D| - [2418176] - C:\Windows\Branding
[21/11/2010 03:17:10] - |D| - [0] - C:\Windows\CSC
[MD5.A4C15BCAD35B4DB7A9DCF859B4E0BEF7] - [26/06/2018 13:17:53] - |RA| - (.-.) - [13] - (0.0.0.0) - C:\Windows

\csup.txt
[13/07/2009 23:20:09] - |D| - [2113488] - C:\Windows\Cursors
[14/07/2009 00:45:54] - |D| - [29552] - C:\Windows\debug
[26/06/2018 13:45:10] - |D| - [948] - C:\Windows\Dell
[14/07/2009 01:32:38] - |D| - [3003724] - C:\Windows\diagnostics
[14/07/2009 01:37:46] - |D| - [0] - C:\Windows\DigitalLocker
[14/07/2009 01:32:38] - |D| - [65] - C:\Windows\Downloaded Program Files
[MD5.94F1B93B30FECAD7F8DDF99037EF8D23] - [14/11/2018 18:47:04] - |A| - (.-.) - [6058] - (0.0.0.0) - C:

\Windows\DPINST.LOG
[21/11/2010 03:17:11] - |D| - [117959641] - C:\Windows\ehome
[14/07/2009 01:37:46] - |D| - [110080] - C:\Windows\en-US
[MD5.BCCD6F8B278450DE25224C0157789584] - [26/06/2018 13:45:10] - |A| - (.-.) - [17776] - (0.0.0.0) - C:

\Windows\EvtMessage.dll
[MD5.38AE1B3C38FAEF56FE4907922F0385BA] - [26/06/2018 11:02:30] - |A| - (.© Microsoft Corporation. - Windows

Explorer.) - [3229696] - (6.1.7601.23537) - C:\Windows\explorer.exe
[13/07/2009 23:20:09] - |RSD| - [388351939] - C:\Windows\Fonts
[MD5.92BB2E9AA28542C685C59EFCBAC2490B] - [13/07/2009 19:22:13] - |A| - (.© Microsoft Corporation. - BitLocker

Drive Encryption Servicing Utility.) - [15360] - (6.1.7600.16385) - C:\Windows\fveupdate.exe
[13/07/2009 23:20:09] - |D| - [32090797] - C:\Windows\Globalization
[13/07/2009 23:20:09] - |D| - [30366808] - C:\Windows\Help
[MD5.A66E522F3CBFB8709EA37844922A002E] - [26/06/2018 09:55:47] - |A| - (.© Microsoft Corporation. - Microsoft

Help and Support.) - [733696] - (6.1.7601.23834) - C:\Windows\HelpPane.exe
[MD5.12589371C087A76B6E8E152939E59E98] - [26/06/2018 09:55:46] - |A| - (.© Microsoft Corporation. - Microsoft®

HTML Help Executable.) - [16896] - (6.1.7601.24134) - C:\Windows\hh.exe
[13/07/2009 23:20:09] - |D| - [143540740] - C:\Windows\IME
[13/07/2009 23:20:10] - |D| - [148300674] - C:\Windows\inf
[26/06/2018 11:09:19] - |SHD| - [1914297515] - C:\Windows\Installer
[13/07/2009 23:20:10] - |D| - [48371] - C:\Windows\L2Schemas
[13/07/2009 23:20:10] - |D| - [0] - C:\Windows\LiveKernelReports
[13/07/2009 23:20:10] - |D| - [75617344] - C:\Windows\Logs
[13/07/2009 23:20:10] - |RSD| - [13327133] - C:\Windows\Media
[MD5.D0F3DD75203DB96D38BDA64F492F1E87] - [04/07/2018 21:03:29] - |A| - (.-.) - [749232895] - (0.0.0.0) - C:

\Windows\MEMORY.DMP
[MD5.23AF90D2355D8C83AA4567EF1763B467] - [13/07/2009 20:10:29] - |A| - (.-.) - [43131] - (0.0.0.0) - C:

\Windows\mib.bin
[13/07/2009 23:20:10] - |D| - [873800845] - C:\Windows\Microsoft.NET
[26/06/2018 11:09:31] - |D| - [4398] - C:\Windows\Migration
[04/07/2018 21:03:31] - |D| - [2222584] - C:\Windows\Minidump
[13/07/2009 23:20:10] - |D| - [0] - C:\Windows\ModemLogs
[MD5.B9FB94A8DA62711C6955825DEFB25C5A] - [13/07/2009 22:35:42] - |A| - (.-.) - [1405] - (0.0.0.0) - C:

\Windows\msdfmap.ini
[MD5.B32189BDFF6E577A92BAA61AD49264E6] - [26/06/2018 11:06:21] - |A| - (.© Microsoft Corporation. - Notepad.)

- [193536] - (6.1.7601.18917) - C:\Windows\notepad.exe
[14/07/2009 01:32:38] - |D| - [65] - C:\Windows\Offline Web Pages
[26/06/2018 13:18:27] - |D| - [0] - C:\Windows\Panther
[27/06/2018 08:31:04] - |D| - [0] - C:\Windows\PCHEALTH
[14/07/2009 01:32:38] - |D| - [62438456] - C:\Windows\Performance
[MD5.AFB1846B83AAEE4BCADCA21260DB9733] - [18/07/2018 16:20:26] - |A| - (.-.) - [69938] - (0.0.0.0) - C:

\Windows\PFRO.log
[13/07/2009 23:20:10] - |D| - [1109514] - C:\Windows\PLA
[13/07/2009 23:20:10] - |D| - [4903900] - C:\Windows\PolicyDefinitions
[26/06/2018 12:22:12] - |D| - [52004630] - C:\Windows\Prefetch
[MD5.FFB8B91BD19E5BC10A3344AAF34880F3] - [21/11/2010 03:17:51] - |A| - (.-.) - [53551] - (0.0.0.0) - C:

\Windows\Professional.xml
[MD5.2E2C937846A0B8789E5E91739284D17A] - [13/07/2009 19:27:10] - |A| - (.© Microsoft Corporation. - Registry

Editor.) - [427008] - (6.1.7600.16385) - C:\Windows\regedit.exe
[13/07/2009 23:20:10] - |D| - [22588] - C:\Windows\Registration
[13/07/2009 23:20:10] - |D| - [5807844] - C:\Windows\rescache
[13/07/2009 23:20:10] - |D| - [1674534] - C:\Windows\Resources
[13/07/2009 23:20:10] - |D| - [0] - C:\Windows\SchCache
[13/07/2009 23:20:10] - |D| - [58021] - C:\Windows\schemas
[13/07/2009 23:20:10] - |D| - [2215878] - C:\Windows\security
[14/07/2009 00:45:47] - |D| - [53275028] - C:\Windows\ServiceProfiles
[13/07/2009 23:20:10] - |D| - [159759889] - C:\Windows\servicing
[14/07/2009 00:45:50] - |D| - [4038] - C:\Windows\Setup
[MD5.D1E4D206D7DF436266301ACCA3CC853A] - [18/07/2018 16:20:51] - |A| - (.-.) - [24250] - (0.0.0.0) - C:

\Windows\setupact.log
[MD5.D41D8CD98F00B204E9800998ECF8427E] - [18/07/2018 16:20:51] - |A| - (.-.) - [0] - (0.0.0.0) - C:\Windows

\setuperr.log
[27/06/2018 08:28:38] - |D| - [35886] - C:\Windows\SHELLNEW
[26/06/2018 12:24:33] - |D| - [1836341289] - C:\Windows\SoftwareDistribution
[13/07/2009 23:20:10] - |D| - [181014046] - C:\Windows\Speech
[MD5.D01628AF9F7FB3F415B357D446FBE6D9] - [20/11/2010 23:24:16] - |A| - (.© Microsoft Corporation. - Print

driver host for 32bit applications.) - [67072] - (6.1.7601.17514) - C:\Windows\splwow64.exe
[MD5.9060C3C745E7B2D8E1A81DD061021546] - [14/07/2009 01:28:38] - |A| - (.-.) - [48201] - (0.0.0.0) - C:

\Windows\Starter.xml
[13/07/2009 23:20:10] - |D| - [0] - C:\Windows\system
[MD5.286A9EDB379DC3423A528B0864A0F111] - [13/07/2009 22:34:57] - |A| - (.-.) - [219] - (0.0.0.0) - C:\Windows

\system.ini
[13/07/2009 23:20:10] - |D| - [3965717846] - C:\Windows\System32
[13/07/2009 23:20:14] - |D| - [1227294567] - C:\Windows\SysWOW64
[13/07/2009 23:20:14] - |D| - [15] - C:\Windows\TAPI
[13/07/2009 23:20:14] - |D| - [17170] - C:\Windows\Tasks
[13/07/2009 23:20:14] - |D| - [90185128] - C:\Windows\Temp
[13/07/2009 23:20:14] - |D| - [0] - C:\Windows\tracing
[MD5.0BEA3F79A36B1F67B2CE0F595524C77C] - [10/06/2009 17:41:17] - |A| - (.- Twain Source Manager (Image

Acquisition Interface).) - [94784] - (1.7.0.0) - C:\Windows\twain.dll
[14/07/2009 01:32:38] - |D| - [14385108] - C:\Windows\twain_32
[MD5.163A95975E1D8819E653AA3E961371CA] - [20/11/2010 23:25:10] - |A| - (.- Twain_32 Source Manager (Image

Acquisition Interface).) - [51200] - (1.7.1.3) - C:\Windows\twain_32.dll
[29/10/2018 20:45:56] - |D| - [16988116] - C:\Windows\Twain_64
[MD5.F36A271706EDD23C94956AFB56981184] - [13/07/2009 18:47:26] - |A| - (.- Twain_32.dll Client's 16-Bit

Thunking Server.) - [49680] - (1.7.0.0) - C:\Windows\twunk_16.exe
[MD5.0BD6E68F3EA0DD62CD86283D86895381] - [13/07/2009 20:14:40] - |A| - (.- Twain.dll Client's 32-Bit Thunking

Server.) - [31232] - (1.7.1.0) - C:\Windows\twunk_32.exe
[MD5.85726231A5D21A86BEF871F552ECBB0F] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\ugisf2r8ffbdd5t
[06/04/2019 14:02:57] - |D| - [3553943] - C:\Windows\usb-audio.deAkaiEIE
[MD5.F5F5F500A20CB350BA5DE93BE7E8763F] - [26/06/2018 13:17:54] - |RAH| - (.-.) - [29] - (0.0.0.0) - C:

\Windows\version
[13/07/2009 23:20:14] - |D| - [12420] - C:\Windows\Vss
[13/07/2009 23:20:14] - |D| - [44155055] - C:\Windows\Web
[MD5.2465EBC8CD6E412CDC1AB9FEF40BCAE6] - [13/07/2009 22:34:57] - |A| - (.-.) - [478] - (0.0.0.0) - C:\Windows

\win.ini
[MD5.5A5CFF37F1BD0F86B9BDAAD7A9445882] - [14/07/2009 00:54:24] - |RAH| - (.-.) - [749] - (0.0.0.0) - C:

\Windows\WindowsShell.Manifest
[MD5.55F310719071386CAC1A8DE3736F4435] - [26/06/2018 12:24:31] - |A| - (.-.) - [1916132] - (0.0.0.0) - C:

\Windows\WindowsUpdate.log
[MD5.1D420D66250BCAAAED05724FB34008CF] - [13/07/2009 20:12:29] - |A| - (.© Microsoft Corporation. - Windows

Winhlp32 Stub.) - [9728] - (6.1.7600.16385) - C:\Windows\winhlp32.exe
[13/07/2009 23:20:14] - |D| - [13228677245] - C:\Windows\winsxs
[MD5.DC17DD0189B0C36D863B4DD0A036C10F] - [10/06/2009 16:52:44] - |A| - (.-.) - [316640] - (0.0.0.0) - C:

\Windows\WMSysPr9.prx
[MD5.F8ED3B4B209E2CB49028E36CF06CA851] - [13/07/2009 19:56:28] - |A| - (.© Microsoft Corporation. - Windows

Write.) - [10240] - (6.1.7600.16385) - C:\Windows\write.exe
[MD5.77802F8703462B1721F42CB116E606B8] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\yxa4f1odk8u8v5
[MD5.51E998034011BA21C7AB51136DC3B004] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\yxa4f1w5a8u8v5
[MD5.FD9D0357DF3715976C84D19284658D09] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\yxa4fff5a8u8v5
[MD5.B9A2867AC53D9A75E99448D43DE3D615] - [04/08/2004 03:56:46] - |AH| - (.-.) - [28] - (0.0.0.0) - C:\Windows

\yxa4fmw5a8u8v5

---------- | C:\Windows\System32\GroupPolicy


---------- | Systemroot\System


---------- | Systemroot\Installer (Microsoft Files Whitelisted)

[26/06/2018 22:12:55] - C:\Windows\Installer\10406fa.msi : (7-Zip (x64 edition) Package - Igor Pavlov)

[Offsets ok ! : D0CF11E0A1B11AE10000000000000000]
[12/07/2019 13:36:26] - C:\Windows\Installer\16985d.msi : (Google Update Helper - Google LLC)

[Offsets ok ! : D0CF11E0A1B11AE10000000000000000]
[02/06/2016 15:08:14] - C:\Windows\Installer\3f5a6b7f.msi : (Visioneer RoadWarrior 3 Series Driver - Visioneer

Inc.) [Offsets ok ! : D0CF11E0A1B11AE10000000000000000]
[02/06/2016 14:44:00] - C:\Windows\Installer\3f5a6b86.msi : (Visioneer Acuity Assets V1 - Visioneer Inc.)

[Offsets ok ! : D0CF11E0A1B11AE10000000000000000]
[17/01/2019 20:46:44] - C:\Windows\Installer\7652fd62.msi : ( -) [Offsets ok ! :

D0CF11E0A1B11AE10000000000000000]
[30/05/2019 09:44:38] - C:\Windows\Installer\b8ad7f5.msi : (Dell SupportAssist - Dell Inc.) [Offsets

ok ! : D0CF11E0A1B11AE10000000000000000]
[26/06/2018 21:10:23] - C:\Windows\Installer\ceac6b.msi : (PuTTY release 0.70 installer - Simon Tatham)

[Offsets ok ! : D0CF11E0A1B11AE10000000000000000]
[13/11/2013 15:23:14] - C:\Windows\Installer\e73ad.msi : (Intel(R) Trusted Connect Service Client - Intel

Corporation) [Offsets ok ! : D0CF11E0A1B11AE10000000000000000]
[25/07/2013 03:00:48] - C:\Windows\Installer\e73b2.msi : (Intel® WiFi - Intel Corporation) [Offsets

ok ! : D0CF11E0A1B11AE10000000000000000]
[17/07/2013 14:57:16] - C:\Windows\Installer\e73b7.msi : (Intel® WiFi - Intel Corporation) [Offsets

ok ! : D0CF11E0A1B11AE10000000000000000]
[17/07/2013 14:57:24] - C:\Windows\Installer\e73bc.msi : (Intel® WiFi - Intel Corporation) [Offsets

ok ! : D0CF11E0A1B11AE10000000000000000]
[09/04/2019 19:34:58] - [41828352] - (.().-. - ()) - C:\Windows\Installer\1af6a9a8.msp
[15/05/2019 22:28:12] - [41816064] - (.().-. - ()) - C:\Windows\Installer\1afd1dd3.msp
[07/06/2018 07:41:40] - [10661888] - (.().-. - ()) - C:\Windows\Installer\1f3b43.msp
[14/08/2018 17:08:56] - [41676800] - (.().-. - ()) - C:\Windows\Installer\1fcc0b.msp
[31/08/2018 01:38:14] - [41668608] - (.().-. - ()) - C:\Windows\Installer\23c104.msp
[07/07/2011 18:53:20] - [14467072] - (.().-. - ()) - C:\Windows\Installer\33719d1.msp
[07/07/2011 18:53:20] - [11155456] - (.().-. - ()) - C:\Windows\Installer\3371a0f.msp
[07/07/2011 18:53:20] - [16972800] - (.().-. - ()) - C:\Windows\Installer\3371a24.msp
[07/07/2011 18:53:20] - [11056128] - (.().-. - ()) - C:\Windows\Installer\3371a37.msp
[07/07/2011 18:53:20] - [13031936] - (.().-. - ()) - C:\Windows\Installer\3371a5e.msp
[07/07/2011 18:53:20] - [2426880] - (.().-. - ()) - C:\Windows\Installer\3371a65.msp
[07/07/2011 18:53:20] - [608768] - (.().-. - ()) - C:\Windows\Installer\3371a6c.msp
[07/07/2011 18:53:20] - [3459584] - (.().-. - ()) - C:\Windows\Installer\3371ba6.msp
[07/07/2011 18:53:20] - [3994624] - (.().-. - ()) - C:\Windows\Installer\3371bb5.msp
[28/06/2011 21:27:28] - [4028928] - (.().-. - ()) - C:\Windows\Installer\a6453.msp
[28/06/2011 21:21:32] - [4637184] - (.().-. - ()) - C:\Windows\Installer\e5797.msp
[04/06/2019 03:15:38] - [41811968] - (.().-. - ()) - C:\Windows\Installer\f11588.msp

---------- | %System%\*.in*

[14/07/2009 00:57:09] - [73] - C:\Windows\System32\desktop.ini
[26/06/2018 11:38:47] - [16303] - C:\Windows\System32\ieuinit.inf
[14/07/2009 01:13:15] - [781790] - C:\Windows\System32\PerfStringBackup.INI
[10/06/2009 17:01:25] - [60124] - C:\Windows\System32\tcpmon.ini
[26/06/2018 11:38:47] - [16303] - C:\Windows\Syswow64\ieuinit.inf
[14/07/2009 00:55:01] - [535] - C:\Windows\Syswow64\mapisvc.inf
[26/06/2018 11:10:24] - [774404] - C:\Windows\Syswow64\PerfStringBackup.INI

---------- | Listing no Microsoft signed files (Not necessary Malwares) | system32 | Syswow64 | General scan

[MD5.6712E83EA2BF4FB46A316EEEF51E8101] - |A| - [03/07/2019 22:16:13] - (.-.) - [124.99 Ko] - (0.0.0.0) - C:

\Windows\AppPatch\AppPatch64\sysmain.sdb
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:08] - [0 Ko] - C:\Windows\AppPatch\Custom

\Custom64
[MD5.00000000000000000000000000000000] - |D| - [08/05/2019 08:49:50] - [0 Ko] - C:\Windows\Temp\7zS6D2D.tmp
[MD5.00000000000000000000000000000000] - |D| - [19/03/2019 18:13:17] - [0 Ko] - C:\Windows\Temp\7zSBC48.tmp
[MD5.00000000000000000000000000000000] - |D| - [07/04/2019 14:54:28] - [0 Ko] - C:\Windows\Temp\7zSD1CA.tmp
[MD5.E9E131B47B5F401894A1256C945DA58D] - |A| - [15/08/2018 09:58:26] - (.-.) - [4.47 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00000.log
[MD5.ED15F7C2043E446541E5E18DE0273940] - |A| - [15/08/2018 09:58:37] - (.-.) - [2.9 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00001.log
[MD5.A6207B26D0687EFDFC7EE1A866022ECB] - |A| - [10/12/2018 23:13:31] - (.-.) - [4.47 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00002.log
[MD5.D000CCB7D2D8D1B66A365C1C6630A10E] - |A| - [10/12/2018 23:13:44] - (.-.) - [2.9 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00003.log
[MD5.A46CF44A5F4E47BB421AC92579F70B1E] - |A| - [10/12/2018 23:16:39] - (.-.) - [4.47 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00004.log
[MD5.DA4FAFF057A0032BDBE8D448027D0076] - |A| - [10/12/2018 23:16:50] - (.-.) - [2.9 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00005.log
[MD5.305F9377876CCA3D256621465AADF1DB] - |A| - [10/12/2018 23:20:54] - (.-.) - [4.47 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00006.log
[MD5.6595E9949FE6B2A6B8F388519B83C182] - |A| - [10/12/2018 23:21:04] - (.-.) - [2.9 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00007.log
[MD5.F3492D2CA7E1136B24D9D4B0E6CB2249] - |A| - [03/07/2019 22:22:19] - (.-.) - [4.47 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00008.log
[MD5.BCCB51111B4C3188D527EF7D5FB12B6C] - |A| - [03/07/2019 22:22:46] - (.-.) - [2.9 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00009.log
[MD5.B41CC0595BAD22F30B191D997F54E405] - |A| - [03/07/2019 22:28:41] - (.-.) - [4.47 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00010.log
[MD5.658F72C1515F61708B9BF9CA273284EE] - |A| - [03/07/2019 22:28:49] - (.-.) - [2.9 Ko] - (0.0.0.0) - C:

\Windows\Temp\ASPNETSetup_00011.log
[MD5.B2EA5738FB72DEA3116B7AFDDD59D9E6] - |A| - [09/10/2018 21:54:09] - (.-.) - [3.89 Ko] - (0.0.0.0) - C:

\Windows\Temp\AutoUpdateScheduler.xml
[MD5.00000000000000000000000000000000] - |D| - [14/07/2019 20:29:33] - [0 Ko] - C:\Windows\Temp\C78D8CC8-

270A-44A8-ACEF-885EF75722CE-Sigs
[MD5.00000000000000000000000000000000] - |D| - [12/07/2019 13:36:51] - [0.04 Ko] - C:\Windows\Temp\Crashpad
[MD5.F9E6B0E3691B63E4A0F7D4E00A83655A] - |A| - [23/10/2018 21:05:06] - (.-.) - [24.57 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat445A.tmp
[MD5.AE05638BF81CBF345EBCD8B470E409AF] - |A| - [23/10/2018 21:05:06] - (.-.) - [18.72 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat446A.tmp
[MD5.46E48CE0628835F68A7369D0254E4283] - |A| - [23/10/2018 21:05:06] - (.-.) - [123.82 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat448B.tmp
[MD5.894A2EDE85A483BF9BEDEFD4DB45CDB9] - |A| - [23/10/2018 21:05:09] - (.-.) - [124.5 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat5167.tmp
[MD5.0825F1DFB7B05FECE8D5CBF12928DD35] - |A| - [23/10/2018 21:05:09] - (.-.) - [26.71 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat5178.tmp
[MD5.D5F6D36274376F4727D6F90C95C4CCDC] - |A| - [23/10/2018 21:05:12] - (.-.) - [3.77 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat5975.tmp
[MD5.F4769F9BDB7466BE65088239C12046D1] - |A| - [23/10/2018 21:05:12] - (.-.) - [19.66 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat59B4.tmp
[MD5.75801960794B7873D87AAA597BCF7447] - |A| - [23/10/2018 21:05:12] - (.-.) - [38.18 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat5BE7.tmp
[MD5.AE05638BF81CBF345EBCD8B470E409AF] - |A| - [22/07/2018 22:22:25] - (.-.) - [18.72 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat9677.tmp
[MD5.46E48CE0628835F68A7369D0254E4283] - |A| - [22/07/2018 22:22:25] - (.-.) - [123.82 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat96B7.tmp
[MD5.F9E6B0E3691B63E4A0F7D4E00A83655A] - |A| - [22/07/2018 22:22:25] - (.-.) - [24.57 Ko] - (0.0.0.0) - C:

\Windows\Temp\dat96D7.tmp
[MD5.0825F1DFB7B05FECE8D5CBF12928DD35] - |A| - [22/07/2018 22:22:35] - (.-.) - [26.71 Ko] - (0.0.0.0) - C:

\Windows\Temp\datC038.tmp
[MD5.D5F6D36274376F4727D6F90C95C4CCDC] - |A| - [22/07/2018 22:22:42] - (.-.) - [3.77 Ko] - (0.0.0.0) - C:

\Windows\Temp\datD935.tmp
[MD5.75801960794B7873D87AAA597BCF7447] - |A| - [22/07/2018 22:22:42] - (.-.) - [38.18 Ko] - (0.0.0.0) - C:

\Windows\Temp\datD9F1.tmp
[MD5.FF2581D26B5DE2E906348EE4C68F16B9] - |A| - [15/08/2018 09:57:42] - (.-.) - [1.2 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_NDP46-KB4344146-x64_decompression_log.txt
[MD5.F90999AC16A0F79DDE85979BE1AFE769] - |A| - [10/12/2018 23:15:49] - (.-.) - [1.25 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_NDP46-KB4457035-x64_decompression_log.txt
[MD5.ACEFC0CDA1B4E5DCF9344B014ACEE009] - |A| - [10/12/2018 23:20:12] - (.-.) - [1.2 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_NDP46-KB4459942-x64_decompression_log.txt
[MD5.ABA771F52BEEFDCB99DDFF1DB0FD6024] - |A| - [03/07/2019 22:20:38] - (.-.) - [1.18 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_NDP46-KB4495588-x64_decompression_log.txt
[MD5.FD1BBF332340BA16BBCE03D9797B72BF] - |A| - [03/07/2019 22:28:09] - (.-.) - [1.18 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_NDP47-KB4502558-x64_decompression_log.txt
[MD5.A5DFAFA27D1C0A8B085099D24C88281F] - |A| - [10/12/2018 23:10:38] - (.-.) - [1.29 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_ndp472-kb4054541-x86-x64-enu_decompression_log.txt
[MD5.365E7F8279C00E3803ED17D9397F8DD3] - |A| - [10/12/2018 23:15:19] - (.-.) - [1.22 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_ndp472-kb4087364-x64_decompression_log.txt
[MD5.CD4BB68004280C23DAFAD97658E011F6] - |A| - [10/12/2018 23:11:23] - (.-.) - [0.46 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_SetupUtility.txt
[MD5.4D70B5E2F73283F7C67E6D5A314908EF] - |A| - [15/08/2018 09:58:18] - (.-.) - [4.57 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20180815_135818_368.txt
[MD5.454F4661A98F9A5F4392DD7F1EB1547C] - |A| - [15/08/2018 09:58:20] - (.-.) - [2.63 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20180815_135820_958.txt
[MD5.93E339E94A8BAA4B320BC8E325DA4F45] - |A| - [10/12/2018 23:13:18] - (.-.) - [4.57 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20181211_031318_725.txt
[MD5.98D43FF9F73ADB25A6677CF1B744D7A6] - |A| - [10/12/2018 23:13:28] - (.-.) - [2.63 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20181211_031328_246.txt
[MD5.2991C504D7F2E26F45F3B6040F7923E0] - |A| - [10/12/2018 23:16:18] - (.-.) - [4.57 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20181211_031618_754.txt
[MD5.174DACDB97075A2426DA1C2031708C63] - |A| - [10/12/2018 23:16:33] - (.-.) - [2.63 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20181211_031633_144.txt
[MD5.613A71FB24791A30966A37D30E20D2C5] - |A| - [10/12/2018 23:20:40] - (.-.) - [4.57 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20181211_032040_241.txt
[MD5.3A73EA977881DF379E1367A28ACB5CD3] - |A| - [10/12/2018 23:20:46] - (.-.) - [2.63 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20181211_032046_711.txt
[MD5.BC917652DA88915E6A9EDB070256B97C] - |A| - [03/07/2019 22:22:01] - (.-.) - [4.57 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20190704_022201_410.txt
[MD5.68A8668DEBF07332B5C4FF34C0DA2990] - |A| - [03/07/2019 22:22:09] - (.-.) - [2.63 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20190704_022209_858.txt
[MD5.C53B9B64DB679ACD8883D4B744C295ED] - |A| - [03/07/2019 22:28:35] - (.-.) - [4.57 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20190704_022835_582.txt
[MD5.6A33F4D5BC3DE2556C450C68D3877CA8] - |A| - [03/07/2019 22:28:37] - (.-.) - [2.63 Ko] - (0.0.0.0) - C:

\Windows\Temp\dd_wcf_CA_smci_20190704_022837_009.txt
[MD5.D41D8CD98F00B204E9800998ECF8427E] - |A| - [26/06/2018 13:37:47] - (.-.) - [0 Ko] - (0.0.0.0) - C:

\Windows\Temp\FXSAPIDebugLogFile.txt
[MD5.D41D8CD98F00B204E9800998ECF8427E] - |A| - [26/06/2018 13:37:47] - (.-.) - [0 Ko] - (0.0.0.0) - C:

\Windows\Temp\FXSTIFFDebugLogFile.txt
[MD5.F4AFADC868347D16519E982371C4EF74] - |A| - [10/12/2018 23:15:25] - (.-.) - [3836.99 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4087364_20181210_221522500-Microsoft .NET Framework 4.7.2-MSP0.txt
[MD5.29B674EB6B07DD5F9DCDDC7B827CA290] - |A| - [10/12/2018 23:15:21] - (.-.) - [76.2 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4087364_20181210_221522500.html
[MD5.AFECAE9137438CE4419E8149F6890891] - |A| - [15/08/2018 09:57:54] - (.-.) - [9997.8 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4344146_20180815_095750038-Microsoft .NET Framework 4.7.1-MSP0.txt
[MD5.C7108B51CD6ACD131A425143EBF75548] - |A| - [15/08/2018 09:57:48] - (.-.) - [98.92 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4344146_20180815_095750038.html
[MD5.233F21D00B3ABA8CE4CA15997460D805] - |A| - [10/12/2018 23:16:02] - (.-.) - [9012.59 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4457035_20181210_221555184-Microsoft .NET Framework 4.7.2-MSP0.txt
[MD5.3D75FE1311FBF6A1DB65155C51DBE84D] - |A| - [10/12/2018 23:15:53] - (.-.) - [101.6 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4457035_20181210_221555184.html
[MD5.55F5817CF9046B9447FD3B8B61C054AB] - |A| - [10/12/2018 23:20:21] - (.-.) - [8858.76 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4459942_20181210_222016771-Microsoft .NET Framework 4.7.2-MSP0.txt
[MD5.4A6EA5A5E4D080A8E29E30E71AC692AB] - |A| - [10/12/2018 23:20:15] - (.-.) - [101.07 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4459942_20181210_222016771.html
[MD5.875DC6719E07F4914626D7D019C42338] - |A| - [03/07/2019 22:21:09] - (.-.) - [9996.27 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4495588_20190703_222055263-Microsoft .NET Framework 4.7.2-MSP0.txt
[MD5.DC503177561FC3C3D392BE96CE029B30] - |A| - [03/07/2019 22:20:50] - (.-.) - [100.81 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4495588_20190703_222055263.html
[MD5.01DE25AB7B3750DBB84BC32661BFBC25] - |A| - [03/07/2019 22:28:17] - (.-.) - [10435.86 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4502558_20190703_222814635-Microsoft .NET Framework 4.7.2-MSP0.txt
[MD5.CABF8F1F5F9639A31AE1B45701A3599B] - |A| - [03/07/2019 22:28:13] - (.-.) - [99.33 Ko] - (0.0.0.0) - C:

\Windows\Temp\KB4502558_20190703_222814635.html
[MD5.CA7FAEC305931463F4D8E51E5C6E33C7] - |A| - [10/12/2018 23:11:26] - (.-.) - [17473.14 Ko] - (0.0.0.0) - C:

\Windows\Temp\Microsoft .NET Framework 4.7.2 Setup_20181210_221059895-MSI_netfx_Full_x64.msi.txt
[MD5.E2E0696FB31E74FACBC54263CAFC5584] - |A| - [10/12/2018 23:10:49] - (.-.) - [668.69 Ko] - (0.0.0.0) - C:

\Windows\Temp\Microsoft .NET Framework 4.7.2 Setup_20181210_221059895.html
[MD5.6D545BDFB69214468090A5F026A3B615] - |A| - [24/07/2018 03:37:16] - (.-.) - [156.78 Ko] - (0.0.0.0) - C:

\Windows\Temp\MpCmdRun.log
[MD5.00000000000000000000000000000000] - |D| - [22/07/2018 22:20:59] - [0 Ko] - C:\Windows\Temp

\MPInstrumentation
[MD5.280473151997F840803405C9220443D8] - |A| - [18/07/2018 15:54:47] - (.-.) - [89.65 Ko] - (0.0.0.0) - C:

\Windows\Temp\MpSigStub.log
[MD5.00000000000000000000000000000000] - |D| - [18/07/2018 15:54:53] - [0 Ko] - C:\Windows\Temp

\MPTelemetrySubmit
[MD5.00000000000000000000000000000000] - |D| - [14/11/2018 18:47:03] - [3681.12 Ko] - C:\Windows\Temp\PL-

2303_backup
[MD5.004FA62F61DF14EA8623B474E49921AF] - |A| - [14/11/2018 18:47:04] - (.Copyright (C) 2001 - QRemover MFC

Application.) - [144 Ko] - (1.0.0.1) - C:\Windows\Temp\QRemover.exe
[MD5.DBEF78447120E830587017C581F994F1] - |A| - [10/12/2018 23:21:00] - (.-.) - [10.19 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGI564B.tmp
[MD5.4AAE089D3731C3F9DCA27587E61CC4A2] - |A| - [10/12/2018 23:21:00] - (.-.) - [8.79 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGI564B.tmp-tmp
[MD5.DBEF78447120E830587017C581F994F1] - |A| - [10/12/2018 23:16:45] - (.-.) - [10.19 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGI7437.tmp
[MD5.4AAE089D3731C3F9DCA27587E61CC4A2] - |A| - [10/12/2018 23:16:45] - (.-.) - [8.79 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGI7437.tmp-tmp
[MD5.DBEF78447120E830587017C581F994F1] - |A| - [03/07/2019 22:28:46] - (.-.) - [10.19 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGI8D4F.tmp
[MD5.4AAE089D3731C3F9DCA27587E61CC4A2] - |A| - [03/07/2019 22:28:46] - (.-.) - [8.79 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGI8D4F.tmp-tmp
[MD5.DBEF78447120E830587017C581F994F1] - |A| - [10/12/2018 23:13:39] - (.-.) - [10.19 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGI9C8E.tmp
[MD5.4AAE089D3731C3F9DCA27587E61CC4A2] - |A| - [10/12/2018 23:13:39] - (.-.) - [8.79 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGI9C8E.tmp-tmp
[MD5.DBEF78447120E830587017C581F994F1] - |A| - [15/08/2018 09:58:33] - (.-.) - [10.19 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGIC626.tmp
[MD5.4AAE089D3731C3F9DCA27587E61CC4A2] - |A| - [15/08/2018 09:58:33] - (.-.) - [8.79 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGIC626.tmp-tmp
[MD5.DBEF78447120E830587017C581F994F1] - |A| - [03/07/2019 22:22:41] - (.-.) - [10.19 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGIFCD3.tmp
[MD5.4AAE089D3731C3F9DCA27587E61CC4A2] - |A| - [03/07/2019 22:22:41] - (.-.) - [8.79 Ko] - (0.0.0.0) - C:

\Windows\Temp\RGIFCD3.tmp-tmp
[MD5.00000000000000000000000000000000] - |D| - [22/07/2018 22:39:09] - [514.78 Ko] - C:\Windows\Temp

\SupportAssistAgent
[MD5.59071590099D21DD439896592338BF95] - |A| - [22/07/2018 22:19:34] - (.-.) - [512 Ko] - (0.0.0.0) - C:

\Windows\Temp\TMPCA02463A00ECA135
[MD5.59071590099D21DD439896592338BF95] - |A| - [22/07/2018 22:25:39] - (.-.) - [512 Ko] - (0.0.0.0) - C:

\Windows\Temp\TMPDFA6F2776A4DEE34
[MD5.3E628653AFD3EAA739D69BEC0E21E913] - |A| - [04/07/2019 00:50:36] - (.-.) - [128 Ko] - (0.0.0.0) - C:

\Windows\Temp\TS_4D06.tmp
[MD5.55C536FA338683D16C6ADA6AE7501EB2] - |A| - [04/07/2019 00:50:53] - (.-.) - [256 Ko] - (0.0.0.0) - C:

\Windows\Temp\TS_905D.tmp
[MD5.A0F17DD1D8D018D5FA536764A6120350] - |A| - [06/04/2019 14:02:50] - (.-.) - [48.7 Ko] - (0.0.0.0) - C:

\Windows\Temp\USB_AUDIO_SETUP.LOG
[MD5.8BE389E76473CD5F1B5DD15BD4EE411F] - |A| - [19/03/2019 18:13:15] - (.-.) - [12.53 Ko] - (0.0.0.0) - C:

\Windows\Temp\WcInstaller.log
[MD5.00000000000000000000000000000000] - |D| - [07/04/2019 14:54:27] - [346.9 Ko] - C:\Windows\Temp

\wctmp_1920530832
[MD5.00000000000000000000000000000000] - |D| - [19/03/2019 18:13:16] - [346.95 Ko] - C:\Windows\Temp

\wctmp_558918626
[MD5.00000000000000000000000000000000] - |D| - [08/05/2019 08:49:49] - [347.76 Ko] - C:\Windows\Temp

\wctmp_727316983
[MD5.D85AD4E72DBDC9B3338FD0DE945BA3FA] - |A| - [19/03/2019 18:13:19] - (.-.) - [9286.35 Ko] - (0.0.0.0) - C:

\Windows\Temp\WebCompanion.zip
[MD5.00000000000000000000000000000000] - |D| - [24/09/2018 21:27:02] - [0 Ko] - C:\Windows\Temp\__SKIP_598
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [0 Ko] - C:\Windows\System32\0409
[MD5.D41D8CD98F00B204E9800998ECF8427E] - |AH| - [14/07/2009 00:45:49] - (.-.) - [21 Ko] - (0.0.0.0) - C:

\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[MD5.D41D8CD98F00B204E9800998ECF8427E] - |AH| - [14/07/2009 00:45:49] - (.-.) - [21 Ko] - (0.0.0.0) - C:

\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [4987.5 Ko] - C:\Windows

\System32\AdvancedInstallers
[MD5.00000000000000000000000000000000] - |D| - [26/06/2018 13:22:12] - [2732.89 Ko] - C:\Windows

\System32\appraiser
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [201.5 Ko] - C:\Windows\System32\ar-SA
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [173 Ko] - C:\Windows\System32\bg-BG
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [2584.8 Ko] - C:\Windows\System32\Boot
[MD5.F02F93D5AEC524052E4A37C1BB7CCF31] - |A| - [13/07/2009 21:20:24] - (.Copyright(C)Brother Industries

Ltd.1997-2006 - Brother Multi Function CoInstaller.) - [19 Ko] - (1.0.0.20) - C:\Windows\System32\brcoinst.dll
[MD5.7D00FF6A4315FDF4ACAFBB4EF157EA9F] - |A| - [13/07/2009 20:07:04] - (.Copyright (C) 2008 - Bthpan Context

Handler.) - [91.5 Ko] - (1.0.0.1) - C:\Windows\System32\BthpanContextHandler.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [99444.95 Ko] - C:\Windows

\System32\catroot
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [27138.78 Ko] - C:\Windows

\System32\catroot2
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [10612.11 Ko] - C:\Windows

\System32\CodeIntegrity
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [357 Ko] - C:\Windows\System32\com
[MD5.00000000000000000000000000000000] - |SD| - [26/06/2018 13:22:12] - [5028.19 Ko] - C:\Windows

\System32\CompatTel
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [271083.36 Ko] - C:\Windows

\System32\config
[MD5.55A9CC0ABBBDA692CD6F3AFDD3847524] - |N| - [06/04/2019 14:02:59] - (.Copyright (C) Ploytec GmbH 2000-2011

- AKAI USB Audio control panel.) - [257.23 Ko] - (2.9.30.0) - C:\Windows\System32\CPLAKAIEIEPRO.CPL
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [432 Ko] - C:\Windows\System32\cs-CZ
[MD5.59075B2A63DF6A568123218BF4DC2696] - |A| - [02/06/2016 13:15:54] - (.-.) - [0.87 Ko] - (0.0.0.0) - C:

\Windows\System32\CustomModeApp.exe.config
[MD5.899E708E589C09700BFF1C73CB7D7002] - |A| - [02/06/2016 13:15:54] - (.-.) - [0.87 Ko] - (0.0.0.0) - C:

\Windows\System32\CustomModeAppv2_0.exe.config
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [427.5 Ko] - C:\Windows\System32\da-DK
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [457.5 Ko] - C:\Windows\System32\de-DE
[MD5.079B8AEB4A55BF8493BD1EC70285D920] - |ASH| - [14/07/2009 00:57:09] - (.-.) - [0.07 Ko] - (0.0.0.0) - C:

\Windows\System32\desktop.ini
[MD5.0E2B7D35E3DDD21AF04FB4D98C2BCF7F] - |A| - [02/06/2016 13:15:54] - (.-.) - [308.83 Ko] - (0.0.0.0) - C:

\Windows\System32\DisplayAudiox64.cab
[MD5.59075B2A63DF6A568123218BF4DC2696] - |A| - [02/06/2016 13:15:54] - (.-.) - [0.87 Ko] - (0.0.0.0) - C:

\Windows\System32\DPTopologyApp.exe.config
[MD5.899E708E589C09700BFF1C73CB7D7002] - |A| - [02/06/2016 13:15:54] - (.-.) - [0.87 Ko] - (0.0.0.0) - C:

\Windows\System32\DPTopologyAppv2_0.exe.config
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:10] - [63125.15 Ko] - C:\Windows

\System32\drivers
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [1267107.62 Ko] - C:\Windows

\System32\DriverStore
[MD5.884BE1FCF1D321D560063BB78E84FEE0] - |A| - [06/01/2012 22:02:08] - (.-.) - [3.04 Ko] - (0.0.0.0) - C:

\Windows\System32\e1c62x64.din
[MD5.DFFDB573AEB313E6F70CDF4590BCC215] - |A| - [18/07/2018 16:20:47] - (.-.) - [329.95 Ko] - (0.0.0.0) - C:

\Windows\System32\FNTCACHE.DAT
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [454 Ko] - C:\Windows\System32\fr-FR
[MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [0 Ko] - C:\Windows\System32\FxsTmp
[MD5.2AE808CB0D9A667B0CF41EA74B3B9BAC] - |A| - [10/06/2009 16:36:24] - (.-.) - [39.6 Ko] - (0.0.0.0) - C:

\Windows\System32\gatherNetworkInfo.vbs
[MD5.899E708E589C09700BFF1C73CB7D7002] - |A| - [02/06/2016 13:15:54] - (.-.) - [0.87 Ko] - (0.0.0.0) - C:

\Windows\System32\Gfxv2_0.exe.config
[MD5.59075B2A63DF6A568123218BF4DC2696] - |A| - [02/06/2016 13:15:54] - (.-.) - [0.87 Ko] - (0.0.0.0) - C:

\Windows\System32\Gfxv4_0.exe.config
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [0 Ko] - C:\Windows

\System32\GroupPolicy
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [0 Ko] - C:\Windows

\System32\GroupPolicyUsers
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [191.5 Ko] - C:\Windows\System32\he-IL
[MD5.17646020C8DACD0F51E76846CFDAEB3A] - |A| - [13/07/2009 21:20:27] - (.-.) - [18.46 Ko] - (0.0.0.0) - C:

\Windows\System32\HPEACLHN.HPI
[MD5.93243A03EA8FB94AB6F3D5E4A3CBD69C] - |A| - [02/06/2016 13:34:16] - (.-.) - [100.5 Ko] - (0.0.0.0) - C:

\Windows\System32\IccLibDll_x64.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [36.27 Ko] - C:\Windows\System32\icsxml
[MD5.0B0A9C46F9A8450857383D4CB798ED28] - |A| - [26/06/2018 13:41:42] - (.Copyright © 2004 - 2009 IDT, Inc. -

IDT PC Audio.) - [1853.5 Ko] - (1.0.6491.0) - C:\Windows\System32\IDTNC64.cpl
[MD5.C6BC3358BFC6ECAA2E830F05B64EDC42] - |A| - [02/06/2016 13:38:58] - (.-.) - [167 Ko] - (0.0.0.0) - C:

\Windows\System32\igdail64.dll
[MD5.BFBFC29FF7D0149EB354C46B7ADB06D7] - |A| - [02/06/2016 13:39:04] - (.-.) - [224.5 Ko] - (0.0.0.0) - C:

\Windows\System32\igdde64.dll
[MD5.F5EC784EBD55DFF46764A0134C3CBCB4] - |A| - [02/06/2016 13:40:26] - (.Copyright (C) 2012-2013 - MDF(CM)

Runtime DX11 Dynamic Link Library.) - [188.99 Ko] - (3.0.0.1284) - C:\Windows\System32\igfx11cmrt64.dll
[MD5.DADEA3888F8175EA4B7E8EF24DA73DFF] - |A| - [02/06/2016 13:40:36] - (.Copyright (C) 2010 - 2013 - MDF(CM)

JIT Dynamic Link Library.) - [1987.99 Ko] - (3.0.0.1284) - C:\Windows\System32\igfxcmjit64.dll
[MD5.521E38CB6C096E91E46D9436DD85AA0C] - |A| - [02/06/2016 13:48:06] - (.Copyright (C) 2010 - 2013 - MDF(CM)

Runtime Dynamic Link Library.) - [194.43 Ko] - (3.0.0.1284) - C:\Windows\System32\igfxcmrt64.dll
[MD5.B554A0591241BD7310C692D540FE9720] - |A| - [02/06/2016 13:40:38] - (.-.) - [258 Ko] - (0.0.0.0) - C:

\Windows\System32\igfxCPL.cpl
[MD5.533E9CC9949165FE3E36491665B54864] - |A| - [02/06/2016 13:40:40] - (.-.) - [92.99 Ko] - (0.0.0.0) - C:

\Windows\System32\igfxCUIServicePS.dll
[MD5.857B333695676433E5AB27365BAE2F8F] - |A| - [02/06/2016 13:40:44] - (.-.) - [67 Ko] - (1.0.0.0) - C:

\Windows\System32\igfxDHLib.dll
[MD5.857912645067D137D31A429657A02074] - |A| - [02/06/2016 13:40:46] - (.-.) - [76.5 Ko] - (1.0.0.0) - C:

\Windows\System32\igfxDHLibv2_0.dll
[MD5.0D8E7EDF1BAE5345236BDE69B5938179] - |A| - [02/06/2016 13:40:48] - (.-.) - [18.99 Ko] - (1.0.0.0) - C:

\Windows\System32\igfxDILib.dll
[MD5.FCA27E38DB40D86E0AB16100647292C2] - |A| - [02/06/2016 13:40:50] - (.-.) - [19 Ko] - (1.0.0.0) - C:

\Windows\System32\igfxDILibv2_0.dll
[MD5.9742A8FB45D39C1AE6530AEB2FFF31ED] - |A| - [02/06/2016 13:40:54] - (.-.) - [18.5 Ko] - (1.0.0.0) - C:

\Windows\System32\igfxEMLib.dll
[MD5.075F721C433FCDB7EAC66009A265C7D8] - |A| - [02/06/2016 13:40:54] - (.-.) - [18.49 Ko] - (1.0.0.0) - C:

\Windows\System32\igfxEMLibv2_0.dll
[MD5.865BB0C723B21D62A16BE6EDD831A17C] - |A| - [02/06/2016 13:41:02] - (.-.) - [13.5 Ko] - (1.0.0.0) - C:

\Windows\System32\igfxLHMLib.dll
[MD5.11BC4B4011AA5FE01FA22A360B875184] - |A| - [02/06/2016 13:41:02] - (.-.) - [13.49 Ko] - (1.0.0.0) - C:

\Windows\System32\igfxLHMLibv2_0.dll
[MD5.6C0F36ABFE80433B352FA7748ED887BF] - |A| - [02/06/2016 13:16:10] - (.-.) - [2748 Ko] - (0.0.0.0) - C:

\Windows\System32\iglhxa64.cpa
[MD5.2FCCF7939D4D3F392AB3C0F5F40039DD] - |A| - [02/06/2016 13:16:10] - (.-.) - [1.1 Ko] - (0.0.0.0) - C:

\Windows\System32\iglhxa64.vp
[MD5.B226B85123619EF1394339C1B5EB5A8D] - |A| - [02/06/2016 13:16:10] - (.-.) - [42.47 Ko] - (0.0.0.0) - C:

\Windows\System32\iglhxc64.vp
[MD5.55C71EDC47B57E5115B40095EEC9E205] - |A| - [02/06/2016 13:16:10] - (.-.) - [42.79 Ko] - (0.0.0.0) - C:

\Windows\System32\iglhxc64_dev.vp
[MD5.94ED4F871997E5DFC610DC1649C38911] - |A| - [02/06/2016 13:16:10] - (.-.) - [42.24 Ko] - (0.0.0.0) - C:

\Windows\System32\iglhxg64.vp
[MD5.04590E9E52E13EF34B2AA02C7EA2431B] - |A| - [02/06/2016 13:16:10] - (.-.) - [42.28 Ko] - (0.0.0.0) - C:

\Windows\System32\iglhxg64_dev.vp
[MD5.3B6EF4F03F2DE75A3B7DDF627A3EC146] - |A| - [02/06/2016 13:16:10] - (.-.) - [42.99 Ko] - (0.0.0.0) - C:

\Windows\System32\iglhxo64.vp
[MD5.715DBDBED4599E798F94EDF6003F75B6] - |A| - [02/06/2016 13:16:10] - (.-.) - [41.09 Ko] - (0.0.0.0) - C:

\Windows\System32\iglhxo64_dev.vp
[MD5.1C70F59C563D05DE6CAFFA7C280987F5] - |A| - [02/06/2016 13:16:10] - (.-.) - [2.52 Ko] - (0.0.0.0) - C:

\Windows\System32\iglhxs64.vp
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [36875.94 Ko] - C:\Windows\System32\IME
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [0 Ko] - C:\Windows\System32\inetsrv
[MD5.AAA0C03BF54FC8A4E895B576861A9848] - |A| - [20/11/2010 23:07:41] - (.-.) - [29.12 Ko] - (0.0.0.0) - C:

\Windows\System32\InstallPackage_ETW.Log
[MD5.4D38B30EF71C8F2CDAAD31166BA66756] - |A| - [02/06/2016 13:41:14] - (.Copyright © The Khronos Group Inc

2011 - OpenCL Client DLL.) - [71 Ko] - (1.2.11.0) - C:\Windows\System32\Intel_OpenCL_ICD64.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [452 Ko] - C:\Windows\System32\it-IT
[MD5.C1B7AB03AC2F3C990A40BC2E18E02CF1] - |A| - [13/07/2009 22:35:50] - (.-.) - [11687.04 Ko] - (0.0.0.0) - C:

\Windows\System32\korwbrkr.lex
[MD5.E89C001FB4D9E08CC7072CE774CDB999] - |A| - [20/11/2010 22:52:07] - (.-.) - [0.01 Ko] - (0.0.0.0) - C:

\Windows\System32\LocalGroupAdminAdd.log
[MD5.563C3703A9B57CC9B370A76D6173D09C] - |A| - [20/11/2010 22:52:08] - (.-.) - [0.05 Ko] - (0.0.0.0) - C:

\Windows\System32\Local_LLU.log
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [2536.51 Ko] - C:\Windows

\System32\LogFiles
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [165 Ko] - C:\Windows\System32\lt-LT
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [166 Ko] - C:\Windows\System32\lv-LV
[MD5.00000000000000000000000000000000] - |D| - [26/06/2018 14:06:44] - [57417.1 Ko] - C:\Windows

\System32\Macromed
[MD5.7A495CA1402C2F9F5D035092AD808669] - |A| - [13/07/2009 16:17:48] - (.-.) - [0.85 Ko] - (0.0.0.0) - C:

\Windows\System32\manage-bde.wsf
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [1981.88 Ko] - C:\Windows

\System32\manifeststore
[MD5.39E801545FFF6230C80140E0F8A06629] - |A| - [14/07/2009 00:57:09] - (.-.) - [1.21 Ko] - (0.0.0.0) - C:

\Windows\System32\migwiz.lnk
[MD5.00000000000000000000000000000000] - |D| - [26/06/2018 11:19:54] - [0 Ko] - C:\Windows\System32\MRT
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [4148.28 Ko] - C:\Windows

\System32\Msdtc
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [11.33 Ko] - C:\Windows\System32\MUI
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [422.5 Ko] - C:\Windows\System32\nb-NO
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [384 Ko] - C:\Windows\System32\NDF
[MD5.CD48AD912839B9FB6CCA5D4AA9B37500] - |A| - [13/07/2009 18:01:19] - (.-.) - [21.3 Ko] - (0.0.0.0) - C:

\Windows\System32\NetTrace.PLA.Diagnostics.xml
[MD5.8E24A7BCAEF2045DA1FF29217622843E] - |A| - [20/11/2010 22:52:07] - (.-.) - [0.04 Ko] - (0.0.0.0) - C:

\Windows\System32\Network_LLU.log
[MD5.1C96B3DA6ABE5E18B63C64DF75884F6A] - |A| - [13/07/2009 22:35:51] - (.-.) - [1.45 Ko] - (0.0.0.0) - C:

\Windows\System32\noise.kor
[MD5.4BAEC8EF638F43F289868C8DBB48B893] - |A| - [07/04/2016 15:07:44] - (.Copyright (c) NovaTek 2009 - 2013 -

NovaTek Msdc Ext - Avision.) - [66.5 Ko] - (12.1.13.23) - C:\Windows\System32\NvUSBScan.dll
[MD5.00000000000000000000000000000000] - |D| - [26/06/2018 13:17:53] - [114.78 Ko] - C:\Windows\System32\OEM
[MD5.2901049544FDF863362FABA2363EB647] - |A| - [13/07/2009 16:24:21] - (.-.) - [0.82 Ko] - (0.0.0.0) - C:

\Windows\System32\onlinesetup.cmd
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [14429.42 Ko] - C:\Windows

\System32\oobe
[MD5.C906B7C38274609652827718DA41D2C3] - |A| - [13/07/2009 22:36:59] - (.-.) - [119.28 Ko] - (0.0.0.0) - C:

\Windows\System32\perfc009.dat
[MD5.B7795BC96C1CEB86E04E8DC843E9C784] - |A| - [10/06/2009 16:33:35] - (.-.) - [113.56 Ko] - (0.0.0.0) - C:

\Windows\System32\PerfCenterCpl.ico
[MD5.7AAA3E23CE4C7845B112F7A79B110E60] - |A| - [13/07/2009 22:36:59] - (.-.) - [30.81 Ko] - (0.0.0.0) - C:

\Windows\System32\perfd009.dat
[MD5.83CB269D4BEDBC99E35408C54FEDB50A] - |A| - [13/07/2009 22:36:59] - (.-.) - [646.79 Ko] - (0.0.0.0) - C:

\Windows\System32\perfh009.dat
[MD5.F1AC5B24012847B39B328104FA2886A5] - |A| - [14/07/2009 01:13:15] - (.-.) - [763.47 Ko] - (0.0.0.0) - C:

\Windows\System32\PerfStringBackup.INI
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [439 Ko] - C:\Windows\System32\pl-PL
[MD5.1DD626FE4DE2D4B710DD1360F404A54F] - |A| - [26/06/2018 09:56:00] - (.Copyright (C) 2001 - PrintBrm

Application.) - [70 Ko] - (1.0.0.0) - C:\Windows\System32\PrintBrmUi.exe
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:50] - [413.88 Ko] - C:\Windows

\System32\Printing_Admin_Scripts
[MD5.F5A689BA3FDB5F8A6F13622B5AC02FD8] - |A| - [29/10/2018 20:46:24] - (.-.) - [2842 Ko] - (4.7.0.0) - C:

\Windows\System32\QtCoreViz4.dll
[MD5.15A0D55B076B0A0CB201B9B286277CA4] - |A| - [29/10/2018 20:46:24] - (.-.) - [10360 Ko] - (4.7.0.0) - C:

\Windows\System32\QtGuiViz4.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [23.75 Ko] - C:\Windows\System32\ras
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [0.78 Ko] - C:\Windows

\System32\Recovery
[MD5.7C47E200D9D049C49156A7D416586C4F] - |A| - [02/06/2016 13:16:24] - (.-.) - [161.58 Ko] - (0.0.0.0) - C:

\Windows\System32\resARA.cui
[MD5.BB02E0907790B462282C099197F01A07] - |A| - [02/06/2016 13:16:26] - (.-.) - [146.02 Ko] - (0.0.0.0) - C:

\Windows\System32\resCHS.cui
[MD5.2F6B4B08827D5B994B097C0D8A9F15C3] - |A| - [02/06/2016 13:16:26] - (.-.) - [146.88 Ko] - (0.0.0.0) - C:

\Windows\System32\resCHT.cui
[MD5.971B2384427DD0133F9FD7B923F395DF] - |A| - [02/06/2016 13:16:26] - (.-.) - [152.96 Ko] - (0.0.0.0) - C:

\Windows\System32\resCSY.cui
[MD5.D48CD2D59E5C72C187883320AFB5FE93] - |A| - [02/06/2016 13:16:26] - (.-.) - [149.91 Ko] - (0.0.0.0) - C:

\Windows\System32\resDAN.cui
[MD5.82566CB31CEA7567BF8B45D832668439] - |A| - [02/06/2016 13:16:26] - (.-.) - [154.68 Ko] - (0.0.0.0) - C:

\Windows\System32\resDEU.cui
[MD5.211F5776CF333B89D0BD361F92CB38C3] - |A| - [02/06/2016 13:16:26] - (.-.) - [179.72 Ko] - (0.0.0.0) - C:

\Windows\System32\resELL.cui
[MD5.7CDD3D6A64BC621EB92E97ADBD7C0711] - |A| - [02/06/2016 13:16:26] - (.-.) - [148.6 Ko] - (0.0.0.0) - C:

\Windows\System32\resENU.cui
[MD5.3C63073FF29B04706024E5678CF43CF8] - |A| - [02/06/2016 13:16:26] - (.-.) - [154.35 Ko] - (0.0.0.0) - C:

\Windows\System32\resESN.cui
[MD5.E34147497C3346D48000124EC377A868] - |A| - [02/06/2016 13:16:26] - (.-.) - [152.32 Ko] - (0.0.0.0) - C:

\Windows\System32\resFIN.cui
[MD5.6E29BB7D3A84B8ED2C398483CF037308] - |A| - [02/06/2016 13:16:26] - (.-.) - [156.44 Ko] - (0.0.0.0) - C:

\Windows\System32\resFRA.cui
[MD5.342DC30F883BEA56448B60A2E1F0D432] - |A| - [02/06/2016 13:16:26] - (.-.) - [161.02 Ko] - (0.0.0.0) - C:

\Windows\System32\resHEB.cui
[MD5.3E4404DF28CE437D634BF3EDFC9A10BE] - |A| - [02/06/2016 13:16:26] - (.-.) - [151.89 Ko] - (0.0.0.0) - C:

\Windows\System32\resHRV.cui
[MD5.C4E050B32A65B326819AD20331AAB818] - |A| - [02/06/2016 13:16:26] - (.-.) - [156.5 Ko] - (0.0.0.0) - C:

\Windows\System32\resHUN.cui
[MD5.2E9301D9FAFB38E6014BB850E3CC4FD6] - |A| - [02/06/2016 13:16:26] - (.-.) - [154.64 Ko] - (0.0.0.0) - C:

\Windows\System32\resITA.cui
[MD5.75CF363FB4F974F7D037F1D1BD883E75] - |A| - [02/06/2016 13:16:26] - (.-.) - [161.08 Ko] - (0.0.0.0) - C:

\Windows\System32\resJPN.cui
[MD5.5168626800CC0FAA332BF1A9E7942D05] - |A| - [02/06/2016 13:16:26] - (.-.) - [154.82 Ko] - (0.0.0.0) - C:

\Windows\System32\resKOR.cui
[MD5.CA5A38DCA65C8540183DB5989B45971B] - |A| - [02/06/2016 13:16:26] - (.-.) - [153.64 Ko] - (0.0.0.0) - C:

\Windows\System32\resNLD.cui
[MD5.E3ECBE665A85EDA30A7F3FEA0427FA3E] - |A| - [02/06/2016 13:16:26] - (.-.) - [150.39 Ko] - (0.0.0.0) - C:

\Windows\System32\resNOR.cui
[MD5.A179BBDE67244C7413CC9DD94350575B] - |A| - [02/06/2016 13:16:26] - (.-.) - [153.96 Ko] - (0.0.0.0) - C:

\Windows\System32\resPLK.cui
[MD5.5CCF59C6E0B3FB08FE2058533D448FDD] - |A| - [02/06/2016 13:16:26] - (.-.) - [153.04 Ko] - (0.0.0.0) - C:

\Windows\System32\resPTB.cui
[MD5.82C21F51E2E9912158831CDFB0A206B6] - |A| - [02/06/2016 13:16:26] - (.-.) - [152.75 Ko] - (0.0.0.0) - C:

\Windows\System32\resPTG.cui
[MD5.BEC45D17F77784FDE5FEE50B626F1BDC] - |A| - [02/06/2016 13:16:26] - (.-.) - [154.44 Ko] - (0.0.0.0) - C:

\Windows\System32\resROM.cui
[MD5.EB9FF588AAF2E64CB52F6B6C3BD6BF1A] - |A| - [02/06/2016 13:16:26] - (.-.) - [175.61 Ko] - (0.0.0.0) - C:

\Windows\System32\resRUS.cui
[MD5.CD28EBD732ECF7A0FAD7E7F334F04938] - |A| - [02/06/2016 13:16:26] - (.-.) - [153.8 Ko] - (0.0.0.0) - C:

\Windows\System32\resSKY.cui
[MD5.6C1F10F831655D5AFA97FE16FB917067] - |A| - [02/06/2016 13:16:26] - (.-.) - [151.33 Ko] - (0.0.0.0) - C:

\Windows\System32\resSLV.cui
[MD5.5782CEFEAEF7CA26BAE4CAA27E020F3C] - |A| - [02/06/2016 13:16:26] - (.-.) - [151.49 Ko] - (0.0.0.0) - C:

\Windows\System32\resSVE.cui
[MD5.267A52FC1DC0DB12959A1F1E293A8E68] - |A| - [02/06/2016 13:16:26] - (.-.) - [186.99 Ko] - (0.0.0.0) - C:

\Windows\System32\resTHA.cui
[MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [0.07 Ko] - C:\Windows\System32\restore
[MD5.CD1ACAC2BEEFEB1684C975496AC7EDA8] - |A| - [02/06/2016 13:16:26] - (.-.) - [152.93 Ko] - (0.0.0.0) - C:

\Windows\System32\resTRK.cui
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:11] - [169 Ko] - C:\Windows\System32\ro-RO
[MD5.61AE1F36E653B0CC54EFFED0B0977407] - |A| - [07/04/2016 15:07:44] - (.Copyright (c) 2015, Visioneer Inc. -

Visioneer RoadWarrior 3 LLD.) - [393 Ko] - (0.9.115.331) - C:\Windows\System32\RWAR3.dll
[MD5.942E76C23637C9971EFC250017D52EB9] - |A| - [11/04/2016 19:09:42] - (.Copyright © 2016, Visioneer Inc. -

TNG CoInstaller.) - [417 Ko] - (5.1.16.4119) - C:\Windows\System32\RWAR3CI.dll
[MD5.5430507217D8AD114349064CC2ED616D] - |A| - [20/07/2015 15:14:14] - (.Copyright © 2015, Visioneer Inc. -

Visioneer WIA Driver.) - [537.5 Ko] - (5.1.15.7205) - C:\Windows\System32\RWAR3WIAT.DLL
[MD5.A8D2065C893DC8B656D3C3FA8180F2AA] - |A| - [20/07/2015 11:08:48] - (.Copyright © 2015, Visioneer Inc. -

Visioneer WIA UI Extension.) - [528.5 Ko] - (5.1.15.7202) - C:\Windows\System32\RWAR3WUI.DLL
[MD5.5C18CD22BE4628865FCB63337A6E5EF6] - |A| - [20/11/2010 23:24:25] - (.-.) - [10.18 Ko] - (0.0.0.0) - C:

\Windows\System32\ScavengeSpace.xml
[MD5.8C3D0C73A0850A0EE62DF9EC36DBDE80] - |N| - [26/06/2018 13:46:08] - (.-.) - [1.86 Ko] - (0.0.0.0) - C:

\Windows\System32\SetupBD.din
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [169.5 Ko] - C:\Windows\System32\sk-SK
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [166 Ko] - C:\Windows\System32\sl-SI
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [37.8 Ko] - C:\Windows\System32\slmgr
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [19650.02 Ko] - C:\Windows\System32\SMI
[MD5.C74D61FCA22F36791105D7878AF73572] - |A| - [10/06/2009 17:08:17] - (.-.) - [8.09 Ko] - (0.0.0.0) - C:

\Windows\System32\spcinstrumentation.man
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [26875.5 Ko] - C:\Windows

\System32\Speech
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [69368.74 Ko] - C:\Windows

\System32\spool
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [2133.41 Ko] - C:\Windows\System32\spp
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [30.19 Ko] - C:\Windows\System32\sppui
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [170 Ko] - C:\Windows\System32\sr-

Latn-CS
[MD5.631F98A02426216B8E0DAA0CF012BEF4] - |A| - [26/06/2018 13:41:19] - (.Copyright © 2004 - 2009 IDT, Inc. -

IDT PC Audio.) - [250 Ko] - (1.0.6491.0) - C:\Windows\System32\st646491.dll
[MD5.02FF0CDD04B9E54BB989EDE66B5C2D6B] - |N| - [26/06/2018 13:41:19] - (.Copyright © 2004 - 2009 IDT, Inc. -

IDT PC Audio.) - [681.5 Ko] - (1.0.6491.0) - C:\Windows\System32\stapi64.dll
[MD5.CA416663232F14D4EFB6A8E2640DD7D4] - |A| - [26/06/2018 13:41:19] - (.Copyright © 2004 - 2009 IDT, Inc. -

IDT PC Audio.) - [2161.5 Ko] - (1.0.6491.0) - C:\Windows\System32\stapo64.dll
[MD5.5FD8F1D4A6B8A9D39BEA42C3FE298C4D] - |A| - [26/06/2018 13:41:19] - (.Copyright © 2004 - 2009 IDT, Inc. -

IDT PC Audio.) - [487.5 Ko] - (1.0.6491.0) - C:\Windows\System32\stcplx64.dll
[MD5.A1C3D414D61A9269CD37098D6E969236] - |A| - [26/06/2018 13:41:42] - (.Copyright © 2004 - 2009 IDT, Inc. -

IDT PC Audio.) - [5958.5 Ko] - (1.0.6491.0) - C:\Windows\System32\stlang64.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [426.5 Ko] - C:\Windows\System32\sv-SE
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [133 Ko] - C:\Windows\System32\sysprep
[MD5.5EC92F0EAE3CA59F647C3CA5AA7CB053] - |A| - [20/11/2010 23:24:36] - (.-.) - [339.75 Ko] - (0.0.0.0) - C:

\Windows\System32\systemsf.ebd
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [276.48 Ko] - C:\Windows\System32\Tasks
[MD5.47F22CAD4A16BB40153555D631546B94] - |A| - [10/06/2009 17:01:25] - (.-.) - [58.71 Ko] - (0.0.0.0) - C:

\Windows\System32\tcpmon.ini
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [157 Ko] - C:\Windows\System32\th-TH
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [424 Ko] - C:\Windows\System32\tr-TR
[MD5.DCD85D844C1583C61D3AFABD983AA0B5] - |A| - [29/10/2018 20:46:24] - (.(C) 1993-2013 TWAIN Working Group. -

TWAIN 32 Source Manager (Image Acquisition Interface).) - [164.2 Ko] - (2.3.0.0) - C:\Windows

\System32\TWAINDSM.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:13] - [166.5 Ko] - C:\Windows\System32\uk-UA
[MD5.05F9840831C29F5BE93AD8BE810D5614] - |A| - [14/07/2009 00:45:37] - (.-.) - [18 Ko] - (0.0.0.0) - C:

\Windows\System32\umstartup.etl
[MD5.F736AA948D0C3CBCE212B7B2CB0EF115] - |A| - [14/07/2009 00:45:37] - (.-.) - [45 Ko] - (0.0.0.0) - C:

\Windows\System32\umstartup000.etl
[MD5.A6E1379EBE20E0BFA119DAA11D764008] - |A| - [26/06/2018 13:44:55] - (.Copyright (C) 1999-2013 Alps Electric

Co., Ltd. - Vxdif.) - [113.34 Ko] - (8.0.0.40) - C:\Windows\System32\Vxdif.dll
[MD5.00000000000000000000000000000000] - |D| - [26/06/2018 11:53:32] - [1754.83 Ko] - C:\Windows\System32\Wat
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [47697.36 Ko] - C:\Windows

\System32\wbem
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:50] - [60.46 Ko] - C:\Windows\System32\WCN
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [102675.76 Ko] - C:\Windows

\System32\wdi
[MD5.6EDD021A8B6457DDE09DE7B7FA4E8C8B] - |A| - [13/07/2009 17:54:15] - (.-.) - [0.6 Ko] - (0.0.0.0) - C:

\Windows\System32\WdsUnattendTemplate.xml
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [96 Ko] - C:\Windows\System32\wfp
[MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [0 Ko] - C:\Windows

\System32\WinBioDatabase
[MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [73.5 Ko] - C:\Windows

\System32\WinBioPlugIns
[MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [8665.44 Ko] - C:\Windows

\System32\WindowsPowerShell
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [80992 Ko] - C:\Windows\System32\winevt
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [99.06 Ko] - C:\Windows\System32\winrm
[MD5.00000000000000000000000000000000] - |HD| - [26/06/2018 13:44:40] - [1.63 Ko] - C:\Windows

\System32\WLANProfiles
[MD5.CB136B267569A62EF63D798BC90ABD5A] - |A| - [26/06/2018 12:39:55] - (.-.) - [0.14 Ko] - (0.0.0.0) - C:

\Windows\System32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
[MD5.9F45771914360A925252A1B7226EC7EC] - |A| - [26/06/2018 10:21:33] - (.-.) - [0.44 Ko] - (0.0.0.0) - C:

\Windows\System32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [0 Ko] - C:\Windows\SysWOW64\0409
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [2258.5 Ko] - C:\Windows

\SysWOW64\AdvancedInstallers
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [201.5 Ko] - C:\Windows\SysWOW64\ar-SA
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [173 Ko] - C:\Windows\SysWOW64\bg-BG
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0 Ko] - C:\Windows\SysWOW64\catroot
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0 Ko] - C:\Windows\SysWOW64\catroot2
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [302.5 Ko] - C:\Windows\SysWOW64\com
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [157.02 Ko] - C:\Windows

\SysWOW64\config
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [427.5 Ko] - C:\Windows\SysWOW64\cs-CZ
[MD5.F2A1B71072E64F3CBF1045CDA048C945] - |A| - [26/06/2018 13:46:23] - (.Copyright 2011 - CSVer.) - [52 Ko] -

(9.3.0.1019) - C:\Windows\SysWOW64\CSVer.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [422.5 Ko] - C:\Windows\SysWOW64\da-DK
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [452 Ko] - C:\Windows\SysWOW64\de-DE
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [4141.5 Ko] - C:\Windows\SysWOW64\Dism
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [3481.93 Ko] - C:\Windows

\SysWOW64\drivers
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [1.05 Ko] - C:\Windows

\SysWOW64\DriverStore
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [451.5 Ko] - C:\Windows\SysWOW64\el-GR
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [1648 Ko] - C:\Windows\SysWOW64\en
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [32600.57 Ko] - C:\Windows

\SysWOW64\en-US
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [443 Ko] - C:\Windows\SysWOW64\es-ES
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [160.5 Ko] - C:\Windows\SysWOW64\et-EE
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [425 Ko] - C:\Windows\SysWOW64\fi-FI
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [449 Ko] - C:\Windows\SysWOW64\fr-FR
[MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [0 Ko] - C:\Windows\SysWOW64\FxsTmp
[MD5.A8A9E272B84E2E0A90247B65BC877BD4] - |A| - [28/06/2002 09:08:00] - (.Copyright © 2000-2002 GEAR Software

Inc. - GEARAspi.) - [60 Ko] - (1.0.6.0) - C:\Windows\SysWOW64\GEARAspi.dll
[MD5.17B77D83C53AE007C11ED811D992E727] - |A| - [02/09/2002 10:51:00] - (.Copyright © 2001 GEAR Software -

gearsec.) - [48 Ko] - (1.0.0.3) - C:\Windows\SysWOW64\gearsec.exe
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0 Ko] - C:\Windows

\SysWOW64\GroupPolicy
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0 Ko] - C:\Windows

\SysWOW64\GroupPolicyUsers
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [191.5 Ko] - C:\Windows\SysWOW64\he-IL
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [168 Ko] - C:\Windows\SysWOW64\hr-HR
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [429 Ko] - C:\Windows\SysWOW64\hu-HU
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [36.27 Ko] - C:\Windows\SysWOW64\icsxml
[MD5.D384FAC33A6A3E4EDACFE7C1C81105BD] - |A| - [02/06/2016 13:34:14] - (.-.) - [149 Ko] - (0.0.0.0) - C:

\Windows\SysWOW64\igdail32.dll
[MD5.6A2EB90AF06BB1DB56F11FCEC8D5A137] - |A| - [02/06/2016 13:41:12] - (.Copyright © The Khronos Group Inc

2011 - OpenCL Client DLL.) - [67.5 Ko] - (1.2.11.0) - C:\Windows\SysWOW64\Intel_OpenCL_ICD32.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [447 Ko] - C:\Windows\SysWOW64\it-IT
[MD5.FA2E1F09ED6C4C221E4513A7E815E13D] - |A| - [27/08/2013 14:00:08] - (.-.) - [1.5 Ko] - (0.0.0.0) - C:

\Windows\SysWOW64\IusEventLog.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [361 Ko] - C:\Windows\SysWOW64\ja-JP
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [356.5 Ko] - C:\Windows\SysWOW64\ko-KR
[MD5.C1B7AB03AC2F3C990A40BC2E18E02CF1] - |A| - [13/07/2009 22:35:50] - (.-.) - [11687.04 Ko] - (0.0.0.0) - C:

\Windows\SysWOW64\korwbrkr.lex
[MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [0 Ko] - C:\Windows\SysWOW64\LogFiles
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [165 Ko] - C:\Windows\SysWOW64\lt-LT
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [166 Ko] - C:\Windows\SysWOW64\lv-LV
[MD5.00000000000000000000000000000000] - |D| - [26/06/2018 14:06:12] - [47832.1 Ko] - C:\Windows

\SysWOW64\Macromed
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [1968.26 Ko] - C:\Windows

\SysWOW64\manifeststore
[MD5.98071B6EE16AA76DABFF377A5DC69C86] - |A| - [14/07/2009 00:55:01] - (.-.) - [0.52 Ko] - (0.0.0.0) - C:

\Windows\SysWOW64\mapisvc.inf
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [3178.93 Ko] - C:\Windows

\SysWOW64\migration
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [32737.45 Ko] - C:\Windows

\SysWOW64\migwiz
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [52.28 Ko] - C:\Windows\SysWOW64\Msdtc
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [11.33 Ko] - C:\Windows\SysWOW64\MUI
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [418 Ko] - C:\Windows\SysWOW64\nb-NO
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0 Ko] - C:\Windows\SysWOW64\NDF
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [51 Ko] - C:\Windows

\SysWOW64\NetworkList
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [438.5 Ko] - C:\Windows\SysWOW64\nl-NL
[MD5.1C96B3DA6ABE5E18B63C64DF75884F6A] - |A| - [13/07/2009 22:35:50] - (.-.) - [1.45 Ko] - (0.0.0.0) - C:

\Windows\SysWOW64\noise.kor
[MD5.E5BB16FC0CF8F16C7CB7BDC51A50F5DB] - |A| - [07/04/2016 15:07:44] - (.Copyright (c) NovaTek 2009 - 2013 -

NovaTek Msdc Ext - Avision.) - [64.5 Ko] - (12.1.13.23) - C:\Windows\SysWOW64\NvUSBScan.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [2566.05 Ko] - C:\Windows\SysWOW64\oobe
[MD5.B7795BC96C1CEB86E04E8DC843E9C784] - |A| - [10/06/2009 17:17:19] - (.-.) - [113.56 Ko] - (0.0.0.0) - C:

\Windows\SysWOW64\PerfCenterCpl.ico
[MD5.44A2D826C266384D0138AD8F556F00D3] - |A| - [26/06/2018 11:10:24] - (.-.) - [756.25 Ko] - (0.0.0.0) - C:

\Windows\SysWOW64\PerfStringBackup.INI
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [434 Ko] - C:\Windows\SysWOW64\pl-PL
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [413.88 Ko] - C:\Windows

\SysWOW64\Printing_Admin_Scripts
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [431 Ko] - C:\Windows\SysWOW64\pt-BR
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [433 Ko] - C:\Windows\SysWOW64\pt-PT
[MD5.03CC2DBAA07B1A6FC2CEE0E5FA96AC8B] - |A| - [29/10/2018 20:46:24] - (.-.) - [2224.5 Ko] - (4.7.0.0) - C:

\Windows\SysWOW64\QtCoreViz4.dll
[MD5.3BD34B2BC0242ACB8C1B5F125674093B] - |A| - [29/10/2018 20:46:24] - (.-.) - [7960 Ko] - (4.7.0.0) - C:

\Windows\SysWOW64\QtGuiViz4.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [23.75 Ko] - C:\Windows\SysWOW64\ras
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0.64 Ko] - C:\Windows

\SysWOW64\Recovery
[MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [0 Ko] - C:\Windows\SysWOW64\restore
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [169 Ko] - C:\Windows\SysWOW64\ro-RO
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [429.5 Ko] - C:\Windows\SysWOW64\ru-RU
[MD5.DEDB6A2F987B056D5FF22FD571745B8F] - |A| - [07/04/2016 15:07:44] - (.Copyright (c) 2015, Visioneer Inc. -

Visioneer RoadWarrior 3 LLD.) - [368 Ko] - (0.9.115.331) - C:\Windows\SysWOW64\RWAR3.dll
[MD5.3D3CD5895450C50B37DC20F48C5F735C] - |A| - [11/04/2016 19:08:56] - (.Copyright © 2016, Visioneer Inc. -

TNG CoInstaller.) - [308 Ko] - (5.1.16.4119) - C:\Windows\SysWOW64\RWAR3CI.dll
[MD5.D1FB5EAEAD98E28242D90DAA978A9F2B] - |A| - [20/07/2015 15:13:34] - (.Copyright © 2015, Visioneer Inc. -

Visioneer WIA Driver.) - [408.5 Ko] - (5.1.15.7205) - C:\Windows\SysWOW64\RWAR3WIAT.DLL
[MD5.09418478BB1C1491DD93CED3EE528DAC] - |A| - [20/07/2015 11:07:34] - (.Copyright © 2015, Visioneer Inc. -

Visioneer WIA UI Extension.) - [411 Ko] - (5.1.15.7202) - C:\Windows\SysWOW64\RWAR3WUI.DLL
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [169.5 Ko] - C:\Windows\SysWOW64\sk-SK
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [166 Ko] - C:\Windows\SysWOW64\sl-SI
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [37.8 Ko] - C:\Windows\SysWOW64\slmgr
[MD5.A95238DEB5AEF6CCF70B034F915C1229] - |A| - [18/07/2018 16:07:20] - (.-.) - [0.11 Ko] - (0.0.0.0) - C:

\Windows\SysWOW64\SmartFlow.txt
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [2800 Ko] - C:\Windows\SysWOW64\Speech
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [1142.37 Ko] - C:\Windows\SysWOW64\spp
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [30.19 Ko] - C:\Windows\SysWOW64\sppui
[MD5.D41D8CD98F00B204E9800998ECF8427E] - |A| - [26/03/2019 23:17:48] - (.-.) - [0 Ko] - (0.0.0.0) - C:

\Windows\SysWOW64\SpyWareFolderstoFilter.txt
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [170 Ko] - C:\Windows\SysWOW64\sr-

Latn-CS
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [421.5 Ko] - C:\Windows\SysWOW64\sv-SE
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [0 Ko] - C:\Windows\SysWOW64\sysprep
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [0 Ko] - C:\Windows\SysWOW64\Tasks
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [157 Ko] - C:\Windows\SysWOW64\th-TH
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [419 Ko] - C:\Windows\SysWOW64\tr-TR
[MD5.569EB253765F2B0854F26A1D7A0191BC] - |A| - [29/10/2018 20:46:24] - (.(C) 1993-2013 TWAIN Working Group. -

TWAIN 32 Source Manager (Image Acquisition Interface).) - [147.2 Ko] - (2.3.0.0) - C:\Windows

\SysWOW64\TWAINDSM.dll
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [166.5 Ko] - C:\Windows\SysWOW64\uk-UA
[MD5.15BD0F8D507546F512EE5D73C3721FA8] - |A| - [13/07/2009 22:35:41] - (.Copyright © 2000 - vfpodbc.) - [20.05

Ko] - (1.0.2.0) - C:\Windows\SysWOW64\vfpodbc.dll
[MD5.00000000000000000000000000000000] - |D| - [26/06/2018 11:53:32] - [237.33 Ko] - C:\Windows\SysWOW64\Wat
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [9058.19 Ko] - C:\Windows\SysWOW64\wbem
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [60.46 Ko] - C:\Windows\SysWOW64\WCN
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [101.23 Ko] - C:\Windows\SysWOW64\wdi
[MD5.00000000000000000000000000000000] - |D| - [14/07/2009 01:32:38] - [8539.71 Ko] - C:\Windows

\SysWOW64\WindowsPowerShell
[MD5.00000000000000000000000000000000] - |D| - [21/11/2010 03:06:51] - [99.06 Ko] - C:\Windows\SysWOW64\winrm
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [333.5 Ko] - C:\Windows\SysWOW64\zh-CN
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [255.5 Ko] - C:\Windows\SysWOW64\zh-HK
[MD5.00000000000000000000000000000000] - |D| - [13/07/2009 23:20:14] - [334 Ko] - C:\Windows\SysWOW64\zh-TW

---------- | [Public]

[13/07/2009 23:20:08] - |RHD| - [6788] - C:\Users\Public\Desktop
[14/07/2009 00:54:24] - |ASH| - [174] - C:\Users\Public\desktop.ini
[13/07/2009 23:20:08] - |RD| - [323] - C:\Users\Public\Documents
[13/07/2009 23:20:08] - |RD| - [174] - C:\Users\Public\Downloads
[13/07/2009 23:20:08] - |RHD| - [0] - C:\Users\Public\Favorites
[23/02/2019 19:07:47] - |D| - [1834] - C:\Users\Public\Foxit Software
[13/07/2009 23:20:08] - |RHD| - [3966] - C:\Users\Public\Libraries
[13/07/2009 23:20:08] - |RD| - [17440357] - C:\Users\Public\Music
[13/07/2009 23:20:08] - |RD| - [5838651] - C:\Users\Public\Pictures
[21/11/2010 03:16:58] - |RD| - [9699579] - C:\Users\Public\Recorded TV
[26/06/2018 13:44:20] - |D| - [0] - C:\Users\Public\Roaming
[13/07/2009 23:20:08] - |RD| - [26246732] - C:\Users\Public\Videos

---------- | [********]

[26/06/2018 09:29:15] - |HD| - [37593398117] - C:\Users\********\AppData
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\Application Data
[26/06/2018 09:29:28] - |RD| - [45008] - C:\Users\********\Contacts
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\Cookies
[26/06/2018 09:29:15] - |RD| - [2906776435] - C:\Users\********\Desktop
[26/06/2018 09:29:15] - |RD| - [1112685926] - C:\Users\********\Documents
[26/06/2018 09:29:15] - |RD| - [21760657332] - C:\Users\********\Downloads
[26/06/2018 09:29:15] - |RD| - [3432] - C:\Users\********\Favorites
[26/06/2018 10:21:40] - |SHD| - [24444] - C:\Users\********\IntelGraphicsProfiles
[26/06/2018 09:29:15] - |RD| - [2304] - C:\Users\********\Links
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\Local Settings
[26/06/2018 09:29:15] - |RD| - [21497044] - C:\Users\********\Music
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\My Documents
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\NetHood
[26/06/2018 09:29:15] - |ASH| - [1835008] - C:\Users\********\NTUSER.DAT
[26/06/2018 09:29:15] - |ASH| - [262144] - C:\Users\********\ntuser.dat.LOG1
[26/06/2018 09:29:15] - |ASH| - [0] - C:\Users\********\ntuser.dat.LOG2
[26/06/2018 09:29:15] - |ASH| - [65536] - C:\Users\********\NTUSER.DAT{016888bd-6c6f-11de-8d1d-

001e0bcde3ec}.TM.blf
[26/06/2018 09:29:15] - |ASH| - [524288] - C:\Users\********\NTUSER.DAT{016888bd-6c6f-11de-8d1d-

001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[26/06/2018 09:29:15] - |ASH| - [524288] - C:\Users\********\NTUSER.DAT{016888bd-6c6f-11de-8d1d-

001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[26/06/2018 09:29:15] - |SH| - [20] - C:\Users\********\ntuser.ini
[26/06/2018 09:29:15] - |RD| - [504] - C:\Users\********\Pictures
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\PrintHood
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\Recent
[26/06/2018 13:44:20] - |D| - [0] - C:\Users\********\Roaming
[26/06/2018 09:29:15] - |RD| - [282] - C:\Users\********\Saved Games
[26/06/2018 09:29:40] - |RD| - [2156] - C:\Users\********\Searches
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\SendTo
[30/08/2018 00:14:03] - |D| - [0] - C:\Users\********\source
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\Start Menu
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\Templates
[26/06/2018 09:29:15] - |RD| - [504] - C:\Users\********\Videos
[26/06/2018 09:29:15] - |D| - [37353303098] - C:\Users\********\AppData\Local
[26/06/2018 09:29:15] - |D| - [283563] - C:\Users\********\AppData\LocalLow
[26/06/2018 09:29:15] - |D| - [239811456] - C:\Users\********\AppData\Roaming
[30/08/2018 00:13:41] - |D| - [2] - C:\Users\********\AppData\Local\.IdentityService
[24/02/2019 23:25:18] - |D| - [0] - C:\Users\********\AppData\Local\Adobe
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\AppData\Local\Application Data
[30/08/2018 08:09:46] - |D| - [0] - C:\Users\********\AppData\Local\Apps
[13/08/2018 21:54:20] - |D| - [0] - C:\Users\********\AppData\Local\Audacity
[26/06/2018 13:46:18] - |D| - [0] - C:\Users\********\AppData\Local\dell
[12/01/2019 00:03:36] - |D| - [11231313] - C:\Users\********\AppData\Local\Dell Inc
[30/08/2018 08:09:45] - |D| - [0] - C:\Users\********\AppData\Local\Deployment
[08/04/2019 10:57:30] - |D| - [101749] - C:\Users\********\AppData\Local\Diagnostics
[27/06/2018 22:18:51] - |A| - [90928] - C:\Users\********\AppData\Local\GDIPFONTCACHEV1.DAT
[12/07/2019 13:36:58] - |D| - [424917179] - C:\Users\********\AppData\Local\Google
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\AppData\Local\History
[26/06/2018 10:11:51] - |AH| - [2633857] - C:\Users\********\AppData\Local\IconCache.db
[26/06/2018 09:29:15] - |D| - [403277230] - C:\Users\********\AppData\Local\Microsoft
[27/06/2018 08:28:25] - |D| - [145260] - C:\Users\********\AppData\Local\Microsoft Help
[26/06/2018 13:51:55] - |D| - [208431218] - C:\Users\********\AppData\Local\Mozilla
[27/06/2018 13:07:36] - |D| - [0] - C:\Users\********\AppData\Local\Notepad++
[27/06/2018 12:00:34] - |D| - [0] - C:\Users\********\AppData\Local\Programs
[10/03/2019 17:53:01] - |D| - [17260365515] - C:\Users\********\AppData\Local\Propellerhead Software
[07/12/2018 01:43:28] - |A| - [600] - C:\Users\********\AppData\Local\PUTTY.RND
[30/08/2018 00:04:17] - |D| - [32] - C:\Users\********\AppData\Local\ServiceHub
[26/06/2018 09:29:15] - |D| - [19041990985] - C:\Users\********\AppData\Local\Temp
[26/06/2018 09:29:15] - |SHD| - [0] - C:\Users\********\AppData\Local\Temporary Internet Files
[26/06/2018 09:29:26] - |D| - [0] - C:\Users\********\AppData\Local\VirtualStore
[29/10/2018 20:51:50] - |D| - [117230] - C:\Users\********\AppData\Local\Visioneer
[26/06/2018 11:08:58] - |SD| - [283563] - C:\Users\********\AppData\LocalLow\Microsoft
[26/06/2018 13:51:59] - |D| - [0] - C:\Users\********\AppData\LocalLow\Mozilla
[30/08/2018 08:01:19] - |D| - [0] - C:\Users\********\AppData\LocalLow\Temp
[26/06/2018 12:39:59] - |D| - [0] - C:\Users\********\AppData\Roaming\Adobe
[13/08/2018 21:54:20] - |D| - [57419] - C:\Users\********\AppData\Roaming\audacity
[23/02/2019 19:07:39] - |D| - [12] - C:\Users\********\AppData\Roaming\Foxit AgentInformation
[23/02/2019 19:07:33] - |D| - [90981165] - C:\Users\********\AppData\Roaming\Foxit Software
[26/06/2018 09:29:30] - |D| - [0] - C:\Users\********\AppData\Roaming\Identities
[26/06/2018 13:44:29] - |D| - [101299] - C:\Users\********\AppData\Roaming\Intel
[26/06/2018 22:04:50] - |D| - [3760] - C:\Users\********\AppData\Roaming\IrfanView
[20/03/2019 22:28:06] - |D| - [445325] - C:\Users\********\AppData\Roaming\iZotope
[23/08/2018 19:50:09] - |D| - [7454] - C:\Users\********\AppData\Roaming\KeePass
[27/06/2018 12:03:16] - |D| - [964852] - C:\Users\********\AppData\Roaming\Line 6
[26/06/2018 14:06:48] - |D| - [510022] - C:\Users\********\AppData\Roaming\Macromedia
[26/06/2018 09:29:15] - |D| - [0] - C:\Users\********\AppData\Roaming\Media Center Programs
[26/06/2018 09:29:15] - |SD| - [25338783] - C:\Users\********\AppData\Roaming\Microsoft
[30/08/2018 00:04:12] - |D| - [0] - C:\Users\********\AppData\Roaming\Microsoft Visual Studio
[17/01/2019 20:51:45] - |D| - [3805258] - C:\Users\********\AppData\Roaming\MixMeister Technology
[26/06/2018 13:51:57] - |D| - [73381144] - C:\Users\********\AppData\Roaming\Mozilla
[26/06/2018 21:16:07] - |D| - [2507165] - C:\Users\********\AppData\Roaming\Notepad++
[30/08/2018 08:00:53] - |D| - [210] - C:\Users\********\AppData\Roaming\NuGet
[27/06/2018 12:01:01] - |D| - [36444928] - C:\Users\********\AppData\Roaming\Propellerhead Software
[30/08/2018 18:35:48] - |D| - [357] - C:\Users\********\AppData\Roaming\Skype
[30/08/2018 00:04:15] - |D| - [4788763] - C:\Users\********\AppData\Roaming\Visual Studio Setup
[27/04/2019 23:59:13] - |D| - [96417] - C:\Users\********\AppData\Roaming\vlc
[30/08/2018 00:04:16] - |D| - [66] - C:\Users\********\AppData\Roaming\vstelemetry
[26/06/2018 20:44:43] - |D| - [377057] - C:\Users\********\AppData\Roaming\Winamp
[26/06/2018 09:29:40] - |SH| - [174] - C:\Users\********\AppData\Roaming\Microsoft\Windows\Start Menu

\desktop.ini
[26/06/2018 09:29:15] - |RD| - [17432] - C:\Users\********\AppData\Roaming\Microsoft\Windows\Start Menu

\Programs
[26/06/2018 09:29:15] - |RD| - [14615] - C:\Users\********\AppData\Roaming\Microsoft\Windows\Start Menu

\Programs\Accessories
[26/06/2018 09:29:40] - |RD| - [174] - C:\Users\********\AppData\Roaming\Microsoft\Windows\Start Menu

\Programs\Administrative Tools
[26/06/2018 09:29:40] - |SH| - [476] - C:\Users\********\AppData\Roaming\Microsoft\Windows\Start Menu

\Programs\desktop.ini
[26/06/2018 09:29:41] - |A| - [1413] - C:\Users\********\AppData\Roaming\Microsoft\Windows\Start Menu

\Programs\Internet Explorer.lnk
[26/06/2018 09:29:15] - |RD| - [580] - C:\Users\********\AppData\Roaming\Microsoft\Windows\Start Menu

\Programs\Maintenance
[26/06/2018 09:29:40] - |RD| - [174] - C:\Users\********\AppData\Roaming\Microsoft\Windows\Start Menu

\Programs\Startup
[26/06/2018 09:29:40] - |SH| - [174] - C:\Users\********\AppData\Roaming\Microsoft\Windows\Start Menu

\Programs\Startup\desktop.ini

---------- | C:\ProgramData

[14/07/2009 01:08:56] - |SHD| - [0] - C:\ProgramData\Application Data
[26/06/2018 13:40:00] - |D| - [1804255] - C:\ProgramData\dell
[26/06/2018 13:36:38] - |D| - [358787008] - C:\ProgramData\Dell Inc
[14/07/2009 01:08:56] - |SHD| - [0] - C:\ProgramData\Desktop
[14/07/2009 01:08:56] - |SHD| - [0] - C:\ProgramData\Documents
[14/07/2009 01:08:56] - |SHD| - [0] - C:\ProgramData\Favorites
[23/02/2019 19:07:39] - |D| - [29] - C:\ProgramData\Foxit ContentPlatform
[23/02/2019 19:07:53] - |D| - [14336] - C:\ProgramData\Foxit Software
[26/06/2018 13:41:00] - |D| - [81505] - C:\ProgramData\Intel
[26/06/2018 13:43:56] - |D| - [1455] - C:\ProgramData\Intel.sav
[27/06/2018 12:03:15] - |D| - [21621574] - C:\ProgramData\Line 6
[22/02/2019 10:31:22] - |D| - [591] - C:\ProgramData\Macrium
[13/07/2009 23:20:08] - |SD| - [952933339] - C:\ProgramData\Microsoft
[27/06/2018 08:28:24] - |D| - [57380] - C:\ProgramData\Microsoft Help
[29/08/2018 23:57:35] - |D| - [1096] - C:\ProgramData\Microsoft Visual Studio
[08/02/2019 01:45:00] - |D| - [24] - C:\ProgramData\Mozilla
[26/06/2018 13:43:04] - |D| - [163404477] - C:\ProgramData\Package Cache
[26/06/2018 13:37:27] - |D| - [182257943] - C:\ProgramData\PCDr
[27/06/2018 12:01:03] - |D| - [5964808815] - C:\ProgramData\Propellerhead Software
[26/06/2018 13:44:20] - |D| - [0] - C:\ProgramData\Roaming
[14/07/2009 01:08:56] - |SHD| - [0] - C:\ProgramData\Start Menu
[26/06/2018 13:36:35] - |D| - [78823424] - C:\ProgramData\SupportAssist
[14/07/2009 01:08:56] - |SHD| - [0] - C:\ProgramData\Templates
[29/10/2018 20:46:56] - |D| - [0] - C:\ProgramData\Visioneer

---------- | C:\ProgramData\Microsoft\Windows\Start Menu

[14/07/2009 01:01:14] - |A| - [1282] - C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
[14/07/2009 00:49:40] - |ASH| - [442] - C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini
[13/07/2009 23:20:08] - |RD| - [182250] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs
[14/07/2009 00:49:40] - |A| - [1266] - C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk

---------- | C:\ProgramData\Microsoft\Windows\Start Menu\Programs

[26/06/2018 22:13:31] - |D| - [1637] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[13/07/2009 23:20:08] - |RD| - [43554] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
[14/07/2009 01:32:38] - |RD| - [21157] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative

Tools
[06/04/2019 14:02:59] - |D| - [1600] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AKAI PROFESSIONAL
[13/08/2018 21:54:14] - |A| - [1019] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
[30/05/2019 09:48:51] - |D| - [2143] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell
[14/07/2009 00:54:23] - |ASH| - [1130] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini
[13/07/2019 10:49:39] - |A| - [942] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
[23/02/2019 19:07:35] - |D| - [2739] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foxit Reader
[14/07/2009 01:32:38] - |RD| - [778] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
[12/07/2019 13:36:58] - |A| - [2298] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
[26/06/2018 13:40:31] - |RD| - [3490] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
[26/06/2018 13:44:04] - |RD| - [11852] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel PROSet

Wireless
[26/06/2018 22:04:52] - |D| - [9633] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IrfanView
[20/03/2019 21:59:53] - |D| - [4730] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iZotope
[23/08/2018 18:00:52] - |A| - [1131] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass 2.lnk
[27/06/2018 12:03:16] - |D| - [2144] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Line 6
[13/07/2009 23:20:08] - |RD| - [4370] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance
[26/06/2018 12:24:35] - |A| - [1345] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
[27/06/2018 08:31:39] - |D| - [31702] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[17/01/2019 20:47:45] - |D| - [918] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MixMeister
[26/06/2018 21:16:08] - |D| - [1037] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
[05/05/2019 22:45:13] - |D| - [2623] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
[27/06/2018 12:00:56] - |D| - [4114] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Propellerhead
[26/06/2018 21:15:05] - |D| - [5242] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PuTTY (64-bit)
[14/07/2009 00:57:08] - |A| - [1330] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
[30/08/2018 18:35:39] - |D| - [1332] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[13/07/2009 23:20:08] - |RD| - [174] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
[27/04/2019 23:56:09] - |D| - [5592] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[30/08/2018 00:12:40] - |D| - [0] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Visual Studio 2017
[26/06/2018 20:45:57] - |D| - [3813] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Winamp
[14/07/2009 00:57:09] - |A| - [1352] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime

Upgrade.lnk
[26/06/2018 12:24:35] - |A| - [1326] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD

Maker.lnk
[14/07/2009 00:54:59] - |A| - [1210] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and

Scan.lnk
[14/07/2009 00:57:06] - |A| - [1547] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media

Player.lnk
[14/07/2009 00:57:08] - |A| - [1246] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk

---------- | C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

[14/07/2009 00:54:23] - |ASH| - [174] - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

\desktop.ini

---------- | C:\Program Files (x86)

[13/08/2018 21:54:09] - |D| - [55066342] - C:\Program Files (x86)\Audacity
[26/06/2018 13:44:00] - |D| - [7114563] - C:\Program Files (x86)\Cisco
[13/07/2009 23:20:08] - |D| - [1393552496] - C:\Program Files (x86)\Common Files
[14/07/2009 00:54:24] - |ASH| - [174] - C:\Program Files (x86)\desktop.ini
[23/02/2019 19:07:26] - |D| - [262446973] - C:\Program Files (x86)\Foxit Software
[12/07/2019 13:36:26] - |D| - [535966281] - C:\Program Files (x86)\Google
[26/06/2018 13:41:18] - |HD| - [7992886] - C:\Program Files (x86)\InstallShield Installation Information
[26/06/2018 10:01:47] - |D| - [50297901] - C:\Program Files (x86)\Intel
[13/07/2009 23:20:08] - |D| - [10317233] - C:\Program Files (x86)\Internet Explorer
[26/06/2018 22:04:50] - |D| - [3978395] - C:\Program Files (x86)\IrfanView
[20/03/2019 21:56:54] - |D| - [87560357] - C:\Program Files (x86)\iZotope
[23/08/2018 18:00:52] - |D| - [7048580] - C:\Program Files (x86)\KeePass Password Safe 2
[22/10/2018 00:33:43] - |D| - [1615211] - C:\Program Files (x86)\Lame For Audacity
[30/08/2018 18:35:32] - |D| - [196515002] - C:\Program Files (x86)\Microsoft
[27/06/2018 08:28:44] - |D| - [39769547] - C:\Program Files (x86)\Microsoft Analysis Services
[27/06/2018 08:28:24] - |D| - [602654491] - C:\Program Files (x86)\Microsoft Office
[30/08/2018 00:04:04] - |D| - [0] - C:\Program Files (x86)\Microsoft Visual Studio
[26/06/2018 11:09:32] - |D| - [8251487] - C:\Program Files (x86)\Microsoft.NET
[17/01/2019 20:47:44] - |D| - [13503903] - C:\Program Files (x86)\MixMeister Pro 5
[13/07/2019 10:49:38] - |D| - [330977] - C:\Program Files (x86)\Mozilla Maintenance Service
[14/07/2009 01:32:38] - |D| - [25757] - C:\Program Files (x86)\MSBuild
[26/06/2018 21:16:07] - |D| - [10359025] - C:\Program Files (x86)\Notepad++
[05/05/2019 22:45:13] - |D| - [138958688] - C:\Program Files (x86)\Panda Security
[14/07/2009 01:32:38] - |D| - [36962049] - C:\Program Files (x86)\Reference Assemblies
[14/07/2009 00:57:06] - |HD| - [0] - C:\Program Files (x86)\Uninstall Information
[29/10/2018 20:45:33] - |D| - [63898285] - C:\Program Files (x86)\Visioneer
[26/06/2018 20:44:43] - |D| - [26487570] - C:\Program Files (x86)\Winamp
[14/07/2009 01:32:38] - |D| - [512000] - C:\Program Files (x86)\Windows Defender
[13/07/2009 23:20:08] - |D| - [6115840] - C:\Program Files (x86)\Windows Mail
[14/07/2009 01:32:38] - |D| - [5008657] - C:\Program Files (x86)\Windows Media Player
[13/07/2009 23:20:08] - |D| - [12062388] - C:\Program Files (x86)\Windows NT
[14/07/2009 01:32:38] - |D| - [4394248] - C:\Program Files (x86)\Windows Photo Viewer
[14/07/2009 01:32:38] - |D| - [189952] - C:\Program Files (x86)\Windows Portable Devices
[14/07/2009 01:32:38] - |D| - [5990148] - C:\Program Files (x86)\Windows Sidebar

---------- | C:\Program Files

[26/06/2018 22:13:30] - |D| - [5158872] - C:\Program Files\7-Zip
[13/07/2009 23:20:08] - |D| - [1356788886] - C:\Program Files\Common Files
[26/06/2018 13:36:35] - |D| - [513645403] - C:\Program Files\Dell
[26/06/2018 13:45:06] - |D| - [24509650] - C:\Program Files\DellTPad
[14/07/2009 00:54:24] - |ASH| - [174] - C:\Program Files\desktop.ini
[14/07/2009 01:32:38] - |D| - [90245652] - C:\Program Files\DVD Maker
[26/06/2018 13:41:18] - |D| - [46886304] - C:\Program Files\IDT
[26/06/2018 10:01:27] - |D| - [258387305] - C:\Program Files\Intel
[13/07/2009 23:20:08] - |D| - [30309460] - C:\Program Files\Internet Explorer
[27/06/2018 08:28:53] - |D| - [6730385] - C:\Program Files\Microsoft Office
[13/07/2019 10:49:38] - |D| - [189693669] - C:\Program Files\Mozilla Firefox
[14/07/2009 01:32:38] - |D| - [25757] - C:\Program Files\MSBuild
[27/06/2018 12:00:54] - |D| - [54260677671] - C:\Program Files\Propellerhead
[26/06/2018 21:15:05] - |D| - [3748404] - C:\Program Files\PuTTY
[14/07/2009 01:32:38] - |D| - [34625193] - C:\Program Files\Reference Assemblies
[14/07/2009 01:09:26] - |HD| - [0] - C:\Program Files\Uninstall Information
[27/04/2019 23:55:43] - |D| - [174855255] - C:\Program Files\VideoLAN
[29/10/2018 20:45:35] - |D| - [3861966] - C:\Program Files\Visioneer
[15/01/2019 20:21:43] - |D| - [23264232] - C:\Program Files\VSTPlugins
[14/07/2009 01:32:38] - |D| - [4016640] - C:\Program Files\Windows Defender
[13/07/2009 23:20:08] - |D| - [6602240] - C:\Program Files\Windows Mail
[14/07/2009 01:32:38] - |D| - [7665069] - C:\Program Files\Windows Media Player
[13/07/2009 23:20:08] - |D| - [12492468] - C:\Program Files\Windows NT
[14/07/2009 01:32:38] - |D| - [5492504] - C:\Program Files\Windows Photo Viewer
[14/07/2009 01:32:38] - |D| - [244736] - C:\Program Files\Windows Portable Devices
[14/07/2009 01:32:38] - |D| - [7040380] - C:\Program Files\Windows Sidebar

---------- | C:\Program Files (x86)\Common Files

[20/03/2019 21:57:06] - |D| - [461383680] - C:\Program Files (x86)\Common Files\Digidesign
[26/06/2018 10:01:23] - |D| - [106832389] - C:\Program Files (x86)\Common Files\Intel
[13/07/2009 23:20:08] - |D| - [201086897] - C:\Program Files (x86)\Common Files\microsoft shared
[26/06/2018 13:40:28] - |D| - [196972] - C:\Program Files (x86)\Common Files\postureAgent
[26/06/2018 20:44:47] - |D| - [4780336] - C:\Program Files (x86)\Common Files\PX Storage Engine
[13/07/2009 23:20:08] - |D| - [2702] - C:\Program Files (x86)\Common Files\Services
[13/07/2009 23:20:08] - |D| - [41103783] - C:\Program Files (x86)\Common Files\SpeechEngines
[13/07/2009 23:20:08] - |D| - [10535331] - C:\Program Files (x86)\Common Files\System
[29/10/2018 20:46:18] - |D| - [27408454] - C:\Program Files (x86)\Common Files\Visioneer
[20/03/2019 21:57:05] - |D| - [491844096] - C:\Program Files (x86)\Common Files\VST3
[17/01/2019 20:46:44] - |D| - [48377856] - C:\Program Files (x86)\Common Files\Wise Installation Wizard

---------- | C:\Program Files\Common files

[20/03/2019 21:57:06] - |D| - [571580920] - C:\Program Files\Common files\Avid
[26/06/2018 13:44:00] - |D| - [49890704] - C:\Program Files\Common files\Intel
[13/07/2009 23:20:08] - |D| - [70059393] - C:\Program Files\Common files\Microsoft Shared
[27/06/2018 12:03:12] - |D| - [2081280] - C:\Program Files\Common files\Propellerhead Software
[13/07/2009 23:20:08] - |D| - [2702] - C:\Program Files\Common files\Services
[13/07/2009 23:20:08] - |D| - [608768] - C:\Program Files\Common files\SpeechEngines
[13/07/2009 23:20:08] - |D| - [12145651] - C:\Program Files\Common files\System
[29/10/2018 20:45:40] - |D| - [28621132] - C:\Program Files\Common files\Visioneer
[20/03/2019 21:57:05] - |D| - [621798336] - C:\Program Files\Common files\VST3

---------- | Tasks

[MD5.F1A6CD5ADAAB953A6764EA364E17BFB8] - [14/07/2009 01:08:49] - |AH| - [6] - C:\Windows\Tasks\SA.DAT
[MD5.308D90E72887F9B5246AAF2FB1854666] - [14/07/2009 01:08:49] - |A| - [17164] - C:\Windows\Tasks\SCHEDLGU.TXT
[MD5.24B1A797A4DC202EF43B0C1FA9FF0181] - [26/06/2018 13:36:59] - |A| - [4208] - C:\Windows\System32\Tasks\Dell

SupportAssistAgent AutoUpdate : C:\Program Files\Dell\SupportAssistAgent\bin

\SupportAssistInstaller.exe
[MD5.5AFF56636FE26F748FF1155056CE6896] - [12/07/2019 13:36:26] - |A| - [3204] - C:\Windows\System32\Tasks

\GoogleUpdateTaskMachineCore : C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
[MD5.A57909F45AE203BCED744BBF7653EB3C] - [12/07/2019 13:36:26] - |A| - [3332] - C:\Windows\System32\Tasks

\GoogleUpdateTaskMachineUA : C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
[MD5.00000000000000000000000000000000] - [13/07/2009 23:20:13] - |D| - [264846] - C:\Windows\System32\Tasks

\Microsoft
[MD5.00000000000000000000000000000000] - [27/06/2018 08:30:03] - |D| - [4392] - C:\Windows\System32\Tasks

\OfficeSoftwareProtectionPlatform
[MD5.00000000000000000000000000000000] - [14/07/2009 01:09:57] - |D| - [0] - C:\Windows\System32\Tasks\WPD
[MD5.5CF981DB98F4965F9D8F6377991E9F54] - [01/10/2018 08:40:59] - |A| - [3136] - C:\Windows\System32\Tasks

\{EE1BEB1A-D10C-43A0-9D62-B7BBC4690C0E} : C:\Windows\system32\pcalua.exe
[MD5.00000000000000000000000000000000] - [13/07/2009 23:20:14] - |D| - [0] - C:\Windows\Syswow64\Tasks

\Microsoft

---------- | Firewall

[HKLM\SYSTEM\CurrentControlSet\Services\sharedaccess\Parameters\FirewallPolicy\FirewallRules]
"Netlogon-NamedPipe-In"=v2.10|Action=Allow|Active=FALSE|Dir=In|Protocol=6|LPort=445|App=System|

[email protected],-1003|[email protected],-1006|[email protected],-1010|
"{C9D920BF-E6BD-40EC-9693-86D8D875A097}"=v2.10|Action=Allow|Active=FALSE|Dir=In|Protocol=6|LPort=808|App=C:

\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe|Svc=NetTcpActivator|[email protected]:\Windows

\Microsoft.NET\Framework64\v4.0.30319\\ServiceModelEvents.dll,-2000|[email protected]:\Windows\Microsoft.NET

\Framework64\v4.0.30319\\ServiceModelEvents.dll,-2001|[email protected]:\Windows\Microsoft.NET

\Framework64\v4.0.30319\\ServiceModelEvents.dll,-2002|
"{DA3FC957-B91F-4B12-B5BC-387B37AEA4A6}"=v2.10|Action=Allow|Active=TRUE|Dir=In|App=C:\Program Files\Intel

\WiFi\bin\PanDhcpDns.exe|Name=Wireless PAN DHCP Server|EmbedCtxt=MyWiFiDHCPDNS|
"{1146613B-9846-4149-AAA7-EED5F9DCFA35}"=v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Private|

Profile=Public|App=C:\Program Files (x86)\Winamp\winamp.exe|Name=Winamp|
"{4EB93D04-534E-4F05-A655-E0F1761C493A}"=v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|Profile=Private|

Profile=Public|App=C:\Program Files (x86)\Winamp\winamp.exe|Name=Winamp|
"{DD6A69A7-6F4D-4C94-93A3-EFD897DCD692}"=v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|App=C:\Users

\********\AppData\Roaming\uTorrent\uTorrent.exe|Name=μTorrent (TCP-In)|Desc=Allow μTorrent network traffic

with Edge Traversal|Edge=TRUE|
"{D0C21295-8A4D-4AAF-867C-F5606173A37E}"=v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|App=C:\Users

\********\AppData\Roaming\uTorrent\uTorrent.exe|Name=μTorrent (UDP-In)|Desc=Allow μTorrent network traffic

with Edge Traversal|Edge=TRUE|
"{43FE1F9D-0162-42B6-B9BC-30E45CEDC654}"=v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|LPort=5353|App=C:

\Program Files (x86)\Google\Chrome\Application\chrome.exe|Name=Google Chrome (mDNS-In)|Desc=Inbound rule for

Google Chrome to allow mDNS traffic.|EmbedCtxt=Google Chrome|





---------- | Control\Class

[HKLM\SYSTEM\CurrentControlSet\Control\Class\{0475BB51-5A02-4EE0-B36C-29040FAD2650}] : (igfx) [] ->
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{1264760F-A5C8-4BFE-B314-D56A7B44A362}] : (DXGKrnl) [] ->
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{24A0C840-2C3D-4410-8236-8B40816C7B90}] : (aswVmm) [] ->
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{25DBCE51-6C8F-4A72-8A6D-B54C2B4FC835}] : (WCEUSBS) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3026
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{36FC9E60-C465-11CF-8056-444553540000}] : (USB) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3025
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4116F60B-25B3-4662-B732-99A6111EDC0B}] : (IPMIDRV) [] ->
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{43675D81-502A-4A82-9F84-B75F418C5DEA}] : (Media Center Extender)

[] -> @%SystemRoot%\system32\McxDriv.dll,-100
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4658EE7E-F050-11D1-B6BD-00C04FA372A7}] : (PnpPrinters) [] -> @

%systemroot%\system32\ntprint.dll,-1300
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{48721B56-6795-11D2-B1A8-0080C72E74A2}] : (Dot4) [] -> @

%SystemRoot%\system32\sysclass.dll,-3023
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{49CE6AC8-6F86-11D2-B1E5-0080C72E74A2}] : (Dot4Print) [] -> @

%SystemRoot%\system32\sysclass.dll,-3024
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}] : (CDROM) [] -> @

%SystemRoot%\System32\StorProp.dll,-17001
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E966-E325-11CE-BFC1-08002BE10318}] : (Computer) [] -> @

%SystemRoot%\System32\SysClass.dll,-3000
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}] : (DiskDrive) [] -> @

%SystemRoot%\System32\StorProp.dll,-17000
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}] : (Display) [] ->

@DispCI.dll,-3100
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}] : (fdc) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3013
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}] : (hdc) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3001
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}] : (Keyboard) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3002
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96C-E325-11CE-BFC1-08002BE10318}] : (MEDIA) [] ->

@mmci.dll,-3000
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}] : (Modem) [] -> @

%SystemRoot%\System32\mdminst.dll,-14100
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96E-E325-11CE-BFC1-08002BE10318}] : (Monitor) [] ->

@Montr_CI.dll,-3100
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96F-E325-11CE-BFC1-08002BE10318}] : (Mouse) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3004
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E970-E325-11CE-BFC1-08002BE10318}] : (MTD) [] ->

@SysClass.Dll,-3021
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E971-E325-11CE-BFC1-08002BE10318}] : (MultiFunction) [] ->

@%SystemRoot%\System32\SysClass.Dll,-3014
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}] : (Net) [] ->

@NetCfgx.dll,-1502
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E973-E325-11CE-BFC1-08002BE10318}] : (NetClient) [] ->

@NetCfgx.dll,-1504
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E974-E325-11CE-BFC1-08002BE10318}] : (NetService) [] ->

@NetCfgx.dll,-1505
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E975-E325-11CE-BFC1-08002BE10318}] : (NetTrans) [] ->

@NetCfgx.dll,-1503
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E977-E325-11CE-BFC1-08002BE10318}] : (PCMCIA) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3010
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E978-E325-11CE-BFC1-08002BE10318}] : (Ports) [] -> @

%SystemRoot%\System32\msports.dll,-10000
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E979-E325-11CE-BFC1-08002BE10318}] : (Printer) [] -> @

%systemroot%\system32\ntprint.dll,-1004
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}] : (SCSIAdapter) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3005
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E97D-E325-11CE-BFC1-08002BE10318}] : (System) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3008
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E97E-E325-11CE-BFC1-08002BE10318}] : (Unknown) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3009
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}] : (FloppyDisk) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3015
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{50127DC3-0F36-415E-A6CC-4CB3BE910B65}] : (Processor) [] -> @

%SystemRoot%\system32\procinst.dll,-100
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{50906CB8-BA12-11D1-BF5D-0000F805F530}] : (MultiPortSerial) [] ->

@%SystemRoot%\system32\sysclass.dll,-3022
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{5099944A-F6B9-4057-A056-8C550228544C}] : (Memory) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3018
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{50DD5230-BA8A-11D1-BF5D-0000F805F530}] : (SmartCardReader) [] ->

@StorProp.dll,-17002
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{5175D334-C371-4806-B3BA-71FD53C9258D}] : (Sensor) [] -> @

%systemroot%\system32\SensorsCpl.dll,-10000
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] : (VolumeSnapshot) [] ->

@%SystemRoot%\System32\SysClass.Dll,-3011
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{53D29EF7-377C-4D14-864B-EB3A85769359}] : (BiometricDevice) [] ->

@%SystemRoot%\System32\SysClass.DLL,-3028
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}] : (1394) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3016
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{6BDD1FC5-810F-11D0-BEC7-08002BE2092F}] : (Infrared) [] ->

@NetCfgx.dll,-1501
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{6BDD1FC6-810F-11D0-BEC7-08002BE2092F}] : (Image) [] -> @

%systemroot%\system32\sti_ci.dll,-52
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{6D807884-7D21-11CF-801C-08002BE10318}] : (TapeDrive) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3006
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{6FAE73B7-B735-4B50-A0DA-0DC2484B1F1A}] : (igfx) [] ->
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A-11D0-BEC7-08002BE2092F}] : (Volume) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3007
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{72631E54-78A4-11D0-BCF7-00AA00B7B32A}] : (Battery) [] -> @

%SystemRoot%\system32\batt.dll,-100
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}] : (HIDClass) [] ->

@hid.dll,-101
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{7EBEFBC0-3200-11D2-B4C2-00A0C9697D07}] : (61883) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3019
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{8ECC055D-047F-11D1-A537-0000F8753ED1}] : (LegacyDriver) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3003
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{990A2BD7-E738-46C7-B26F-1CF8FB9F1391}] : (SmartCard) [] ->

@sccls.dll,-300
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{997B5D8D-C442-4F2E-BAF3-9C8E671E9E21}] : (SideShow) [] -> @

%systemroot%\system32\AuxiliaryDisplayClassInstaller.dll,-10000
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{A0A588A4-C46F-4B37-B7EA-C82FE89870C6}] : (SDHost) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3012
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{A3E32DBA-BA89-4F17-8386-2D0127FBD4CC}] : (rdpbus) [] ->
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{BC103702-DD72-406F-9B28-95C868337B59}] : (Transfer Cable) [] ->

@%SystemRoot%\System32\migwiz\migres.dll,-20
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{C06FF265-AE09-48F0-812C-16753D7CBA83}] : (AVC) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3027
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{CE5939AE-EBDE-11D0-B181-0000F8753EC4}] : (MediumChanger) [] ->

@%SystemRoot%\System32\StorProp.dll,-17003
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}] : (SBP2) [] -> @

%SystemRoot%\System32\SysClass.Dll,-3017
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{D61CA365-5AF4-4486-998B-9DB4734C6CA3}] : (XnaComposite) [] -> @

%SystemRoot%\system32\XInput9_1_0.dll,-1000
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}] : (SecurityDevices) [] ->

@%SystemRoot%\System32\SysClass.Dll,-3020
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{DB4F6DDD-9C0E-45E4-9597-78DBBAD0F412}] : (SmartCardFilter) [] ->

@sccls.dll,-301
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{E0CBF06C-CD8B-4647-BB8A-263B43F0F974}] : (Bluetooth) [] -> @

%SystemRoot%\system32\bthci.dll,-4001
[HKLM\SYSTEM\CurrentControlSet\Control\Class\{EEC5AD98-8080-425F-922A-DABF3DE3F69A}] : (WPD) [] ->

@wpd_ci.dll,-101
[HKLM\SYSTEM\CurrentControlSet\Control\Els\Services\{2D64B439-6CAF-4f6b-B688-E5D0F4FAA7D7}] : (Script

Detection) [@elscore.dll,-2] -> ElsLad.dll (Copyright (c) Microsoft Corporation.)
[HKLM\SYSTEM\CurrentControlSet\Control\Els\Services\{A22D52C1-DBFD-40cb-AE78-E3BA9EE1D88F}] :

(Transliteration) [@elscore.dll,-5] -> elstrans.dll (Copyright (c) Microsoft Corporation.)
[HKLM\SYSTEM\CurrentControlSet\Control\Els\Services\{CF7E00B1-909B-4d95-A8F4-611F7C377702}] : (Language

Detection) [@elscore.dll,-1] -> ElsLad.dll (Copyright (c) Microsoft Corporation.)

---------- | Loaded modules (whitelist)

[26/06/2018 13:44:55] - (8.0.0.395) - (Alps Electric Co., Ltd. - Alps Touch Pad Driver) - C:\Windows

\system32\DRIVERS\Apfiltr.sys
[08/05/2018 11:33:24] - (1.4.2.0) - (Dell Inc. - DDDriver.sys) - C:\Windows\system32\drivers

\DDDriver64Dcsa.sys
[08/05/2018 11:33:24] - (3.0.1.4) - (Dell Computer Corporation - DellProf.sys) - C:\Windows\system32\drivers

\DellProf.sys
[26/06/2018 13:41:19] - (6.10.6491.0) - (IDT, Inc. - IDT PC Audio) - C:\Windows\system32\DRIVERS\stwrt64.sys
[27/05/2016 08:03:50] - (1.0.0.0) - (LXD Development, Inc. - Gaming Mouse 33052 Driver) - C:\Windows

\system32\drivers\GMLXDFltr01.sys
[06/04/2019 14:02:57] - (2.9.30.0) - (Ploytec GmbH - Ploytec USB Audio driver) - C:\Windows\System32\Drivers

\akaieieu.sys
[06/04/2019 14:02:57] - (2.9.30.0) - (Numark - Numark WDM MIDI Driver) - C:\Windows\system32\drivers

\akaieiem.sys
[06/04/2019 14:02:57] - (2.9.30.0) - (Numark - Numark USB Audio WDM Driver) - C:\Windows\system32\drivers

\akaieiea.sys
[// ::] - (0.0.0.0) - ( -) - C:\Users\********\AppData\Local\Temp\aswMBR.sys
[// ::] - (0.0.0.0) - ( -) - C:\Users\********\AppData\Local\Temp\aswVmm.sys

---------- | Services | 0 : Starting up | 1 : System | 2 : Automatic | 3 : Manual | 4 : Disabled | R : Running

service | S : Stopped service

R0 - [Kernel Driver] - ACPI (Microsoft ACPI Driver) -> system32\drivers\ACPI.sys - AcceptPause: False -

AcceptStop: True
R0 - [Kernel Driver] - amdxata () -> system32\drivers\amdxata.sys - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - CLFS (@%SystemRoot%\system32\clfs.sys,-100) -> System32\CLFS.sys - AcceptPause: False -

AcceptStop: True
R0 - [Kernel Driver] - CNG () -> System32\Drivers\cng.sys - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - Compbatt (Microsoft Composite Battery Driver) -> system32\DRIVERS\compbatt.sys -

AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - Disk (Disk Driver) -> system32\drivers\disk.sys - AcceptPause: False - AcceptStop: True
R0 - [File System Driver] - FileInfo (@%SystemRoot%\system32\drivers\fileinfo.sys,-100) -> system32\drivers

\fileinfo.sys - AcceptPause: False - AcceptStop: True
R0 - [File System Driver] - FltMgr (@%SystemRoot%\system32\drivers\fltmgr.sys,-10001) -> system32\drivers

\fltmgr.sys - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - fvevol (@%SystemRoot%\system32\drivers\fvevol.sys,-100) -> System32\DRIVERS\fvevol.sys

- AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - hwpolicy (@%systemroot%\system32\drivers\hwpolicy.sys,-101) -> System32\drivers

\hwpolicy.sys - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - iaStorV (Intel RAID Controller Windows 7) -> system32\drivers\iaStorV.sys -

AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - KSecDD () -> System32\Drivers\ksecdd.sys - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - KSecPkg () -> System32\Drivers\ksecpkg.sys - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - mountmgr (@%SystemRoot%\system32\drivers\mountmgr.sys,-100) -> System32\drivers

\mountmgr.sys - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - msisadrv () -> system32\drivers\msisadrv.sys - AcceptPause: False - AcceptStop: True
R0 - [File System Driver] - Mup (@%systemroot%\system32\drivers\mup.sys,-101) -> System32\Drivers\mup.sys -

AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - NDIS (@%SystemRoot%\system32\drivers\ndis.sys,-200) -> system32\drivers\ndis.sys -

AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - partmgr (@%SystemRoot%\system32\drivers\partmgr.sys,-100) -> System32\drivers

\partmgr.sys - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - pci (PCI Bus Driver) -> system32\drivers\pci.sys - AcceptPause: False - AcceptStop:

True
R0 - [Kernel Driver] - pcw (Performance Counters for Windows Driver) -> System32\drivers\pcw.sys -

AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - rdyboost (ReadyBoost) -> System32\drivers\rdyboost.sys - AcceptPause: False -

AcceptStop: True
R0 - [Kernel Driver] - spldr (Security Processor Loader Driver) -> (?) - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - storflt (@%SystemRoot%\system32\vmstorfltres.dll,-1000) -> system32\drivers

\vmstorfl.sys - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - Tcpip (@%SystemRoot%\system32\tcpipcfg.dll,-50003) -> System32\drivers\tcpip.sys -

AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - vdrvroot (Microsoft Virtual Drive Enumerator Driver) -> system32\drivers\vdrvroot.sys -

AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - volmgr (Volume Manager Driver) -> system32\drivers\volmgr.sys - AcceptPause: False -

AcceptStop: True
R0 - [Kernel Driver] - volmgrx (@%SystemRoot%\system32\drivers\volmgrx.sys,-100) -> System32\drivers

\volmgrx.sys - AcceptPause: False - AcceptStop: True
R0 - [Kernel Driver] - volsnap (Storage volumes) -> system32\drivers\volsnap.sys - AcceptPause: False -

AcceptStop: True
R0 - [Kernel Driver] - Wdf01000 (@%SystemRoot%\system32\drivers\Wdf01000.sys,-1000) -> system32\drivers

\Wdf01000.sys - AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - AFD (@%systemroot%\system32\drivers\afd.sys,-1000) -> \SystemRoot\system32\drivers

\afd.sys - AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - Beep (Beep) -> (?) - AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - blbdrive () -> system32\DRIVERS\blbdrive.sys - AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - cdrom (CD-ROM Driver) -> system32\DRIVERS\cdrom.sys - AcceptPause: False - AcceptStop:

True
R1 - [Kernel Driver] - CSC (@%systemroot%\system32\cscsvc.dll,-202) -> system32\drivers\csc.sys - AcceptPause:

False - AcceptStop: True
R1 - [File System Driver] - DfsC (@%systemroot%\system32\drivers\dfsc.sys,-101) -> System32\Drivers\dfsc.sys -

AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - discache (@%systemroot%\system32\drivers\discache.sys,-102) -> System32\drivers

\discache.sys - AcceptPause: False - AcceptStop: True
R1 - [File System Driver] - Msfs () -> (?) - AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - mssmbios (Microsoft System Management BIOS Driver) -> \SystemRoot\system32\drivers

\mssmbios.sys - AcceptPause: False - AcceptStop: True
R1 - [File System Driver] - NetBIOS (NetBIOS Interface) -> system32\DRIVERS\netbios.sys - AcceptPause: False -

AcceptStop: True
R1 - [Kernel Driver] - NetBT (@%SystemRoot%\system32\drivers\netbt.sys,-2) -> System32\DRIVERS\netbt.sys -

AcceptPause: False - AcceptStop: True
R1 - [File System Driver] - Npfs () -> (?) - AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - nsiproxy (@%SystemRoot%\system32\drivers\nsiproxy.sys,-2) -> system32\drivers

\nsiproxy.sys - AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - Null () -> (?) - AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - Psched (@%SystemRoot%\System32\drivers\pacer.sys,-101) -> system32\DRIVERS\pacer.sys -

AcceptPause: False - AcceptStop: True
R1 - [File System Driver] - rdbss (@%systemroot%\system32\wkssvc.dll,-1000) -> system32\DRIVERS\rdbss.sys -

AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - RDPCDD (@%systemroot%\system32\DRIVERS\RDPCDD.sys,-100) -> System32\DRIVERS\RDPCDD.sys

- AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - RDPENCDD (@%systemroot%\system32\drivers\RDPENCDD.sys,-101) -> system32\drivers

\rdpencdd.sys - AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - RDPREFMP (@%systemroot%\system32\drivers\RdpRefMp.sys,-101) -> system32\drivers

\rdprefmp.sys - AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - Serial (Serial port driver) -> system32\DRIVERS\serial.sys - AcceptPause: False -

AcceptStop: True
R1 - [Kernel Driver] - tdx (@%SystemRoot%\system32\tcpipcfg.dll,-50004) -> system32\DRIVERS\tdx.sys -

AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - TermDD (Terminal Device Driver) -> \SystemRoot\system32\drivers\termdd.sys -

AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - VgaSave () -> \SystemRoot\System32\drivers\vga.sys - AcceptPause: False - AcceptStop:

True
R1 - [Kernel Driver] - vwififlt (Virtual WiFi Filter Driver) -> system32\DRIVERS\vwififlt.sys - AcceptPause:

False - AcceptStop: True
R1 - [Kernel Driver] - Wanarpv6 (@%systemroot%\system32\rascfg.dll,-32012) -> system32\DRIVERS\wanarp.sys -

AcceptPause: False - AcceptStop: True
R1 - [Kernel Driver] - WfpLwf (WFP Lightweight Filter) -> system32\DRIVERS\wfplwf.sys - AcceptPause: False -

AcceptStop: True
R2 - [Kernel Driver] - lltdio (Link-Layer Topology Discovery Mapper I/O Driver) -> system32\DRIVERS\lltdio.sys

- AcceptPause: False - AcceptStop: True
R2 - [File System Driver] - luafv (@%systemroot%\system32\drivers\luafv.sys,-100) -> \SystemRoot

\system32\drivers\luafv.sys - AcceptPause: False - AcceptStop: True
R2 - [Kernel Driver] - PEAUTH (PEAUTH) -> system32\drivers\peauth.sys - AcceptPause: False - AcceptStop: True
R2 - [Kernel Driver] - rspndr (Link-Layer Topology Discovery Responder) -> system32\DRIVERS\rspndr.sys -

AcceptPause: False - AcceptStop: True
R2 - [Kernel Driver] - tcpipreg (TCP/IP Registry Compatibility) -> System32\drivers\tcpipreg.sys -

AcceptPause: False - AcceptStop: True

---------- | System files (Microsoft|Avast|Atheros|Adaptec|Brother|Intel Files whitelisted)

[MD5.9FC9C4753876A96C7DEE2E7FF8911294] - [20/03/2003 09:48:00] - (.Copyright (c) GEAR Software 2003 - Filter

Driver for 2k and XP.) - [9.22 Ko] - (1.0.2.3) - C:\Windows\Syswow64\Drivers\GEARAspiWDM.sys

---------- | Uninstall (Whitelist)

[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\AddressBook] : (.-.) ->
----------[{Hidden}][HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\Connection Manager] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\DirectDrawEx] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\DXM_Runtime] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\Fontcore] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\IE40] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\IE4Data] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\IE5BAKEX] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\IEData] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\MobileOptionPack] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\MPlayer2] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\PROSet] : (Intel(R) Network Connections

Drivers.-.Intel) -> Prounstl.exe
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\Reason10.0Stable_64_is1] : (Reason 10

10.4.0d4.-.Propellerhead Software AB) -> "C:\Program Files\Propellerhead\Reason 10\Uninstall Reason

10\unins000.exe"
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\Reason8.0Stable_64_is1] : (Reason 8

8.3.2d7.-.Propellerhead Software AB) -> "C:\Program Files\Propellerhead\Reason 8\Uninstall Reason

8\unins000.exe"
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\SchedulingAgent] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\USB_AUDIO_DEusb-audio.deAkaiEIE] : (Akai EIE Pro USB

Audio driver.-.) -> C:\Windows\usb-audio.deAkaiEIE\Setup.exe /l1
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\WIC] : (.-.) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\{23170F69-40C1-2702-1805-000001000000}] : (7-Zip

18.05 (x64 edition).-.Igor Pavlov) -> MsiExec.exe /I{23170F69-40C1-2702-1805-000001000000}
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\{45B3032F-22CC-40CD-9E97-4DA7095FA5A2}] : (PuTTY

release 0.70 (64-bit).-.Simon Tatham) -> MsiExec.exe /X{45B3032F-22CC-40CD-9E97-4DA7095FA5A2}
----------[{Hidden}][HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\{73ca1ddf-9d19-45f2-ad4c-

04169ec13342}] : (Intel(R) PRO/Wireless Driver.-.Intel Corporation) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\{806422F1-FC4E-4D7C-8855-05748AEFC031}] : (Dell

SupportAssist.-.Dell Inc.) -> MsiExec.exe /X{806422F1-FC4E-4D7C-8855-05748AEFC031}
----------[{Hidden}][HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\{9C481E27-751F-48B9-801D-

C583F032DA50}] : (Intel® PROSet/Wireless WiFi Software.-.Intel Corporation) -> MsiExec.exe /I{9C481E27-751F-

48B9-801D-C583F032DA50}
----------[{Hidden}][HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\{B5E06417-A4AC-4225-B36E-

7E34C91616E7}] : (Intel® Trusted Connect Service Client.-.Intel Corporation) -> MsiExec.exe /I{B5E06417-A4AC-

4225-B36E-7E34C91616E7}
----------[{Hidden}][HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\{BE1CF6CA-3182-45D8-9535-

A18055B73607}] : (Dell Custom Help.-.Intel Corporation) ->
[HKLM\SOFTWARE\Microsoft\windows\CurrentVersion\Uninstall\{F6762963-9AE5-4bc6-A70F-2D749F6AC02F}_is1] :

(Authorizer 2.9.5d1.-.Propellerhead Software AB) -> "C:\Program Files\Propellerhead\Authorizer\Uninstall

Authorizer\unins000.exe"
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\AddressBook] : (.-.) ->
----------[{Hidden}][HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\Connection Manager]

: (.-.) ->
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\DirectDrawEx] : (.-.) ->
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\Fontcore] : (.-.) ->
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\IE40] : (.-.) ->
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\IE4Data] : (.-.) ->
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\IE5BAKEX] : (.-.) ->
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\IEData] : (.-.) ->
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\Line 6 Uninstaller] : (Line 6

Uninstaller.-.Line 6) -> C:\Users\********\AppData\Roaming\Line 6\L6TWXY\Tools\Line 6 Uninstaller.exe
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\MobileOptionPack] : (.-.) ->
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\Neutron 2] : (Neutron 2

Advanced.-.iZotope, Inc.) -> C:\Program Files (x86)\iZotope\Neutron 2\Uninstall Neutron 2.exe
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\Ozone 8] : (Ozone 8 Advanced.-.iZotope,

Inc.) -> C:\VSTs\iZotope\Ozone 8\Uninstall Ozone 8.exe
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\SchedulingAgent] : (.-.) ->
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\WIC] : (.-.) ->
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\{24D75A2D-A712-42F7-B71B-2FFF95905C97}

_is1] : (Europa by Reason.-.Propellerhead Software) -> "C:\Users\********\AppData\Roaming\Propellerhead

Software\Europa by Reason\unins000.exe"
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\{4920CF11-4A79-4D8D-B643-58E0611FC106}]

: (MixMeister Pro 5.-.MixMeister Technology LLC) -> MsiExec.exe /I{4920CF11-4A79-4D8D-B643-58E0611FC106}
----------[{Hidden}][HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6

-A427-B07A5498B4CA}] : (Google Update Helper.-.Google LLC) -> MsiExec.exe /I{60EC980A-BDA2-4CB6-A427-

B07A5498B4CA}
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\{88374377-FCCE-498B-AD19-D72D755F0D46}]

: (Visioneer RoadWarrior 3 Series Driver.-.Visioneer Inc.) -> MsiExec.exe /I{88374377-FCCE-498B-AD19-

D72D755F0D46}
[HKLM\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Uninstall\{AAF91E62-A45B-489B-9C98-3E8C06EBB74F}]

: (Visioneer Acuity Assets V1.-.Visioneer Inc.) -> MsiExec.exe /I{AAF91E62-A45B-489B-9C98-3E8C06EBB74F}

---------- | Ports


---------- | Installer

[HKCR\Installer\Products\11FC029497A4D8D46B34850E16F11C60] : MixMeister Pro 5
[HKCR\Installer\Products\1F224608E4CFC7D488555047A8FE0C13] : Dell SupportAssist -> C:\Windows\Installer

\{806422F1-FC4E-4D7C-8855-05748AEFC031}\ARPPRODUCTICON.exe
[HKCR\Installer\Products\26E19FAAB54AB984C989E3C860BE7BF4] : Visioneer Acuity Assets V1 -> C:\Windows

\Installer\{AAF91E62-A45B-489B-9C98-3E8C06EBB74F}\_6FEFF9B68218417F98F549.exe
[HKCR\Installer\Products\71460E5BCA4A52243BE6E7439C61617E] : Intel® Trusted Connect Service Client
[HKCR\Installer\Products\72E184C9F1579B8408D15C380F23AD05] : Intel® PROSet/Wireless WiFi Software -> C:

\Windows\Installer\{9C481E27-751F-48B9-801D-C583F032DA50}\ARPPRODUCTICON.exe
[HKCR\Installer\Products\77347388ECCFB894DA917DD257F5D064] : Visioneer RoadWarrior 3 Series Driver -> C:

\Windows\Installer\{88374377-FCCE-498B-AD19-D72D755F0D46}\_RWAR3ICON
[HKCR\Installer\Products\96F071321C0420728150000010000000] : 7-Zip 18.05 (x64 edition)
[HKCR\Installer\Products\A089CE062ADB6BC44A720BA745894BAC] : Google Update Helper
[HKCR\Installer\Products\AC6FC1EB28138D5459531A08557B6370] : Dell Custom Help -> C:\Windows\Installer

\{BE1CF6CA-3182-45D8-9535-A18055B73607}\ARPPRODUCTICON.exe
[HKCR\Installer\Products\F2303B54CC22DC04E979D47A90F55A2A] : PuTTY release 0.70 (64-bit) -> C:\Windows

\Installer\{45B3032F-22CC-40CD-9E97-4DA7095FA5A2}\installericon.exe
[HKCR\Installer\Products\FDD1AC3791D92F54DAC44061E91C3324] : Intel(R) PRO/Wireless Driver -> C:\Windows

\Installer\{73CA1DDF-9D19-45F2-AD4C-04169EC13342}\ARPPRODUCTICON.exe

---------- | Drives


---------- | MBR


64 bits not supported by MBR.exe, Dump : C:\QuickDiag\MBR.Bin

---------- | 20 La********ntLog

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------


------------


------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

An exception occurred in session change of service start: System.Reflection.TargetInvocationException:

Exception has been thrown by the target of an invocation. ---> System.TypeLoadException: Could not find

Windows Runtime type 'Windows.UI.Notifications.ToastNotificationManager'. --->

System.PlatformNotSupportedException: Operation is not supported on this platform.
--- End of inner exception stack trace ---
at

Dell.Services.SupportAssist.Notification.Command.NotificationCommand.<DeleteNotificationWhileUninstall>d__23.M

oveNext()
at System.Runtime.CompilerServices.AsyncTaskMethodBuilder.Start[TStateMachine](TStateMachine& stateMachine)
at Dell.Services.SupportAssist.Notification.Command.NotificationCommand.DeleteNotificationWhileUninstall()
at Dell.Services.SupportAssist.Notification.Command.NotificationCommand.ShowNotificationsOnSessionUnlock

(SessionChangeDescription changeDescription)
--- End of inner exception stack trace ---
at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean

constructor)
at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[]

arguments)
at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[]

parameters, CultureInfo culture)
at Dell.Services.SupportAssist.SupportAssistAgent.BootStrapperMinimized.SessionChangeAction

(SessionChangeDescription changeDescription)
at Dell.Services.SupportAssist.SupportAssistAgent.SupportAssistAgent.OnSessionChange

(SessionChangeDescription changeDescription)
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------

Faulting application name: wmiprvse.exe, version: 6.1.7601.17514, time stamp: 0x4ce79d42
Faulting module name: WINTRUST.dll, version: 6.1.7601.23971, time stamp: 0x5a26d97f
Exception code: 0xc0000005
Fault offset: 0x000000000000a8ea
Faulting process id: 0xaa8
Faulting application start time: 0x01d51ee7b4e3a1e7
Faulting application path: C:\Windows\system32\wbem\wmiprvse.exe
Faulting module path: C:\Windows\system32\WINTRUST.dll
Report Id: c8af1667-8c90-11e9-bb6e-b8ca3ad5e05a
------------

Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA

"Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace

"//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem

is corrected.
------------


----------( EOF)---------- - 3076 | 10:41:58
 

Malnutrition

Malnurished Mod
Moderator
Security Team
Jul 22, 2016
3,379
551
Make sure and add your user name to this fix, where it is needed.


Download attached fixlist.txt file and save it to the Desktop. NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work. NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system. Run FRST/FRST64 and press the Fix button just once and wait. If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run. When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.
 

Attachments

Malnutrition

Malnurished Mod
Moderator
Security Team
Jul 22, 2016
3,379
551
The way you broke the log up to edit your name makes it difficult to read....

What is in these folders??

C:\Windows\1f8bf2vui4tpp8w
C:\Windows\2e2uf4b4q8p2kci
C:\Windows\4cwyf4jbcce5n1p
C:\Windows\4cwyfyv7x1w5n1p
C:\Windows\5b4wf2e7p2v8qio
C:\Windows\5b4wf4c8n5s1jta
C:\Windows\5b4wf4poy2v8qio
C:\Windows\5b4wf7y1l7q8qio
C:\Windows\5b4wffx8w5s1jta
C:\Windows\5b4wfyn5s5s1jta
 

Fla_Panther

PCHF Member
PCHF Member
Sep 19, 2016
38
4
44
Those are 1kb hidden files, containing non-human-readable characters.
Not sure how Find & Replace is breaking the logs ... it should just be converting only the relevant characters, not adding any line breaks.


Fix result of Farbar Recovery Scan Tool (x64) Version: 15-07-2019 01
Ran by ******** (15-07-2019 12:07:29) Run:1
Running from C:\Users\********\Desktop
Loaded Profiles: ******** (Available Profiles: ********)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
Closeprocesses:
CreateRestorePoint:
Emptytemp:
RemoveProxy:
FirewallRules: [{DD6A69A7-6F4D-4C94-93A3-EFD897DCD692}] => (Allow) C:\Users\********\AppData\Roaming\uTorrent\uTorrent.exe No File
FirewallRules: [{D0C21295-8A4D-4AAF-867C-F5606173A37E}] => (Allow) C:\Users\********\AppData\Roaming\uTorrent\uTorrent.exe No File
HKU\S-1-5-21-3206243102-205974907-2145499838-1000\...\MountPoints2: {a08823cb-795d-11e8-b725-e41f28566541} - E:\RTK_NIC_DRIVER_INSTALLER.sfx.exe
Task: {D67DBDCB-4494-4132-A263-D7274A930236} - System32\Tasks\{EE1BEB1A-D10C-43A0-9D62-B7BBC4690C0E} => C:\Windows\system32\pcalua.exe -a C:\Users\********\Desktop\out_lame.binf_v164.exe -d C:\Users\********\Desktop
Task: {F3CA5017-53C0-47CD-A21A-E197090FB41D} - System32\Tasks\Dell SupportAssistAgent AutoUpdate => C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistInstaller.exe [1512920 2019-05-24] (Dell Inc. -> Dell Inc.)
Tcpip\Parameters: [DhcpNameServer] 209.18.47.62 209.18.47.61
Tcpip\..\Interfaces\{F1ABA7E1-57DC-49E4-8FA4-8A72EEFAFE0B}: [DhcpNameServer] 209.18.47.62 209.18.47.61
HKLM\System\...\Parameters\PersistentRoutes: [0.0.0.0,0.0.0.0,192.168.0.201,-1]
HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.dell.com/
HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
C:\Users\********\AppData\Local\*.*
C:\Users\********\AppData\Roaming\*.*
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> No File
C:\Windows\system32\drivers\etc\hosts
hosts:
StartBatch:
ipconfig /flushdns
netsh advfirewall reset
net stop Hamachi2Svc
net stop HiPatchService
net stop DDVRulesProcessor
net stop Dell Hardware Support
net stop SupportAssistAgent
net stop WinDefend
sc config "Hamachi2Svc" start= demand
sc config "HiPatchService" start= demand
sc config DDVRulesProcessor start= demand
sc config Dell Hardware Support start= demand
sc config SupportAssistAgent= demand
sc config Windefend= demand
dir /a C:\temp
dir /a "C:\Program Files\Common Files\AV"
dir /a C:\Users\???\AppData\Roaming
dir /a C:\Users\???\AppData\Local
EndBatch:
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
CMD: netsh advfirewall reset
CMD: netsh advfirewall set allprofiles state ON
CMD: ipconfig /flushdns
CMD: netsh winsock reset catalog
CMD: netsh int ip reset c:\resetlog.txt
CMD: ipconfig /release
CMD: ipconfig /renew
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
CMD: bitsadmin /reset /allusers
EmptyTemp:
reboot:
end
*****************

Processes closed successfully.
Restore point was successfully created.

========= RemoveProxy: =========

"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully
"HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
"HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully


========= End of RemoveProxy: =========

"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{DD6A69A7-6F4D-4C94-93A3-EFD897DCD692}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{D0C21295-8A4D-4AAF-867C-F5606173A37E}" => removed successfully
HKU\S-1-5-21-3206243102-205974907-2145499838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a08823cb-795d-11e8-b725-e41f28566541} => removed successfully
HKLM\Software\Classes\CLSID\{a08823cb-795d-11e8-b725-e41f28566541} => not found
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D67DBDCB-4494-4132-A263-D7274A930236}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D67DBDCB-4494-4132-A263-D7274A930236}" => removed successfully
C:\Windows\System32\Tasks\{EE1BEB1A-D10C-43A0-9D62-B7BBC4690C0E} => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{EE1BEB1A-D10C-43A0-9D62-B7BBC4690C0E}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F3CA5017-53C0-47CD-A21A-E197090FB41D}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F3CA5017-53C0-47CD-A21A-E197090FB41D}" => removed successfully
C:\Windows\System32\Tasks\Dell SupportAssistAgent AutoUpdate => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Dell SupportAssistAgent AutoUpdate" => removed successfully
"HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\\DhcpNameServer" => removed successfully
"HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{F1ABA7E1-57DC-49E4-8FA4-8A72EEFAFE0B}\\DhcpNameServer" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\PersistentRoutes\\0.0.0.0,0.0.0.0,192.168.0.201,-1" => removed successfully
HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Internet Explorer\Main\\Start Page => value restored successfully
HKU\S-1-5-21-3206243102-205974907-2145499838-1000\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE => removed successfully
HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE => removed successfully

=========== "C:\Users\********\AppData\Local\*.*" ==========

C:\Users\********\AppData\Local\GDIPFONTCACHEV1.DAT => moved successfully
C:\Users\********\AppData\Local\IconCache.db => moved successfully
C:\Users\********\AppData\Local\PUTTY.RND => moved successfully

========= End -> "C:\Users\********\AppData\Local\*.*" ========


=========== "C:\Users\********\AppData\Roaming\*.*" ==========

not found

========= End -> "C:\Users\********\AppData\Roaming\*.*" ========

HKLM\Software\Classes\Directory\Background\ShellEx\ContextMenuHandlers\igfxcui => removed successfully
HKLM\Software\Classes\CLSID\{3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => not found
C:\Windows\system32\drivers\etc\hosts => moved successfully
Hosts restored successfully.

========= Batch: =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.
Ok.

The service name is invalid.

More help is available by typing NET HELPMSG 2185.

The service name is invalid.

More help is available by typing NET HELPMSG 2185.

The Dell Data Vault Processor service is not started.

More help is available by typing NET HELPMSG 3521.

The syntax of this command is:

NET STOP
service

The Dell SupportAssist service is not started.

More help is available by typing NET HELPMSG 3521.

..
The Windows Defender service was stopped successfully.

[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.

[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.

[SC] ChangeServiceConfig SUCCESS
DESCRIPTION:
Modifies a service entry in the registry and Service Database.
USAGE:
sc <server> config [service name] <option1> <option2>...

OPTIONS:
NOTE: The option name includes the equal sign.
A space is required between the equal sign and the value.
type= <own|share|interact|kernel|filesys|rec|adapt>
start= <boot|system|auto|demand|disabled|delayed-auto>
error= <normal|severe|critical|ignore>
binPath= <BinaryPathName>
group= <LoadOrderGroup>
tag= <yes|no>
depend= <Dependencies(separated by / (forward slash))>
obj= <AccountName|ObjectName>
DisplayName= <display name>
password= <password>
DESCRIPTION:
Modifies a service entry in the registry and Service Database.
USAGE:
sc <server> config [service name] <option1> <option2>...

OPTIONS:
NOTE: The option name includes the equal sign.
A space is required between the equal sign and the value.
type= <own|share|interact|kernel|filesys|rec|adapt>
start= <boot|system|auto|demand|disabled|delayed-auto>
error= <normal|severe|critical|ignore>
binPath= <BinaryPathName>
group= <LoadOrderGroup>
tag= <yes|no>
depend= <Dependencies(separated by / (forward slash))>
obj= <AccountName|ObjectName>
DisplayName= <display name>
password= <password>
DESCRIPTION:
Modifies a service entry in the registry and Service Database.
USAGE:
sc <server> config [service name] <option1> <option2>...

OPTIONS:
NOTE: The option name includes the equal sign.
A space is required between the equal sign and the value.
type= <own|share|interact|kernel|filesys|rec|adapt>
start= <boot|system|auto|demand|disabled|delayed-auto>
error= <normal|severe|critical|ignore>
binPath= <BinaryPathName>
group= <LoadOrderGroup>
tag= <yes|no>
depend= <Dependencies(separated by / (forward slash))>
obj= <AccountName|ObjectName>
DisplayName= <display name>
password= <password>
Volume in drive C has no label.
Volume Serial Number is B62F-E83E

Directory of C:\temp

10/29/2018 08:46 PM <DIR> .
10/29/2018 08:46 PM <DIR> ..
0 File(s) 0 bytes
2 Dir(s) 25,897,353,216 bytes free
Volume in drive C has no label.
Volume Serial Number is B62F-E83E

Directory of C:\Program Files\Common Files

File Not Found
The filename, directory name, or volume label syntax is incorrect.
The filename, directory name, or volume label syntax is incorrect.

========= End of Batch: =========


========= reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

The operation completed successfully.

========= End of Reg: =========


========= reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f =========

The operation completed successfully.

========= End of Reg: =========


========= netsh advfirewall reset =========

Ok.


========= End of CMD: =========


========= netsh advfirewall set allprofiles state ON =========

Ok.


========= End of CMD: =========


========= ipconfig /flushdns =========


Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========


========= netsh winsock reset catalog =========


Sucessfully reset the Winsock Catalog.
You must restart the computer in order to complete the reset.


========= End of CMD: =========


========= netsh int ip reset c:\resetlog.txt =========

Reseting Global, OK!
Reseting Interface, OK!
Reseting Unicast Address, OK!
Reseting Route, OK!
Reseting Subinterface, OK!
Restart the computer to complete this action.


========= End of CMD: =========


========= ipconfig /release =========


Windows IP Configuration

No operation can be performed on Wireless Network Connection 3 while it has its media disconnected.
No operation can be performed on Wireless Network Connection 2 while it has its media disconnected.

Wireless LAN adapter Wireless Network Connection 3:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Wireless LAN adapter Wireless Network Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . :
IPv6 Address. . . . . . . . . . . : ::808b:ac54:2e88:6506
Temporary IPv6 Address. . . . . . : ::d039:672f:5fd9:d29a
Link-local IPv6 Address . . . . . : fe80::808b:ac54:2e88:6506%14
Default Gateway . . . . . . . . . :

Ethernet adapter Local Area Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{41B84864-2D3D-4D17-B09E-E347F560F7F7}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{3D0D15B6-5A19-4873-88B7-D9B5B9D67406}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{AFE20685-E901-42C7-A0EA-94EC69D7938C}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.mifi.local:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

========= End of CMD: =========


========= ipconfig /renew =========


Windows IP Configuration

No operation can be performed on Wireless Network Connection 3 while it has its media disconnected.
No operation can be performed on Wireless Network Connection 2 while it has its media disconnected.
No operation can be performed on Local Area Connection 2 while it has its media disconnected.

Wireless LAN adapter Wireless Network Connection 3:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Wireless LAN adapter Wireless Network Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . :
IPv6 Address. . . . . . . . . . . : ::808b:ac54:2e88:6506
Temporary IPv6 Address. . . . . . : ::d039:672f:5fd9:d29a
Link-local IPv6 Address . . . . . : fe80::808b:ac54:2e88:6506%14
IPv4 Address. . . . . . . . . . . : 192.168.0.3
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1

Ethernet adapter Local Area Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{41B84864-2D3D-4D17-B09E-E347F560F7F7}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{3D0D15B6-5A19-4873-88B7-D9B5B9D67406}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.{AFE20685-E901-42C7-A0EA-94EC69D7938C}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

Tunnel adapter isatap.mifi.local:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

========= End of CMD: =========


========= netsh int ipv4 reset =========

Reseting Interface, OK!
Restart the computer to complete this action.


========= End of CMD: =========


========= netsh int ipv6 reset =========

There's no user specified settings to be reset.


========= End of CMD: =========


========= bitsadmin /reset /allusers =========


BITSADMIN version 3.0 [ 7.5.7601 ]
BITS administration utility.
(C) Copyright 2000-2006 Microsoft Corp.

BITSAdmin is deprecated and is not guaranteed to be available in future versions of Windows.
Administrative tools for the BITS service are now provided by BITS PowerShell cmdlets.

Unable to cancel {97BBEDF9-9744-46DB-8361-9072ACC2FB39}.
Unable to cancel {EB242197-4D7C-460A-95BA-496CC5DE1902}.
0 out of 2 jobs canceled.

========= End of CMD: =========


=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 114554891 B
Java, Flash, Steam htmlcache => 508998 B
Windows/system/drivers => 90185128 B
Edge => 0 B
Chrome => 266632772 B
Firefox => 210102278 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 66356 B
systemprofile32 => 66356 B
LocalService => 0 B
NetworkService => 228608 B
******** => 19243430732 B

RecycleBin => 609313796 B
EmptyTemp: => 19.1 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 12:07:57 ====
 

Malnutrition

Malnurished Mod
Moderator
Security Team
Jul 22, 2016
3,379
551
You are safe to delete those folders, there is no malware that I can see.

I'd Run this tool to clean up more crap from your machine tho, just empty of the temp files cleaned up 20 gigs.

Privazer


Adware Cleaner Scan.

Please download AdwCleaner by Xplode onto your desktop.



  • Close all open programs and internet browsers.
  • Right Click on adwcleaner.exe and run as admin to run the tool.
  • Click on Scan button.
  • When the scan has finished click on Clean button.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please Attach the contents of that logfile with your next reply.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.

====================================================================================

ZHP Scan.

Please download Zhp Cleaner to your desktop. Right Click the icon and select run as administrator.






2. Once you have started the program, you will need to click the scanner button.









The program will close all open browsers!
3. Once the scan is completed, the you will want to click the Repair button.



At the end of the process you may be asked to reboot your machine. After you reboot a report will open on your desktop.

Copy and paste the report here in your next reply.


====================================================================

Security Check Scan.



  • Download Security Check to your desktop.
  • Right click it run as administrator.
  • When the program completes, the tool will automatically open a log file.
  • Please post that log here in your next post.
=============================================================================


HijackThis.



1- Please click HERE to download HijackThis.
2- Run the program.
3- Click on the Main Menu button if not already there.
4- Select Do a system scan and save a logfile.
5- Copy paste the log here.
 

Fla_Panther

PCHF Member
PCHF Member
Sep 19, 2016
38
4
44
No, the temp folder was empty. I had a 20GB folder of WAV files on my desktop that I moved to F: and I emptied the recycle bin, which was another 20GB. But Privizer did delete almost another 20GB, so I've got almost 60GB free now.

My main concern about whether or not I've been infected is that in the last year I started using a password manager with different complex passwords for every website. Of course if my PC is infected with a keylogger then they could download my password file and open that and have all the keys anyway. It will be super annoying if I have to go change the passwords for all these sites again (I have something like 100+ recorded).

Here are the logs:

~ ZHPCleaner v2019.7.19.103 by Nicolas Coolman (2019/07/19)
~ Run by ******** (Administrator) (15/07/2019 15:07:42)
~ Web: https://www.nicolascoolman.com
~ Blog: https://nicolascoolman.eu/
~ Facebook : https://www.facebook.com/nicolascoolman1
~ State version : Version OK
~ Certificate ZHPCleaner: Legal
~ Type : Scan
~ Report : C:\Users\********\Desktop\ZHPCleaner (S).txt
~ Quarantine : C:\Users\********\AppData\Roaming\ZHP\ZHPCleaner_Reg.txt
~ System Restore Point :
~ UAC : Activate
~ Boot Mode : Normal (Normal boot)
Windows 7 Professional, 64-bit Service Pack 1 (Build 7601)


---\\ Alternate Data Stream (ADS). (0)
~ No malicious or unnecessary items found.


---\\ Services (0)
~ No malicious or unnecessary items found.


---\\ Browser internet (0)
~ No malicious or unnecessary items found.


---\\ Hosts file (1)
~ The hosts file is legitimate (1)


---\\ Scheduled automatic tasks. (0)
~ No malicious or unnecessary items found.


---\\ Explorer ( File, Folder) (12)
FOUND file: C:\Windows\Installer\wix{B5E06417-A4AC-4225-B36E-7E34C91616E7}.SchedServiceConfig.rmi =>.SUP.Empty
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\000 =>.SUP.Temporary.Chrome
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\001 =>.SUP.Temporary.Chrome
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\002 =>.SUP.Temporary.Chrome
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\003 =>.SUP.Temporary.Chrome
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\004 =>.SUP.Temporary.Chrome
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\005 =>.SUP.Temporary.Chrome
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\006 =>.SUP.Temporary.Chrome
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\007 =>.SUP.Temporary.Chrome
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\008 =>.SUP.Temporary.Chrome
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\009 =>.SUP.Temporary.Chrome
FOUND folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\010 =>.SUP.Temporary.Chrome


---\\ Registry ( Key, Value, Data) (0)
~ No malicious or unnecessary items found.


---\\ Summary of the elements found (2)
https://nicolascoolman.eu/2017/01/20/logiciels-superflus/ =>.SUP.Empty
https://nicolascoolman.eu/2017/01/20/logiciels-superflus/ =>.SUP.Temporary.Chrome


---\\ Result of repair
~ Any repair made
~ Browser not found (Opera Software)


---\\ Statistics
~ Items scanned : 64416
~ Items found : 12
~ Items cancelled : 0
~ Items options : 13/13
~ Space saving (bytes) : 0


~ End of search in 00h03mn09s

---\\ Reports (0)
ZHPCleaner--15072019-15_10_51.txt

~ ZHPCleaner v2019.7.19.103 by Nicolas Coolman (2019/07/19)
~ Run by ******** (Administrator) (15/07/2019 15:12:37)
~ Web: https://www.nicolascoolman.com
~ Blog: https://nicolascoolman.eu/
~ Facebook : https://www.facebook.com/nicolascoolman1
~ State version : Version OK
~ Certificate ZHPCleaner: Legal
~ Type : Repair
~ Report : C:\Users\********\Desktop\ZHPCleaner (R).txt
~ Quarantine : C:\Users\********\AppData\Roaming\ZHP\ZHPCleaner_Reg.txt
~ System Restore Point : OK
~ UAC : Activate
~ Boot Mode : Normal (Normal boot)
Windows 7 Professional, 64-bit Service Pack 1 (Build 7601)


---\\ Alternate Data Stream (ADS). (0)
~ No malicious or unnecessary items found.


---\\ Services (0)
~ No malicious or unnecessary items found.


---\\ Browser internet (0)
~ No malicious or unnecessary items found.


---\\ Hosts file (1)
~ The hosts file is legitimate (1)


---\\ Scheduled automatic tasks. (0)
~ No malicious or unnecessary items found.


---\\ Explorer ( File, Folder) (12)
MOVED file: C:\Windows\Installer\wix{B5E06417-A4AC-4225-B36E-7E34C91616E7}.SchedServiceConfig.rmi =>.SUP.Empty
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\000 =>.SUP.Temporary.Chrome
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\001 =>.SUP.Temporary.Chrome
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\002 =>.SUP.Temporary.Chrome
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\003 =>.SUP.Temporary.Chrome
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\004 =>.SUP.Temporary.Chrome
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\005 =>.SUP.Temporary.Chrome
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\006 =>.SUP.Temporary.Chrome
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\007 =>.SUP.Temporary.Chrome
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\008 =>.SUP.Temporary.Chrome
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\009 =>.SUP.Temporary.Chrome
MOVED folder: C:\Users\********\AppData\Local\Google\Chrome\User Data\Default\File System\010 =>.SUP.Temporary.Chrome


---\\ Registry ( Key, Value, Data) (0)
~ No malicious or unnecessary items found.


---\\ Summary of the elements found (2)
https://nicolascoolman.eu/2017/01/20/logiciels-superflus/ =>.SUP.Empty
https://nicolascoolman.eu/2017/01/20/logiciels-superflus/ =>.SUP.Temporary.Chrome


---\\ Other deletions. (4)
~ Registry Keys Tracing deleted (4)
~ Remove the old reports ZHPCleaner. (0)


---\\ Result of repair
~ Repair carried out successfully
~ Browser not found (Opera Software)


---\\ Statistics
~ Items scanned : 684
~ Items found : 0
~ Items cancelled : 0
~ Items options : 13/13
~ Space saving (bytes) : 0


~ End of clean in 00h00mn07s

---\\ Reports (2)
ZHPCleaner--15072019-15_10_51.txt
ZHPCleaner-[R]-15072019-15_12_44.txt

SecurityCheck by glax24 & Severnyj v.1.4.0.53 [27.10.17]
WebSite: www.safezone.cc
DateLog: 15.07.2019 15:15:57
Path starting: C:\Users\********\AppData\Local\Temp\SecurityCheck\SecurityCheck.exe
Log directory: C:\SecurityCheck\
IsAdmin: True
User: ********
VersionXML: 6.63is-06.07.2019
___________________________________________________________________________

Windows 7(6.1.7601) Service Pack 1 (x64) Professional Lang: English(0409)
Installation date OS: 26.06.2018 13:29:10
LicenseStatus: Windows(R) 7, Professional edition The machine is permanently activated.
Boot Mode: Normal
Default Browser: C:\Program Files\Mozilla Firefox\firefox.exe
SystemDrive: C: FS: [NTFS] Capacity: [200 Gb] Used: [140.6 Gb] Free: [59.4 Gb]
------------------------------- [ Windows ] -------------------------------
Internet Explorer 11.0.9600.19403 [+]
User Account Control enabled (Level 3)
Notify before download
Date install updates: 2019-07-15 00:30:27
Windows Update (wuauserv) - The service has stopped
Security Center (wscsvc) - The service has stopped
Remote Registry (RemoteRegistry) - The service has stopped
SSDP Discovery (SSDPSRV) - The service is running
Remote Desktop Services (TermService) - The service has stopped
Windows Remote Management (WS-Management) (WinRM) - The service has stopped
------------------------------ [ MS Office ] ------------------------------
Microsoft Office 2010 x86 v.14.0.6029.1000
--------------------------- [ FirewallWindows ] ---------------------------
Windows Firewall (MpsSvc) - The service is running
--------------------------- [ AntiSpyware_WMI ] ---------------------------
Windows Defender (enabled and up to date)
--------------------------- [ OtherUtilities ] ----------------------------
VLC media player v.3.0.6 Warning! Download Update
Microsoft .NET Framework 4.7.2 v.4.7.03062
PuTTY release 0.70 (64-bit) v.0.70.0.0 Warning! Download Update
Dell SupportAssist v.3.2.2.119 [+]
Foxit Reader v.9.4.1.16828 Warning! Download Update
IrfanView 4.51 (32-bit) v.4.51
KeePass Password Safe 2.39.1 v.2.39.1 Warning! Download Update
Winamp v.5.666 [+]
-------------------------------- [ Arch ] ---------------------------------
7-Zip 18.05 (x64 edition) v.18.05.00.0 Warning! Download Update
Uninstall old version and install new one.
--------------------------------- [ IM ] ----------------------------------
Skype version 8.29 v.8.29 Warning! Download Update
--------------------------- [ AdobeProduction ] ---------------------------
Adobe Flash Player 32 ActiveX v.32.0.0.142 Warning! Download Update
Adobe Flash Player 29 NPAPI v.29.0.0.171 Warning! Download Update
------------------------------- [ Browser ] -------------------------------
Mozilla Firefox 68.0 (x64 en-US) v.68.0 [+]
Google Chrome v.75.0.3770.142 [+]
------------------ [ AntivirusFirewallProcessServices ] -------------------
Windows Defender (WinDefend) - The service has stopped
----------------------------- [ End of Log ] ------------------------------

Logfile of HiJackThis Fork by Alex Dragokas v.2.9.0.19

Platform: x64 Windows 7 (Pro), 6.1.7601.24496, Service Pack: 1
Time: 15.07.2019 - 15:18 (UTC-04:00)
Language: OS: English (0x409). Display: English (0x409). Non-Unicode: English (0x409)
Elevated: Yes
Ran by: ******** (group: Administrator) on ********-PC, FirstRun: yes

Chrome: 75.0.3770.142
Firefox: 68.0.0.7125
Internet Explorer: 11.0.9600.19404
Default: "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "%1" (Firefox)

Boot mode: Normal

Running processes:
Number | Path
1 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
1 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
1 C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
1 C:\Program Files (x86)\Notepad++\notepad++.exe
1 C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
1 C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
1 C:\Program Files\DellTPad\ApMsgFwd.exe
1 C:\Program Files\DellTPad\ApntEx.exe
1 C:\Program Files\DellTPad\Apoint.exe
1 C:\Program Files\DellTPad\hidfind.exe
1 C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe
1 C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe
1 C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe
1 C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6.0.7033.2285\DSAPI.exe
1 C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6.0.7033.2285\pcdrwi.exe
1 C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe
1 C:\Program Files\IDT\WDM\stacsv64.exe
1 C:\Program Files\IDT\WDM\sttray64.exe
1 C:\Program Files\Intel\WiFi\bin\EvtEng.exe
1 C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
1 C:\Program Files\Intel\iCLS Client\HeciServer.exe
1 C:\Program Files\Visioneer\RWAR3\RWAR3HV_0001_0.EXE
1 C:\Program Files\Visioneer\RWAR3\RWAR3Monitor.exe
1 C:\Program Files\Windows Media Player\wmpnetwk.exe
1 C:\Users\********\Desktop\HiJackThis.exe
1 C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
1 C:\Windows\SysWOW64\gearsec.exe
1 C:\Windows\System32\SearchFilterHost.exe
1 C:\Windows\System32\SearchIndexer.exe
1 C:\Windows\System32\SearchProtocolHost.exe
1 C:\Windows\System32\VSSVC.exe
1 C:\Windows\System32\WUDFHost.exe
1 C:\Windows\System32\audiodg.exe
3 C:\Windows\System32\conhost.exe
2 C:\Windows\System32\csrss.exe
1 C:\Windows\System32\dwm.exe
1 C:\Windows\System32\igfxCUIService.exe
1 C:\Windows\System32\igfxEM.exe
1 C:\Windows\System32\igfxHK.exe
1 C:\Windows\System32\igfxTray.exe
1 C:\Windows\System32\lsass.exe
1 C:\Windows\System32\lsm.exe
1 C:\Windows\System32\services.exe
1 C:\Windows\System32\smss.exe
1 C:\Windows\System32\spoolsv.exe
1 C:\Windows\System32\sppsvc.exe
16 C:\Windows\System32\svchost.exe
1 C:\Windows\System32\taskeng.exe
1 C:\Windows\System32\taskhost.exe
1 C:\Windows\System32\wbem\WmiApSrv.exe
3 C:\Windows\System32\wbem\WmiPrvSE.exe
2 C:\Windows\System32\wbem\unsecapp.exe
1 C:\Windows\System32\wininit.exe
1 C:\Windows\System32\winlogon.exe
1 C:\Windows\System32\wlanext.exe
1 C:\Windows\explorer.exe

O4 - HKLM\..\Run: [Apoint] = C:\Program Files\DellTPad\Apoint.exe
O4 - HKLM\..\Run: [IntelPROSet] = C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SysTrayApp] = C:\Program Files\IDT\WDM\sttray64.exe
O4-32 - HKLM\..\Run: [IMSS] = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
O4-32 - HKLM\..\Run: [KeePass 2 PreLoad] = C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe --preload
O15 - Trusted Zone: *.dell.com
O15 - Trusted Zone: *.localhost
O17 - DHCP DNS 1: 209.18.47.62
O17 - DHCP DNS 2: 209.18.47.61
O23 - Service R2: Audio Service - (STacSV) - C:\Program Files\IDT\WDM\STacSV64.exe
O23 - Service R2: Dell Data Vault Collector - (DDVDataCollector) - C:\Program Files\Dell\DellDataVault\DDVDataCollector.exe
O23 - Service R2: Dell Data Vault Service API - (DDVCollectorSvcApi) - C:\Program Files\Dell\DellDataVault\DDVCollectorSvcApi.exe
O23 - Service R2: Dell Hardware Support - C:\Program Files\Dell\SupportAssistAgent\PCDr\SupportAssist\6.0.7033.2285\DSAPI.exe
O23 - Service R2: Dell SupportAssist - (SupportAssistAgent) - C:\Program Files\Dell\SupportAssistAgent\bin\SupportAssistAgent.exe
O23 - Service R2: Diagnostics Tracking Service - (DiagTrack) - C:\Windows\System32\svchost.exe -k utcsvc; "ServiceDll" = C:\Windows\system32\diagtrack.dll
O23 - Service R2: Intel(R) Capability Licensing Service Interface - C:\Program Files\Intel\iCLS Client\HeciServer.exe
O23 - Service R2: Intel(R) Dynamic Application Loader Host Interface Service - (jhi_service) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
O23 - Service R2: Intel(R) HD Graphics Control Panel Service - (igfxCUIService1.0.0.0) - C:\Windows\system32\igfxCUIService.exe
O23 - Service R2: Intel(R) Management and Security Application Local Management Service - (LMS) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
O23 - Service R2: Intel(R) PROSet/Wireless Event Log - (EvtEng) - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service R2: Intel(R) PROSet/Wireless Registry Service - (RegSrvc) - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service R2: Intel(R) PROSet/Wireless Zero Configuration Service - (ZeroConfigService) - C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
O23 - Service R2: RWAR3HV_0001_0 - C:\Program Files\Visioneer\RWAR3\RWAR3HV_0001_0.EXE
O23 - Service R2: RWAR3Monitor - C:\Program Files\Visioneer\RWAR3\RWAR3Monitor.exe
O23 - Service R2: gearsec - C:\Windows\SysWOW64\gearsec.exe
O23 - Service R3: Dell Data Vault Processor - (DDVRulesProcessor) - C:\Program Files\Dell\DellDataVault\DDVRulesProcessor.exe
O23 - Service S2: Google Update Service (gupdate) - (gupdate) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /svc
O23 - Service S3: Google Chrome Elevation Service - (GoogleChromeElevationService) - C:\Program Files (x86)\Google\Chrome\Application\75.0.3770.142\elevation_service.exe
O23 - Service S3: Google Update Service (gupdatem) - (gupdatem) - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /medsvc
O23 - Service S3: Intel(R) Capability Licensing Service TCP IP Interface - C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
O23 - Service S3: Intel(R) Content Protection HECI Service - (cphs) - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service S3: Mozilla Maintenance Service - (MozillaMaintenance) - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service S3: Wireless PAN DHCP Server - (MyWiFiDHCPDNS) - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe


--
End of file - Time spent: 12.1 sec. - 14354 bytes, CRC32: FFFFFFFF. Sign: ⬅
 
Last edited by a moderator:

Fla_Panther

PCHF Member
PCHF Member
Sep 19, 2016
38
4
44
Well, on the plus side, I just noticed that my laptop's date was somehow switched to Wednesday the 17th. I corrected it to the proper date and FireFox was able to load the webpages properly that had been failing before.
 

Malnutrition

Malnurished Mod
Moderator
Security Team
Jul 22, 2016
3,379
551
Update your programs with Patch My PC, then post a new security check log please.

This freeware tool from DougKnox.com lets you change the Internet Time Update interval from Weekly to Daily or Hourly. You will have to run the tool as an administrator.
 

Fla_Panther

PCHF Member
PCHF Member
Sep 19, 2016
38
4
44
When you ask for a security check log ... which of the programs are you asking me to run? None of them were called "security check".
 

Fla_Panther

PCHF Member
PCHF Member
Sep 19, 2016
38
4
44
Bah. My bad. I don't know how I missed it before. Here's the log:


SecurityCheck by glax24 & Severnyj v.1.4.0.53 [27.10.17]
WebSite: www.safezone.cc
DateLog: 23.07.2019 18:35:00
Path starting: C:\Users\********\AppData\Local\Temp\SecurityCheck\SecurityCheck.exe
Log directory: C:\SecurityCheck\
IsAdmin: True
User: ********
VersionXML: 6.63is-06.07.2019
___________________________________________________________________________

Windows 7(6.1.7601) Service Pack 1 (x64) Professional Lang: English(0409)
Installation date OS: 26.06.2018 13:29:10
LicenseStatus: Windows(R) 7, Professional edition The machine is permanently activated.
Boot Mode: Normal
Default Browser: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
SystemDrive: C: FS: [NTFS] Capacity: [200 Gb] Used: [142 Gb] Free: [58 Gb]
------------------------------- [ Windows ] -------------------------------
Internet Explorer 11.0.9600.19403 [+]
User Account Control enabled (Level 3)
Notify before download
Date install updates: 2019-07-15 00:30:27
Windows Update (wuauserv) - The service is running
Security Center (wscsvc) - The service is running
Remote Registry (RemoteRegistry) - The service has stopped
SSDP Discovery (SSDPSRV) - The service is running
Remote Desktop Services (TermService) - The service has stopped
Windows Remote Management (WS-Management) (WinRM) - The service has stopped
------------------------------ [ MS Office ] ------------------------------
Microsoft Office 2010 x86 v.14.0.6029.1000
--------------------------- [ FirewallWindows ] ---------------------------
Windows Firewall (MpsSvc) - The service is running
--------------------------- [ AntiSpyware_WMI ] ---------------------------
Windows Defender (enabled and up to date)
--------------------------- [ OtherUtilities ] ----------------------------
VLC media player v.3.0.7.1
Microsoft .NET Framework 4.8 v.4.8.03761 [+]
Dell SupportAssist v.3.2.2.119 [+]
PuTTY release 0.72 (64-bit) v.0.72.0.0 [+]
Foxit Reader v.9.6.0.25114
IrfanView 4.53 (32-bit) v.4.53
KeePass Password Safe 2.42.1 v.2.42.1
Winamp v.5.666 [+]
-------------------------------- [ Arch ] ---------------------------------
7-Zip 19.00 (x64 edition) v.19.00.00.0
--------------------------------- [ IM ] ----------------------------------
Skype version 8.50 v.8.50 [+]
--------------------------- [ AdobeProduction ] ---------------------------
Adobe Flash Player 32 ActiveX v.32.0.0.223 [+]
Adobe Flash Player 32 NPAPI v.32.0.0.223 [+]
------------------------------- [ Browser ] -------------------------------
Mozilla Firefox 68.0.1 (x64 en-US) v.68.0.1 [+]
Google Chrome v.75.0.3770.142 [+]
------------------ [ AntivirusFirewallProcessServices ] -------------------
Windows Defender (WinDefend) - The service is running
Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - The service has stopped
----------------------------- [ End of Log ] ------------------------------
 

Malnutrition

Malnurished Mod
Moderator
Security Team
Jul 22, 2016
3,379
551
I do not see any malware, but to be certain a couple more checks just to be on the safe side. :)

Note: You can expect this process to take a long time, up to several hours or more.
  • Download ESET Online Scanner and save it to your Desktop
  • Right click on esetonlinescanner_enu.exe and select Run as administrator
  • Click Computer scan
  • Click Full scan
  • Click Start scan, leaving the default setting
  • If threats were found click Save scan log and save it to your Desktop as ESETScan.txt
  • Click Continue 3 times
  • Click Close
  • Copy and paste the ESETScan.txt file contents in your reply
  • Review the list and let me know if you think any of the items are legitimate and should be restored
  • If no threats were found, click Continue 3 times
  • Place a check mark in Delete application data on closing then click Close
==========================================================================================

Rogue Killer Scan.

Download RogueKiller -- (Portable) -- from one of the following links and save it to your Desktop:

Link 1
Link 2




  • Close all other the running programs
  • Disable ALL Antivirus -- Antimalware -- Applications.
  • Right Click Rogue Killer and Run as Administrator.
  • Click the Start Scan button.
  • Allow the scan to run -- it can take ten minutes or more.
  • Once the scan is complete check All items for removal.







  • After All items are checked then press Remove Selected.
  • Wait until the Status box shows Deleting Finished.
  • Click on open report -- then open txt
  • Copy the content of the report and paste it here in your next reply.
 

Fla_Panther

PCHF Member
PCHF Member
Sep 19, 2016
38
4
44
ESET didn't find anything. RogueKiller did, but I'm a bit surprised at what it found. I had an autoclicker I'd downloaded ... I'd probably downloaded 10 autoclickers, and this one was the only one that didn't have a virus or malware in it. So either it was a new one, or maybe a false positive. Not sure.

RogueKiller Anti-Malware V13.3.2.0 (x64) [Jul 15 2019] (Free) by Adlice Software
mail : https://adlice.com/contact/
Website : https://adlice.com/download/roguekiller/
Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits
Started in : Normal mode
User : ******** [Administrator]
Started from : C:\Users\********\Desktop\RogueKiller_portable64.exe
Signatures : 20190723_195507, Driver : Loaded
Mode : Standard Scan, Delete -- Date : 2019/07/23 21:19:42 (Duration : 00:05:33)

¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Delete ¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
[PUP.AutoIt.Gen (Potentially Malicious)] GS AutoClicker.exe -- %USERPROFILE%\Desktop\GS AutoClicker.exe -> Deleted
[PUP.AutoIt.Gen (Potentially Malicious)] GS AutoClicker.exe -- %USERPROFILE%\Desktop\GS AutoClicker.exe -> Found
 

Fla_Panther

PCHF Member
PCHF Member
Sep 19, 2016
38
4
44
Not that I know of at the moment, but I'd still like clarification on whether I had anything. As I mentioned above, I started using a password manager a few months ago. If I was infected and they had a keylogger they could have downloaded my password file and have the master key. I'd have to go change the passwords for ~100 websites.
 

Malnutrition

Malnurished Mod
Moderator
Security Team
Jul 22, 2016
3,379
551
No, there is no malware to speak of on your machine, just cleaned up a bit of rubbish is all.
 

Fla_Panther

PCHF Member
PCHF Member
Sep 19, 2016
38
4
44
Okay, thanks. We can mark this as closed then. I'll see if I can do so, if not feel free to do so.
 
Status
Not open for further replies.